Privacy Policy

1)DEFINITIONS AND LEGAL REFERENCES

Personal Data (or Data) – Any information that directly, indirectly, or in connection with other information — including a personal identification number — allows for the identification or identifiability of a natural person.

Usage Data – Information collected automatically through this Platform (or third-party services employed in this Platform), which can include: the IP addresses or domain names of the computers utilized by the Users who use this Platform, the URI addresses (Uniform Resource Identifier), the time of the request, the method utilized to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server's answer (successful outcome, error, etc.), the country of origin, the features of the browser and the operating system utilized by the User, the various time details per visit (e.g., the time spent on each page within the Platform) and the details about the path followed within the Platform with special reference to the sequence of pages visited, and other parameters about the device operating system and/or the User's IT environment.

User – The individual using this Platform who, unless otherwise specified, coincides with the Data Subject.

Data Subject – The natural person to whom the Personal Data refers.

Data Processor (or Data Supervisor) – The natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller, as described in this privacy policy.

Data Controller (or Owner) – The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data, including the security measures concerning the operation and use of this Platform. The Data Controller, unless otherwise specified, is the Owner of this Platform.

GDPR – The Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

CCPA – The California Consumer Privacy Act of 2018, as amended (including the California Privacy Rights Act of 2020), providing California residents with specific rights regarding their personal information.

LGPD – The Lei Geral de Proteção de Dados (General Data Protection Law) of Brazil, Law No. 13,709/2018.

PIPEDA – The Personal Information Protection and Electronic Documents Act of Canada, governing how private sector organizations collect, use, and disclose personal information.

Australian Privacy Act – The Privacy Act 1988 (Cth) of Australia and the Australian Privacy Principles (APPs) set out in Schedule 1 of that Act.

POPIA – The Protection of Personal Information Act 4 of 2013 of South Africa.

ePrivacy Directive – Directive 2002/58/EC of the European Parliament and of the Council concerning the processing of personal data and the protection of privacy in the electronic communications sector, as amended.

Standard Contractual Clauses (SCCs) – Contractual clauses adopted by the European Commission to ensure appropriate data protection safeguards for personal data transferred outside the EEA.

This Platform – The means by which the Personal Data of the User is collected and processed.

Service – The service provided by this Platform as described in the relative terms and on this Platform.

2)COLLECTING OF DATA

This section explains generally the sources from which, and the means by which, we collect and process personal information.

2.1 Profile Registration

We collect Personal Data when you register for an account, when you use certain Services (including when you sign up for an account, create or share, and message or communicate) and when you visit certain pages on Platform. This can include information on or about the services you provide or about how you use our Services.

Personal Data and other details about you that you supply as part of the registration process or that are collected by us when you use the Services are used to provide you with the Services and information as set out in our Terms of Service. We will not use that information for any purpose other than the Services.

2.2 Communicating with Us

If you contact us in relation to any of the Services (via email, telephone, post or otherwise), we may collect and retain your contact details and your communication for the purpose of handling your query and keeping records of communications.

2.3 Submit Personal Information

When you submit personal information to us voluntarily, including when you register an account, communicate with us, pay for our services, or use any of our Services.

2.4 Visit Our Platform

When you visit our Platform, we may collect location and other information from the internet browser you are using.

2.5 Technology Technical Information

When your communications with us provide us with certain technical information, such as internet protocol (IP) address, browser type, time zone setting and location, device operating system, and other technologies you may use to access our Platform or otherwise communicate with us.

3)COLLECTED DATA

The personal information we collect varies by user, transaction, and purpose, but our primary purpose is the efficient and satisfactory conduct of our business and for related legal purposes.

Users are responsible for any third-party Personal Data obtained, published or shared through this Platform and confirm that they have the third party's consent to provide the Data to the Owner.

We collect the following data:

• Contact information, including your name, postal address, email address and phone number and any other information you provide to prove you are eligible to use our Services;
• Account information, including password, and other registration information, your use of our Services. Note that account passwords and user authentication are securely stored by our authentication service providers. However, we may collect other registration information and data on your use of our services;
• Financial information, including payment details of accounts you have linked to your Profile. This information is securely transmitted and stored by Stripe, a third-party payment processor, as part of providing our services. We do not store complete payment card information directly;
• Communications information, including records of your communications with us and our customer service team (such as records of emails, chat);
• Technical information, including device identifiers, IP address, and where you have enabled location services, your GPS location, as well as information on how you use our website and app. This information is mainly collected through cookies and includes: your visits to our platform, the links you click on, through and from our site (including date and time), the services you view or search for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling and clicks), and methods used to browse away from the page.

Categories of Third-Party Service Providers

To provide our Services, we engage the following categories of third-party providers who may process your data:

All third-party providers are contractually bound by data processing agreements that ensure compliance with applicable data protection laws, including GDPR requirements where applicable.

4)PURPOSE OF DATA COLLECTION

We do not use your personal information to take automated decisions about you which have a legal or similarly significant effect on you.

