This document outlines the principles by which the Data Controller manages user's personal data and employs cookies.

I. DEFINITIONS

The capitalized terms in this policy are defined as follows:

a) “Data Controller” – Refers to Dropcatcher.nl B.V., located at Wim Duisenbergplantsoen 31, 6331SE Maastricht, The Netherlands, Chamber of Commerce (KvK) Register number 70251924.

b) “Mobile Application” – A software application developed for use on mobile devices, which facilitates the use of the Services.

c) “Policy” – This document that delineates the principles of personal data handling and the guidelines related to the Data Data Controller’s use of cookies.

d) “GDPR” – The General Data Protection Regulation (Regulation (EU) 2016/679), instituted by the European Parliament and Council on April 27, 2016, concerning the protection of individuals with regard to the processing of personal data and the free movement of such data, replacing Directive 95/46/EC.

e) “Website” – The online platform accessible at https://www.marketgpt.app/.

f) “Service” – A service provided electronically as referred to in the Digital Services Act (Regulation (EU) 2022/2065).

g) “User” or “you” – An individual who uses the Services.

II. GENERAL TERMS

1. The Policy is applicable to all Users who utilize the Services provided by the Data Controller, as well as to all visitors to the Website and those who use the Application.

2. Prior to using the Services, the User should acquaint themselves with this Policy.

3. The Data Controller is not accountable for links that enable Users to directly access websites managed by other entities.

4. If the User clicks on a link to third-party websites or services, the User should review the privacy policies implemented by these entities.

III. DATA CONTROLLER

1. Dropcatcher.nl B.V., with its registered office in Wim Duisenbergplantsoen 31, 6331SE Maastricht, The Netherlands, Chamber of Commerce (KvK) Register number 70251924, is the Data Controller of the User’s personal data.

2. Any inquiries, requests regarding the exercise of rights, and comments concerning the Policy and the processing of personal data by the Data Controller should be submitted in writing to the address provided at https://www.marketgpt.app/contact.

IV. DATA COLLECTED BY THE DATA CONTROLLER

The Data Controller processes Users’ personal data based on at least one of the legal bases listed below:

1. Consent

The legal basis for processing personal data is Article 6(1)(a) of the General Data Protection Regulation (GDPR) – User’s consent.

You may be requested to provide consent for the processing of your personal data, or you may independently and voluntarily provide your personal data to the Data Controller (e.g., by filling in optional fields of the form).

Consent is always voluntary. You may withdraw the consent at any time. However, the withdrawal of consent does not affect the lawfulness of data processing before its withdrawal.

Your consent is obtained to enable the Data Controller to share electronic data collected automatically through cookies. Processing of this data by the Data Controller for profiling and displaying personalized advertisements may be carried out in connection with the Data Controller’s legitimate interest.

2. Performance of the Contract

The legal basis for processing personal data is Article 6(1)(b) of the GDPR – taking steps to enter into a contract and performing the contract.

The Data Controller may process your personal data due to the ongoing process of entering into contracts and, subsequently, the performance of contracts, including contracts related to using the Services.

If you represent an entity with which the Data Controller has entered into a contract, your data is processed to pursue the legitimate interests of the Data Controller (Article 6(1)(f) of the GDPR), i.e., entering into and performing a contract with the represented entity.

3. Legal Obligation

The legal basis for processing personal data is Article 6(1)(c) of the GDPR – compliance with a legal obligation to which the Data Controller is subject, resulting from specific legal provisions.

The Data Controller may process User’s personal data due to the need to fulfil legal obligations. This includes situations where data, such as data resulting from issued invoices, must be stored for accounting and tax purposes.

4. Legitimate Interest

The legal basis for processing personal data is Article 6(1)(f) of the GDPR – the pursuit of the legitimate interests of the Data Controller.

Based on legitimate interests, the Data Controller may process User’s personal data to:

• Conduct direct marketing of its products and services. In such cases, it is justified to tailor marketing content to the interests of Users;
• Analyse the use of the Services;
• Improve the Services;
• Assert rights and defend against claims;
• Archive;
• Accept submissions, and respond to inquiries;
• Measure the effectiveness of advertising;
• Ensure the security of the Services provided and IT systems, session security, and fraud detection. Based on a legitimate interest, data related to the User, in particular system logs, may also be processed.

