PRIVACY POLICY

Version dated November 19, 2024

This Privacy Policy (“Policy”) outlines how we, UCOZ LTD, process your personal information (“Personal Information”) during your use of the Survey Ninja service (“Service”), including:

• (a) what information we collect;
• (b) how and why we do this;
• (c) how we protect the information;
• what rights you have regarding this information.

By this, you consent to the processing of your Personal Information under the terms of this Policy. Your actions aimed at using the Service constitute your unconditional acceptance of the terms of the Policy and the conditions of Personal Information processing specified therein.

Before starting to use the Service, you must carefully read the Policy in its entirety and ensure that you fully understand, agree with its terms, and meet the necessary requirements for accepting them. If you have not read it fully, do not understand it, do not accept the terms of the Policy, or do not meet the necessary requirements, you may not use the Service and must immediately cease any interaction with it.

A necessary requirement for accepting the terms of the Policy is that you are of an age that allows you to independently manage your Personal Information in accordance with the laws of your jurisdiction; if there are limitations on your legal capacity, you must obtain the appropriate permission from your legal representative (or guardian) to accept the terms of the Policy; if you are acting on behalf of another person, you must have confirmation of the relevant authority to accept the terms of the Policy.

Under the applicable law, you are not obligated to provide us with any Personal Information; however, providing such information is a mandatory condition for using the Service. By this, you confirm, guarantee, and agree that any information you provide to us is given of your own free will, that this consent is specific, unambiguous, and reflects your actual desire for us to use your Personal Information for the purposes described in the Policy.

You may withdraw your consent for the processing of your Personal Information at any time. We guarantee that the process for withdrawing consent will be as simple as the process for providing it. The withdrawal of consent does not affect the legality of the processing of Personal Information based on consent prior to its withdrawal.

1. COLLECTION OF PERSONAL INFORMATION

1.1. In our operations, we are guided by the applicable laws of Cyprus regarding the processing of personal data and the General Data Protection Regulation (GDPR).

1.2. The legal basis for collecting Personal Information is your consent to the collection of information in accordance with point (a) of Article 6(1) of the General Data Protection Regulation (GDPR).

1.3. In accordance with the principle of "data minimization," we collect Personal Information only to the extent necessary for using the Service and achieving the purposes for which it is collected.

1.4. During your use of the Service, we collect:

• 1.4.1. Personal information that allows us to identify you. This information is provided by you when filling out the registration form or is transmitted from the Google account used to log into the Service. The mandatory type of personal information for using the Service is your email address. Additionally, you may provide your phone number, which is not required to access the Service and is provided to us solely at your discretion.
• 1.4.2. Anonymized information that does not allow us to identify you. This information is collected automatically during registration and use of the Service. Anonymized information may include:
• (a) information obtained through cookies, pixel tags, web beacons, browser analytics tools, server logs, and other similar technologies and tools;
• (b) information about the devices you use to access the Service, including the operating system type, device model, browser type, system settings, language information, geolocation data (country/region identification), device time zone, and carrier/provider information;
• (c) action logs stored on the server, recording IP addresses of devices used to interact with the Service, access time, sequence of actions within the Service, session information including response time, and loading errors;
• (d) other non-identifying information depending on the permissions you have granted.

1.5. You accept and agree that, in some cases, we have the right to request additional information about you, as well as copies of documents to verify the provided details, and to make any other requests when necessary based on reasonable assumptions and legitimate interests.

2. PURPOSES OF COLLECTING PERSONAL INFORMATION

2.1. We use your Personal Information for the following purposes:

• 2.1.1. To provide access to the Service for its further use.
• 2.1.2. To improve the Service, enhance its usability, and adjust necessary settings based on general or individual preferences, user experience, or difficulties you may encounter.
• 2.1.3. To provide technical support, feedback, including sending notifications, requests, and information related to the use of the Service (notifications about updates, security information, changes to our terms and conditions of using the Service).
• 2.1.4. To create aggregate statistical information, including analytics and monitoring of trends in the use of the Service and actions within the Service.
• 2.1.5. To send promotional newsletters to your email address and display advertising materials within the Service about products, services, promotions, events, and other news and information that we believe may interest you. You can opt out of receiving promotional messages by using the "unsubscribe" button.
• 2.1.6. To prevent fraud or violations of applicable laws, particularly for detecting, investigating, and preventing illegal activities, and to protect our rights and property, as well as the rights and property of other users and third parties.
• 2.1.7. To comply with the laws of Cyprus or the laws applicable to you.

