Balu Privacy and Cookies Policy

This Privacy and Cookies Policy (“Privacy Policy”) explains how Balu Technologies GmbH (“Balu,” “we,” “us,” or “our”) collects, uses, and discloses your personal information and how we gather information through cookies and related technologies. It also describes your rights under applicable data protection laws and explains how you can access and update your personal information.

Unless otherwise stated, Balu acts as the data controller for the data processing operations described in this Privacy Policy.

We reserve the right to make changes to our practices and this Privacy Policy at any time. If we change the way we handle your personal information, we will update this Privacy Policy and notify you as appropriate.

This Privacy Policy addresses the following:

• INFORMATION THAT WE COLLECT ABOUT YOU
• USE OF COOKIES AND SIMILAR TECHNOLOGIES
• USES MADE OF YOUR PERSONAL INFORMATION AND OUR LEGAL BASIS FOR PROCESSING
• DISCLOSURES OF YOUR PERSONAL INFORMATION
• WITHDRAWING CONSENT OR OTHERWISE OBJECTING TO BALU'S DIRECT MARKETING
• EUROPEAN DATA PROTECTION RIGHTS
• INFORMATION PROCESSED AS PART OF THE USE OF BALU’S APPS AND PLATFORM
• MISCELLANEOUS

1. INFORMATION THAT WE COLLECT ABOUT YOU

Customers, Site Visitors, and End Users

Information Provided by You upon Registration and/or Making a Purchase

When you register for an account on a Site and/or purchase a Product subscription or service from us, we collect information that allows us to identify you, such as:

• Name
• E-mail address
• Address (where entered as part of a “business/location scan”)
• ZIP/Postal code
• Home phone
• Mobile phone
• Billing address
• Balu login details (username and password)

Information Provided When You Contact Us

We also collect personal information that you voluntarily provide to us when you contact us with a question or comment about our Products and services or sign up for product demonstrations. Typically, this includes:

• Name
• E-mail address
• Organization name
• Phone number
• Content of your communication

Automatically Collected Information

When you access our Sites and some of our Balu Products, we automatically collect:

• Technical information about your device, including your device’s internet protocol (IP) address
• Information about your visit (the referral URL, the content viewed, and the content interacted with)

Some of this information is collected using cookies and related technologies. See Section 2 for more detail. For additional detail on the information collected when you use Balu's platform that interacts with our Products, please see Section 8.

Information Collected in Connection with Our Products

Where our customers use our Products, we compile general statistical and other information related to the performance and operation of the relevant Products, for instance, from reviews collected from our third-party publishers including name/alias of reviewers. We use or share such information with our customers to:

• Provide our Products
• Conduct research and development
• Offer analytics, reports, and benchmarking about our Products (e.g. average location ratings or frequently used terms within the reviews)

We may also use such aggregated information for our own promotional purposes. Cookies and similar technologies may be used both on our Sites and our customer sites to collect some of this information (see Section 2 for more detail).

Information Collected from Other Third-Party Sources

We collect data from the following third parties, such as:

• Social media networks and advertising networks – Commercially-available data such as name, address, email address, and preferences
• Analytics Providers – Non-personal data, such as aggregated or de-identified demographic/profile data, from third-party sources including select partners and companies specializing in enterprise data, analytics, and software as a service

To ensure data accuracy and offer a superior customer experience with personalized services, content, marketing, and ads, we may link or combine information from these sources with the information we collect directly from you.

Partners, Publishers, and Other Service Providers

We will process certain contact information about individuals within organizations that we work with, such as publishers, mailing houses, payment providers, IT hosting and maintenance providers, and other service providers.

2. USE OF COOKIES AND SIMILAR TECHNOLOGIES

We use and allow select partners to use cookies, clickstream capture, pixels, web beacons, embedded scripts, and other similar technologies (collectively “Tools”) on our Sites, our Products, our Balu powered properties, and in our communications with you for the purposes outlined below or via our cookie consent management tool. Typically, these Tools will capture information about your device (including your IP address), your preferences, your visit to our Sites, our Products, and Balu powered properties, as well as your interactions with our communications. For further information, visit www.allaboutcookies.org.

