Privacy Policy

1. Introduction

This Privacy Policy applies globally to all applications, websites (including the dutyfreedynamics.com website referred to herein as the “Site”), and the online, connected tv and mobile advertising and data services (collectively, the “Services”) offered by Duty Free Dynamics and its affiliates (“Duty Free Dynamics” or “we”). We developed this Privacy Policy to describe how we collect, use and disclose information from and about you. If you do not agree to every provision of this Privacy Policy and the related terms of service, you should not access or use the Sites or the Services.

This Site and the Services offered by Duty Free Dynamics are for a general audience, are not targeted to children, and we do not knowingly collect personal information from children under 13 years of age. This Privacy Policy applies to Duty Free Dynamics’s collection and use of your Personal Data.

Personal Data includes data such as:

• Your first and last name;
• Email address;
• Unique online identifiers (e.g., cookie IDs);
• Device identifiers (e.g., IDs for mobile advertising); and
• Location data (e.g., latitude and longitude).

Data that does not contain any information that can be used to identify you or has otherwise been anonymized or aggregated is considered “Non-Personal Data.”

Duty Free Dynamics is committed to handling your personal data with care and honoring your privacy rights.

2. Collection of Information

Duty Free Dynamics collects data directly from you when you provide it to us, automatically as you navigate through the Site, or we receive it from our third parties as part of the Services. Duty Free Dynamics may collect the following information from and about you:

Site Contact Information. Information you may submit to the Site, for example, to obtain information about our services. Contact information may include, for example, name and email address.

Site Activity Information. When you access and interact with the Site, Duty Free Dynamics and our service providers may collect certain information about those visits. For example, in order to permit your connection to the Site, our servers receive and record information about your computer, device, and browser, including potentially your IP address, browser type, authentication identifiers, and other software or hardware information. If you access the Site from a mobile or other device, we may collect a unique device identifier assigned to that device, geolocation data, or other transactional information for that device in order to provide the Site to it.

Cookies and other tracking technologies (such as browser cookies or pixels), which are comprised of small bits of data that often include a de-identified or anonymous unique identifier may also be used. Websites, apps and other services send this data to your browser when you first request a web page and then store the data on your computer or other device so the website, app or other service can access information when you make subsequent requests for pages from that website, app or other service. These technologies may also be used to collect and store information about your usage of the Site, such as pages you have visited, the videos and other content you have viewed and advertisements you have seen. Cookies and other tracking technologies may also be used by us or by our service providers to collect and store information on your use of other companies’ websites or services, such as sites you visit and materials you view. We may merge this with other data we collect about you from third parties to assist us in our ability to provide the Site, including, without limitation, to advertise and provide content to you.

Third parties that provide services to Duty Free Dynamics, such as allowing you to share content or tracking aggregate Site usage statistics, may also use these technologies to collect similar information when you use the Site or third party services. Duty Free Dynamics does not control these third party technologies and their use is governed by the privacy policies of third parties using such technologies.

Data From Third Parties. We also receive other data (e.g., demographic information and digital identifiers) from third parties or through analytical techniques that we combine with the data we collect or derive through the Services. We also may receive data from third parties including:

• Business Partners, Developers & Enterprise Customers: This includes third parties who create and deliver experiences using our services, such as the incorporation of our technology (i.e., SDK or APIs) into their apps and websites. In some cases, these third parties may license data to us.
• Data Suppliers and/or Brokers and Advertising Networks: This includes third parties who provide us commercially available data, including demographic data, data about how you interact with a third party’s websites, apps, smart TVs and streaming devices, device data (including mobile device and advertising identifiers, such as Apple IDFA or Google Advertising ID, and location data), and information from cookies, pixels and other similar technologies.
• Duty Free Dynamics Service Providers: This includes third parties who specialize in providing enterprise data, analytics and software as a service. This data tends to be aggregated, pseudonymized or otherwise de-identified.

