Privacy Policy

PRIVACY POLICY

Last updated: 1.09.2026

This Privacy Policy (“Policy”) describes how ELYSEIN LIMITED OU, a private limited company incorporated and existing under the laws of the Republic of Estonia, registry code 17379660, registered address: Harju maakond, Tallinn, Kesklinna linnaosa, Vesivärava tn 50-201, 10152, Estonia (“Company”, “we”, “us” or “our”), processes personal data in connection with access to the Company’s website, platform, customer dashboard, application programming interfaces (APIs), other interfaces, applications, software solutions, documentation, features and other related services of the Company, as well as services provided through or in connection with any of the foregoing (“Service”).

This Policy has been prepared taking into account applicable data protection laws of the European Union and the Republic of Estonia, including Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”), as well as applicable rules relating to electronic communications, cookies and similar technologies.

This Policy is intended for users of the Service, representatives of customer organisations, business contacts, website visitors and other individuals whose personal data may be processed by the Company in connection with the Service. This Policy explains which categories of personal data may be processed, for what purposes and on which legal bases such processing may be carried out, to which categories of recipients personal data may be disclosed or made available, how long personal data may be retained, which safeguards may apply, and which rights data subjects may have under applicable data protection laws.

Depending on the specific processing context, the Company may act as a controller or as a processor of personal data. With respect to personal data that the Company processes for its own purposes, including managing the Service, providing access to the Service, administering accounts, communicating with users and customers, ensuring security, managing billing, performing contractual obligations, protecting rights and complying with applicable legal requirements, the Company will generally act as a controller of personal data.

Where the Company processes personal data on behalf of and under the instructions of a customer organisation, such customer will generally act as the controller of the relevant personal data, and the Company will act as a processor. In such case, the relevant processing will be governed by the applicable customer agreement, data processing agreement, order form or other contractual document.

Capitalised terms used but not expressly defined in this Policy have the meanings given to them in the applicable Terms of Service, order form, customer agreement, data processing agreement or other document governing access to and use of the Service.

This Policy applies to personal data that the Company collects or receives when you:

1. visit the Company’s website located at https://waibee.com or other pages where this Policy is made available;
2. create an account, access the Service or use the Service;
3. interact with the Company by email, contact forms, customer support, commercial, technical or other communication channels;
4. use APIs, integrations, interfaces or other technical means of accessing the Service;
5. act on behalf of a customer, supplier, partner or other organisation interacting with the Company;
6. provide personal data to the Company, or when such data is provided to the Company through the Service, integrations, APIs or other technical means.

Before using the Service, please carefully review the applicable Terms of Service, available at https://waibee.com/legal/terms, and this Policy. Use of the Service involves the processing of personal data in accordance with this Policy, the applicable Terms of Service and applicable law. If you do not want personal data to be processed in connection with the use of the Service, you should not use or access the Service.

Where a separate consent is required for a specific processing operation, such consent will be requested separately in accordance with applicable law. Withdrawal of such consent does not affect the lawfulness of processing carried out before its withdrawal and does not prevent further processing of personal data where such processing is carried out on another applicable legal basis.

If you act on behalf of an organisation, you confirm that you have the necessary authority to interact with the Company and provide the relevant data in connection with the use of the Service.

1. WHAT PERSONAL DATA WE PROCESS

The Company may process personal data when you visit the Company’s website, create an account, use the Service, interact with the Company, act on behalf of a customer, supplier, partner or other organisation, or where personal data is provided to the Company through the Service, APIs, integrations or other technical means.

For the purposes of this Policy, personal data means any information relating to an identified or identifiable natural person. Depending on the context in which the Service is used, the Company may process the following categories of personal data.

