Privacy policy

Such data processors may receive or otherwise have access to your personal data, in its entirety or in part – depending on each of their particular roles and purposes in facilitating and enhancing our Services and business, and may only use it for such purposes. Under no circumstances may data processors use the data for their own purposes.

‍

We will also share your data with our affiliates from Loadstone Group only provided that a Data Processing Agreement is concluded with them.
‍

Please note that your personal data will be maintained, stored, and processed at a destination inside the European Economic Area.
‍

In case of a transfer of your personal data to a country not providing an adequate level of protection, we ensure compliance with the GDPR by entering into a Data Processing Agreement based on the EU Standard Contractual Clauses.
‍

Considering the judgment of the Court of Justice of the EU in Case C-311/18 we will make an assessment as to whether the data processor we engage is able to comply with all EU Standard Contractual Clauses requirements and will suspend the transfers in case it is unable to comply.

Once this contract is terminated, the Data processor will return data to us or transmit it to another processor appointed by us and erase any copy in its possession. However, the processor may keep the data locked to address possible administrative or jurisdictional responsibilities.

‍

DATA RETENTION
Unless otherwise specified, where you have indicated to us that you are happy for us to send you the information about goods and services we offer and we feel may interest you or similar to those that you have already purchased or enquired about doing so, we assume you are happy for us to keep your collected personal data. We may retain your personal data (contact details) for as long as your User Account is active or as otherwise needed to provide you with information about our Services. As the data subject, you have rights related to processing of your personal data and the option of withdrawing your consent to receive promotions at any time. Please see paragraph “Your rights”.

‍

If you and we enter into a contract, we might keep your data during the performance of the contract and as long as it is necessary for our legitimate interests and contractual and legal obligations.
‍

We might hold your information for as long as is necessary to comply with our legal obligations and in accordance with our legitimate interests to develop our business and satisfy our partners’ needs as a Data controller after the contractual relationship between you and us elapses.

‍

COOKIE POLICY
We use tracking technologies like cookies, tags, scripts to collect and store information from you when you use our Services, such as your IP address, browser type, browser language, operating system, device type, referring site (site you visited before coming to our Site), date and time of visit, URL and page metadata, operating system type and application version.

‍

DATA SECURITY
We keep your personal data secure by taking appropriate technical and organizational measures against its unauthorized or unlawful processing and against its accidental loss, destruction, damage, misuse, or disclosure.
‍

Disclosure of personal data to third parties
We do not rent, sell, or share your personal data with other people or non-affiliated companies without your consent except to provide products or services you’ve requested, when we have your permission, or under the following circumstances:
‍

1. We transfer personal data to trusted partners who provide us services under data processing agreements, specified in Paragraph “Trusted partners (data processors)” who process personal data on our behalf under data processing agreements and might store, maintain or process your data. These companies do not have any independent right to share this information.
2. We may disclose your personal data to third parties when we reasonably believe we are obligated to do so by law, and in order to investigate, prevent, or take action regarding suspected or actual prohibited activities, including but not limited to, fraud and situations involving potential threats to the physical safety of any person.
3. In the event we are acquired by or merged with a third-party entity or undergo another change of control, we reserve the right to transfer information, including your personal data, to a successor entity. In this event, we will notify you by electronic means before information about you is transferred and becomes subject to a different privacy policy.

AUTOMATED SOLUTIONS
We do not use automated decision-making to assess personal aspects relating to You.
‍

YOUR RIGHTS
You have the following rights in accordance with the General Data Protection Regulation
‍

1. THE RIGHT TO BE INFORMED. In this Privacy Policy we supply you with detailed information related to your personal data storage, maintenance, and processing.
2. THE RIGHT TO ACCESS DATA HELD ABOUT YOU.
3. THE RIGHT TO RECTIFY YOUR PERSONAL DATA if it is inaccurate, incomplete, or out-of-date.
4. THE RIGHT TO ERASURE (DELETE OR REMOVE) YOUR PERSONAL DATA.
5. THE RIGHT TO RESTRICT (BLOCK) PROCESSING. When processing is restricted, we will store your personal data, but not further process it.
6. THE RIGHT TO DATA PORTABILITY is your right to receive the personal data which you have given to us, in a structured, commonly used and machine-readable format and the right to transmit that data to another controller from the current controller applicable if: The processing is based on consent or on a contract, and the processing is carried out by automated means.
7. THE RIGHT TO OBJECT at any time to processing of your personal data based on our legitimate interests.
8. THE RIGHT TO WITHDRAW YOUR CONSENT OR OBJECT TO DIRECT MARKETING AND OTHER TYPES OF PROCESSING IF APPLICABLE. You can exercise your rights by following the “unsubscribe” instructions contained in the promotional communications you receive.
9. THE RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY. You have the right to lodge a complaint with a supervisory authority if you have a concern about our information rights practices.
10. If you are a resident of Brazil, the Lei Geral de Proteção de Dados Pessoais (LGPD), Federal Law No. 13,709/2018, may provide you with additional privacy rights with respect to the collection and use of your personal data.
11. For individuals who reside in other locations and wish to exercise your privacy rights, please contact us by the email provided in this document. You may use this form to make a request to exercise certain rights which you may have under privacy and data protection regulations in your region and/or country.