Information from Other Sources. We also combine and bundle data collected from these different sources, as well as from Duty Free Dynamics affiliates, and create inferences in order to deliver, maintain, and personalize our services, and to operate our business. You can learn more about Duty Free Dynamics’s data collection, including categories, examples and sources, in the chart below.

Data Category	Data Examples	Data Source
Contact Data	Name, email address, phone number, date of birth, address, and other similar contact data.	You Choose to Provide
Demographic Data	Gender, age, preferred language, income brackets, occupation, educational status, marital status or other similar information about you.	You Choose to Provide / Data From Third Parties
Geolocation Data	If you opt-in to sharing your precise or approximate location, we receive data about your location whenever you use apps or visit websites incorporating our services.	You Choose to Provide
Online Activity Data	Internet and other electronic network activity data, or data regarding your interaction with websites or advertisements (or those of third parties), and viewing information connected TVs. This data may come from cookies, pixels, web beacons, and/or other technologies. You can control certain types of cookies through your browser settings or other tools.	Automatically Collected / Data from Third Parties
Device Data & Identifiers	Unique device identifiers (e.g., mobile device advertising identifiers (such as Apple IDFA or Google Advertising ID), or connected/smart TV or streaming device identifiers, device model, operating system and version, sensor data, language, and wireless network, device name, types of mobile apps installed, or other identifiers such as hashed email addresses.	Automatically Collected / Data From Third Parties

When we collect data, we rely on several legal bases, these include:

• Contract Performance. When the processing is necessary to perform our contract with you.
• Legitimate Interests. When the processing is necessary for our legitimate business interests (or those of our enterprise customers).
• Consent. When you have given us your consent, including as described in this Privacy Policy.
• Legal Obligation. When we have a legal obligation to do so, as described in this Privacy Policy.

3. Use and Sharing

We may use the personal information and other information we collect from and about you for the following purposes:

To provide and manage the Site. Duty Free Dynamics and our service providers use the information we collect from and about you to provide the Site and features to you, including, for example, to measure and improve the Site and its features. We may also use aggregated or anonymous data about your use of and activity on the Site to assist us in this regard.

To allow service providers to assist us in providing and managing the Site. Duty Free Dynamics may make the information we collect from and about you available to certain third-party service providers, such as contractors, analytics and other measurement companies, agents or sponsors, who help us analyze and understand your use of the Site and manage and/or provide the Site.

To contact you. Duty Free Dynamics may periodically send promotional materials or notifications related to the Site to the email address you may have provided to us. If you want to stop receiving such promotional materials, please send an email to info@dutyfreedynamics.com.

Product & Service Development. We conduct data analytics and use automated processing, artificial intelligence and machine learning to support internal research, create new products and services, improve functionality of existing products and services, and develop new features such as those developed to enhance security and protect privacy. We use your data, along with inferences that we derive from your data, to offer products and services to developers, our partners and enterprise customers. These product and service offerings include the following:

• Visits: When you opt-in to the collection and sharing of geolocation data from your mobile device, we use that data to create an inferred visit to a public location (“Visits”).
• Audiences (Segments): Using our Visits, along with inferences about your interests, location and other demographics that we derive from the data we have about you, we create “Audiences.” Audiences are then used to send you advertisements tailored to your interests.
• Points of Interest (POI): POI data relates to physical places (restaurants, shops, airports, hotels, etc.) and is used to identify and provide context to points of interest worldwide. This data is typically Non-Personal Data.

Sharing with Your Consent or at Your Direction. We share your personal data with your consent or as necessary to complete any transaction or provide any product you have requested or authorized.

Sharing with Affiliates. We share data with other Duty Free Dynamics affiliates for the purposes outlined in this Privacy Policy.

Sharing with Service Providers & for Business Purposes. We share your data with service providers that perform services on our behalf, such as cloud storage, IT services, marketing, analytics and search engine and other software services.