1.1. Data Provided Directly by You or Your Organisation

Such data may include:

1. identification and contact data, including first name, last name, job title, business email address, telephone number, organisation name, role within the organisation and other business contact details;
2. account data, including data required to register, configure, administer and protect an account, customer dashboard or access to the Service;
3. contractual and commercial data, including information relating to enquiries, negotiations, order forms, agreements, selected plans, limits, Service access terms, invoices, payments and settlements;
4. communication data, including the content of messages, enquiries, support requests, and commercial, technical, legal or other correspondence with the Company;
5. data provided through forms, interfaces, APIs or integrations, including information that you or your organisation enter, upload, transmit or otherwise provide through the Service or in connection with its use;
6. feedback and information about the quality of the Service, including reviews, suggestions, bug reports, testing results, ratings, comments and other information that you provide to the Company in connection with the operation of the Service.

1.2. Data Processed in Connection with Artificial Intelligence Features

In the course of providing the Service, the Company may process data related to the use of artificial intelligence features, including user prompts, instructions, input data, context, files, messages, processing results, responses, output data and other materials that are submitted through the Service or generated when the Service is used (“Input and Output Data”).

Input and Output Data may also be referred to in the applicable Terms of Service, order form, customer agreement, data processing agreement, documentation or other contractual documents as inputs, outputs, customer content or similar terms.

Where Input and Output Data includes personal data, such data is processed in accordance with this Policy, the applicable contractual documents and, where applicable, a data processing agreement.

You should not include in Input and Output Data any personal data, special categories of personal data, confidential information, trade secrets, payment data, identity document data, data relating to persons under the age of eighteen (18) or persons who have not reached the age of majority under the laws applicable to them, or other sensitive information, unless such submission is necessary, permitted under the applicable contractual documents and supported by an appropriate legal basis.

If you or your organisation include personal data in Input and Output Data, such personal data may be processed as part of the relevant prompt, instruction, file, message, context or processing result. Depending on the nature of the request and the operation of the relevant Service feature, personal data contained in input data may be reflected, transformed, reproduced or otherwise taken into account in output data.

Input and Output Data may be processed by the Company and its engaged service providers, including providers of artificial intelligence technologies, model providers, request routing providers, infrastructure providers and technical service providers, to the extent necessary to provide, protect, support, administer and technically enable the relevant Service features.

More detailed information on the processing of Input and Output Data, the use of providers of artificial intelligence technologies and limitations related to such features may be set out in the Terms of Service, order form, customer agreement, data processing agreement, documentation or other applicable contractual documents.

1.3. Data Automatically Collected by the Company

When you visit the website, access the Service or use the Service, the Company may automatically collect certain technical data and usage data, including:

1. IP address, approximate location derived from the IP address, date and time of access;
2. device type, operating system, browser type and version, language settings, time zone settings and other technical parameters of the device or browser;
3. data about activities on the website or within the Service, including pages, features or sections accessed, usage events, session duration, technical requests, navigation, actions in the customer dashboard and other usage data;
4. event logs, system logs, diagnostic data, information about errors, failures, performance, security, API requests, integrations and other technical activity;
5. data necessary to prevent fraud, abuse, unauthorised access, security breaches, circumvention of technical restrictions or unlawful use of the Service.

1.4. Data Received by the Company from Customers, Partners and Other Sources

The Company may receive personal data from customer organisations, their authorised users, representatives, suppliers, partners, technical systems, integrations, payment or billing providers, customer support providers, professional advisers and other persons or sources, where such data is provided to the Company in connection with the provision, administration, protection, support or use of the Service.

Where a customer organisation provides the Company with personal data of its employees, representatives, contractors, users, customers or other individuals, such customer is responsible for having an appropriate legal basis for providing such data to the Company and for providing such individuals with the necessary information regarding the processing of their personal data.

1.5. Cookies and Similar Technologies

The Company may use cookies and similar technologies to ensure the operation of the website and the Service, maintain security, store user preferences, analyse the use of the website and the Service, diagnose errors and improve the operation of the Service.

Some cookies may be strictly necessary for the operation of the website or the Service and cannot be disabled without affecting the relevant functionality. Other cookies, including analytical, marketing or similar technologies, are used only in the cases and in the manner provided by applicable law, including obtaining consent where such consent is required.

