10. Obtaining your personal data

We collect your personal data from the following categories of sources:

• Directly from you: When you provide it to us directly to open an account and use the Services, when you update your personal data in your account, or by corresponding with us (e.g. User Data, Account Data).
• Automatically or indirectly from you: For example, through and as a result of your use of the Services (e.g. Transaction Data, Technical Data, Usage Data).
• From our service providers: For example, where permitted by applicable law, we receive Third-Party Onboarding Data and certain Technical Data from our third-party age and identity verification providers.

11. Sharing your personal data

We share personal data with the following categories of third parties:

• Our third-party service providers: Such as our IT, payment processing, customer support, content and text moderation, and age and identity verification / age estimation service providers. The lawful basis we rely on for sharing personal data with these recipients is that it is necessary for our legitimate interests (namely the receipt of services to support business functionality).
• Our professional advisers: Such as our legal advisors, bankers, auditors, accountants, consultants, and insurers. Our professional advisors will process personal data as necessary to provide their services to us. The lawful basis we rely on for sharing personal data with these recipients is that it is necessary for our legitimate interests (namely the receipt of professional services).
• Corporate: Relevant third parties in the event of a possible sale, merger, acquisition, business reorganisation or group restructuring exercise. The lawful basis we rely on for sharing personal data with these recipients is that it is necessary for our and the relevant third parties’ legitimate interests (namely assessing and putting into effect potential transactions).
• Our group companies: For the centralised coordination and management of our business, in accordance with the purposes set out at Section 9 (categories of personal data). These recipients will process personal data in the same way as set out in this Policy. The lawful basis we rely on for sharing personal data with these recipients is that it is necessary for our legitimate interests (namely coordinating the global operations of our business).
• Relevant authorities, regulators and organisations: In response to requests from governmental authorities (including law enforcement and tax authorities), regulators, and certain non-governmental organisations (such as the National Center for Missing & Exploited Children (NCMEC)). These recipients will use your personal data in the performance of their regulatory, law enforcement or otherwise charitable or not-for-profit role. The lawful basis we rely on for sharing personal data with these recipients is that the processing is either necessary to comply with a legal obligation to which we are subject, or necessary for our, or a third-party’s, legitimate interests, or where it is in the interests of the wider public to do so (namely reporting illegal content to, and assisting with requests from, such authorities, regulators and organisations, to protect the safety of our users and third parties).

12. International data transfers

We share your personal data within our group companies and to our third parties, as set out at Section 13 (sharing your personal data).

In some circumstances, this will involve transferring your data outside the UK, the EEA and Switzerland. We make those transfers: (i) to countries that have been deemed to provide an adequate level of protection for personal data; (ii) using appropriate safeguards; or (iii) where otherwise authorised by applicable law.

Please contact us using the contact details set out at Section 19 (assistance and contact information) if you would like further information on the specific mechanism used by us when transferring your personal data outside the UK, the EEA and Switzerland.

13. Your rights regarding personal data

You have certain rights regarding the collection and processing of personal data. You may exercise these rights by contacting us using the contact details set out at Section 19 (assistance and contact information).

Under certain circumstances and subject to certain exemptions, you have the right to:

• Withdraw your consent to the processing of your personal data: Please note that withdrawing your consent will not affect the lawfulness of any processing carried out before you withdraw your consent.
• Request to know or access to your personal data: You may receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you: You may correct any incomplete or inaccurate personal data we hold about you.
• Request deletion / erasure of your personal data: You may ask us to delete or remove personal data where there is no legitimate reason for us continuing to process it. You also may ask us to delete or remove your personal data where you have exercised your right to object to processing (see below). Please note that we may not always be able to comply with your request of deletion / erasure for specific legal reasons.
• Request the restriction of processing of your personal data: You may ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of some sections of your personal data to another party.

You also have the right to object to processing of your personal data where we are relying on a legitimate interest for the processing and there is something about your particular situation which makes you want to object to processing on this ground.

We do not process personal data that is subject to solely automated decision-making, where that decision-making is likely to have a legal or similarly significant effect on you.

You also have the right:

• To lodge a complaint with a data protection regulator. For example, in the UK, this is the Information Commissioner’s Office (ICO) and in Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC). If you are resident in the EEA, you may wish to contact your local country or state-specific data protection regulator.
• Depending on your location, to not receive retaliatory or discriminatory treatment in connection with a request to exercise the above rights, or appeal a decision we have made in connection with your privacy rights request. All appeal requests should be submitted by contacting us using the contact details set out at Section 19 (assistance and contact information).