You may exercise your aforementioned rights by sending a written request to our DPO by e-mail: european.DPO@loadstone.io

‍

Our websites and services may contain links to other websites, applications, platforms and services maintained by third parties. The information practices of these third parties, including the social media platforms that host our branded social media pages, are governed by their privacy statements, which you should review to better understand their privacy practices.

‍

CHANGES TO THIS PRIVACY POLICY
The Company may update this Privacy Policy at any time. In case of any significant changes to the Privacy Policy you will receive a notification on your email address filled in your account information or we will post a prominent notice of the Site prior to changes becoming effective.

‍

Region-specific notices

Out of respect for your privacy, we have implemented additional measures to comply with the obligations and rights associated with the collection of Personal Information as dictated by the laws governing the regions of our users.

‍

Disclosures for residents of Australia

If you are a resident of Australia, you have certain rights in relation to your Personal Information based on the Australian Privacy Act 1988 (“Privacy Act 1988”) that we comply with as part of our commitment to your privacy. This supplemental section, together with other relevant sections of the Policy, provides information about your rights and how to exercise them. Unless otherwise expressly stated, all terms in this section have the same meaning as defined in the Privacy Act 1988.

‍

(a) Right to access and correct: You have the right to access Personal Information we hold about you. You also have the right to request corrections to your Personal Information if you think the information is inaccurate, out-of-date, incomplete, irrelevant, or misleading.

‍

(b) Right to restrict processing: You can request that we stop or restrict the processing of your Personal Information in certain circumstances, such as when you contest the accuracy of your data.

‍

(c) Right to data portability: You have the right to request the transfer of your Personal Information to a different service provider as long as it is technically possible to do so or directly to you.

‍

(d) Right to not be subject to automated decision-making: You have the right to opt out of decisions based solely on automated processing of your Personal Information, particularly when these decisions have legal or similarly significant effects on you.

‍

(e) Right to anonymity: You are generally able to use a pseudonym or remain anonymous when interacting with us. However, in some circumstances, you may have to provide certain Personal Information. For example, we may require Personal Information to assess your eligibility for a program or service. We will inform you if you are not able to remain anonymous or use a pseudonym when dealing with us.

‍

Disclosures for residents of Brazil

If you are a resident of Brazil, you have certain rights in relation to your Personal Information based on the Brazilian General Data Protection Law (“LGPD”) that we comply with as part of our commitment to your privacy. This supplemental section, together with other relevant sections of the Policy, provides information about your rights and how to exercise them. Unless otherwise expressly stated, all terms in this section have the same meaning as defined in the LGPD.

‍

(a) Right to know and access: You have the right to confirm whether we process your Personal Information and, if so, access it. This ensures you are fully informed about the data we hold and how it’s used.

‍

(b) Right to correct: You have the right to correct Personal Information if you find any of it in our possession to be incorrect or outdated as we are committed to maintaining the accuracy and relevance of your Personal Information.

‍

(c) Right to anonymize and block: You can request the anonymization or blocking of Personal Information that is unnecessary, excessive, or not processed in compliance with the LGPD.

‍

(d) Right to data portability: You have the right to transfer your data to another service provider or product supplier, promoting your freedom to choose services without losing your data history.

‍

(e) Right to delete: If we have processed your data based on consent, you can request its deletion, except where law requires or permits us to retain it.

‍

(f) Right to information about third parties: You can ask about the third parties with whom we share your data, ensuring transparency in our data-sharing practices.

‍

(g) Right to information on consent denial: You have the right to be informed about the consequences of not providing consent to make informed decisions about the use of your Personal Information.

‍

(h) Right to withdraw consent: You can withdraw your consent for data processing at any time to ensure control over your Personal Information.

‍

(i) Right to review automated decisions: You can request a review of decisions made solely based on automated processing of your data to ensure fairness and accuracy in processes that significantly impact you.