More detailed information about the types of cookies used, the purposes for which they are used, their retention periods and available settings may be provided in a separate cookie notice or in the relevant consent management interface, where such tool is used by the Company.

2. PURPOSES AND LEGAL BASES FOR PROCESSING PERSONAL DATA

The Company processes personal data only where such processing is necessary for the provision, administration, protection, support, analysis or development of the Service, the performance of contractual or legal obligations, the protection of the rights and legitimate interests of the Company, or for other purposes described in this Policy, the applicable contractual documents or applicable law.

Where GDPR applies to the processing of personal data, the Company processes personal data only where an applicable legal basis is available. Depending on the specific processing context, the category of personal data and the relevant purpose, such legal bases may include:

1. performance of a contract or taking steps prior to entering into a contract, where processing is necessary to provide access to the Service, administer accounts, process order forms, manage plans, limits, invoices, payments, API access, integrations or other contractual relationships;
2. legitimate interests pursued by the Company or a third party, where processing is necessary to manage, protect, support, analyse and develop the Service, ensure security, prevent abuse, diagnose errors, provide customer support, or protect rights and legitimate interests, provided that such interests are not overridden by the rights and freedoms of the data subject;
3. compliance with legal obligations, where processing is necessary to comply with applicable accounting, tax, corporate, regulatory, sanctions, information security or other legal requirements, or to respond to lawful requests from public authorities, regulators, courts or other authorised persons;
4. consent, where applicable law requires consent for a specific processing operation, such as the use of certain cookies, analytics, marketing or similar technologies, sending certain marketing communications, or other processing for which the Company requests consent;
5. protection of vital interests, where processing is necessary in exceptional cases to protect the life, health or safety of an individual.

Depending on the specific context, the Company may process personal data for the following purposes and on the following possible legal bases:

Purpose of processing

Categories of personal data

Possible legal basis

Provision, administration and support of the Service

identification and contact data, account data, technical data, usage data, Input and Output Data

performance of a contract; legitimate interests

Creation, configuration and management of accounts, customer dashboard, API access and integrations

identification and contact data, account data, technical data, access data

performance of a contract; legitimate interests

Processing user requests and enabling artificial intelligence features

Input and Output Data, technical data, usage data

performance of a contract; legitimate interests

Communication with customers, users and representatives of organisations

identification and contact data, communication data, contractual and commercial data

performance of a contract; legitimate interests; consent, where applicable

Billing, payments, invoices, settlements and commercial administration

identification and contact data, contractual and commercial data, payment and billing data

performance of a contract; compliance with legal obligations; legitimate interests

Security, fraud prevention, abuse prevention and prevention of unauthorised access

technical data, usage data, event logs, security data, account data, Input and Output Data where applicable

legitimate interests; compliance with legal obligations

Error diagnostics, service availability, performance monitoring and technical maintenance

technical data, event logs, diagnostic data, usage data, communication data

legitimate interests; performance of a contract

Analysis and development of the Service

technical data, usage data, feedback, data used to create aggregated, statistical, pseudonymised or anonymised information

legitimate interests; consent, where applicable

Customer and technical support

identification and contact data, communication data, account data, technical data, error data

performance of a contract; legitimate interests

Sending service, technical, administrative and contractual notices

identification and contact data, account data, contractual data

performance of a contract; legitimate interests; compliance with legal obligations

Sending marketing or informational communications

identification and contact data, communication data, preference data

consent; legitimate interests, where applicable and permitted by law

Compliance with laws, reporting, tax, accounting, sanctions or other legal compliance

identification and contact data, contractual and commercial data, billing data, communication data, technical data

compliance with legal obligations; legitimate interests

Dispute resolution, protection of rights and participation in official proceedings

identification and contact data, contractual and commercial data, communication data, technical data, usage data, Input and Output Data where applicable

legitimate interests; compliance with legal obligations

If the Company processes personal data on behalf of a customer organisation as a processor, the legal bases for such processing are generally determined by the relevant customer acting as the controller of the personal data. In such case, the Company processes personal data in accordance with the customer’s instructions, the applicable customer agreement, data processing agreement, order form or other contractual document.

