IF YOU HAVE QUESTIONS RELATED YOUR RIGHTS, YOU CAN CONTACT OUR LEGAL OFFICER AT [email protected].
USING THE WEBSITE 2TA.IO YOU ACKNOWLEDGE THAT YOU ARE AWARE OF THE COLLECTION OF COOKIES, THE PURPOSES AND METHODS OF OBTAINING AND PROCESSING PERSONAL DATA (PERSONAL INFORMATION), THAT THE DATA YOU PROVIDE ARE PROCESSED BY THE PROFILING, AND YOU GIVE YOUR CONSENT TO THE PROCESSING OF PERSONAL DATA (PERSONAL INFORMATION) AND PROVIDING IT TO THIRD PARTIES.
ALL DATA THAT YOU PROVIDE IS A PREREQUISITE FOR CONCLUDING AN TERMS OF SERVICE ON THE USE OF THE SITE.
The Site and Services are provided to you by entrepreneur DENIS VOLKOV, TAX NUMBER: 315090235 with registered office at Largo Jorge Moutinho de Albuquerque 5 3°A, 2780-255 Oeiras, Portugal.
Consequently, “We”, “Us” and “Ours” refers to DENIS VOLKOV or 2TA.IO.
DATA CONTROLLERS (BUSINESSES) AND DATA PROCESSORS (SERVICE PROVIDERS)
With respect to processing of personal information (hereinafter referred to as “personal data”) of the customers of our Services (“Customers”) and
with respect to the Services where We determine the purposes and means of the processing of personal data of social networks users (“Influencers”), we are the “Data Controller” or “Controller” of Customers’ personal data and Influencers’ personal data respectively.
Feel free to send any of your data protection queries to us at [email protected]
With respect to the Services (e.g. Campaign Management) where a Customer determines the purposes and essential means of the processing of personal data of Influencers (e.g. which and whose personal data to process, how long to store them), but where We still may determine technical means of the processing of personal data (e.g. where and how to search, collect, store the personal data), and We process personal data on Customers’ behalf or on Customers’ orders and in Customers’ interests (e.g. where our Services are to provide a tool to Customers to reach the Customers’ purposes), Customer is Controller, and we are Processor (or Data Processor or Service Provider).
With respect to the Services (e.g. Landing Pages) where a Customer determines the purposes and essential means of the processing of personal data of Influencers (e.g. which and whose personal data to process, how long to store them), but where We still may determine technical means of the processing of personal data (e.g. where and how to search, collect, store the personal data), and We process personal data on Customers’ behalf or on Customers’ orders and in Customers’ interests (e.g. where our Services are to provide a tool to Customers to reach the Customers’ purposes), Customer is Controller of Customers’ personal data and Influencers’ personal data respectively, and we are Processor (or Data Processor or Service Provider).
We abide and fully comply with all the rules regarding personal data, both the European legislation and the US legislation related to personal data (“Applicable Law”).
2. What personal data and data is processed and the legal basis for processing
In accordance with Recital 62 and Article 14(5)(b), We are allowed to, because, due to a great number of Influencers, the provision of such information proves impossible or would involve a disproportionate effort (in particular for processing for statistical purposes).
Nevertheless, We commit to take appropriate measures to protect the data subject's rights and freedoms and legitimate interests.
There are different types of information we collect, whether directly from you at sign up (Article 13 GDPR) or automatically via your device (for instance, personal computer, laptop, mobile phone) when you use our Sites (Article 13-14 GDPR). In accordance with “data minimization” principle (Article 5(1)(c) GDPR), we collect and process only what is strictly necessary to provide you with our Services, no more, no less.
|Personal data We collect directly from you:||Legal basis for processing (Art. 13(1)(c) GDPR)||Purposes for processing (Art. 13(1)(c) GDPR): Reason for collection|
|1. Full name||Performance of the contract with you (Art. 6(1)(b) GDPR). We will store just limited information to respect your opt-out preference.||You know our name, We require yours for the contractual relationship between the parties|
|2. Email||1)Performance of contract with you (Art. 6(1)(b) GDPR) and||1) We require your email to log you into the system and to provide you with the Service, reports, Service-related updates, communications and other important information.|
|2) Our legitimate interests, if related to marketing (Art. 6(1)(f) and Recital 47 GDPR).||2) If We do use your email to contact you for marketing purposes, it will be in Our legitimate interests to do so, but you will always have a chance to opt out of such marketing communications for similar products and/or services prior to first (and any subsequent) communication. You may opt out at any time by emailing [email protected]|
The rest is the technical information that must be processed in order to provide you with our services.
|Personal Data collected/accessed by Us automatically||Legal basis for processing (Art. 14(1)(c) GDPR)|
|1. Internet Protocol (IP) address||Performance of the contract (Art. 6(1)(b) GDPR). You need this to connect to the Internet.|
|2. We set and access various cookies* on your device||Contract performance for the “strictly necessary” cookies. Legitimate interest for the first-party analytics cookies (Art. 6(1)(f) GDPR). Your consent prior to the placement of all the other types of cookies (Art. 6(1)(a) GDPR).|
* This is a piece of information that is automatically transmitted from your electronic device when you use your browser. More information about what kind of information your browser transmits can be found on the sites of the browser companies (for example, Chrome). You can disable the transfer of cookies at any time in the browser settings.
