THIS PRIVACY POLICY IS DRAFTED FOR SAKE OF OUR COMMITMENT TO THE PRINCIPLE OF “ACCOUNTABILITY” IN COMPLIANCE WITH ARTICLE 5(2) GDPR.

IF YOU HAVE QUESTIONS RELATED YOUR RIGHTS, YOU CAN CONTACT OUR LEGAL OFFICER AT [email protected].

USING THE WEBSITE 2TA.IO YOU ACKNOWLEDGE THAT YOU ARE AWARE OF THE COLLECTION OF COOKIES, THE PURPOSES AND METHODS OF OBTAINING AND PROCESSING PERSONAL DATA (PERSONAL INFORMATION), THAT THE DATA YOU PROVIDE ARE PROCESSED BY THE PROFILING, AND YOU GIVE YOUR CONSENT TO THE PROCESSING OF PERSONAL DATA (PERSONAL INFORMATION) AND PROVIDING IT TO THIRD PARTIES.

ALL DATA THAT YOU PROVIDE IS A PREREQUISITE FOR CONCLUDING AN TERMS OF SERVICE ON THE USE OF THE SITE.

The Site and Services are provided to you by entrepreneur DENIS VOLKOV, TAX NUMBER: 315090235 with registered office at Largo Jorge Moutinho de Albuquerque 5 3°A, 2780-255 Oeiras, Portugal.

Consequently, “We”, “Us” and “Ours” refers to DENIS VOLKOV or 2TA.IO.

DATA CONTROLLERS (BUSINESSES) AND DATA PROCESSORS (SERVICE PROVIDERS)

With respect to processing of personal information (hereinafter referred to as “personal data”) of the customers of our Services (“Customers”) and

with respect to the Services where We determine the purposes and means of the processing of personal data of social networks users (“Influencers”), we are the “Data Controller” or “Controller” of Customers’ personal data and Influencers’ personal data respectively.

Feel free to send any of your data protection queries to us at [email protected]

With respect to the Services (e.g. Campaign Management) where a Customer determines the purposes and essential means of the processing of personal data of Influencers (e.g. which and whose personal data to process, how long to store them), but where We still may determine technical means of the processing of personal data (e.g. where and how to search, collect, store the personal data), and We process personal data on Customers’ behalf or on Customers’ orders and in Customers’ interests (e.g. where our Services are to provide a tool to Customers to reach the Customers’ purposes), Customer is Controller, and we are Processor (or Data Processor or Service Provider).

With respect to the Services (e.g. Landing Pages) where a Customer determines the purposes and essential means of the processing of personal data of Influencers (e.g. which and whose personal data to process, how long to store them), but where We still may determine technical means of the processing of personal data (e.g. where and how to search, collect, store the personal data), and We process personal data on Customers’ behalf or on Customers’ orders and in Customers’ interests (e.g. where our Services are to provide a tool to Customers to reach the Customers’ purposes), Customer is Controller of Customers’ personal data and Influencers’ personal data respectively, and we are Processor (or Data Processor or Service Provider).

This Privacy Policy describes the way that We deal with certain personal data of Customers and data of Influencers.

We abide and fully comply with all the rules regarding personal data, both the European legislation and the US legislation related to personal data (“Applicable Law”).

All provisions of this Privacy Policy are drawn up in accordance with European legislation in the field of personal data compliance (Regulation (EU) 2016/679 General Data Protection Regulation (“GDPR”)), as well as have been brought into line with, comply with and do not contradict the requirements of US legislation in the field of personal data protection (in particular, this Privacy Notice has been published on this website as per requirement of the California Consumer Privacy Act (“CCPA”)).

2. What personal data and data is processed and the legal basis for processing

By means of this Privacy Policy We fulfil Our obligation under Articles 13 and 14 GDPR to provide information on data processing to the concerned data subjects.

DISCLAIMER: However, in some cases (especially when We obtain the personal data not from the data subjects, e.g. from the social networks) we are incapable to inform each data subject (especially Influencers) rather than by means of this Privacy Policy.

In accordance with Recital 62 and Article 14(5)(b), We are allowed to, because, due to a great number of Influencers, the provision of such information proves impossible or would involve a disproportionate effort (in particular for processing for statistical purposes).

Nevertheless, We commit to take appropriate measures to protect the data subject's rights and freedoms and legitimate interests.

2.1. CUSTOMERS

There are different types of information we collect, whether directly from you at sign up (Article 13 GDPR) or automatically via your device (for instance, personal computer, laptop, mobile phone) when you use our Sites (Article 13-14 GDPR). In accordance with “data minimization” principle (Article 5(1)(c) GDPR), we collect and process only what is strictly necessary to provide you with our Services, no more, no less.

The rest is the technical information that must be processed in order to provide you with our services.