2.2. Your Personal Information will not be used for purposes other than those stated above.

2.3. You confirm that the purposes for which we use your Personal Information align with your interests, and the consent for processing your Personal Information, expressed at the beginning of using the Service, is given for each purpose of processing specified in the Policy.

3. DISCLOSURE OF PERSONAL INFORMATION

3.1. We are committed to not disclosing your Personal Information to third parties, except in the following cases:

• 3.1.1. You have given explicit and specific consent for the disclosure of your Personal Information.
• 3.1.2. This is necessary for your use of the Service, or for the execution of our User Agreement or other binding documents that govern our relationship.
• 3.1.3. This is necessary for the operation of the Service and its functionality (e.g., transmission of information to hosting, communications and content delivery networks, data protection and cybersecurity services, billing and payment processing services, fraud detection and prevention services, web analytics, email distribution, and Service status monitoring, including performance measurement and data optimization, marketing, and advertising services). Third parties (recipients of Personal Information) may receive or otherwise have access to your Personal Information in full or in part, depending on the role and purposes of each such party in maintaining the Service's functionality or improving it. Third parties may only use the information obtained for the purposes specified in the Policy.
• 3.1.4. The transfer of Personal Information is carried out in accordance with the laws of Cyprus and international legislation in response to requests from authorized entities for such information (court orders and law enforcement requests), when we are obligated to disclose such information, provided we act in good faith, believing that the law requires us to do so.
• 3.1.5. There is a transfer of ownership or control of all or part of the Service to a new owner.
• 3.1.6. The transfer of Personal Information is carried out to ensure the protection of our rights and legitimate interests, or the rights and interests of third parties, in cases where you violate the Policy or other binding documents that govern our relationship or applicable laws. The above-mentioned cases should not be considered as unauthorized disclosure of personal information, as these actions are aimed at achieving the purposes of processing Personal Information.

3.2. Information may be transferred to third parties only in strict accordance with this Policy and the laws of Cyprus.

4. TERRITORY OF STORAGE AND TRANSBORDER TRANSFER OF PERSONAL INFORMATION

4.1. We store and process your Personal Information within the European Union. The storage and processing of your Personal Information are carried out either directly by us or with the help of third parties specializing in information storage. These parties are required to protect and safeguard the Personal Information in accordance with this Privacy Policy, the laws of Cyprus, and the General Data Protection Regulation (GDPR).

4.2. If you are located outside the European Union, by accessing or using the Service or otherwise providing us with your Personal Information, you consent to the processing and transborder transfer of your Personal Information to the territory of the European Union countries.

4.3. We will strive to protect your Personal Information to at least the same extent as required in your jurisdiction, provided that it does not violate the laws of Cyprus or the General Data Protection Regulation (GDPR).

5. YOUR RIGHTS REGARDING THE PERSONAL INFORMATION PROVIDED

5.1. Under this Policy, you have all the rights granted to you by the General Data Protection Regulation (GDPR), which include:

• 5.1.1. The right to access your Personal Information. To ensure this right, the Service provides a dedicated section in your account where all the personal information we have collected from you is listed. You can access this section at any time to review your information. Upon your request, we will provide a complete list of the Personal Information we have collected about you, the legal basis, the purposes of processing, categories of Personal Information, a list of third parties to whom the Personal Information has been or will be disclosed, the retention period of the Personal Information, as well as the security measures in place for Personal Information that are not confidential. A response will be provided within a reasonable time frame in accordance with the laws of Cyprus.
• 5.1.2. The right to rectification. At any time, you have the right to make corrections to your Personal Information through your account. If, for any reason, you encounter issues with correcting your Personal Information, you can send us a request, and we will make the necessary corrections within a reasonable period. Considering the purposes of processing, you have the right to provide only partial Personal Information, specifying only the mandatory types of Personal Information necessary for accessing the Service.
• 5.1.3. The right to withdraw consent for the processing of Personal Information. You have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. The Service provides the option to withdraw consent as easily as it was given. You can request the deletion of your account at any time, and we will delete it within a reasonable time after receiving the corresponding request. Please note that you can correct, update, or delete certain parts of your Personal Information on your own. When you make corrections to your Personal Information or withdraw consent for its processing, we will notify all third parties who have access to your Personal Information. Regardless of the withdrawal of consent for processing Personal Information and receiving a corresponding request for its deletion, we may continue processing certain Personal Information if required by the laws of Cyprus.
• 5.1.4. The right to erasure ("right to be forgotten"). You have the right to request, and we are obligated to delete your Personal Information without undue delay if:
• (a) the Personal Information is no longer necessary for the purposes for which it was collected;
• (b) the legal basis for processing the Personal Information is no longer valid (the consent for processing the Personal Information has been withdrawn);
• (c) the processing of Personal Information would violate your rights;
• (d) the Personal Information must be erased in accordance with the laws of Cyprus, the General Data Protection Regulation (GDPR), or the applicable laws in your jurisdiction.
• 5.1.5. The right to data portability. You have the right to receive your Personal Information in a structured, commonly used, and machine-readable format. To obtain all the Personal Information we have ever collected, you can send a corresponding request to our technical support service. You have the right to transfer your Personal Information directly from one controller to another, if technically feasible.