If processing is based on consent, you may withdraw such consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal and does not prevent further processing of personal data where such processing is carried out on another applicable legal basis.

2.1. Aggregated, Statistical and Anonymised Information

The Company may use personal data to create aggregated, statistical, pseudonymised or anonymised information where this is necessary to analyse the operation of the Service, assess performance, diagnose errors, research general usage trends, prepare internal reports, develop functionality, improve security and enhance the quality of the Service.

Such information should not directly or indirectly identify a specific individual using reasonably available means. If applicable law requires such data to be treated as personal data for as long as there is a reasonable possibility of re-identification, the Company will treat such data as personal data in accordance with this Policy.

2.2. Use of Input and Output Data

Input and Output Data is used to provide the relevant Service features, process user requests, enable the technical operation of artificial intelligence features, provide support, maintain security, diagnose errors, prevent abuse and ensure compliance with applicable contractual documents.

The Company does not use Input and Output Data to train its own artificial intelligence models unless expressly provided in the applicable agreement, order form, documentation, applicable account settings, separate consent or another mechanism expressly made available by the Company for that purpose.

Where third-party providers of artificial intelligence technologies, model providers or request routing providers are used, Input and Output Data may be processed by such providers in accordance with applicable contractual documents, data processing settings, documentation and contractual obligations owed to the Company. More detailed information may be set out in the Terms of Service, customer agreement, data processing agreement, order form, documentation or list of subprocessors, where such list applies.

2.3. Google Workspace Data and Limited Use

Waibee’s use and transfer of information received from Google Workspace APIs complies with the Google Workspace API User Data and Developer Policy, including its Limited Use requirements. Notwithstanding any other provision of this Privacy Policy, our Terms of Service, or any customer agreement, Google Workspace data - including raw, aggregated, anonymised, and derived data - is not used by Waibee or its third-party providers to create, train, or improve foundational or generalized AI/ML models. This restriction applies regardless of user consent or account settings. Transfers of Google Workspace data to AI service providers are limited to processing necessary for user-facing features, with the user’s consent, and subject to protections prohibiting such model training

3. TO WHOM PERSONAL DATA MAY BE DISCLOSED

The Company may disclose personal data or make it available only to certain categories of recipients, in the cases, to the extent and for the purposes described in this Policy, the applicable contractual documents or applicable law.

Depending on the nature of the Service, the functionality used and the relevant contractual relationship, personal data may be disclosed or made available to the following categories of recipients:

Category of recipients

Purpose of disclosure or access

Technical infrastructure, hosting and cloud service providers

Hosting, storage, support, scaling and ensuring the stable operation of the Service.

Software, technical and integration service providers

Ensuring the operation of the Service, APIs, integrations, customer dashboard, technical support and internal workflows.

Analytics service providers

Analysing the operation of the Service, diagnosing errors, assessing performance, improving user experience and developing the Service.

Providers of artificial intelligence technologies, model providers and request routing providers

Processing user requests, enabling artificial intelligence features, routing requests between models and providing technical support for the relevant Service features.

Information security providers

Protecting the Service, preventing fraud, abuse, unauthorised access, technical attacks and other security threats.

Customer support and communication service providers

Processing enquiries, providing technical and customer support, sending notices, messages and other service communications.

Payment, billing and financial administration service providers

Processing payments, issuing invoices, maintaining settlements, financial administration and confirming transactions.

Legal, accounting, tax, audit and other professional advisers

Obtaining professional support, maintaining records, complying with legal and tax obligations, and protecting the rights and legitimate interests of the Company.