In essence, We only process information which you have alreadyshared via open accounts of the social networks: Instagram, YouTube. We process Your personal data and ensure them to be processed in compliance with Applicable Law and namely in accordance with the principle of “lawfulness, fairness, transparency” (Art. 5(1)(a)), and We respect Your rights (see section below).
|Information about Influencer (categories of personal data):||Legal basis for processing (Art. 14(1)(c) GDPR)||Purposes for processing (Art. 14(1)(c) GDPR): Reason for collection|
|1. A link to Influencer profile, full name, avatar, language, biography, country/city/state, brand and common interests, notable engaged users, sponsored posts.||Influencers provide their data to social networks, thereby making it public. We handle anonymous data that We receives from public sources (Instagram, YouTube).||To allow Customers to choose an Influencer for their business purposes and assess the effectiveness of each Influencer’s reach.|
|2. Email and social network profile.||We have a legitimate interest in using the data made available by Influencers via social networks for direct marketing purposes (Recital 47 GDPR) without affecting Influencer’s fundamental rights and freedoms.|
|3. Images, graphics, photos, profiles, audio and video clips, sounds, musical works, liaisons with audience, texts of the comments, works of authorship, applications, links and other content or materials from your social network profile.|
2.3. Audience data and statistics
We analyze a vast amount of information in order to provide Customers with statistics. In relation to the Influencer audience (the “Audience”), this includes, in particular: gender, age group and ethnicity. While these items may represent a somewhat sensitive issue, We have undertaken, in accordance with Article 35(7)(a) GDPR, an assessment to identify and prove our legitimate interests and to exclude that our legitimate interests be overridden by the fundamental rights and freedoms of the Audience or any individuals (Art. 6(1)(f) GDPR). We concluded that our processing for statistical purposes is in line with the Applicable Law and does not conflict with the fundamental rights and freedoms of individuals.
In order to lawfully process the data on the ethnic origin of the Audience, We require relevant legal basis. One of the bases is processing for statistical purposes (Art. 9(2)(j) GDPR) (while safeguarding fundamental rights and interests of the Audience) and the fact that such data (Art. 9(2)(e) are made publically available by their data subject by means of disclosure in social media). Such processing does not have discriminatory effects on natural persons involved nor results in measures having such effect. Finally, there is no automated decision-making and profiling based on ethnic origin of the Audience (Art. 14(2)(g) GDPR).
3. What we do with your personal data and aggregate data
Our legitimate interest to work with personal data are direct marketing purposes as said in Recital 47 GDPR (EU GDPR), and Statistical purposes referring to Recitals 113 and 162 GDPR.
However, under US law (as such as The California Consumer Privacy Act), there is no concept of Legitimate Interest. The law does not enumerate specific bases for processing, although the sale of consumer information is prohibited if the consumer has opted out.
Thus, we clearly suggest each of our INFLUENCERS use the opted-out function.
We do not sell, share or disclose Customers’ data except as provided herein. We never treat your personal data in any way that would surprise you (unless We told you about it and you provided us with an informed and unambiguous consent to such usage).
We use Customer contact details and payment information to establish, support and conduct customer relationships as necessary for the performance of Services. Should the Customer fail to provide the personal data we need, we may be unable to complete the transaction. We only contact Customers with service-related information. Where marketing is involved, Customers have an option to opt out at any time before first (and any subsequent) contact.
Notification about the processing of Influencer’s personal data occurs through our website and through the provisions of this Policy. Due to the processing of a huge amount of data, we do not have the technical ability to notify each Influencer directly. Also, in accordance with Terms of Service and Contracts with Customers, the obligation to notify the Influencer about the processing of its personal data passes to the Customer.
We provide a statistical service and so, the data about Influencers identified here in under is shared with Customers whether on a trial basis or upon payment of fees.
Our Customers prohibited to “assign, syndicate, resell or otherwise transfer or make available information obtained via 2TA.IO to third parties…”.
However, we have no control on Our Customers and therefore we are unable to know whether any of Our Customers intends to sell or share the Influencers’ below-mentioned personal information received via our services or not.
