Privacy policy

Last updated on February 14, 2024

At XX.Operator PSA (“XX,” “we,” “us”), we treat your privacy like our greatest treasure and maintain full transparency—we want you to have a clear picture of how we collect, use, and share your data. This Privacy Policy is our roadmap—it shows you where your data travels and how you can influence that journey. Embrace your data as your rights—because ultimately, you have control!

Unless we provide a link to a different policy or state otherwise, this Privacy Policy applies when you visit or use XX’s websites, mobile applications, APIs, or related services (the “Services”). It also applies to potential corporate customers in the form of legal entities.

By using the Services, you agree to the terms of this Privacy Policy. You should not use the Services if you do not agree with the terms of this Privacy Policy and any other agreements that govern your use of the Services.

What Data We Obtain
1.1 Data Provided to Us by You
1.2 Data Collected by Automated Means
1.3 Data from Third Parties
How We Obtain Data About You
2.1 Cookies and Data Collection Tools
2.2 Why We Use Data Collection Tools
How We Use Data
Who We Share Data With
Security
Your Rights
6.1 Your Choices About the Use of Your Data
6.2 Accessing, Updating, and Deleting Personal Data
6.3 Our Policy for Children
Jurisdiction-Specific Rules
7.1 Users in California
7.2 Users Who Reside in Nevada
7.3 Users Who Reside in Australia
7.4 Users in the European Economic Area (EEA) and the United Kingdom (UK)
7.5 Data Privacy Framework Regulations (for EU/EEA, UK, and Swiss Data Subjects)
7.6 Users Outside the United States
Updates and Contact Information
8.1 Changes to This Privacy Policy
8.2 Interpretation
8.3 Questions

1. What Data We Obtain

We collect some data directly from you, such as information you enter yourself, data about your content consumption, and data from third-party platforms that you link to XX. We also collect some data automatically, such as information about your device and how you interact with or spend time in various parts of our Services. All data listed in this section is subject to the following processing activities: collection, recording, structuring, storage, alteration, retrieval, encryption, pseudonymization, deletion, combining, and transfer.

1.1 Data Provided to Us by You

We may collect various data from or about you, depending on how you use the Services. Below are some examples to help you better understand what data we collect.

When creating an account and using the Services, including through third-party platforms, we collect any data you provide directly, as shown below:

Categories of Personal DataDescriptionLegal Basis for Processing

Account DataTo use certain features (such as access to content), you need to create a user account, which requires us to collect and store your email address, password, and account settings. If you create an instructor account, we collect and store your name, email address, password, and account settings. When using certain functions on the site, you may be asked for additional information such as your profession, identifying data, verification photo, date of birth, race/ethnicity, interests, and phone number. Once your account is created, we assign you a unique ID number.Contract fulfillment. Legitimate interests (providing services, identity verification, fraud prevention and security, communication)

Profile DataYou may also provide profile information such as a photo, headline, biography, language, website link, social media profiles, country, or other data. Your profile data will be publicly visible to others.Contract fulfillment. Legitimate interests (enhanced platform functionality, providing information about content sources)

Shared ContentCertain parts of the Services allow you to interact with other users or publicly share content, including uploading courses and other educational content, posting reviews about content, asking or answering questions, sending messages to course participants or instructors, and posting photos or other user-submitted materials. Such shared content may be publicly visible depending on where it is posted.Contract fulfillment. Legitimate interests (provision of services, enhanced platform functionality)

Training DataWhen you use content, we collect data such as courses, assignments, and tests you start and complete; the content and subscription purchases as well as promotional credits; subscriptions; completion certificates; interactions with instructors, teaching assistants, and other participants; plus any essays, question responses, or other items submitted to fulfill course and related content requirements.Contract fulfillment. Legitimate interests (provision of services, enhanced platform functionality)

Learner Payment DataIf you make purchases, we collect certain purchase-related data (such as name, billing address, and postal code) necessary to fulfill the order, which may optionally be saved for future orders. You must provide certain payment and billing data directly to our service providers, including your name, credit card information, billing address, and postal code. We may also receive partial information (e.g., a new card’s last four digits) from payment operators that help facilitate payments. For security reasons, XX does not collect or store sensitive cardholder data, such as full credit card numbers or card authentication data.Contract fulfillment. Legal obligation. Legitimate interests (enabling payment transactions, fraud prevention and security, regulatory compliance)