Public authorities, regulators, courts, law enforcement authorities and other authorised persons

Complying with applicable legal obligations, responding to lawful requests, protecting rights, resolving disputes and participating in official proceedings.

Customer organisations on whose behalf or in connection with whose use of the Service the Company processes personal data

Providing the Service to the relevant customer under the applicable agreement, order form, data processing agreement or other contractual document.

Other persons involved in corporate, commercial or legal procedures

Carrying out a reorganisation, transaction involving assets or business, financing, audit, legal due diligence, assignment of rights, transfer of contract or other lawful corporate and commercial procedures, where such disclosure is necessary and subject to appropriate safeguards.

Where the Company engages service providers that process personal data on behalf of the Company, the Company takes reasonable measures to ensure that such service providers process personal data in accordance with applicable contractual obligations, the Company’s instructions and data protection law requirements.

Where the Company processes personal data on behalf of a customer organisation and engages subprocessors for such processing, the engagement of such subprocessors is governed by the applicable customer agreement, data processing agreement, order form, documentation, list of subprocessors or other applicable contractual document.

Certain providers, integrations or other recipients may act as independent controllers of personal data where they independently determine the purposes and means of processing in accordance with applicable law. In such cases, the processing of personal data by such persons may be governed by their own terms, privacy policies or other applicable documents.

The Company may also disclose personal data with your consent or at your direction, where such consent or direction is required or constitutes an applicable legal basis for the relevant processing.

The Company may disclose personal data where necessary to comply with applicable law, fulfil a lawful request from a public authority, regulator, court or other authorised person, protect the rights, security and legitimate interests of the Company, customers, users or other persons, investigate violations, prevent abuse, enforce the Terms of Service or other applicable contractual documents, resolve disputes or participate in official proceedings.

4. YOUR RIGHTS IN RELATION TO PERSONAL DATA

Depending on applicable law, your jurisdiction and the specific processing context, you may have certain rights in relation to your personal data.

Such rights may include:

1. the right to be informed about what personal data is processed by the Company, for what purposes, on which legal bases, to which categories of recipients it may be disclosed or made available, and for how long it may be retained;
2. the right of access to your personal data, including the right to obtain confirmation as to whether the Company processes your personal data and to receive a copy of such data, where provided by applicable law;
3. the right to rectification of inaccurate, incomplete or outdated personal data;
4. the right to erasure of personal data in the cases provided by applicable law;
5. the right to restriction of processing of personal data in the cases provided by applicable law;
6. the right to object to the processing of personal data where the processing is based on the legitimate interests of the Company or a third party, subject to applicable exceptions;
7. the right to data portability, where the processing is based on consent or contract and is carried out by automated means;
8. the right to withdraw consent, where processing is based on your consent. Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal;
9. the right to opt out of marketing communications, where such communications are sent to you, in the manner indicated in the relevant communication or otherwise provided by the Company;
10. the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data violates applicable law.

To exercise your rights, you may contact the Company at: [email protected].

Before processing a request, the Company may request additional information necessary to verify your identity, the authority of your representative, or the connection of the relevant request with a specific account, customer, organisation or use of the Service.

The Company will consider your request within the time limits provided by applicable law. In certain cases, the Company may refuse to satisfy a request in whole or in part where there are lawful grounds to do so, including where this is necessary to comply with legal obligations, perform a contract, maintain security, prevent abuse, protect the rights and legitimate interests of the Company, customers, users or other persons, preserve evidence, resolve disputes or fulfil other lawful purposes.

If you use the Service on behalf of a customer organisation, or if your personal data is processed by the Company on behalf of such customer, the Company may act as a processor of personal data. In such case, your request may be forwarded to the relevant customer or may need to be addressed directly to that customer, where that customer is the controller of the relevant personal data.

The Company does not make decisions based solely on automated processing of personal data, including profiling, that produce legal effects concerning a data subject or similarly significantly affect that data subject, unless such processing is permitted under applicable law and, where required, appropriate information and safeguards are provided in accordance with applicable law.

