Privacy policy

1. CONTROLLER; DEFINITIONS 1.1 This Privacy Policy (the "Policy") is issued by Oznaka (the "Company", "we", "our" or "us"), the provider and operator of the OznakaAI application (the "Application" or the "Service") and the website at oznaka.ai. The Company acts as controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 ("GDPR") in respect of the processing described herein. 1.2 Data-protection enquiries and requests shall be directed to: contact@oznaka.ai, or by post to the registered office marked "Data Protection". Capitalised terms not defined herein have the meaning given in the GDPR. 2. SCOPE; CATEGORIES OF DATA SUBJECTS 2.1 This Policy applies to the processing of personal data of: (a) visitors to the website ("Visitors"); (b) persons registering for the waitlist, a demonstration, or communications ("Registrants"); (c) authorised users of Client accounts ("Client Users"); and (d) natural persons operating publicly accessible creator accounts on social-media platforms whose public data is analysed by the Service ("Creators"). 3. CATEGORIES OF PERSONAL DATA; SOURCES 3.1 Data provided directly. In respect of Registrants and Client Users: name, business email address, organisation, role, credentials, billing details, campaign briefs, and the content of correspondence. Source: the data subject. 3.2 Data collected automatically. In respect of Visitors and Client Users: IP address, device and browser characteristics, and Service-usage records. Strictly necessary cookies and similar technologies are deployed without consent; analytics technologies and any marketing technologies are deployed only upon the Visitor's prior consent, in accordance with applicable ePrivacy rules and as described in Clause 12. 3.3 Creator data. In respect of Creators, the Company processes exclusively: (a) publicly accessible profile data (handle, display name, biography, follower and following counts, account metadata); (b) publicly accessible content and the public engagement metrics thereof; (c) publicly observable audience and engagement signals; (d) publicly listed or client-reported rate information; and (e) derived data, namely scores and estimates generated by the Company's statistical models from the foregoing ("Scores"). The Company does not process data from private or protected accounts, private communications, or non-public sources, and does not intentionally process special categories of personal data within the meaning of Article 9 GDPR, nor do its models infer such categories. Sources: the official application programming interfaces of X Corp. under commercial licence, equivalent official interfaces of other platforms, and aggregated client reports. 4. PURPOSES AND LEGAL BASES OF PROCESSING 4.1 The Company processes personal data for the following purposes and on the following legal bases: (a) Provision, administration, and security of the website and the Service, in respect of Visitors and Client Users — Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(f) GDPR (legitimate interest in security); (b) Waitlist administration, responding to enquiries, and other pre-contractual steps, in respect of Registrants — Article 6(1)(b) GDPR, and Article 6(1)(a) GDPR (consent) for optional communications; (c) Analysis of publicly accessible Creator accounts and generation of Scores for provision to business clients, in respect of Creators — Article 6(1)(f) GDPR (legitimate interests, as described in Section 5); (d) Service improvement and aggregated benchmarking, using aggregated or de-identified data wherever feasible — Article 6(1)(f) GDPR; (e) Compliance with legal obligations and the establishment, exercise, or defence of legal claims — Article 6(1)(c) and Article 6(1)(f) GDPR. 5. LEGITIMATE INTERESTS; PROFILING OF CREATOR ACCOUNTS 5.1 The legitimate interests pursued pursuant to Article 6(1)(f) GDPR are: (a) the Company's interest in operating a business-to-business market-intelligence service; (b) clients' interest in the effective and lawful selection of commercial partners; and (c) the interest of the advertising ecosystem, including Creators with authentic audiences, in the identification of authentic engagement. The Company has conducted and documented a legitimate-interest assessment and a data-protection impact assessment pursuant to Article 35 GDPR, which are reviewed periodically. 5.2 Scores constitute probabilistic estimates produced by statistical models applied to publicly available data. They represent the Company's analytical assessment and do not constitute assertions of fact concerning, or findings of conduct by, any natural person. A description of the nature of the Scores is available at oznaka.ai/creators. 5.3 Scores are disclosed solely to vetted business clients under contractual obligations of confidentiality and non-publication. The Company does not publish rankings or Scores of identified Creators. 5.4 The Company does not take decisions concerning Creators based solely on automated processing which produce legal effects or similarly significantly affect them within the meaning of Article 22 GDPR. Scores serve exclusively as decision-support for human evaluation conducted by clients, who are contractually required to exercise independent judgment. 5.5 Accounts identified as operated by minors are excluded from the Service. 6. RECIPIENTS OF PERSONAL DATA 6.1 Personal data may be disclosed to: (a) business clients of the Company, in the case of Creator data, subject to the contractual restrictions described in Clause 5.3; (b) processors engaged by the Company (hosting, communications, support, and payment providers) acting on documented instructions pursuant to Article 28 GDPR; (c) professional advisers bound by confidentiality; (d) competent authorities where disclosure is required by law; and (e) an acquirer or successor in the context of a merger, acquisition, or asset transfer, subject to appropriate safeguards. A current list of processors is available upon request. The Company does not sell personal data. 7. INTERNATIONAL TRANSFERS 7.1 Where personal data is transferred to a third country not benefiting from an adequacy decision, the Company implements the safeguards of Chapter V GDPR, in particular the Standard Contractual Clauses adopted by the European Commission, supplemented where necessary by additional technical and organisational measures. Information on the safeguards applied is available upon request. 