* This is a piece of information that is automatically transmitted from your electronic device when you use your browser. More information about what kind of information your browser transmits can be found on the sites of the browser companies (for example, Chrome). You can disable the transfer of cookies at any time in the browser settings.

2.2. INFLUENCERS

In essence, We only process information which you have already publically shared via open accounts of the social networks: Instagram, YouTube. We process Your personal data and ensure them to be processed in compliance with Applicable Law and namely in accordance with the principle of “lawfulness, fairness, transparency” (Art. 5(1)(a)), and We respect Your rights (see section below).

2.3. Audience data and statistics

We analyze a vast amount of information in order to provide Customers with statistics. In relation to the Influencer audience (the “Audience”), this includes, in particular: gender, age group and ethnicity. While these items may represent a somewhat sensitive issue, We have undertaken, in accordance with Article 35(7)(a) GDPR, an assessment to identify and prove our legitimate interests and to exclude that our legitimate interests be overridden by the fundamental rights and freedoms of the Audience or any individuals (Art. 6(1)(f) GDPR). We concluded that our processing for statistical purposes is in line with the Applicable Law and does not conflict with the fundamental rights and freedoms of individuals.

In order to lawfully process the data on the ethnic origin of the Audience, We require relevant legal basis. One of the bases is processing for statistical purposes (Art. 9(2)(j) GDPR) (while safeguarding fundamental rights and interests of the Audience) and the fact that such data (Art. 9(2)(e) are made publically available by their data subject by means of disclosure in social media). Such processing does not have discriminatory effects on natural persons involved nor results in measures having such effect. Finally, there is no automated decision-making and profiling based on ethnic origin of the Audience (Art. 14(2)(g) GDPR).

3. What we do with your personal data and aggregate data

Our legitimate interest to work with personal data are direct marketing purposes as said in Recital 47 GDPR (EU GDPR), and Statistical purposes referring to Recitals 113 and 162 GDPR.

However, under US law (as such as The California Consumer Privacy Act), there is no concept of Legitimate Interest. The law does not enumerate specific bases for processing, although the sale of consumer information is prohibited if the consumer has opted out.

Thus, we clearly suggest each of our INFLUENCERS use the opted-out function.

3.1. CUSTOMERS

We do not sell, share or disclose Customers’ data except as provided herein. We never treat your personal data in any way that would surprise you (unless We told you about it and you provided us with an informed and unambiguous consent to such usage).

We use Customer contact details and payment information to establish, support and conduct customer relationships as necessary for the performance of Services. Should the Customer fail to provide the personal data we need, we may be unable to complete the transaction. We only contact Customers with service-related information. Where marketing is involved, Customers have an option to opt out at any time before first (and any subsequent) contact.

3.2. INFLUENCERS

Notification about the processing of Influencer’s personal data occurs through our website and through the provisions of this Policy. Due to the processing of a huge amount of data, we do not have the technical ability to notify each Influencer directly. Also, in accordance with Terms of Service and Contracts with Customers, the obligation to notify the Influencer about the processing of its personal data passes to the Customer.

We provide a statistical service and so, the data about Influencers identified here in under is shared with Customers whether on a trial basis or upon payment of fees.

Our Customers prohibited to “assign, syndicate, resell or otherwise transfer or make available information obtained via 2TA.IO to third parties…”.

However, we have no control on Our Customers and therefore we are unable to know whether any of Our Customers intends to sell or share the Influencers’ below-mentioned personal information received via our services or not.

If you do not wish your personal information to be shared with or sold to Customers, please send an email with “DO NOT SELL MY PERSONAL INFORMATION” to Our Legal Officer at [email protected]

The data about Influencers that we process is divided into two categories:

Raw Data - All available information collected from social networks. Information is collected only from public / open profiles of Influencers on Instagram, YouTube. Raw data is not structured, so the Influencer identity cannot be determined based on this information. Processed Data - the data formed from Raw Data, and then Reports are generated.

The Processed Data is divided into two groups:

• Collected and stored as is: profile name, avatar, profile description, likes, commenters, Influencers’ liaisons with commenters and other audience, e-mail, texts of the comments;

• Data generated by AI scripts: audience type, topics and interests of the audience, age of the audience, earnings, history of profile development, authenticity of the audience set.

At any stage of data collection Influencers have the right to send a request to our Legal Officer at [email protected] for the purpose of changing / deleting their data or not sharing their data with Our Customers.

3.3. AUDIENCE DATA

Audience data for each Influencer is aggregated for statistical purposes and shared with Customers whether on a trial basis or upon payment of fees.

3.4. DATA CONTROLLER

Data Controller can use the collected data itself as a marketing advertiser. Such Data Controller’s report will be identical to a regular Report provided to any Customer. Such Reports are subject to laws and regulations applicable to all Data Controller’s activities.