If you do not wish your personal information to be shared with or sold to Customers, please send an email with “DO NOT SELL MY PERSONAL INFORMATION” to Our Legal Officer at [email protected]
The data about Influencers that we process is divided into two categories:
- All available information collected from social networks. Information is from public / open profiles of Influencers on Instagram, YouTube. Raw data is not structured, so the Influencer identity cannot be determined based on this information. - the data formed from Raw Data, and then Reports are generated.
The Processed Data is divided into two groups:
- : profile name, avatar, profile description, likes, commenters, Influencers’ liaisons with commenters and other audience, e-mail, texts of the comments;
- : audience type, topics and interests of the audience, age of the audience, earnings, history of profile development, authenticity of the audience set.
At any stage of data collection Influencers have the right to send a request to our Legal Officer at [email protected] for the purpose of changing / deleting their data or not sharing their data with Our Customers.
3.3. AUDIENCE DATA
Audience data for each Influencer is aggregated for statistical purposes and shared with Customers whether on a trial basis or upon payment of fees.
3.4. DATA CONTROLLER
Data Controller can use the collected data itself as a marketing advertiser. Such Data Controller’s report will be identical to a regular Report provided to any Customer. Such Reports are subject to laws and regulations applicable to all Data Controller’s activities.
3.5. CAMPAIGN MANAGEMENT SERVICES
With respect to Campaign Management Services We are Data Processor on behalf of our Customers and in Customers’ interests (who are Data Controller). Data Customers use their personal cabinet/account on e-platform as a tool to process data related to companies databases in form Excel tables. We do not store such databases (they are stored directly on the secured servers). We have no access to our Customers’ personal cabinets and do not know their content, including the content of the databases and any personal data (if any) therein. We just determine, to some extent, technical means of the processing of personal data (e.g. account maintenance).
4. Where and how long personal data is stored for
In compliance with Article 5(1)(b), (c), (e) GDPR, We commit to the principles of “purpose limitation”, “data minimization”, “storage limitation”, and therefore We collect, retain, store and otherwise process only such information that is necessary to ensure our legitimate interests or to comply with a legal obligation, and for the period necessary to meet our legitimate interests.
We store your data while your account is active. Whether your annual subscription expires or you fail to use the credits on time, We will delete your personal data from our systems within 1 (one) month after expiration of your annual subscription or when you request such deletion in the frame of exercise your rights (as listed below).
As stated above, We process the personal data obtained from public sources (open accounts on Instagram, YouTube). The updates may take up to 20 days. If an Influencer deletes his/her account, We will also delete such personal data from our systems and make it unavailable to Customers. This synchronization may take up to 1 (one)month from the date the Influencer deleted his/her account on the relevant social networks.
4.3. AUDIENCE DATA
Audience data is only relevant to the Influencer and is kept in aggregated form together with information about Influencer. Once Influencer data is deleted, Audience data of the Influencer is also deleted.
All Data in Our databases are stored in encoded form.
6. Categories of recipients of personal data and data
We do provide a fee-based statistical service in relation to Influencer and Audience data. The recipients of such data are Customers of Our Service.
In relation to Customer data, We do not blindly follow disclosure orders. We will check each request to ensure it satisfies the relevant safeguards, contains a court order, or is issued under a legislative measure for the prevention, investigation, detection or prosecution of criminal offences.
If We employ a (sub)processor (service provider) to act on our behalf, We ensure that there are adequate contractual measures to ensure responsibility, security and liability to the same level as expected of Us.
In any case where a third party accesses your data on Our behalf or upon Our instructions (be it inside or outside the EEA), We use the relevant legal basis to comply with the data protection legislation. In cases where there is no decision by the European Commission confirming the adequate level of protection (Art. 45(1) GDPR), We use standard data protection clauses adopted by the European Commission (Art. 46(2)(c) GDPR) to ensure the appropriate safeguards of your rights and personal data in case of third party’s access or other data transfer outside the EEA.
7. Your rights
In compliance with Article 5(1)(a), (d) GDPR, We commit to the principles of “lawfulness, fairness and transparency”, and “accuracy”.
7.1 You are entitled to the full spectrum of the rights under the General Data Protection Regulation, and We commit to respect your rights. Among those, you have the right to:
- Require access to your personal data (Art. 15 GDPR);
- Require rectification of your personal data (Art. 16 GDPR);
- Require erasure of your personal data (Art. 17 GDPR);
- Require restriction of your personal data processing (Art. 18 GDPR);
- Require portability of your personal data (Art. 20 GDPR);
- Object to the processing of your personal data (Art. 21 GDPR);
- Object to automated processing (if any) of your personal data (Art. 22 GDPR);
- Withdraw your consent to processing of your personal data, where applicable (Art. 7(3) GDPR);
- Lodge a complaint with your national supervisory authority (in the EEA) if you believe that your privacy rights have been breached (Art. 13(2)(d), 14(2)(e), 15(1)(f)).