‍

For Customers located in Latin America, Loadstone processes personal data in accordance with applicable national data protection laws, including but not limited to Brazil’s Lei Geral de Proteção de Dados (LGPD), Argentina’s Ley de Protección de los Datos Personales, and Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties. Where legally required, a Data Processing Agreement (DPA) or similar instrument shall be executed.

‍

Disclosures for residents of Canada

‍

If you are a resident of Canada, you have certain rights in relation to your Personal Information based on the Personal Information Protection and Electronic Documents Act (“PIPEDA”) that we comply with as part of our commitment to your privacy. This supplemental section, together with other relevant sections of the Policy, provides information about your rights and how to exercise them. Unless otherwise expressly stated, all terms in this section have the same meaning as defined in the PIPEDA.

‍

(a) Right to access: You have the right to access the Personal Information we hold about you if you wish to review, verify, or correct your information.

‍

(b) Right to correct: We strive to maintain the accuracy of your Personal Information and will promptly make necessary corrections when you identify inaccuracies in your data.

‍

(c) Right to withdraw consent: You can withdraw your consent regarding the handling of your Personal Information at any time, subject to legal or contractual limitations.

‍

(d) Right to complain: You have the right to file a complaint with the Privacy Commissioner of Canada if you feel your Personal Information is being handled in a way that violates PIPEDA.

‍

(e) Right to challenge compliance: You can challenge our compliance with PIPEDA, including how we handle your Personal Information, consent, access requests, and how we respond to your correction requests.

‍

(f) Right to know about breaches: You have the right to be notified in cases of a security breach involving your Personal Information that poses a real risk of significant harm.

‍

Disclosures for residents of the EU/EEA, the UK and Swiss

If you are a resident of the European Union (“EU”), the European Economic Area (“EEA”), or the United Kingdom (“UK”), you have certain rights in relation to your Personal Information based on the GDPR and the UK DPA that we comply with as part of our commitment to your privacy. Unless otherwise expressly stated, all terms in this section have the same meaning as defined in the GDPR and the UK DPA.

‍

(a) Right to withdraw consent: You have the right to withdraw consent where you have previously given your consent to the processing of your Personal Information. To the extent that the legal basis for our processing of your Personal Information is consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing before the withdrawal.

‍

(b) Right to access: You have the right to learn if your Personal Information is being processed by us, obtain disclosure regarding certain aspects of the processing, and obtain a copy of your Personal Information undergoing processing.

‍

(c) Right to rectification: You have the right to verify the accuracy of your information and ask for it to be updated or corrected. You also have the right to request us to complete the Personal Information you believe is incomplete.

‍

(d) Right to object to the processing: You have the right to object to the processing of your information if the processing is carried out on a legal basis other than consent. Where Personal Information is processed for the public interest, in the exercise of an official authority vested in us, or for the purposes of the legitimate interests pursued by us, you may object to such processing by providing a ground related to your particular situation to justify the objection.

‍

(e) Right to restrict processing: You have the right, under certain circumstances, to restrict the processing of your Personal Information. These circumstances include: the accuracy of your Personal Information is contested by you and we must verify its accuracy; the processing is unlawful, but you oppose the erasure of your Personal Information and request the restriction of its use instead; we no longer need your Personal Information for the purposes of processing, but you require it to establish, exercise or defend your legal claims; you have objected to processing pending the verification of whether our legitimate grounds override your legitimate grounds. Where processing has been restricted, such Personal Information will be marked accordingly and, with the exception of storage, will be processed only with your consent or for the establishment, to exercise or defense of legal claims, for the protection of the rights of another natural, or legal person or for reasons of important public interest.

‍

(f) Right to delete: You have the right, under certain circumstances, to obtain the erasure of your Personal Information from us. These circumstances include: the Personal Information is no longer necessary in relation to the purposes for which it was collected or otherwise processed; you withdraw consent to consent-based processing; you object to the processing under certain rules of applicable data protection law; the processing is for direct marketing purposes; and the personal data have been unlawfully processed. However, there are exclusions of the right to erasure such as where processing is necessary: for exercising the right of freedom of expression and information; for compliance with a legal obligation; or for the establishment, for exercising or defense of legal claims.

‍

(g) Right to data portability: You have the right to receive your Personal Information that you have provided to us in a structured, commonly used, and machine-readable format and, if technically feasible, to have it transmitted to another controller without any hindrance from us, provided that such transmission does not adversely affect the rights and freedoms of others.