Instructor Payment DataIf you are an instructor, you can link your PayPal, Payoneer, or other payment account to the Services to receive payments. Once linked, we collect and use certain information, including the email address associated with the account, account ID, physical address, or other necessary details for sending payments. In some cases, we may collect automatic clearinghouse or wire transfer information to send payments to your account. To comply with applicable laws, we partner with trusted third-party companies to collect legally required tax-related information. This may include residency details, tax identification numbers, biographical information, and other personal data necessary for tax purposes. For security reasons, XX does not collect or store sensitive bank account details. Collection, use, and disclosure of payment and billing data are governed by the privacy policy and other terms of the payment service provider.Contract fulfillment. Legal obligation. Legitimate interests (service provision, enabling payment transactions, fraud prevention and security, regulatory compliance)

Data on Accounts Linked to Other ServicesWe may obtain certain information through social media or other online accounts if they are linked to your XX account. If you log in to XX via Facebook or another third-party platform or service, we request your permission to access specific information about that account. For example, depending on the platform or service, we may collect details such as your name, profile picture, account ID, login email, location, device’s physical location, gender, date of birth, and a list of friends or contacts. These platforms and services provide data to us through APIs. The data we receive depends on what you (through your privacy settings), the platform, or the service decides to share with us. If you access or use our Services via a third-party platform or service or click a third-party link, the collection, use, and sharing of your data will also be subject to that third party’s privacy policy and other agreements.Legitimate interests (identity verification, improving user experience)

Sweepstakes, Promotions, and SurveysWe may invite you to fill out a survey or offer you the opportunity to participate in promotions (for example, competitions, challenges, sweepstakes) through the Services or a third-party platform. If you take part, we collect and store the data you provide as part of participation, such as name, email address, mailing address, date of birth, or phone number. This data is subject to this Privacy Policy unless the official rules of the promotion or another privacy policy state otherwise. The collected data will be used to manage the promotion or survey, including notifying winners and distributing prizes. If you win a prize, you may be asked to allow us to publicly post certain information (e.g., winner info on a specific web page). If we use a third-party platform to administer a survey or promotion, that third-party’s privacy policy applies.Contract fulfillment. Legitimate interests (administering promotions, delivering prizes, compliance with regulations)

Communications and SupportIf you contact us for technical support or to report an issue or concern (whether or not you have created an account), we collect and store your contact information, messages, and other data about you, such as your name, email address, messages, location, XX user ID, refund transaction IDs, and any other data you provide or that we collect automatically (as discussed below). We use this data to respond to inquiries or concerns, in accordance with this Privacy Policy.Legitimate interests (customer support and technical assistance)

The data listed above is stored by us and associated with your account.

1.2 Data Collected by Automated Means

When you access the Services (including browsing content), we collect certain data automatically. Examples are shown below:

Categories of Personal DataDescriptionLegal Basis for Processing

System DataTechnical data about your computer or device, such as IP address, device type, operating system type and version, unique device identifiers, browser, browser language, domain and other system data, and platform types.Contract fulfillment. Legitimate interests (providing services, customer support and technical assistance, fraud prevention and security, communication, product improvements)

Usage DataUsage statistics about your interactions with the Services, including content accessed, time spent on pages or the Service, pages visited, features used, search queries, click data, date and time, referring system, and other data regarding your use of the Services.Legitimate interests (providing services, improving the user experience, enhancing products)

Approximate Geographic DataApproximate geographic location, including information such as country, city, and geographic coordinates, inferred from your IP address.Legitimate interests (improving user experience, fraud prevention and security, regulatory compliance)

We collect the data mentioned above via server log files and tracking technologies, as described in the “Cookies and Data Collection Tools” section below. We store it and associate it with your account.

1.3 Data from Third Parties

In the case of businesses or companies that are potential XX users, in addition to the information you send us, we may collect certain contact data from external sources.