14. Exercising your rights

If you would like to exercise your rights set out at Section 15 (your rights regarding personal data), you may do so by contacting us using the contact details set out at Section 19 (assistance and contact information).

If you submit the request yourself, please ensure that your request contains sufficient information to allow us to confirm your identity and properly understand, evaluate, and respond to it.

In order to verify your identity, we may at times need to request additional personal data from you, taking into consideration our relationship with you and the sensitivity of your request. In certain circumstances, we may decline a privacy rights request, particularly where we are unable to verify your identity.

If your request is made by a third-party authorised by you, we will also require proof that the third-party has permission to submit the request on your behalf (such as a signed document evidencing that the third-party has authority to make the request).

15. Choices and control over your personal data

Modifying and deleting your personal data: If you have an account with us, you may update your account settings on our Website. Please note that changes to your settings may require some time to take effect.

Access to device information: You may control the Services’ access to your Technical Data through your “Settings” app on your device. For instance, you can withdraw permission for the Services to access your network devices and geolocation.

Email notification opt-out: We currently do not send emails for direct marketing purposes. However, we do send email notifications which are related to your account (e.g. for Creators, where you have a new subscriber, you have received a new tip, or somebody has renewed their subscription with you). You may opt-out of receiving certain types of email communications from us by changing your notification preferences on our Website. You may also email us using the contact details set out at Section 19 (assistance and contact information). Please include “E-mail notification opt-out” in the email’s subject line and include your name and your account email address in the body of the email.

Please note that you cannot opt-out of certain automated email notifications that are necessary to provide the Services or are otherwise required in accordance with applicable law (e.g. account verification, transactional communications, changes / updates to features of the service, technical and security notices).

16. Retention of personal data

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes for which it was collected, as set out in this Policy. Subject to the below, we retain personal data for a period of 6 months after the deletion or deactivation of your account on the Website.

Please note that:

• We will delete your personal data sooner where a shorter retention period is required by applicable law.

• We will retain your personal data for a longer period to the extent we deem necessary to carry out the processing activities set out in this Policy, for example:

  • where it is necessary to comply with laws and regulatory obligations that are applicable to us (e.g. adhering to record keeping / maintenance requirements in certain locations and financial / tax reporting requirements, which in some cases is up to 7 years, and if we receive a valid legal request, such as a preservation order or search warrant, related to your account);
  • for the purposes of identifying and reporting illegal activity, protecting the safety of our users and third parties, or otherwise protecting the rights and property of our users, us, and other third parties (e.g. where you have, or we have reason to believe that you have, violated our Terms of Service, and in circumstances where users are banned from further access to the Website);
  • for purposes of legal proceedings (e.g. to defend ourselves in litigation about a claim related to you); and
  • for the purposes of responding to requests from third parties in relation to your account, such as requests received from, or investigations by, law enforcement authorities, relevant governmental authorities (e.g. tax authorities and regulatory authorities) and non-governmental organisations (e.g. NCMEC).

The personal data that we retain and the length of time for which it is retained will be determined on a case-by-case basis, depending on the particular circumstances.

17. Assistance and contact information

We have appointed a Data Protection Officer (“DPO“) whose responsibilities include, together with our team of privacy specialists, responding to questions, requests, and concerns in relation to this Policy and our use of personal data.

If you have questions about this Policy, or how we process your personal data, please submit a ticket through your account or email us at privacy@bootybonk.com.

20. Additional U.S. state privacy disclosures

Residents of the States of California, Colorado, Connecticut, Nevada, Utah, and Virginia: These additional U.S. State Privacy Disclosures (“U.S. Disclosures“) supplement the information contained in the Policy by providing additional information about our personal data processing practices relating to individual residents of these states. Unless otherwise expressly stated, all terms defined in this Policy retain the same meaning in these U.S. Disclosures.

For the purposes of these U.S. Disclosures, personal data does not include publicly available information or deidentified, aggregated or anonymised information that is maintained in a form that is not capable of being associated with or linked to you.

No sales for targeted advertising

We do not sell or share personal data for the purpose of displaying advertisements that are selected based on personal data obtained or inferred over time from an individual’s activities across businesses or distinctly-branded websites, applications, or other services (otherwise known as “targeted advertising“).