If we choose to process your personal data for any purpose you do not agree with, We will provide you with appropriate information at the point where you come across those additional purposes in order to obtain your consent (where required) or are able to perform Our legal obligations, prior to commencing any such additional processing activities. You are not required to give consent just because We ask for it.
If your personal data were processed on the base of your consent, you may further change your mind and withdraw your consent at later by contacting Our Legal Officer and requesting to be removed from the mailing list at the following email address [email protected]. However, your consent withdrawal will not impact the processing of your personal data which took place before your withdrawal.
If your personal data was processed without your given consent (based on the legitimate interest), you may also ask Us to stop processing your personal data and to remove you from the mailing list, by contacting at [email protected]
However, your request will not impact the processing of your personal data which took place before such request.
If you request Us to rectify, erase your personal data or to restrict processing your data (to stop processing or by withdrawing your consent), We will inform you as soon as your request is satisfied (in accordance with Art.13(2)(c), 14(2)(d), and19 GDPR).
If your question is not resolved or is not resolved satisfactorily, you have the right to contact your local data protection authority (Art. 13(2)(d), 14(2)(e), 15(1)(f)). You can find the contact details of your local data protection authority here:
You have the right to request information about the Customer who received the personal data of your social media profile, and 2TA.IO commits to provide you with all information about the Customer.
If you request information about the Customer who received the personal data of you, 2TA.IO will provide you with all information of the Customer, within 72 hours of receiving the request from you.
If a Customer has transferred to third parties The Report about your Social media profile received when using 2TA.IO service, you have the right to get the entire chain of persons to whom such a Report was transferred, within 72 hours after your request.
You have the right to request to remove data/content collected from our Service. Such data/content must be deleted within 72 hours of receiving the notification.
Also, data/content should be deleted by all persons/companies/auditors to whom such information was transferred.
You have the right to log into your account and change information about yourself to the extent that the system allows. Also, you can submit a request to change information about yourself to the support service.
8. Cookies and similar technologies
We use aggregated, non-identifying, electronic data collected from use of our Sites and Services to operate, analyze, improve, and develop our Sites and Services. This information is not used to inform decisions about specific individuals; rather, it is processed to understand how different categories of users interact with our Sites and Services so that we can consistently improve the same for Customers.
We inform you that in order to fulfill our legitimate interest and improve the quality of services, We may transfer some of the personal data that is publicly available on social networks to the following service providers:
- Amazon Web Services, Inc.
- Hetzner Online, GmbH
- Stripe, Inc.
- MixPanel, Inc.
- Google Inc.
- Chatwoot, Inc.
The service provider Google Analytics is located in the USA. We contracted to them via purchase of their software and maintenance services (to be used for marketing and communication with clients) and via accepting their customers terms and conditions and privacy policies published on their websites:
On the matter of transferring (importing/exporting) and processing personal data falling within the scope of GDPR, Google rely on the EU model (standard) contractual clauses; and Amplitude relies on the EU-US and Swiss-US Privacy Shield ().
9. Children’s privacy (Article 8 GDPR)
We never knowingly collect, process or solicit any information from anyone of 16 years and younger. The information society services (“Services”) on our sites are neither offered directly nor intend to appeal to such persons. Parents or parental responsibility holders who believe that We directly offer Services to or process personal data of their children aged 16 and under may contact at [email protected]
: When processing open data from social networks, if it is reasonably impossible to recognize the real age of users, Our verification of the age of users is limited to technically available and reasonable treatment of the information openly provided by the social networks from which we collect the data. In case or fallacious, erroneous or missing age data, the social networks shall be solely responsible for violation of requirements of the Applicable Law in relation to the personal data of children.
10. Our commitment
- We will only collect and use your data where We have a legal basis to do so;
- We will always be transparent and tell you about how we use your information;
- When We collect your data for a particular purpose, We will not use it for anything else without your consent, unless other legal basis applies;
- We will not ask for more data than needed for the purposes of providing our services;
- We will adhere to the data retention policies and ensure that your information is securely disposed of at the end of such retention period;
- We will observe and respect Your rights by ensuring that queries relating to privacy issues are dealt with promptly and transparently;
- We will keep our staff trained in privacy and security obligations;
- We will ensure to have appropriate technological and organizational measures in place to protect your data regardless of where it is held;
- We will also ensure that all of our data (sub)processors (service providers) have appropriate security measures in place with contractual provisions requiring them to comply with Our commitment;
TAX NUMBER: 315090235
Largo Jorge Moutinho de Albuquerque 5 3°A, 2780-255 Oeiras,
: 15 may, 2023