2. How We Obtain Data About You

We use tools such as cookies, web beacons, and similar tracking technologies to gather the data mentioned above. Some of these tools allow you to opt out of data collection.

2.1 Cookies and Data Collection Tools

We use cookies—small text files stored by your browser—to collect, store, and share information about your activities across websites, including XX. Cookies let us remember details about your visit to the XX platform, such as your preferred language, and information needed to simplify site usage. You can find more information about cookies at:
https://cookiepedia.co.uk/all-about-cookies
We may also use clear pixels in emails to track email delivery and open rates.

When you access or use the Services, XX and service providers acting on our behalf (like Google Analytics and external advertisers) use server logs and automated data collection tools such as cookies, tags, scripts, and web beacons (collectively, “Data Collection Tools”). These Data Collection Tools automatically track and collect certain System Data and Usage Data when you use the Services. In some cases, as outlined in this Privacy Policy, we associate data collected by these tools with other data we collect.

2.2 Why We Use Data Collection Tools

XX uses the following Data Collection Tools for the described purposes:

Essential: These tools allow you to access the site, provide basic functionality (like logging in and accessing content), secure the site, protect against fraudulent logins, detect misuse and unauthorized account access attempts, and safeguard against them. These tools are essential for the proper functioning of the Services, so disabling them may cause parts of the site to not work properly or become unavailable.
Functional: These tools remember information about your browser and preferences, enable additional features on the site, customize content to be more relevant to you, and recall settings that influence the look and behavior of the Services (for example, preferred language or video playback volume).
Performance: These tools help measure and improve the performance of the Services by providing usage and performance data, visit counts, traffic sources, and information on where the application was downloaded. They help us test different versions of XX to see which features and content users prefer, and which emails are opened.
Advertising: These tools may be used to gather and transmit product information (on or off the site) based on knowledge about you and your preferences.
Social Media: These tools enable social media-related functions, such as sharing content with friends and networks.

You can set your browser to warn you about attempts to place cookies on your computer, restrict the types of cookies allowed, or reject cookies altogether. In such cases, you may not be able to use some or all features of the Services, and your experience may differ or be less functional. More information about managing Data Collection Tools can be found in Section 6.1 (Your Choices About the Use of Your Data).

3. How We Use Data

We use your data for purposes such as providing our Services, communicating with you, troubleshooting, fraud and abuse prevention, improving and updating our Services, analyzing how people use our Services, delivering personalized advertising, and complying with legal requirements or requirements necessary to ensure safety and integrity. We retain your data for as long as needed to serve the purposes for which it was collected.

We use the data we collect through your use of the Services to:

Provide and manage the Services, including facilitating your use of content, issuing completion certificates, displaying content customized to you, and facilitating communication with other users (Account Data, Shared Content, Training Data, System Data, Usage Data, Approximate Geographic Data).
Process payments from you and other third parties (Learner Payment Data; Instructor Payment Data).
Process your requests and orders for educational content, products, specific services, information, or features (Account Data, Service Data, Learner Payment Data, System Data, Communications and Support).
Communicate with you about your account (Account Data, Shared Content, Service Data, Promotions and Surveys, System Data, Communications and Support).
Respond to your questions and concerns.
Send you messages and administrative information, including notices of changes to our Services and updates to our agreements.
Send you information, for instance via email or SMS, regarding your progress in the Services, rewards programs, new services, new features, promotions, newsletters, and other available content developed by XX (which you can opt out of at any time).
Send push notifications to your wireless device for updates and other relevant messages (you can manage these via the “options” or “settings” page in the mobile app).
Manage your account and account preferences, and personalize your experience (Account Data, Training Data, Learner Payment Data, Instructor Payment Data, System Data, Usage Data, Cookie Data).
Enable the technical functioning of the Services, including troubleshooting, securing the Services, preventing fraud and abuse (Account Data, Learner Payment Data, Instructor Payment Data, Communications and Support, System Data, Approximate Geographic Data).
Verify the identity of subcontractors (Account Data, Instructor Payment Data).
Obtain user feedback (Account Data, Communications and Support).
Market the Services, including surveys and promotions (Account Data, Training Data, Promotions and Surveys, Usage Data, Cookie Data).
Market subscription plans to potential customers (Account Data, Training Data, Cookie Data).
Identify unique users across different devices (Account Data, System Data, Cookie Data).
Match promotional and advertising information across different devices (Cookie Data).
Improve our Services and develop new Services and features (all categories of data).
Analyze trends and traffic, track purchases, and usage data (Account Data, Service Data, Learner Payment Data, Communications and Support, System Data, Usage Data, Approximate Geographic Data, Cookie Data).
Advertise our Services on third-party websites and applications (Account Data, Cookie Data).
Use as required or permitted by law (all categories of data).
Use at our discretion or in any other way necessary to ensure the safety or integrity of our users, employees, third parties, the public, or our Services (all categories of data).