Sharing with Enterprise Customers. We share data with enterprise customers that, for example, may use “Visits” combined with data that they collect to understand movement patterns to determine where to open a physical store, to conduct analytics, to serve targeted ads, and to determine whether an online or offline advertisement you were exposed to resulted in a visit to a physical store. Under certain privacy and data protection laws, this activity may be considered a “sale” of personal data.

Sharing with Advertising Partners. We may share data such as your mobile advertising identifier with advertising partners (including the ad networks, ad-serving companies and other service providers they may use) so that they may recognize your devices and deliver interest based content and advertisements to you. Under certain privacy and data protection laws, this activity may be considered a “sale” of personal data.

Sharing for Corporate Transactions. We may also share data as part or in anticipation of a business sale, merger, consolidation, investment, change in control, transfer of substantial corporate assets, reorganization, liquidation, or similar business transaction or corporate event.

4. Security

Duty Free Dynamics uses commercially reasonable administrative, technical, personnel and physical measures to safeguard information in its possession against accidental loss, theft and unauthorized access, use, disclosure or modification. Although we do our best to protect your information, no one can guarantee the complete safety of your information.

5. User Choices, Access and Control

We strive to provide you with choices regarding the personal information you provide to us through the Site. We have created mechanisms to provide you with the following control over your information:

• Access, Correction, or Deletion. If you would like to access, review, correct, update, suppress, or otherwise limit our use of your personal information you have previously provided directly to Duty Free Dynamics, you may do so by contacting us via email at info@dutyfreedynamics.com. In your request, please include your name and specify clearly what information you would like to access, change, update and/or whether you would like to have your personal information suppressed from our database, or if you have other questions about your personal information.
• Tracking Technologies and Advertising. Most browsers are initially set to accept cookies, but you can change your settings to notify you when a cookie is being set or updated, or to block cookies altogether. Please consult the “Help” section of your browser for more information. Users can manage the use of Flash technologies, with the Flash management tools available at Adobe’s website. Please note that by blocking any or all cookies you may not have access to certain features, content or personalization available through the Site.
• Promotional Offers from Duty Free Dynamics. If you do not wish to have your email address or other contact information used by Duty Free Dynamics to promote our own or third parties’ products or services, you can opt-out by sending us an email stating your request to info@dutyfreedynamics.com. If we have sent you a promotional email, you may send us a return email asking to be omitted from future email distributions. This opt out does not apply to information provided to Duty Free Dynamics as a result of a product purchase, warranty registration, product service experience or other transactions.

6. Data Retention

To the extent permitted by applicable law, we keep the personal data you provide for the purposes indicated in this Privacy Policy for the duration of our legitimate business purposes or to comply with the applicable statute of limitations periods and other applicable laws or legal considerations. You may ask us to delete that information by following the instructions in “Access, Correction, or Deletion” section.

7. Other Important Information

Means of Notice and Choice. This Privacy Policy is the primary means by which Duty Free Dynamics provides you with notice and choice regarding its collection and use of your personal information.

Updates to Privacy Policy. Duty Free Dynamics may modify this Privacy Policy from time to time. Please look at the Effective Date at the top of this Privacy Policy to see when this Privacy Policy was last revised. Any changes to this Privacy Policy will become effective when we post the revised Privacy Policy on the Site.

Location of Data. The Site is hosted in and managed from the United States. If you are a user located outside the United States, you understand and consent to having any personal information transferred to and processed in the United States. United States data protection and other relevant laws may not be the same as those in your jurisdiction. This includes the use of cookies and other tracking technologies as described above. As a result, please read this Privacy Policy with care.

Linked Services. The Site may also link, or be linked, to sites operated by unaffiliated companies, and may carry advertisements or offer content, functionality, games, newsletters, contests or sweepstakes, or applications developed and maintained by unaffiliated companies. Duty Free Dynamics is not responsible for the privacy practices of unaffiliated companies, and once you leave the Site via a link, enable an unaffiliated service or click an advertisement you should check the applicable privacy policy of the unaffiliated service.