6. USE OF TRACKING TECHNOLOGIES

6.1. We use certain tracking technologies (cookies) to maintain, ensure, and continuously improve the operation of our Service, as well as to enhance your experience while using the Service. By default, we use several such technologies for authentication, session management, security, saving your preferences (such as default language and settings), connection stability, monitoring Service performance, marketing campaigns, and for providing and improving the Service.

7. STORAGE PERIOD OF PERSONAL INFORMATION

7.1. We retain your Personal Information for the duration of your use of the Service (the active period of your account) or until it is no longer needed for providing the Service, or until a longer retention period is established (if we are required to retain it longer due to Cyprus law or for resolving disputes with our users, preventing fraud and abuse, and/or protecting our legitimate interests).

8. INFORMATION SECURITY

8.1. We take all necessary and sufficient organizational and technical measures, in accordance with Cyprus law, to protect your Personal Information from unauthorized or accidental access, destruction, alteration, blocking, copying, distribution, and other unlawful actions by third parties. In our operations, we use widely recognized industry standards to protect data. The protection of Personal Information is implemented by default at the design level of the Service during its development. Security measures include firewall protection, data encryption, data minimization, system resilience to failures, the ability to restore availability and access to Personal Information in case of physical or technical incidents, physical access control to data centers, and access control to data. We regularly monitor our systems for potential vulnerabilities and attacks, assess the effectiveness of technical and organizational measures for ensuring the security of Personal Information, and continuously seek new ways and service providers to further enhance the security of our Service and protect the privacy of our users. All third parties who have access to Personal Information and are involved in providing access to the Service adhere to security measures for protecting Personal Information that are at least as stringent.

8.2. We cannot guarantee absolute security, and therefore, we encourage you to exercise caution, set a strong password for your account, and avoid providing any sensitive information whose disclosure could cause you significant harm.

8.3. In the event of any breach of personal information confidentiality, we take all necessary measures to eliminate or minimize potential negative consequences, as well as ensure immediate notification of you and the relevant supervisory authorities, providing all available information about the breach. Such incidents are recorded in a special incident log, which we are required to maintain in accordance with the General Data Protection Regulation (GDPR).

8.4. A breach of personal information confidentiality, as defined in this Policy, refers to a security incident that results in the unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal information that we process.

9. AMENDMENT AND INTERPRETATION OF POLICY

9.1. Policy, its interpretation, and any claims or disputes related to it are governed, construed, and enforced exclusively in accordance with the laws of Cyprus and the General Data Protection Regulation (GDPR).

9.2. By this, you agree that any disputes arising shall be resolved exclusively by the courts in the location of our residence, in accordance with the procedures established by the laws of Cyprus.

9.3. We reserve the right to amend the Policy at any time. If we deem the changes to be significant (at our sole discretion), we will notify you before the changes take effect. In other cases, we are not obligated to provide such notice.

9.4. We recommend that you periodically review this page for the most up-to-date information on our Policy. Unless otherwise explicitly stated, our most recent version of the Policy applies to all information we hold about you.

10. INTERACTION WITH US AND RESPONSES TO YOUR INQUIRIES

10.1. If you have any questions or notices regarding this Policy and the use of your Personal Information, please contact us through the designated form or via email at [email protected].

10.2. You can also send a letter to our address: Vasili Michailidi 9, 3026 Limassol, Cyprus.

10.3. We will respond to your inquiry within a reasonable time frame, but no later than the period specified by applicable law.

10.4. In cases where the Policy or applicable law imposes an obligation on us to provide you with copies of information or documents, we will provide them in a single copy, subject to your reimbursement of the costs for preparation and delivery of these documents. If you make the request electronically, and unless otherwise specified by you, we will provide the response in a widely used electronic format at our discretion.

10.5. If we reasonably believe that your requests are unjustified or excessive, particularly due to their repetitive nature, we reserve the right to refuse to act on the request.

10.6. If we have reasonable doubts regarding the identity of the person making the request, we may ask for additional information necessary to verify the identity of the requester.