4. Who We Share Data With

We share certain data about you with instructors, other participants, companies performing services for us, XX affiliates, content creators, our business partners, analytics and data enrichment providers, social media providers, companies helping us run promotions and surveys, and advertising companies that help us promote our Services. We may also share your data when needed for security, compliance, or corporate restructuring. We may also share data in other ways if it is aggregated or de-identified or if we have your consent.

We may share your data with third parties under the following circumstances or as described in this Privacy Policy:

Content Creators: We may share information we have about you (but not your email address) with content creators or teaching assistants for the educational content you accessed or in which you expressed interest, so that they can better prepare it for you and other learners. These data may include your country, browser language, operating system, device settings, the website that brought you to the XX platform, and certain activities on the XX platform, such as the Services you started and a text, audio, or video review of the Service. We do not share your email address with content creators or teaching assistants (Account Data, System Data, Usage Data, Approximate Geographic Data).
Service Providers, Contractors, and Agents: We share your data with third-party companies that perform services on our behalf, such as payment processing, fraud and abuse prevention, data analysis, information and advertising services (including retargeted advertising), hosting and email services, as well as customer service and support. These service providers may have access to your personal data and are required to use it only as directed by us to provide the requested service (all categories of data).
Sharing with XX Affiliates: We may share your data across our group of content creators and partners to enable or help provide the Services (all categories of data).
Business Partners: We have agreements with other websites and platforms to distribute our Services and direct traffic to XX. Depending on your location, we may share your data with these trusted partners (Account Data, Training Data, Communications and Support, System Data).
Analytics and Data Enrichment: As part of our use of third-party analytics tools (like Google Analytics) and data enrichment services (like ZoomInfo), we share certain contact or de-identified data. “De-identified” data means we remove details such as your name and email address and replace them with a token ID. This allows these providers to deliver analytics services or match your data with publicly available database information (including contact and social data from other sources). We do this to communicate with you more effectively and in a more personalized way (Account Data, System Data, Usage Data, Cookie Data).
Social Media Features: The social media features in the Services (such as the Facebook “Like” button) may allow a third-party social media provider to collect information such as your IP address and which page you are visiting on the Services, as well as to set a cookie to enable the feature. Your interactions with these features are governed by the third party’s privacy policy (System Data, Usage Data, Cookie Data).
Managing Promotions and Surveys: We may share your data as needed for administering or sponsoring promotions and surveys you choose to participate in, or as required by applicable law (e.g., providing a winners’ list or making necessary filings), or per the rules of the promotion or survey (Account Data, Promotions and Surveys).
Advertising: If we decide to offer advertising in the future, we may use and share certain System Data and Usage Data with advertisers and networks to show general demographic and preference information about our users. We may also allow advertisers to collect System Data through Data Collection Tools, and to use this data to offer targeted ads, in order to personalize your user experience (through behavioral advertising) and conduct web analytics. Advertisers may also share with us the data they collect about you.
For Security and Legal Compliance: We may disclose personal data (all categories of data) to third parties if (in our sole discretion) we believe in good faith that such disclosure is:
- Requested as part of a judicial, governmental, or legal inquiry, order, or proceeding;
- Reasonably necessary as part of a valid subpoena, court order, or other enforceable legal request;
- Reasonably necessary to enforce our Terms of Use, this Privacy Policy, or other legal agreements;
- Required to detect, prevent, or otherwise address fraud, abuse, misuse, potential violations of law (or rules/regulations), or security or technical issues;
- Reasonably necessary, in our judgment, to protect against immediate harm to the rights, property, or safety of XX, our Users, employees, the public, or our Services; or
- We may also disclose data about you to our auditors and legal advisors to assess our rights and obligations under this Privacy Policy.
During a Change in Control: If XX undergoes a business transaction such as a merger, acquisition, corporate divestiture, dissolution (including bankruptcy), or sale of all or part of its assets, we may share, disclose, or transfer all of your data to the organization that is the successor during or in contemplation of such a transition (including as part of due diligence) (all categories of data).
After Aggregation/De-identification: We may disclose or use data in aggregated or de-identified form for any purpose.
With Your Consent: With your consent, we may share data with third parties outside the scope of this Privacy Policy (all categories of data).