3.5. CAMPAIGN MANAGEMENT SERVICES

With respect to Campaign Management Services We are Data Processor on behalf of our Customers and in Customers’ interests (who are Data Controller). Data Customers use their personal cabinet/account on e-platform as a tool to process data related to companies databases in form Excel tables. We do not store such databases (they are stored directly on the secured servers). We have no access to our Customers’ personal cabinets and do not know their content, including the content of the databases and any personal data (if any) therein. We just determine, to some extent, technical means of the processing of personal data (e.g. account maintenance).

4. Where and how long personal data is stored for

In compliance with Article 5(1)(b), (c), (e) GDPR, We commit to the principles of “purpose limitation”, “data minimization”, “storage limitation”, and therefore We collect, retain, store and otherwise process only such information that is necessary to ensure our legitimate interests or to comply with a legal obligation, and for the period necessary to meet our legitimate interests.

4.1. CUSTOMERS

We store your data while your account is active. Whether your annual subscription expires or you fail to use the credits on time, We will delete your personal data from our systems within 1 (one) month after expiration of your annual subscription or when you request such deletion in the frame of exercise your rights (as listed below).

4.2. INFLUENCERS

As stated above, We process the personal data obtained from public sources (open accounts on Instagram, YouTube). The updates may take up to 20 days. If an Influencer deletes his/her account, We will also delete such personal data from our systems and make it unavailable to Customers. This synchronization may take up to 1 (one)month from the date the Influencer deleted his/her account on the relevant social networks.

4.3. AUDIENCE DATA

Audience data is only relevant to the Influencer and is kept in aggregated form together with information about Influencer. Once Influencer data is deleted, Audience data of the Influencer is also deleted.

4.4. DATABASE

All Data in Our databases are stored in encoded form.

6. Categories of recipients of personal data and data

We do not rent, sell, or share Customer personal data with any non-affiliated third parties, except (a) where We have to comply with Our legal obligation and (b) where we need to ensure storage and technical support measures of such data via our service providers (data processes) specified in this Privacy Policy (in the latter case (b), the data remain undisclosed and inaccessible to such service providers).

We do provide a fee-based statistical service in relation to Influencer and Audience data. The recipients of such data are Customers of Our Service.

In relation to Customer data, We do not blindly follow disclosure orders. We will check each request to ensure it satisfies the relevant safeguards, contains a court order, or is issued under a legislative measure for the prevention, investigation, detection or prosecution of criminal offences.

If We employ a (sub)processor (service provider) to act on our behalf, We ensure that there are adequate contractual measures to ensure responsibility, security and liability to the same level as expected of Us.

In any case where a third party accesses your data on Our behalf or upon Our instructions (be it inside or outside the EEA), We use the relevant legal basis to comply with the data protection legislation. In cases where there is no decision by the European Commission confirming the adequate level of protection (Art. 45(1) GDPR), We use standard data protection clauses adopted by the European Commission (Art. 46(2)(c) GDPR) to ensure the appropriate safeguards of your rights and personal data in case of third party’s access or other data transfer outside the EEA.

7. Your rights

In compliance with Article 5(1)(a), (d) GDPR, We commit to the principles of “lawfulness, fairness and transparency”, and “accuracy”.

7.1 You are entitled to the full spectrum of the rights under the General Data Protection Regulation, and We commit to respect your rights. Among those, you have the right to:

• Require access to your personal data (Art. 15 GDPR);

• Require rectification of your personal data (Art. 16 GDPR);

• Require erasure of your personal data (Art. 17 GDPR);

• Require restriction of your personal data processing (Art. 18 GDPR);

• Require portability of your personal data (Art. 20 GDPR);

• Object to the processing of your personal data (Art. 21 GDPR);

• Object to automated processing (if any) of your personal data (Art. 22 GDPR);

• Withdraw your consent to processing of your personal data, where applicable (Art. 7(3) GDPR);

• Lodge a complaint with your national supervisory authority (in the EEA) if you believe that your privacy rights have been breached (Art. 13(2)(d), 14(2)(e), 15(1)(f)).

7.2 Your consent and your right to withdraw your consent

If we choose to process your personal data for any purpose you do not agree with, We will provide you with appropriate information at the point where you come across those additional purposes in order to obtain your consent (where required) or are able to perform Our legal obligations, prior to commencing any such additional processing activities. You are not required to give consent just because We ask for it.

If your personal data were processed on the base of your consent, you may further change your mind and withdraw your consent at later by contacting Our Legal Officer and requesting to be removed from the mailing list at the following email address [email protected]. However, your consent withdrawal will not impact the processing of your personal data which took place before your withdrawal.

7.3 Your right to object to data processing

If your personal data was processed without your given consent (based on the legitimate interest), you may also ask Us to stop processing your personal data and to remove you from the mailing list, by contacting at [email protected]

However, your request will not impact the processing of your personal data which took place before such request.