8. RETENTION 8.1 Personal data is retained no longer than necessary for the purposes stated: (a) Registrant data — until the conclusion of launch communications or withdrawal, and no longer than twenty-four (24) months of inactivity; (b) Client User data — for the duration of the contractual relationship and thereafter as required by statutory retention obligations; (c) Creator data — on a rolling basis, whereby data no longer publicly accessible at the source is removed in the subsequent refresh cycle, and objection or opt-out requests are preserved on a minimal suppression list solely to ensure continued exclusion; (d) correspondence — twenty-four (24) months after closure of the matter; in each case subject to longer retention where necessary for compliance with legal obligations or the establishment, exercise, or defence of legal claims. 9. RIGHTS OF DATA SUBJECTS 9.1 Subject to the conditions and limitations of the GDPR, every data subject has the right to: access (Art. 15); rectification (Art. 16); erasure (Art. 17); restriction of processing (Art. 18); data portability (Art. 20); objection to processing based on legitimate interests (Art. 21); and withdrawal of consent at any time with prospective effect (Art. 7(3)). 9.2 In respect of Creators specifically: (a) upon objection pursuant to Article 21(1), the Company will cease the processing concerned unless it demonstrates compelling legitimate grounds; as a matter of policy, verified account owners may obtain exclusion of their account from client-facing results; (b) requests to rectify inaccurate source data will, where substantiated, result in correction and recomputation of affected Scores; (c) a dedicated review procedure for disputed Scores, involving human review, is described at oznaka.ai/creators. 9.3 Requests shall be submitted to contact@oznaka.ai. The Company may require verification that a request concerning a Creator account originates from the person controlling that account. The Company responds within one month, extendable by two further months for complex or numerous requests, in which case the data subject will be informed. 10. SOURCE-PLATFORM SIGNALS; ACCURACY 10.1 The Company processes deletion and protection signals received from source platforms: content deleted or rendered non-public at the source is removed from the Company's systems in the subsequent refresh cycle. The Company applies reasonable measures to ensure the accuracy of personal data having regard to the purposes of processing, including periodic refresh of source data and the rectification and dispute procedures described in Clause 9.2. 11. SECURITY 11.1 The Company implements technical and organisational measures appropriate to the risk pursuant to Article 32 GDPR, including encryption in transit and at rest, role-based access controls, logging and monitoring, and contractual confidentiality obligations on personnel. Personal-data breaches are handled in accordance with Articles 33 and 34 GDPR. 12. COOKIES 12.1 The website uses cookies and similar technologies, including browser local storage and session storage (together, "Cookies"). Consent is requested, recorded, and managed through the Cookiebot consent-management platform provided by Usercentrics A/S. Cookies are grouped into the following categories. 12.2 Necessary. Cookies required for the website to function, including the Cookie that records the Visitor's consent choice and session storage that preserves form input and campaign-referral parameters (such as UTM parameters) for the duration of a browser session. These Cookies are deployed without consent pursuant to the strictly-necessary exemption. 12.3 Statistics. Subject to the Visitor's prior consent, the Company uses Microsoft Clarity (Microsoft Corporation) and PostHog (PostHog Inc.) to understand how the website is used, including pages viewed, interactions such as clicks and scrolling, session recordings and heatmaps, and device and browser characteristics. PostHog stores a pseudonymous identifier in the browser's local storage. Legal basis: Article 6(1)(a) GDPR (consent). 12.4 Marketing. The Company may in future deploy advertising technologies, such as the X (Twitter) pixel provided by X Corp., to measure the effectiveness of its advertising campaigns. Such technologies will be deployed only upon the Visitor's prior consent to the Marketing category. Legal basis: Article 6(1)(a) GDPR (consent). 12.5 Consent may be given, changed, or withdrawn at any time via the "Cookie settings" link in the website footer. Withdrawal takes effect prospectively and does not affect the lawfulness of processing based on consent before its withdrawal. Upon withdrawal, the Company ceases collection through the technologies concerned and removes the identifiers it stores in the Visitor's browser. 12.6 The current list of Cookies, including their provider, purpose, and duration, is available in the cookie declaration accessible through the consent banner. 13. CHILDREN 13.1 The Service is directed exclusively at business users. The Company does not knowingly process the personal data of children and excludes from the Service accounts identified as operated by minors. 14. AMENDMENTS 14.1 The Company may amend this Policy from time to time. The current version, with its effective date, is published at oznaka.ai/privacy. Material amendments affecting Client Users or Creators will be announced in advance through the website or by direct notice where feasible. Amendments do not have retroactive effect on rights already accrued.