When you visit some of our Sites (where required by applicable law), you have the option to accept, reject, or adjust most of the categories of Tools through our cookie consent management tool. You can modify these settings or withdraw your consent at any time at this link. Details of the cookies which we use (including third-party cookies and the partners with whom we may share your data) and their purposes are described via the link at the bottom of this webpage and as follows:

Performance Cookies

Aggregated data from these Tools may also be shared with our business partners. The type of information we collect includes how many visitors visit our Sites and Products, how many customers log in, when they visited, for how long, and which areas of our Sites, our Products, and services, but is generally not used to identify you individually.

Functional Cookies

We use these types of Tools to remember choices you make on our Sites or our Products (such as your preferred language or the region you are in) and provide enhanced, more personalized features on our Sites, our Products, and in our communications. These technologies are also used to provide content that aligns with your past behavior or interests.

How can you manage these Tools?

The length of time a cookie will stay on your browsing device depends on whether it is a “persistent” or “session” cookie. Session cookies will only stay on your device until you stop browsing. Persistent cookies stay on your browsing device after you have finished browsing until they expire or are deleted. The duration of other Tools varies depending on the type of Tool used. For instance:

• Tools that are “strictly necessary” are typically set to expire after no more than 12 months.
• Tools used for performance are typically set to expire after no more than 24 months.
• Targeting and social media Tools vary, with most expiring within 2-3 years.

You may be able to set your browser to block all cookies. For more information, please refer to your browser settings. Note that by disabling certain categories of cookies, you may be prevented from accessing some features of our Sites or certain content or functionality may not be available.

3. USES MADE OF YOUR PERSONAL INFORMATION AND OUR LEGAL BASIS FOR PROCESSING

In order to provide you with access to our Products, services, and other resources such as demos, providing certain personal information (e.g., contact information and name, log-in details) may be necessary to receive these services and resources. You may choose whether or not to receive electronic marketing communications from us, and we will only send you such communications where we have the appropriate consents to do so (to the extent required by applicable law). For more information on your choices, please see Section 5 below.

We process personal information through electronic and manual means for the following purposes:

Customers and Website Users

To fulfill a contract or to take steps linked to a contract. This includes:

• to administer access to your accounts;
• to onboard new customers;
• to manage our customer;
• to process orders and payments, perform fraud checks, and provide our Products and services, for which you have registered and any other Products or services you have requested, and send you service-related communications;
• for customer support purposes including responding to your queries and investigating any complaints about the Sites;

As required to conduct our business and pursue our legitimate interests, in particular:

• to provide our Products and services for which you have registered and any other Products or services you have requested;
• to enable accurate and high-quality sales, account management, and training;
• to analyze your use and measure the effectiveness of our Products, services, and Sites to better understand how they are being used so we can improve them and engage and retain customers;
• to send you information about Balu Products and services and similar information (where your consent is not required);
• to diagnose problems in our Products, services, and Sites;
• to administer our office and Sites and conduct identity verification;
• to detect, prevent, or otherwise address fraudulent, deceptive, or illegal activity and misuse of our Products, services, and Sites;
• to detect, prevent, or otherwise address security or technical issues relating to our offices, Products, services, and Sites (including the use of data loss prevention tools), as well as to protect against harm to the rights, property, or safety of Balu, our users, or the public;
• to send you information you have requested;
• for our own internal functions, management and corporate reporting, internal research and analytics, and to improve business efficiencies;
• to enforce compliance with our terms of use and other policies or otherwise in connection with legal claims, compliance, regulatory and investigatory purposes as necessary (including disclosure of such information in connection with government agency requests, legal process, or litigation);
• to create aggregate and statistical data (which cannot be used to identify you). For example, aggregate data may include data that describes the general demographics, usage, or other characteristics of a Site’s users. We reserve the right to transfer and/or sell aggregate or group data about a Site’s users for lawful purposes;
• to conduct surveys and market research about our customers, their interests, the effectiveness of our marketing campaigns, and customer satisfaction (unless we need consent to undertake such surveys, in which case we will only do this with your permission);
• if we merge with or are acquired by another company, your personal information will likely be disclosed to the prospective purchaser, our advisers, and any other prospective purchaser's advisers and will be one of the assets that is transferred to the new owner;

Where we process your information based on legitimate interests, you can object to this processing in certain circumstances. In such cases, we will cease processing information unless we have compelling legitimate grounds to continue processing, or where it is needed for legal reasons.