In addition, Duty Free Dynamics is not responsible for the privacy or data security practices of other organizations, including but not limited to any other app developer, app provider, social media platform provider, operating system provider, wireless service provider, or device manufacturer, including in connection with any information you disclose to other organizations through or in connection with the Site.

Sensitive Information. We ask that you not send us, and you not disclose, any sensitive personal information (such as social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, criminal background or trade union membership) on or through the Site or otherwise.

8. California Rights

California residents have certain rights with respect to the personal information collected by businesses. If you are a California resident, you may exercise the following rights regarding your personal information, subject to certain exceptions and limitations:

• The right to know the categories and specific pieces of personal information we collect, use, disclose, and sell about you, the categories of sources from which we collected your personal information, our purposes for collecting or selling your personal information, the categories of your personal information that we have either sold or disclosed for a business purpose, and the categories of third parties with which we have shared personal information;
• The right to request that we delete the personal information we have collected from you or maintain about you.
• The right to opt out of our sale(s) of your personal information. Please note that if you opt out of certain types of sales, we will be unable to provide you with the services that rely on such sales.
• The right not to receive discriminatory treatment for the exercise of the privacy rights conferred by the CCPA.

To exercise any of the above rights, please contact us and submit the required verifying information.

Shine the Light. California’s “Shine the Light” law (Civil Code Section § 1798.83) permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please send an email to info@dutyfreedynamics.com.

9. GDPR Privacy Policy

As used in this Section 9, the following capitalized terms have the following ascribed meanings:

“Controller” means a person or organization that, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.

“Customer” means a business that has, formerly had, or is contemplating purchasing or using our Services, or any party that is employed by such business and accesses Services pursuant to such business purchasing or using our Services.

“GDPR” means the EU General Data Protection Regulation 2016/679.

“Personal Data” means any information relating to an identified or identifiable natural person.

“Process” and “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automated means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure or dissemination, and erasure or destruction.

“Processor” means a person or organization that engages in Processing.

“Representative” means an individual who (i) acts on behalf of, or is employed by, a Customer, including, a Customer’s employees, agents, and representatives, (ii) acts on behalf of a Service Provider, including, a Service Provider’s employees, agents, and representatives, (iii) acts on behalf of a business partner, including a business partner’s employees, agents, and representatives or (iv) otherwise interacts with us in any manner, for example through our Website or uses our Services, in any manner whatsoever.

“Service Provider” means a supplier, subcontractor, vendor, or other third party who provides services to us.

“Services” means the products and services provided by us, including, but not limited to, cloud-based or mobile application services and trainings, data analytics services, and any other software and services that we may make available from time to time.

“Website” means all of the websites and applications maintained by us that display a link to the Privacy Policy.

This GDPR Privacy Policy applies to the Processing of Personal Data by Duty Free Dynamics in its role as a Controller, or as otherwise covered by the GDPR, when individuals:

• visit or use our Website;
• interact with us either on your own behalf or on behalf of a Customer in connection with the provision of our Services;
• interact with us on behalf of a Service Provider in connection with the products and services our Service Provider provides to us;
• interact with us on behalf of a business partner in connection with our relationship with the business partner;
• apply to work with us;
• receive marketing communications from us; and/or
• interact with us by registering for, attending and/or otherwise taking part in our trade events, webinars, or conferences or communicate with us via email, phone, or in-person interactions.

This GDPR Privacy Policy does not apply to any Personal Data Processed, stored, or hosted by Customers using any of our Services or to the extent that we Process Personal Data in the role of a Processor on behalf of our Customers. Where we act as Processors on behalf of our Customers, that Processing is subject to the protections contained in our data processing agreements with Customers. We have no control over, and are not responsible for, any Personal Data that our Customers may store or host on their equipment or otherwise process while using our Services. We are not responsible for the privacy or data security practices of our Customers, which may differ from those set forth in this GDPR Privacy Policy. For information related to how our Customers Process Personal Data, please contact the respective Customer directly.