5. Security

We apply appropriate security measures based on the type and sensitivity of data stored. Like any system connected to the internet, there is always a risk of unauthorized access, so it’s important to protect your password and contact us if you suspect unauthorized access to your account.

XX uses appropriate security measures to protect against unauthorized access, alteration, disclosure, or destruction of your personal data that we collect and store. These measures vary based on the type and sensitivity of the data. However, no system can be 100% secure, so we cannot guarantee that communications between you and XX, the Services, or any information provided to us in connection with the data we collect through the Services will be free from unauthorized access by third parties. Your password is an important part of our security system, and it is your responsibility to protect it. You should not share your password with third parties. If you believe your password or account has been compromised, you should change it immediately and contact us at: mail@operator.online.

6. Your Rights

You have certain rights regarding the use of your data, including the option to opt out of promotional emails, cookies, and the collection of your data by certain third parties. You can update or close your account in our Services and also contact us about individual rights requests concerning your personal data. Parents who believe we have inadvertently collected personal data about their minor children should contact us to request the deletion of such information.

6.1 Your Choices About the Use of Your Data

You can choose not to provide certain data to us, but in that case, you may not be able to use certain features of the Services.

You can opt out of receiving promotional communications by using the unsubscribe link in a promotional communication you receive or by updating your email preferences in your account. Note that regardless of your email preferences, we will still send you transactional and relationship messages regarding the Services, including administrative confirmations, order confirmations, important updates about the Services, and notices about our policies.

If you are in the European Economic Area, you can disable certain Data Collection Tools by clicking the “Cookie Settings” link at the bottom of each page.

Your browser or device may allow you to control cookies and other types of local data storage. For more information on managing cookies, see https://cookiepedia.co.uk/how-to-manage-cookies. Your wireless device may also allow you to control whether location or other data is collected and shared.

To obtain information and control cookies used for tailored advertising from participating companies, visit the consumer opt-out pages of the Network Advertising Initiative and the Digital Advertising Alliance, or if you are located in the European Economic Area, visit Your Online Choices. Users in Japan should visit the Digital Advertising Consortium. To opt out of Google display advertising or customize ads on the Google Display Network, visit the Google Ads Settings. To opt out of targeted ads from the Taboola platform, use the opt-out link in the Taboola Cookie Policy.

To opt out of Google Analytics, Mixpanel, ZoomInfo, or Clearbit’s use of your data for analytics or enrichment, use the Google Analytics Opt-Out Browser Add-On, the Mixpanel opt-out cookie, ZoomInfo’s Privacy Policy information, and Clearbit’s data request mechanism.

Apple iOS, Android OS, and Microsoft Windows systems offer their own instructions on controlling personalized in-app advertisements. For other devices and operating systems, refer to the privacy settings of that platform.

If you have any questions about your personal data, how we use it, or your rights, please email us at mail@operator.online.

6.2 Accessing, Updating, and Deleting Personal Data

You can access and update your personal data that XX collects and stores in the following ways:

To update data you have provided directly, log into your account at any time and update it.

To close your account:

Send an email to mail@operator.online specifying the date on which the account should be deleted.
If you have any issues closing your account, email us at mail@operator.online.