‍

(h) Right to complaint: You have the right to complain to a data protection authority about our collection and use of your Personal Information. If you are not satisfied with the outcome of your complaint directly with us, you have the right to lodge a complaint with your local data protection authority. For more information, please contact your local data protection authority in the EU or the EEA. This provision is applicable provided that your Personal Information is processed by automated means and that the processing is based on your consent, on a contract which you are part of, or on pre-contractual obligations thereof.

‍

Disclosures for residents of the Middle East

If you are a resident of a Middle Eastern country with a national data protection law (e.g., the United Arab Emirates, Israel, or Qatar), you may have certain rights in relation to your Personal Information, based on the applicable legislation (such as the UAE Federal Decree Law No. 45 of 2021 on the Protection of Personal Data, the Israeli Protection of Privacy Law, or the QFC Data Protection Regulations). These rights are outlined below and apply in conjunction with our general Privacy Policy. Unless otherwise expressly stated, all terms in this section have the same meaning as defined in the relevant national privacy law.

‍

(a) Right to access and correction: You have the right to request access to and correction of your Personal Information held by us.

‍

(b) Right to object or restrict processing: You may object to certain types of data processing, or request restriction where the legal basis is unclear or under dispute.

‍

(c) Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time.

‍

(d) Right to lodge a complaint: You may contact the national data protection authority in your jurisdiction if you believe your privacy rights have been violated.

‍

Disclosures for residents of the Pacific region

If you are a resident of New Zealand or Papua New Guinea, you have certain rights in relation to your Personal Information based on the regional regulation, including New Zealand’s Privacy Act 2020 (“Privacy Act 2020”) that we comply with as part of our commitment to your privacy. This supplemental section, together with other relevant sections of the Policy, provides information about your rights and how to exercise them. Unless otherwise expressly stated, all terms in this section have the same meaning as defined in the Privacy Act 2020.

‍

(a) Right to Access: You have the right to access your Personal Information that we hold, enabling you to review and understand the data we have about you for transparency and accuracy.

‍

(b) Right to Correction: If your Personal Information is incorrect or outdated, you have the right to request its correction, ensuring that the information we hold is accurate and up-to-date.

‍

(c) Right to Make a Complaint: If you believe your privacy rights have been breached, you have the right to make a complaint to a data protection authority.

‍

(d) Right to Object to Automated Decision-making: You can object to decisions made solely on automated processing of your Personal Information that have significant effects on you, ensuring a fair and transparent decision-making process.

‍

(e) Right to Data Portability: Where applicable, you have the right to request the transfer of your Personal Information to another service provider if technically possible or directly to you.

‍

(f) Right to Anonymity and Pseudonymity: Where possible, you have the option to interact with us without revealing your identity or by using a pseudonym, offering flexibility and control over your personal engagement.

‍

(g) Notification of Data Breaches: In the event of a data breach that may harm your privacy, we will notify you promptly, taking immediate steps to mitigate any potential impacts.

‍

Disclosures for residents of South Africa

If you are a resident of South Africa, your privacy rights are governed by the Protection of Personal Information Act (POPIA). In compliance with this law, we offer the following rights:

‍

(a) Right to be informed: You have the right to be notified when your Personal Information is being collected and the purpose of such collection.

‍

(b) Right to access: You may request access to your Personal Information held by us.

‍

(c) Right to correct or delete: You have the right to request correction, deletion, or destruction of your Personal Information that is inaccurate, irrelevant, or excessive.

‍

(d) Right to object to processing: You may object to the processing of your data under certain circumstances, including for direct marketing.

‍

(e) Right to withdraw consent: Where we rely on your consent to process your Personal Information, you have the right to withdraw that consent at any time.

‍

(f) Right to lodge a complaint: You may file a complaint with the Information Regulator if you believe your rights have been infringed.

Disclosures for residents of the USA, Canada

If you are a resident of California, Colorado, Connecticut, Delaware, Iowa, Maryland, Utah, Virginia, Canada you have certain rights and we aim to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Information. This supplemental section, together with other relevant sections of the Policy, provides information about your rights and how to exercise them under the California Consumer Privacy Act and the California Privacy Rights Act (collectively, “CPRA”), the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CDPA”), the Delaware Online Privacy and Protection Act (“DOPPA”), the Iowa Consumer Data Protection Act (“ICDPA”), the Maryland Personal Information Protection Act (“PIPA”), the Utah Consumer Privacy Act (“UCPA”), the Virginia Consumer Data Protection Act (“VCDPA”), and any and all regulations arising therefrom. Unless otherwise expressly stated, all terms in this section have the same meaning as defined in the related state laws.