Furthermore, this GDPR Privacy Policy does not apply to any third-party website or service that may be linked to the Websites or the Services unless that website or service is controlled by us and displays this GDPR Privacy Policy. We have no control over, and are not responsible for, the data collection and/or handling practices of these third-party websites or services outside our Websites or Services. We encourage you to read the privacy statements of any third-party websites or services linking to (or linked to via) the Website or Services. In the event of a conflict between this GDPR Privacy Policy and the remainder of the Privacy Policy this GDPR Privacy Policy will prevail.

Our Data Collection Practices

Duty Free Dynamics collects and processes the following categories of Personal Data from Customers, Service Providers, business partners, Representatives, Website Visitors, prospective employees, individuals that receive marketing communications from Duty Free Dynamics and individuals that interact with Duty Free Dynamics by registering for, attending and/or otherwise taking part in Duty Free Dynamics webinars or conferences or who communicate with Duty Free Dynamics via email, phone or in person, in each case to operate its business for the specific purposes identified below.

• Personal Details include data such as names, titles, company names, departments, email addresses, physical street addresses, telephone numbers, and social media usernames of individuals.
• Login Credentials include data such as usernames and passwords of individuals needed to access our Services.
• Unique IDs include data such as IP addresses and geolocation data that we obtain from (a) prospective employees, (b) Website Visitors, or (c) other individuals that interact with us.
• Customer Support Records include data such as call details and other similar data regarding customer support communications and chat sessions with Representatives.
• Website and Service Records include data related your interactions with our Websites and Services and other online content such as log data (i.e., preferences and settings, IP addresses, technical information about the device used to visit the Websites or use the Services, and geolocation information) and traffic data (i.e., pages viewed, date stamps, time spent on a page, click through and clickstream data, queries made, search history, search results selected, comments made, type of service requested, and purchases made).
• Employment Information includes details such as descriptions of roles performed and locations of employment.

Why Does Duty Free Dynamics Collect Personal Data, What are the Sources, the Purposes for Processing, and the Lawful Basis?

The table below sets out the types of Personal Data Duty Free Dynamics Processes, the purposes of Processing such Personal Data, and Duty Free Dynamics’s lawful basis for doing so. The lawful basis will vary with the type of Processing involved and will typically include Processing (i) necessary for Duty Free Dynamics to pursue its legitimate business interests, (ii) based on your consent, where this is required by data protection laws, and (iii) necessary for Duty Free Dynamics to comply with its legal obligations. Where we rely on our legitimate business interests, we have explained what the grounds are for that reliance.