Note: Even after your account is closed, some or all of your data may remain visible to others, including without limitation any data that (a) has been copied, stored, or disseminated by other users (including in comments), (b) has been shared or disseminated by you or others (including in shared content), or (c) has been posted to a third-party platform. Even after your account is closed, we retain your data as long as it is reasonably necessary (and in accordance with applicable law) for assisting in fulfilling legal obligations, resolving disputes, and enforcing our agreements. We may retain and disclose such data pursuant to this Privacy Policy after your account has been closed.

To access, correct, or delete your personal data, please use the online form found in your account settings after logging in, or send a request to mail@operator.online, or write to us at XX Operator PSA, ulica Sarmacka 1A / 145, 02-972 Warsaw, Poland. We will respond within 30 days. To protect you, we may require that the request be sent from the email address associated with your account and we may need to verify your identity before fulfilling the request. Please note that we may keep certain data when we have a legal basis to do so, including for mandatory recordkeeping and transactional purposes.

6.3 Our Policy for Children

We recognize the need to protect children’s privacy and encourage parents and guardians to take an active role in their children’s online activities and interests. Individuals under 18 years of age who are also of an age eligible to use online services in their place of residence (for example, 13 in the U.S. or 16 in Ireland) may not create an account with us on their own, but may ask a parent or guardian to create one for them and help them access age-appropriate content. Children below the age that allows them to use online services may not use our Services. If we learn that we have collected personal data from children under that age, we will take appropriate steps to delete it.

Parents who believe that XX may have inadvertently collected personal data about their child under the stated age limit should contact us at mail@operator.online to request the deletion of such information.

7. Jurisdiction-Specific Rules

A California resident has certain rights to access, delete, and obtain information about how we share their personal data. An Australian resident has the right to file a formal complaint with the relevant government agency.

7.1 Users in California

A California resident has certain rights under the California Consumer Privacy Act (“CCPA”), such as:

“Right to Know”—You have the right to know the categories and specific pieces of personal data we have collected about you, as well as the right to access a copy of it.
“Right to Correct”—You have the right to request correction of any inaccurate personal data we have.
“Right to Delete”—You have the right to request that we delete the personal data we have collected about you.
“Right to Non-Discrimination”—If you choose to exercise any of your rights under CCPA, XX will treat you the same as any other user. In other words, you won’t be penalized for exercising your rights under CCPA.
“Right to Opt-Out”—You have the right to opt out of the sale or sharing of your personal data.

CCPA has a specific definition of “selling” and “sharing,” and while XX does not sell user personal data in the traditional sense, we do use cookies that share non-personally identifiable information with certain third parties, including for cross-context targeted advertising. To opt out of such “selling” and “sharing,” click the “Do Not Sell or Share My Personal Information” link at the bottom of this page.

To exercise any of your rights under CCPA, send an email to mail@operator.online or a letter to XX Operator PSA, ulica Sarmacka 1A / 145, 02-972 Warsaw, Poland. Under CCPA, you may appoint an agent to make such requests on your behalf. For your security, we may require that the request be sent from the email address associated with your account and may need to verify your identity or your agent’s identity before fulfilling the request.

For more information about the personal data we collect and how we collect it, please see the above sections titled “What Data We Obtain” and “How We Obtain Data About You.”

A California resident also has the right to request certain information about which personal data we have shared with third parties for their direct marketing purposes. To submit a request of this kind, please email mail@operator.online with “California Shine the Light” in the subject line, including in the body of your email your mailing address, state of residence, and email address.

Because there is no widely accepted standard for recognizing or honoring Do Not Track (DNT) signals from web browsers, we do not currently recognize or respond to such signals.

7.2 Users Who Reside in Nevada

XX does not sell personal data of any users. However, residents of Nevada may submit a request that we not sell any personal data covered by those terms. Such a request should be sent by email to mail@operator.online or by mail to XX Operator PSA, ulica Sarmacka 1A / 145, 02-972 Warsaw, Poland.