If you request Us to rectify, erase your personal data or to restrict processing your data (to stop processing or by withdrawing your consent), We will inform you as soon as your request is satisfied (in accordance with Art.13(2)(c), 14(2)(d), and19 GDPR).

7.4 Your right to lodge a complaint

If your question is not resolved or is not resolved satisfactorily, you have the right to contact your local data protection authority (Art. 13(2)(d), 14(2)(e), 15(1)(f)). You can find the contact details of your local data protection authority here: https://edpb.europa.eu/about-edpb/board/members_en

7.5 INFLUENCER: your right to be informed on the Customer

You have the right to request information about the Customer who received the personal data of your social media profile, and 2TA.IO commits to provide you with all information about the Customer.

If you request information about the Customer who received the personal data of you, 2TA.IO will provide you with all information of the Customer, within 72 hours of receiving the request from you.

If a Customer has transferred to third parties The Report about your Social media profile received when using 2TA.IO service, you have the right to get the entire chain of persons to whom such a Report was transferred, within 72 hours after your request.

7.6 Your right to access to and to erasure of your personal data

You have the right to request to remove data/content collected from our Service. Such data/content must be deleted within 72 hours of receiving the notification.

Also, data/content should be deleted by all persons/companies/auditors to whom such information was transferred.

You have the right to log into your account and change information about yourself to the extent that the system allows. Also, you can submit a request to change information about yourself to the support service.

8. Cookies and similar technologies

We use aggregated, non-identifying, electronic data collected from use of our Sites and Services to operate, analyze, improve, and develop our Sites and Services. This information is not used to inform decisions about specific individuals; rather, it is processed to understand how different categories of users interact with our Sites and Services so that we can consistently improve the same for Customers.

We work with analytics providers such as Google Analytics, Yandex Metrika which use cookies and similar technologies to collect and analyze information about use of the Services and report on activities and trends. Google Analytics may also collect information regarding the use of other websites, apps and online resources. You can learn about Google’s practices by going to www.google.com/policies/privacy/partners/, and opt out of them by downloading the Google Analytics opt-out browser add-on.

We inform you that in order to fulfill our legitimate interest and improve the quality of services, We may transfer some of the personal data that is publicly available on social networks to the following service providers:

• Amazon Web Services, Inc.

• Hetzner Online, GmbH

• Stripe, Inc.

• MixPanel, Inc.

• Google Inc.

• Chatwoot, Inc.

The service provider Google Analytics is located in the USA. We contracted to them via purchase of their software and maintenance services (to be used for marketing and communication with clients) and via accepting their customers terms and conditions and privacy policies published on their websites:

https://policies.google.com/privacy?hl=en-US

On the matter of transferring (importing/exporting) and processing personal data falling within the scope of GDPR, Google rely on the EU model (standard) contractual clauses; and Amplitude relies on the EU-US and Swiss-US Privacy Shield (https://www.privacyshield.gov/Program-Overview).

9. Children’s privacy (Article 8 GDPR)

We never knowingly collect, process or solicit any information from anyone of 16 years and younger. The information society services (“Services”) on our sites are neither offered directly nor intend to appeal to such persons. Parents or parental responsibility holders who believe that We directly offer Services to or process personal data of their children aged 16 and under may contact at [email protected]

DISCLAIMER: When processing open data from social networks, if it is reasonably impossible to recognize the real age of users, Our verification of the age of users is limited to technically available and reasonable treatment of the information openly provided by the social networks from which we collect the data. In case or fallacious, erroneous or missing age data, the social networks shall be solely responsible for violation of requirements of the Applicable Law in relation to the personal data of children.

10. Our commitment

• We will only collect and use your data where We have a legal basis to do so;

• We will always be transparent and tell you about how we use your information;

• When We collect your data for a particular purpose, We will not use it for anything else without your consent, unless other legal basis applies;

• We will not ask for more data than needed for the purposes of providing our services;

• We will adhere to the data retention policies and ensure that your information is securely disposed of at the end of such retention period;

• We will observe and respect Your rights by ensuring that queries relating to privacy issues are dealt with promptly and transparently;

• We will keep our staff trained in privacy and security obligations;

• We will ensure to have appropriate technological and organizational measures in place to protect your data regardless of where it is held;

• We will also ensure that all of our data (sub)processors (service providers) have appropriate security measures in place with contractual provisions requiring them to comply with Our commitment;

11. Changes to the privacy policy

To keep you up to date, We will always notify you via email should we update this privacy policy.

DENIS VOLKOV,

TAX NUMBER: 315090235

Largo Jorge Moutinho de Albuquerque 5 3°A, 2780-255 Oeiras,

Portugal.

Tel: +351913733205

E-mail:  info@2ta.io

Effective Date: 15 may, 2023