When using the Services, information necessary to ensure technical access to the Services is collected. Such information includes:

• IP address,
• Date and time of the request,
• Request content (Website domain),
• Domain of the originating website,
• Type, language, and version of the browser,
• Type and version of the operating system,
• Technical data of the end device (e.g., computer, phone),

The above data, contained in the so-called system logs, are used by the Data Controller to improve the Services, adapt them to Users’ needs, and more effectively resolve detected malfunctions.

V. DATA DISCLOSURE

1. The Data Controller may disclose Users’ personal data only when there is a legal basis for doing so, including at the request of entities authorized under the law or when it is necessary to provide services offered by the Data Controller (e.g., entities providing services to the Data Controller).

2. Your personal data may be disclosed at the request of public authorities or other entities authorized to access such data under legal provisions, particularly when it is necessary to ensure the security of the Data Controller’s systems or the rights of other Users.

3. Entities providing services to the Data Controller, including the delivery of services to Users, may access your personal data. These entities may include IT service providers, service subcontractors, providers of analytical services and online opinion research, agencies handling e-mail campaigns, advertising agencies, law firms, and debt collection agencies.

4. Your data may be transferred to third countries, i.e., outside the European Economic Area. In such cases, data is transferred only to countries for which the European Commission has issued a decision confirming the existence of an adequate level of personal data protection. In the absence of such a decision, the Data Controller and its providers apply additional safeguards, including standard contractual clauses.

VI. USER RIGHTS

You have the rights indicated below concerning your personal data processed by the Data Controller.

1. Right of access to personal data.

Upon your request, the Data Controller will provide information on what personal data of yours is processed and will provide a copy of such data.

2. Right to rectification of personal data.

In cases where your personal data is inaccurate or incomplete, you may request the Data Controller to rectify or complete it.

3. Right to erasure of personal data.

In certain situations, you may request the Data Controller to delete personal data processed by the Data Controller (e.g., when the data is no longer necessary for the provision of services by the Data Controller).

4. Right to restriction of the processing of personal data.

You may request the Data Controller to temporarily suspend the processing of your data (e.g., not to send marketing information to the provided e-mail address) in specific situations. For example, you may request the restriction of processing of your personal data when you object to the processing or when you question the accuracy of the data. Despite the restriction of processing, the Data Controller will still be authorized to store personal data.

5. Right to request personal data portability.

In specific situations (e.g., regarding data processed based on consent), you have the right to receive personal data processed by the Data Controller in a structured, commonly used and machine-readable format to transmit the data to another Data Controller.

6. Right to withdraw consent to the processing of personal data.

If the processing of personal data is based on your consent, you may withdraw the consent at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out by the Data Controller based on consent before its withdrawal.

7. Right to object to the processing of personal data.

You may request the Data Controller to cease the processing of your personal data due to your particular situation when:

• The Data Controller processes your personal data based on its own legitimate interest or that of a third party, except when those interests override your interests, rights, and freedoms.
• Your personal data is processed for direct marketing purposes;
• The processing of personal data includes automated decision-making in relation to you, including profiling.

8. Right to lodge a complaint with the Data Protection Authority

You have the right to lodge a complaint with the Dutch Data Protection Authority President (address: P.O. Box 93374, 2509AJ The Hague, The Netherlands) regarding the processing of personal data by the Data Controller.

VII. DATA RETENTION PERIOD

1. The Data Controller retains Users’ personal data only for the time necessary to fulfil the purposes for which the data was collected and for the time required by law (e.g., five years from the end of the tax year in accordance with tax regulations). After this period, the data will be deleted or may be anonymized so that your identity cannot be determined.

2. Personal data may be stored for a longer period if such an obligation is imposed by law or if it is necessary for the Data Controller to defend or assert claims against Users.

3. If the basis for data processing is the need to perform a contract, the data will be processed for the duration of its performance and until the expiration of the limitation period for claims arising from the contract or until the completion of proceedings.

4. Personal data processed solely based on consent will be processed until such consent is withdrawn, but no longer than is necessary for the specified purpose.

5. If the basis for processing personal data is the legitimate interest of the Data Controller, the data will be processed until you effectively object.

The Data Controller does not use the Users’ personal data for automated decision-making, nor does it transfer it to international organizations.

VIII. CHANGES TO THE PRIVACY POLICY

1. The Data Controller provides a link to the current Privacy Policy in the Website’s menu.