Duty Free Dynamics’s Purpose of Processing Personal Data	Duty Free Dynamics’s Lawful Basis for Collecting Personal Data
To interact with Customers, Service Providers and business partners. When a Customer places an order for our Services, Duty Free Dynamics Processes the Categories of Personal Data necessary to deliver and provide Services to its Customer. Duty Free Dynamics also collects and Processes such Personal Data when engaging with and purchasing products and services from Service Providers or business partners. Personal Details, Login Credentials, Unique IDs	Duty Free Dynamics has a legitimate business interest in processing Personal Data in order to engage in transactions with its Customers, Service Providers and business partners and efficiently run its business.
To aggregate data provided by users of the Services for Customers. As part of the Services provided to Customers, Duty Free Dynamics aggregates and anonymizes Data provided by Customers and creates reports using such Data. Personal Details, Login Credentials, Unique IDs	Duty Free Dynamics has a legitimate business interest in processing Personal Data in order to engage in transactions with its Customers and efficiently run its business.
To manage the security of our systems or Services. In order to grant a Customer, Service Provider, business partner or prospective employee access rights to our systems or Services and to monitor applicable security thereof, Duty Free Dynamics collects and Processes the following categories of Personal Data from the Representatives or the prospective employee: Personal Details, Unique IDs, Access Credentials and Visitation Records	Duty Free Dynamics has a legitimate business interest in protecting the security of its systems and Services.
To provide customer and technical support. Duty Free Dynamics collects and Processes the following categories of Personal Data to provide Customers and their Representatives with technical and general support: Personal Details, Login Credentials, Unique IDs, Customer Support Records	Duty Free Dynamics has a legitimate business interest in being able to provide its Customers with customer and technical support.
To communicate and respond to requests and inquiries. When a Customer, Service Provider, business partner or other person or entity contacts us by email, phone, text or by submitting a contact form on our Website, Duty Free Dynamics collects and Processes the following Categories of Personal Data in order to communicate and respond to their requests and inquiries. Duty Free Dynamics also collects this Personal Data from Representatives who register for a trade event, webinar, conference: Personal Details, Unique IDs, Website Records, Marketing and Event Records	Duty Free Dynamics has a legitimate business interest in being able to communicate with its Customers, Service Providers, business partners and other persons or entities and respond to their inquiries and requests.
To market our Services and tailor our marketing and sales activities. Duty Free Dynamics may Process the following categories of Personal Data when marketing new and existing Services and features and in an effort to personalize such experience. It also collects this Personal Data from Representatives who register for a trade event, webinar, or conference: Personal Details, Unique IDs, Website Records, Marketing and Event Records	Except in cases where opt-in consent is required by law for the processing of email addresses, IP addresses or other unique identifiers to send or process electronic communications (emails, texts, cookies, etc.), Duty Free Dynamics processes this data for marketing purposes on the basis of its legitimate interests.
To analyze, improve, and optimize the use, function and performance of our Website and Services. Duty Free Dynamics may Process the following categories of Personal Data for quality assurance and training purposes, as well as for marketing and sales campaigns. Personal Details, Unique IDs, Website Records, Marketing and Event Records	Duty Free Dynamics has a legitimate business interest in improving and optimizing the use of its Website and Services.
To comply with applicable laws, regulations and internal policies. Duty Free Dynamics may be required to disclose certain categories of Personal Data to comply with applicable laws and regulations, for example, to respond to a request from a government agency or to defend a legal claim, and when conducting internal audits and investigations.	Duty Free Dynamics has a legitimate business interest in complying with all applicable laws, regulations, and internal policies.
To receive applications for employment. Duty Free Dynamics may Process the following categories of Personal Data when receiving, reviewing, using, and storing applications for employment: Personal Details, Login Credentials, Unique IDs, Education and Work History	Duty Free Dynamics has a legal obligation to collect certain information to confirm your right to work in the country to which you have applied. Otherwise, Duty Free Dynamics has a legitimate business interest in Processing the Personal Data of job applicants to assess them as candidates for employment.

Sharing with Third Parties

Except as described below, we will not share or disclose Personal Data with or to outside third parties. We may share Personal Data between each other. Any and all Personal Data provided to us by a Customer, Website Visitor, Business Partner, or other third party is transferred only on a “need to know” basis in keeping with the purposes outlined in this Privacy Policy.

Service Providers. We may share Personal Data with our Service Providers in connection with advertising, hosting, data analytics, information technology and infrastructure, order management and fulfillment, billing, contract management, email delivery, auditing, events, and other related activities. We provide such Personal Data or authorize the processing of such Personal Data only as necessary to enable our Service Providers to perform their designated functions. Our contracts with them (1) require them to act only under our instruction and for the purpose(s) directed by us with respect to such Personal Data; and (2) prohibit them from sharing such Personal Data with any third parties without our authorization.

Business Partners. We may also share your Personal Data with trusted business partners pursuant to our contractual arrangements with them, which will include appropriate safeguards to protect any Personal Data that we share with these partners. These may include, but are not limited to, third parties that organize tradeshows, third party consultants and experts, and auditors.