7.3 Users Who Reside in Australia

Australian residents who wish to file a complaint may do so with the Office of the Australian Information Commissioner (“OAIC”). You can contact the OAIC by visiting www.oaic.gov.au, sending an email to enquiries@oaic.gov.au, calling 1300 363 992, or mailing GPO Box 5218, Sydney NSW 2001, Australia. You may also contact our Privacy Team at mail@operator.online to make a complaint about a breach of the Australian Privacy Principles, and you will receive a response within 30 days.

7.4 Users in the European Economic Area (EEA) and the United Kingdom (UK)

If you reside in the EEA or UK, you have the right to request access to your data in a portable format, as well as request corrections, deletion, restrictions on processing, or object to the processing of your personal data. Additionally, if you reside in the UK, EEA, or Switzerland, you may also file a complaint with your local supervisory authority.

Personal data is also processed outside of the UK, Switzerland, and EEA by XX or our service providers, for example, to process transactions, facilitate payments, and provide support services described in Section 4. We use the European Commission’s standard contractual clauses for controller-to-processor transfers to facilitate the transfer of personal data from the EEA to other countries, and we have Data Processing Agreements in place with our service providers and with XX’s group of creators and partners, which limit and govern their processing of our users’ data. By submitting your data and/or using our Services, you consent to such transfers, as well as the storage and processing of data by XX and its processors.

7.5 Data Privacy Framework Regulations (for EU/EEA, UK, and Swiss Data Subjects)

XX Operator PSA complies with the EU–U.S. Data Privacy Framework (EU–U.S. DPF), the UK Extension to the EU–U.S. DPF, and the Swiss–U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce. XX Operator PSA has certified to the Department of Commerce that it adheres to the EU–U.S. DPF Principles with respect to the processing of personal data received from the European Union in reliance on the EU–U.S. DPF, and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU–U.S. DPF. XX Operator PSA also commits to comply with the Swiss–U.S. Data Privacy Framework Principles with respect to personal data received from Switzerland in reliance on the Swiss–U.S. DPF. In the event of any conflict between the terms in this Privacy Policy and the EU–U.S. DPF and/or Swiss–U.S. DPF Principles, the relevant Principles shall govern.

We commit to subject to the DPF Principles all personal data received from the EU, UK, Gibraltar, and Switzerland under the DPF.

We remain responsible under the Onward Transfer Principle for any of your personal data shared, in accordance with that principle, with a third party for external processing on our behalf. Furthermore, we may be required to disclose personal data in response to lawful requests by public authorities, including requests to meet national security or law enforcement requirements.

Individuals have the right to access their personal data. Instructions for exercising this right are found in Section 6.2 of this Privacy Policy. Individuals may also limit the use and disclosure of their personal data as described in Section 6.1.

In compliance with the EU–U.S. DPF, the UK Extension to the EU–U.S. DPF, and the Swiss–U.S. DPF, XX, Inc. commits to resolving DPF-related complaints and how we collect or use your personal data. EU, UK, and Swiss individuals with questions or complaints regarding our privacy practices under the respective DPF frameworks should first contact XX at mail@operator.online.

8. Updates and Contact Information

When we make significant changes to this policy, we will notify users via email, product notifications, or another mechanism required by law. Changes take effect on the date they are posted. If you have any questions, concerns, or disputes, please contact us via email or mail.

8.1 Changes to This Privacy Policy

If we make any significant changes to it, we will notify you by email, through the Services, or as required by law. We will also post a summary of the key changes. Unless otherwise stated, the changes take effect on the date of posting.

As permitted by applicable law, your continued use of the Services after the effective date of any change will constitute your acceptance of and agreement to be bound by the revised Privacy Policy. The revised Privacy Policy supersedes all previous Privacy Policies.

8.2 Interpretation

Any capitalized terms not defined in this policy have the meaning set forth in XX’s [Terms of Use]. Any non-Polish version of this Privacy Policy is provided for your convenience. In the event of any discrepancy with the non-Polish version, you agree that the Polish version will govern.

8.3 Questions

If you have any questions, concerns, or disputes about our Privacy Policy, please contact our Privacy Team (including our Data Protection Officer) at mail@operator.online. You may also write to us at XX Operator PSA, ulica Sarmacka 1A / 145, 02-972 Warsaw, Poland.

phone 511 359 802