If legitimate interest is not an available legal basis in a particular jurisdiction, we will engage in the processing activities described above on a legal basis that is available in that particular jurisdiction.

Where required by applicable law, where you give us consent:

• to send you information about Balu Products and services, special offers, and similar information, and to share your information with third parties for their own marketing purposes (for example email marketing in some countries). For more information about how to modify your preferences about marketing communications, please see Section 5;
• to place cookies or similar technologies in our Products, Sites, and email communications in accordance with Section 2, Use of Cookies and Similar Technologies, above, and the information provided to you when those technologies are used;
• on other occasions where we ask for your consent, for the purpose we explain at the time.

As required by law:

• In response to requests by government or law enforcement authorities.

Partners, Publishers, and Other Service Providers

We use contact information about individuals within other organizations that we work with in order to fulfill our contractual obligations or as required to conduct our business and pursue our legitimate interests, including for our own internal functions such as management, marketing and publicity, corporate reporting, and record keeping.

4. DISCLOSURES OF YOUR PERSONAL INFORMATION

We will share your personal information with the third parties listed below for the purposes that are described in this Privacy Policy or otherwise with your consent.

Service Providers & Partners

We engage service providers or partners to manage or support certain aspects of our business operations on our behalf. These service providers or partners may be located in the EU or in other global locations and may provide services such as:

• Product delivery
• Advertising and marketing activities (including digital and personalized advertising)
• IT services
• Email service providers
• Data hosting
• Management or support of our Sites

Our service providers and partners are required by contract to safeguard any personal data they receive from us and are prohibited from using the personal data for any purpose other than to perform the services as instructed by Balu.

Legal Requirements

We disclose personal information to government authorities or other third parties if required to do so by law or in the good faith belief that such action is necessary to:

• Comply with a subpoena, court order, or similar legal obligation;
• Protect and defend our rights or property;
• Act in urgent circumstances to protect the personal safety of users of any Site or the public;
• Protect against legal liability;
• Investigate fraud or other unlawful activity; or
• As otherwise required or permitted by law.

Business Transfers

As we develop our business, we might sell or buy businesses or assets. In the event of a corporate sale, merger, reorganization, dissolution, or similar event, including in bankruptcy, your personal information may be part of the transferred assets. You will be notified via email and/or a prominent notice on our Sites of any change in ownership or uses of your personal information, as well as any choices you may have regarding your personal information.

Publishers

If requested, we provide personal information on behalf of our customers to third-party publishers (e.g., Google) that we work with. For example, if a customer has provided one of its employees’ name, contact details, biography, and/or job title to be published on a third-party publisher’s website.

5. WITHDRAWING CONSENT OR OTHERWISE OBJECTING TO BALU'S DIRECT MARKETING

Where we rely on consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes, such as those set out above in Section 3. You have the absolute right to opt out of our direct marketing at any time.

To stop receiving newsletters or marketing communications from us, you can use the unsubscribe mechanism in the relevant communication or send an email to [email protected] with information necessary to process your request.

Please note that this will not stop you from receiving service-related messages (i.e., non-marketing communications) such as email messages to let you know our service has been suspended for maintenance.

6. EUROPEAN DATA PROTECTION RIGHTS

You may have the right to ask us for a copy of your personal data, to correct, delete, or restrict processing of your personal data, and to obtain the personal data you provide to us in a structured, machine-readable format. In addition, you can object to the processing of your personal data in some circumstances (in particular, where we are not required to process such data to meet a contractual or other legal requirement).

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, as described above. You can obtain information on any of our balancing tests by contacting us using the details below.

These rights may be limited, for example, if fulfilling your request would reveal personal data about another person, or if you ask us to delete information that we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are set out in applicable data protection laws. We will inform you of the relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, please email [email protected] with the information necessary for us to process your request. Note that we may need to request additional information from you to verify your identity or understand the scope of your request.

If you deactivate your account, we will delete, block, or anonymize your personal information so that it is no longer possible to identify you, subject to our retention policy below.

If you have provided a review to one of our customers, please contact that customer directly if you have any questions about their privacy practices, wish to stop receiving communications from that customer, or wish to exercise your rights in respect of personal data processed by that customer.