‍

The California Consumer Privacy Act (as amended by the California Privacy Rights Act) requires businesses to disclose whether they sell or share Personal Data. As a business covered by the CCPA, we do not sell Personal Data. We may share Personal Data (in the form of identifiers and internet activity information) with third party advertisers for purposes of targeting advertisements on non-Loadstone websites, applications and services. In addition, we may allow third parties to collect Personal Data from our sites or services if those third parties are authorized service providers who have agreed to our contractual limitations as to their retention, use, and disclosure of such Personal Data, or if you use Salesforce sites or services to interact with third parties or direct us to disclose your Personal Data to third parties.

‍

California law requires that we detail the categories of Personal Data that we disclose for certain “business purposes,” such as to service providers that assist us with securing our services or marketing our products, and to such other entities as described in this Privacy Policy. We disclose the following categories of Personal Data for our business purposes:

‍

• Email
• Full Name
• Phone Number
• Country
• Company
• Business Size

In addition to the rights as explained in this Policy, if you provide Personal Information as defined in the statute to obtain Services for personal, family, or household use, you have the right to submit requests related to your Personal Information once a calendar year. Note that there are circumstances when we may not be able to comply with your request such as when we are not able to verify your request or find that providing a full response conflicts with other legal obligations or regulatory requirements. You will be notified if it’s the case.

‍

(a) Right to know and right to access: You have the right to request certain information we have collected about you. Once we receive and confirm a verifiable request from you, we will disclose to you, to the extent permitted by law: the specific pieces of Personal Information we hold about you, the categories of sources from which Information about you is collected, the purposes for collecting, selling, or sharing your Personal Information. You have the right to request that the Personal Information is delivered in a format that is both portable and easily usable, as long as it is technically possible to do so.

‍

(b) Right to correct: You have the right to request that we correct your inaccurate Personal Information taking into account the nature of the Personal Information and the purposes of the processing of the Personal Information.

‍

(c) Right to delete: You have the right to request deletion of your Personal Information.

‍

(d) Right to opt-out of the sale and sharing: You have the right to opt-out of the sale of your Personal Information which may include selling, disclosing, or transferring Personal Information to another business or a third party for monetary or other valuable consideration.

‍

(e) Right to consent to or limit the use of your sensitive personal information: You have the right to consent to the use of your Sensitive Personal information and to direct us to restrict its use and disclosure solely to what is essential for carrying out or delivering the Services in a manner reasonably anticipated by an average user, or for certain business objectives as specified by law. However, we do not use Sensitive Personal Information for any purposes other than those legally permitted or beyond the scope of your consent.

‍

(f) Right to non-discrimination: You have the right to not be discriminated against in the Services or quality of Services you receive from us for exercising your rights. We may not, and will not, treat you differently because of your data subject request activity, and we may not and will not deny goods or Services to you, charge different rates for goods or Services, provide a different level quality of goods or Services, or suggest that we would treat you differently because of your data subject request activity.

‍

(g) Shine the Light: California residents that have an established business relationship with us have the right to know how their personal information is disclosed to third parties for their direct marketing purposes under California’s “Shine the Light” law, or the right to opt out of such practices.

‍

To exercise any of your rights, simply contact us using the email european.DPO@loadstone.io. After we receive and verify your request, we will process it to the extent possible within our capabilities.

‍

Your Personal Data may be collected, transferred to and stored by us in the EU and by our affiliates and third-parties disclosed in Description,

above, that are based in other countries.

‍

Your Personal Data may be processed outside your country or jurisdiction, including in places that are not subject to an adequacy decision by the European Commission or your local legislature or regulator, and that may not provide for the same level of data protection.

We ensure that the recipient of your Personal Data offers an adequate level of protection and security, for instance by entering into the appropriate back-to-back agreements and, if required, standard contractual clauses or an alternative mechanism for the transfer of data as approved by the European Commission (Art. 46 GDPR) or other applicable regulators or legislators. Where required by applicable law, we will only share, transfer or store your Personal Data outside of your jurisdiction with your prior consent.

‍

How to exercise your rights

Any requests to exercise your rights can be directed to us through the contact details provided in this document. Please note that we may ask you to verify your identity before responding to such requests. Your request must provide sufficient information that allows us to verify that you are the person you are claiming to be or that you are the authorized representative of such a person. If we receive your request from an authorized representative, we may request evidence that you have provided such an authorized representative with power of attorney or that the authorized representative otherwise has valid written authority to submit requests on your behalf.

‍

You must include sufficient details to allow us to properly understand the request and respond to it. We cannot respond to your request or provide you with Personal Information unless we first verify your identity or authority to make such a request and confirm that the Personal Information relates to you.P