If you believe that the processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with a competent data protection supervisory authority. Where applicable, this may be the supervisory authority of the country of your residence, place of work or place of the alleged infringement. In relation to the Company as a legal entity incorporated in Estonia, the competent supervisory authority may be the Estonian Data Protection Inspectorate.

4.1. Account Management and Accuracy of Data

If the functionality of the Service allows you to view, modify or update certain account data, you may do so through the relevant account settings or customer dashboard.

You are responsible for ensuring that the data you provide to the Company or place in your account is accurate, up to date and not misleading. If you believe that your personal data is inaccurate or outdated, you may update it yourself where such functionality is available, or submit a relevant request to the Company.

4.2. Account Deletion

If you no longer wish to use the Service, you may request deletion of your account, if such account has been created and if deletion is available in accordance with the applicable contractual documents and applicable law.

Deletion of an account may result in loss of access to the Service, settings, usage history, data associated with the account and other information available through that account. After a deletion request has been processed, restoration of the account or related data may not be possible.

Certain personal data may continue to be retained after account deletion where this is necessary to perform a contract, comply with legal obligations, maintain accounting or tax records, ensure security, prevent abuse, protect the rights and legitimate interests of the Company, customers or other persons, preserve evidence, resolve disputes or fulfil other lawful purposes.

4.3. Marketing Communications

If the Company sends you marketing or informational communications, you may opt out of receiving such communications by following the instructions provided in the relevant communication, where available, or by contacting the Company at: [email protected].

Opting out of marketing communications does not affect the Company’s ability to send you service, technical, administrative, contractual, legal, payment-related, information security or other non-marketing communications related to the use of the Service, performance of contractual documents or compliance with applicable law.

5. SECURITY OF PERSONAL DATA

The Company implements appropriate technical, organisational and administrative measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access or other unlawful use.

Such measures may include, depending on the nature of the personal data, the functionality of the Service, the level of risk and applicable contractual requirements, access controls, user permission management, technical safeguards, security monitoring, event logging, confidentiality measures, internal data handling procedures and other measures aimed at maintaining the security of the Service.

When selecting and applying security measures, the Company takes into account the nature, scope, context and purposes of personal data processing, as well as the risks to the rights and freedoms of individuals. However, no method of transmission over the internet, electronic storage or technical processing can be guaranteed to be absolutely secure.

The security of personal data also depends on the actions of users and customers. If you are provided with credentials, a password, access token, API key or any other means of accessing the Service, you must keep them confidential, must not disclose them to other persons without proper authorisation, and must promptly notify the Company of any suspected unauthorised access, loss, compromise or unlawful use of such credentials or means of access.

Customer organisations are responsible for managing access by their users, assigning roles and access rights, and controlling the use of accounts, API keys, integrations and other technical means of accessing the Service, unless expressly provided otherwise in the applicable agreement.

If the Company becomes aware of a personal data breach or another security incident involving personal data, the Company will take measures in accordance with applicable law, the nature of the incident, the level of risk and applicable contractual obligations. Where required by applicable law or applicable contractual obligations, the Company will notify the competent supervisory authority, affected data subjects or the relevant customer organisation in accordance with applicable requirements.

6. THIRD-PARTY SERVICES, INTEGRATIONS AND EXTERNAL PROVIDERS

The Service may contain links to third-party websites, applications, interfaces, services, platforms, documentation or other resources, and may also be integrated with third-party services or use functionality provided by external providers (“Third-Party Services”).

This Policy applies to the processing of personal data by the Company. If you access a third-party website, use a Third-Party Service, enable an integration, interact with an external platform or transmit data through functionality provided by a third-party provider, the processing of personal data by such provider may be governed by its own terms of use, privacy policy, data processing agreement, documentation or other applicable documents.