7. INFORMATION PROCESSED AS PART OF THE USE OF BALU'S PLATFORM

This Section 8 provides additional details concerning the information Balu processes about persons who log in and use the platform operated by Balu that interact with our Products (“Product Users”). This Section also describes how Balu is processing this information, the purposes for which this information is processed, and how Product Users can request for their information to be deleted.

Product User Information Processed by Balu

When you are a Product User, we collect information that allows us to identify you, including:

• Balu login details (username and password)
• Organization name
• Technical information about your device, including your device’s internet protocol (IP) address
• Information about your visit (the referral URL, the content viewed, and the content interacted with)

We may also obtain some Product User information from third-party publishers (e.g., Meta), such as access tokens.

How Balu is Processing Product User Information

In addition to processing Product User information as described above in this Privacy Policy, Balu processes Product User information obtained from third-party publishers (e.g., Meta) to integrate with our Products in order to make our Products work seamlessly. We may also share some Product User information with third-party publishers to provide our Products and services.

Purposes for which Product User Information is Processed

Balu processes Product User information to conduct our business and pursue our legitimate interests, including to provide our Products and services for which you or your organization have registered.

Requesting Deletion of Product User Information

To request the deletion of Product User information, please email [email protected].

Please note that we may need to request additional information from you to verify your identity or confirm the scope of your request.

As a Product User, in addition to deletion, you may also have other rights in relation to your personal information; see Section 6.

8. MISCELLANEOUS

Third-Party Websites and Services

The Sites may contain links to third-party owned and/or operated websites or utilize third-party services. We are not responsible for the privacy practices or the content of such websites or services. Please contact these third parties directly for information regarding their privacy practices prior to providing them with any information. Parts of the Sites utilize YouTube API Services. These YouTube API Services are subject to the privacy practices currently found at https://www.youtube.com/t/terms.

Some of our Products are integrated into our customers’ own websites, applications, and communications (“Customer Solutions”). Where this is the case, we do not interact directly with the ultimate end user of these Customer Solutions, and the customer will be responsible for the operation of these Customer Solutions and any personal information collected in connection therewith. We are not responsible for the processing of personal information by these Customer Solutions, save to the extent that we receive any personal information via these Customer Solutions on behalf of the customer in order to fulfill the Product and service requests. In these cases, we will act as a data processor, and this Privacy Policy will not apply to such personal information. Please contact the relevant customer directly if you have questions regarding their data collection practices or any communications you may receive from them.

Security

We take commercially reasonable steps to protect personal information from loss, misuse, unauthorized access, disclosure, alteration, and destruction. However, no Internet or e-mail transmission is ever fully secure or error free. In particular, e-mail sent to or from a Site may not be secure, and you should therefore take special care in deciding what information you send to us via e-mail. Please keep this in mind when disclosing any personal information to us or to any other party via the Internet. When you enter sensitive information on our order forms or login credentials (such as username and password) on our platform login, we encrypt the transmission of that information using secure socket layer technology (SSL).

Retention

We will retain your information for as long as your account is active or longer if needed to provide you services and our Products, comply with our legal obligations, resolve disputes, or enforce our agreements. Retention periods will be determined taking into account the type of information that is collected and the purpose for which it is collected, bearing in mind the requirements applicable to the situation and the need to destroy outdated, unused information at the earliest reasonable opportunity. For instance, in respect of data held for the management of customers and prospects, we consider the lead time necessary to develop and maintain our commercial relationships and how recent our interactions are with you. We may rectify, update, or remove incomplete or inaccurate information at any time and at our own discretion. For more information on our retention periods, you can contact [email protected].

Minors

Visitors under 18 years of age are not permitted to use and/or submit their personal information on any Site. We do not knowingly solicit or collect information through our Sites from visitors under 18 years of age. We encourage parents and guardians to spend time online with their children and to participate and monitor the interactive activities of their children.

Data Controllers and Contacting Us

The relevant controller for your information is set out below. Our “contact us” page contains e-mail links that allow you to contact us directly with any questions or comments that you may have. If you have any questions about this Privacy Policy or our privacy practices or to make a complaint about our compliance with applicable privacy laws, please feel free to contact us at [email protected] or at the relevant affiliates below. Where more than one entity is listed, please send your query to [email protected].