Affiliated Entities. We share Personal Data with our Affiliates. Subject to local requirements, this Personal Data may be used to provide Services offered by our Affiliates, for the Affiliates to provide support to the Affiliated entity that is sharing the Personal Data or for any other purposes described in this Privacy Policy. For example, Affiliates may share Personal Data about our Customers, Service Providers, business partners, Representatives, prospective employees, and Website Visitors for direct marketing purposes.

Fraud Prevention and Protection of Legal Rights. We may use and disclose Personal Data to the appropriate legal, judicial or law enforcement authorities and our advisors and investigators: (i) when we believe, in our sole discretion, that such disclosure is necessary to investigate, prevent, or respond to suspected illegal or fraudulent activity or to protect the safety, rights, or property of Duty Free Dynamics and of our Customers, Service Providers, business partners, Representatives, Website Visitors, prospective employees, or others; (ii) when we suspect abuse of the Website or Services or unauthorized access to any system, spamming, denial of service attacks, or similar attacks; (iii) to exercise or protect legal rights or defend against legal claims; or (iv) to allow us to pursue available remedies or limit the damages that we may sustain. We may disclose personal information to our partners, service providers, and law enforcement to secure our Website and Services, including to detect, prevent, and investigate security incidents or violations of our Terms of Use or applicable laws.

Law Enforcement. We may have to disclose the Personal Data of our Customers, Service Providers, business partners, Representatives, applicants, Website Visitors or others if a court, law enforcement or other public or government authority with appropriate competency requests that we provide that Personal Data and we believe, in our reasonable discretion, that such request was made in compliance with applicable law.

Corporate Reorganization. We may transfer the Personal Data of our Customers, Service Providers, business partners, Representatives, Website Visitors or others to a third party in the case of the reorganization, sale, merger, joint venture, assignment, transfer or other disposition of all or any portion of our business, asset or stocks, including in the event of bankruptcy or corporate restructuring. Except as otherwise provided by a bankruptcy or other court, the use and disclosure of all transferred Personal Data will be subject to compliance with applicable data protection laws. Any Personal Data that an individual submits or that is collected after the reorganization may be subject to a new privacy policy adopted by the successor entity, of which we will inform, where required.

Service Improvements. We may disclose personal information to our service providers in order to improve our Website and Services, such as to identify bugs, repair errors, or ensure that services function as intended, or conduct internal research and analysis to improve our technology.

In addition to the above, we also may disclose personal information to third parties at your direction.

Cross-Border Transfers

If we transfer EEA/EU/UK/Switzerland Personal Data to affiliates in the US, we will put in place appropriate intra-group agreements in accordance with the GDPR requirements, including use of the EU Commission-approved Standard Contractual Clauses for Controllers as appropriate. If we transfer EEA/EU/UK/Switzerland Personal Data to third parties, such as Service Providers or business partners in countries outside the EEA/EU/UK/Switzerland, we will put in place the EU Standard Contractual Clauses or other relevant international transfer documentation that complies with the GDPR requirements. We will also put in place a GDPR-compliant data processing agreement.

Data Retention

We will retain Personal Data that we collect and Process where we have a justifiable business need to do so and/or for as long as it is needed to fulfill the purposes outlined in this Privacy Policy. We may retain Personal Data as required by law, such as for tax, legal, or accounting purposes. When, in our reasonable discretion, we have no justifiable business need to Process your Personal Data (for example, after all of our necessary interactions have ended, our internal record keeping policies no longer require us to continue to Process your Personal Data, and we have no other legal obligations to retain your Personal Data), we will either delete it or anonymize it.

Data Subject Rights under the GDPR

The GDPR grants individuals who are in the EU/EEA/UK the following rights, with some limitations. Individuals may contact us, at our contact information as set forth herein to exercise any of those rights and we will respond with the requested action or information, or will let you know why such rights do not apply to you. These rights are not absolute and are subject to various conditions under applicable data protection and privacy legislation and the laws and regulations to which we are subject. In some cases, the exercise of these rights (for example, erasure, objection, restriction or the withholding or withdrawing of consent to processing) may make it impossible for us to provide services.