Where an external provider processes personal data on behalf of the Company or acts as a subprocessor in connection with the provision of the Service to a customer organisation, such processing is governed by applicable contractual obligations, data protection law requirements and, where applicable, a data processing agreement, order form, documentation or list of subprocessors.

Certain Third-Party Services, integrations or external providers may act as independent controllers of personal data where they independently determine the purposes and means of processing in accordance with applicable law. In such cases, the Company does not determine the independent purposes and means of such processing, except where expressly provided by the applicable agreement or applicable law.

If you use Third-Party Services, enable integrations or transmit data through external platforms, you should review the terms of use, privacy policies and other documentation of the relevant Third-Party Services.

7. RETENTION OF PERSONAL DATA

The Company retains personal data only for as long as necessary to achieve the purposes for which such data was collected or otherwise processed, including the provision, administration, protection, support and development of the Service, performance of contractual obligations, compliance with applicable law, maintenance of accounting, tax and corporate records, ensuring security, preventing abuse, resolving disputes, and protecting the rights and legitimate interests of the Company, customers, users or other persons.

The retention period for personal data may depend on the category of data, the nature of the relationship with the relevant customer or user, the terms of applicable contractual documents, legal requirements, technical settings of the Service, and the need to retain records for security, audit, incident investigation, claims handling or rights protection purposes.

In particular, the Company may retain:

1. account data - for the duration of the relevant account and for a reasonable period after its closure, where further retention is necessary for lawful purposes;
2. contractual, billing, payment, tax and accounting data - for the periods required by applicable law or necessary to confirm transactions, perform obligations, maintain records and protect rights;
3. technical data, event logs, security data and usage data - for the period necessary to ensure security, diagnose errors, prevent abuse, investigate incidents and maintain the stability of the Service;
4. communication data and support requests - for the period necessary to process the request, confirm communications, improve support, resolve disputes or protect rights;
5. Input and Output Data - for the period determined by the applicable contractual documents, Service settings, technical limitations, data processing agreement, documentation or other applicable terms.

When personal data is no longer required for the purposes set out in this Policy, the Company takes reasonable measures to delete, destroy, anonymise or restrict the processing of such data, unless further retention is required under applicable law, contractual obligations or the legitimate interests of the Company.

Certain data may temporarily remain in backups, archives, event logs or technical systems until deletion, overwriting or expiry of the relevant technical retention cycle, provided that such data is protected in accordance with this Policy and is not used for new purposes.

The Company may continue to use aggregated, statistical or anonymised information after deletion of personal data or cessation of processing, provided that such information does not directly or indirectly identify a specific individual using reasonably available means. If applicable law requires such information to be treated as personal data for as long as there is a reasonable possibility of re-identification, the Company will treat such information as personal data in accordance with this Policy.

Where the Company processes personal data on behalf of a customer organisation, the retention, return and deletion of such data may additionally be governed by the customer agreement, data processing agreement, order form, documentation or other applicable contractual document. In such case, to the extent applicable to the relevant processing, the Company acts in accordance with its contractual obligations and the documented instructions of the relevant customer.

8. AGE RESTRICTIONS

The Service is intended for use by customer organisations, their authorised representatives and users who are at least eighteen (18) years of age and have reached the age of majority under the laws applicable to them .

The Service is not intended for direct use by persons under the age of eighteen (18) or persons who have not reached the age of majority under the laws applicable to them. The Company does not knowingly offer the Service directly to such persons and does not seek to collect their personal data through the Service.

If you are under the age of eighteen (18) or have not reached the age of majority under the laws applicable to you, you must not use the Service or provide any personal data to the Company.

You should not transmit through the Service any personal data relating to persons under the age of eighteen (18) or persons who have not reached the age of majority under the laws applicable to them unless such transmission is necessary for the use of the Service, permitted under the applicable contractual documents and supported by an appropriate legal basis under applicable law.