Sensitive information

Although sensitive information may be disclosed for a business purpose as described below, we do not sell or share sensitive information for the purpose of targeted advertising.

The following personal data elements we, or our service providers, collect may be classified as “sensitive” under certain privacy laws (“sensitive information“) including:

• username and password;
• social security number, driver’s licence number, and passport number;
• government identifiers (such as driver’s licence numbers);
• partial payment card number and the name registered with your payment card; and
• Face Recognition Data (biometric information which is collected and processed by our third-party providers).

We use this sensitive information for the purposes set out at Section 11 (how / why we use your personal data and lawful bases for processing), to the extent necessary for the operation of our Services, to enter into and perform a contract with you, to comply with legal and regulatory requirements, to protect the safety of ours users and third parties or as otherwise permissible for our own internal purposes consistent with applicable laws.

Deidentified information

We may at times receive, or process personal data, to create deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual or household. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by applicable law.

Minors

Our Services are strictly intended for individuals 18 years of age or older. Anyone under 18 years of age is not permitted to use the Services. By using the Services, you represent that you are 18 years of age or older.

CALIFORNIA SPECIFIC DISCLOSURES

The following disclosures only apply to residents of the State of California:

Personal data collection

California law requires that we provide disclosures to you about what personal data we collect by reference to the categories of personal data set forth within California law. To address this obligation, we have identified the relevant California personal data category for the personal data set out in more detail at Section 9 (categories of personal data):

• Identifiers: Such as your name, address, phone number, email address, passport or other government identity information including driver’s licence information, account information, or other similar identifiers.
• Customer Records: Such as your driver’s licence number, passport number, partial debit card information, partial credit card information, bank account information or other payment or financial information.
• Protected Classification Characteristics: Such as age, date of birth, and gender.
• Commercial Information: Such as information about products or services purchased and your use of our Services.
• Biometric Information: Which is limited to Face Recognition Data, used by our third-party providers for age and identity verification purposes. Face Recognition Data remains with our third-party providers and we do not ourselves collect, receive, possess, or have access to this data.
• Internet / Network Information: Such as device information, log, and analytics data.
• Sensory Information: Such as pictures and videos (content) you upload to the Website.
• Professional / Employment Information: Such as the business or organisation you are associated with and, where applicable, your title with that business or organisation and information relating to your role with the business or organisation.
• Other Personal Data: Such as communication preferences, customer service and communication history, personal data an individual permits us to see when interacting with us through social media, personal data an individual provides us in relation to a question or request, and messages you send us through our Services or make available to us on social media.
• Inferences: Such as information generated from your use of our Services.

We may disclose all of these categories of personal data for a business purpose to service providers or other third parties, as outlined in this Policy.

Disclosure of personal data

As set out at Section 13 (sharing your personal data), we may disclose the categories of personal data identified above to the following categories of third parties for various business purposes: our group and affiliated companies, service providers, our professional advisers, business partners, other businesses as needed to provide our Services, and certain third parties where you have provided consent, where it is in connection with a corporate transaction, or where we are required by law or in connection with other legal process.

Sources of personal data

We collect personal data directly from you, from your browser or device when you interact with our Services, and from our business partners and affiliates, third parties you direct to share information with us, and other third-party providers. For more information, please see Section 12 (obtaining your personal data).

Purpose for collection

We collect personal data about you for the purposes set out at Section 11 (how / why we use your personal data and lawful bases for processing).

Notice of financial incentives

As discussed above, we currently do not use any cross-site tracking technologies and we do not sell personal data collected about you, or share personal data collected about you for cross-context behavioural advertising. We do not currently send emails for direct marketing purposes.

We currently offer a referral program, whereby existing Creators of the Website can use their unique referral code to introduce people who are interested in becoming Creators on the Website, and the referring Creator will receive referral payments, based on the referred Creator’s earnings. The referral program is subject to our Terms of Service and any such referral payments are calculated, and limited, as described in the Referral Program Terms in our Terms of Service.

Any personal data associated with the referring Creator, or the referred Creator, is processed in accordance with this Policy.

We have determined that the value of the referral program is reasonably related to the value of the personal data we process in connection with the referral program (based on our reasonable but sole determination). We estimate the value of the personal data we receive and otherwise process in connection with the referral program by considering the expense we incur in collecting and processing the personal data, as well as the expenses related to facilitating the referral program.

You may exercise your rights in relation to your personal data as outlined in this Policy, and as applicable, by emailing privacy@bootybonk.com.