Right Not to Provide Consent or to Withdraw Consent. We may seek to rely on your consent in order to Process certain Personal Data. Where we do so, you have the right not to provide your consent, and the right to withdraw your consent at any time. If you withdraw your consent, this will not affect the lawfulness of the Processing conducted based on consent before its withdrawal.

Right of Access. You have the right to obtain confirmation as to whether or not we collect or Process Personal Data concerning you and, if this is the case, you have the right to request a copy of such Personal Data in digital format.

Right of Rectification. You have the right to require that we correct any inaccurate Personal Data concerning you, and that we complete incomplete Personal Data.

Right of Erasure. In certain circumstances, you have the right to request that we erase Personal Data concerning you; for example, if it is no longer necessary for the purposes for which it was originally collected and we do not otherwise have a legitimate reason to retain it. We may need to retain certain Personal Data when legally required, for internal, record keeping purposes, and/or in order to complete any transactions initiated prior to an individual’s request to remove or delete their Personal Data. Where we are unable to delete data from our systems, we will anonymize it so it will no longer be tied to your identity.

Right to Restrict Processing. In certain circumstances, you have the right to request that we restrict the Processing of the Personal Data that we have collected about you; for example, where you believe that the Personal Data that we hold about you is not accurate or lawfully held.

Right to Data Portability. In certain circumstances, you have the right to receive the Personal Data concerning you that you have provided to us in a structured, commonly used, machine readable format, and for us to transmit the data to another entity where technically feasible.

Right to Object to the Processing. In certain circumstances, you have the right to request that we stop Processing your Personal Data, including where we rely on legitimate interests as legal basis in the tables on the details of Processing provided above. If you receive commercial electronic communications from us, you can unsubscribe from the receipt of future commercial electronic communications from us by clicking on the “unsubscribe” link provided in such communications. Please also note that if you do opt out of receiving commercial electronic communications from us, we may still send you important administrative messages (such as updates about your account or changes in the Services), and you cannot opt out from receiving these messages, unless you stop receiving our Services.

Right Not to be Subject to Decisions Based Solely on Automated Processing that Produce Legal Effects. We do not make decisions based solely on automated processing — including profiling — that produces legal effects or similarly affects you.

Right to Complain to a Supervisory Authority. You have the right to lodge a complaint with a Supervisory Authority if you believe that our Processing of Personal Data relating to you is inconsistent with our obligations under the GDPR. In this situation, we ask you please consider contacting us first, so that we can try and assist with your query or address your concern.

To exercise any of your rights as set forth herein, please contact us in writing, via email or postal mail as indicated above, so that we may consider your request under applicable law. We may ask that you provide the following Personal Data for us to address your request speedily:

• The name, User ID, pseudonym, email address, or other identifier you have provided to us or if you have not otherwise previously interacted with us, your first and last name and an address where we can correspond with you;
• The country in which you are located;
• A clear description of the Personal Data or content you wish to receive or to be deleted or corrected, or the action you wish to be taken; and
• Sufficient information to allow us to locate the content or Personal Data to be deleted, removed, or corrected.

For your protection, we may only implement requests with respect to the Personal Data that are associated with the particular email address that you use to send us your request. In addition, please note that, depending on the nature of your inquiry, request, or complaint, we may need to verify your identity before implementing your request and may require proof of identity, such as in the form of a government issued ID and proof of your physical address. We will try to comply with your request as soon as reasonably practicable and in any case within the timelines prescribed by applicable laws. However, we reserve the right to refuse to act on a request that is manifestly unfounded or excessive (for example because it is repetitive) and/or, in some cases, to charge a fee that takes into account the administrative costs for providing the information or the communication or taking the action requested.

10. Contact Us

If you have questions about this Privacy Policy, please contact us via email at info@dutyfreedynamics.com.