If the Company becomes aware that personal data relating to a person under the age of eighteen (18) or a person who has not reached the age of majority under the laws applicable to them has been provided to the Company without an appropriate legal basis, required consent or another lawful basis for such processing, the Company will take reasonable measures to delete such data or restrict its processing in accordance with applicable law.

Customer organisations are responsible for ensuring that their users, representatives and persons whose personal data is transmitted through the Service comply with applicable age, legal and contractual requirements.

9. INTERNATIONAL TRANSFERS OF PERSONAL DATA

In connection with the provision, administration, protection, support, analysis and development of the Service, personal data may be transferred to, stored in, accessed from or otherwise processed in countries other than your country of residence, the country where the relevant customer organisation is located or the country where the data was originally collected, including the United States, the United Kingdom, Switzerland and other countries outside the European Economic Area (“EEA”), where the Company’s service providers, third-party providers, model providers, infrastructure providers or other recipients operate or maintain infrastructure.

Such transfers may occur, in particular, when using the categories of recipients described in the section “To Whom Personal Data May Be Disclosed”, where the relevant recipients or their infrastructure are located outside the EEA or where personal data is accessed from such countries.

Where personal data is transferred outside the EEA to a country that is not subject to an adequacy decision of the European Commission, the Company will take reasonable and appropriate measures within its control to ensure that such transfer is carried out in accordance with applicable data protection law, including through applicable transfer mechanisms or safeguards.

Such mechanisms or safeguards may include reliance on adequacy decisions adopted by the European Commission under Article 45 of the GDPR, the use of standard contractual clauses adopted by the European Commission under Article 46 of the GDPR, assessment of applicable transfer risks, application of technical and organisational safeguards, contractual obligations with data recipients, and other lawful mechanisms for transferring personal data as provided by applicable law.

Where the Company processes personal data on behalf of a customer organisation, international transfers of such data may additionally be governed by the applicable customer agreement, applicable data processing terms, documentation, list of subprocessors or other applicable contractual document. 

10. RELATIONSHIP WITH APPLICABLE LAW AND CONTRACTUAL DOCUMENTS

This Policy should be read in conjunction with applicable data protection law, including the laws of the European Union and the Republic of Estonia, as well as the applicable Terms of Service, order form, customer agreement, data processing agreement or other contractual document governing access to and use of the Service.

To the extent that matters relating to the use of the Service, liability of the parties, governing law, jurisdiction or dispute resolution are regulated by separate contractual documents, such matters will be determined by the relevant contractual documents.

In the event of any conflict between this Policy and a data processing agreement or other contractual document governing the processing of personal data on behalf of a customer organisation, the relevant contractual document will apply to the extent of such conflict and with respect to such processing, unless otherwise required by applicable law.

Nothing in this Policy limits the rights of data subjects under applicable data protection law.

11. CHANGES TO THIS POLICY

The Company may update this Policy from time to time to reflect changes in the Service, applicable law, technical or organisational processes, contractual arrangements or personal data processing practices.

The updated Policy will be made available on the Company’s website, through the Service or by other appropriate means, with the “Last updated” date revised accordingly. 

If required by applicable law, or if changes to this Policy materially affect the processing of personal data or the rights of data subjects, the Company will take reasonable steps to notify users or customer organisations in advance, where reasonably practicable, by email, through the Service, through the account interface, by posting a notice on the Company’s website or by other appropriate means.

Unless the Company states otherwise in the relevant notice, or applicable law requires otherwise, changes to this Policy will become effective upon publication, notification or otherwise being made available.

Where consent is required for a specific processing operation, the Company will request such consent separately in accordance with applicable law.

12. CONTACT INFORMATION

If you have any questions about this Policy or the processing of personal data by the Company, or if you wish to exercise your rights in relation to personal data, you may contact the Company at: [email protected]

The Company’s registered details are provided at the beginning of this Policy.

If the Company processes personal data on behalf of a customer organisation, requests relating to such personal data may need to be addressed to the relevant customer organisation acting as the controller of that personal data, as described in this Policy and the applicable contractual documents.