We use the personal information that we collect or receive from our Users for the purposes described in this Policy and for other business purposes allowed by law, including:

• To provide and maintain our Service, including to monitor the usage of our Service;
• To manage your Account: to manage your registration of the Service. The Personal Data you provide can give you access to different functionalities of the Service that are available to you;
• For the performance of a contract: the development, compliance and undertaking of the contract for the Services or of any other contract with us through the Service;
• To contact you: To contact you by email, telephone calls, SMS, or other equivalent forms of electronic communication;
• To manage your requests: To attend and manage your requests to us;
• To respond to your requests and questions, resolve disputes, investigate and address your concerns, and monitor and improve our responses;
• To help maintain the safety, security, and integrity of our Platform, databases, and technology assets and to detect and prevent transactional fraud;
• For testing, research, analysis, and product and service development, including to improve our Platform and services;
• For facilitating and processing your transactions with us and with our third party affiliates and business partners;
• To respond to law enforcement requests and as required by applicable laws, court orders, or governmental regulations;
• For other purposes: We may use your information for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our Service, marketing and your experience.

5)METHODS OF DATA PROCESSING

Athenum takes appropriate security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of the Data.

The Data processing is carried out using computers and/or IT enabled tools, following organizational procedures and modes strictly related to the purposes indicated. In addition to Athenum, in some cases, the Data may be accessible to certain types of persons in charge, involved with the operation of this Platform (administration, sales, marketing, legal, system administration) or external parties (such as third-party technical service providers, mail carriers, hosting providers, IT companies, communications agencies) appointed, if necessary, as Data Processors by Athenum. The updated list of these parties may be requested from the Owner at any time.

Athenum has put in place appropriate security measures to prevent your Personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, Athenum limits access to your Personal data to those employees, agents, contractors and other third parties who have a business relationship with Athenum, on a need-to-know basis. They will only process your Personal data on instructions of the Company, and they are subject to a duty of confidentiality.

Athenum has put in place procedures to deal with any suspected Personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. We take appropriate measures to ensure the security of your data, including but not limited to encryption at rest and in transit, state-of-the-art firewall and backup technology, and continuous backup in several high-security, access-controlled data centers located in different regions.

While we take every effort to ensure the security and privacy of your personal data, no system can be completely secure. Therefore, we cannot guarantee the absolute security of your personal data. If a data breach occurs, we will promptly inform you and any applicable regulators as required by law.

6)TRANSFERS AND SHARING OF DATA

Athenum may need to transfer and share your personal data in order to provide our services to you and for other legitimate business purposes. Depending on the User's location, data transfers may involve transferring the User's Data to a country other than their own. If any such transfer takes place, Users can find out more by checking the relevant sections of this document or inquire with Athenum using the information provided in the contact section.

International Data Transfers

Athenum may store, process, and/or transfer personal data to countries outside of the European Economic Area (EEA), the United Kingdom, or Switzerland (including countries where the European Commission, UK authorities, or Swiss authorities have not made a decision of an adequate level of protection of personal data). When such transfers occur, we implement the following safeguards to ensure your data remains protected in accordance with GDPR, UK GDPR, and Swiss data protection requirements:

• Standard Contractual Clauses (SCCs): We utilize the European Commission's Standard Contractual Clauses (adopted pursuant to Commission Implementing Decision (EU) 2021/914) as the primary legal mechanism for transfers to third countries. For UK transfers, we apply the UK International Data Transfer Addendum to the SCCs.
• EU-U.S. Data Privacy Framework: Where applicable, transfers to the United States may rely on the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the DPF, and/or the Swiss-U.S. Data Privacy Framework, provided our service providers are certified under these frameworks.
• Adequacy Decisions: For countries recognized by the European Commission, UK, or Switzerland as providing an adequate level of data protection, we may transfer data without additional safeguards.
• Supplementary Measures: Where necessary based on transfer impact assessments, we implement additional technical and organizational measures (such as encryption, pseudonymization, and access controls) to ensure effective protection of your data.

You may request a copy of the Standard Contractual Clauses or information about specific safeguards by contacting us at the email address provided below.

Data Sharing Recipients

We may share your personal data with the following recipients:

• If we have aggregated or de-identified the information, so that it cannot reasonably be used to identify you;
• With our affiliates and partners in order to provide you with specific Services that are offered or provided by us;
• With third party service providers who we use in delivering our Services (see the "Categories of Third-Party Service Providers" table in Section 3 for details);
• If required by applicable law or legal process, or if we believe it is in accordance with applicable law or legal process;
• To protect the rights, property and safety of Company, our users and the public, including, for example, in connection with court proceedings, or to detect or prevent criminal activity, fraud, material misrepresentation, or to establish our rights or defend against legal claims;
• In connection with selling, merging, transferring, or reorganizing all or parts of our business;
• Internal recipients: Your Personal data will only be disclosed to authorized employees that require access to fulfil their obligations. Our employees are specifically trained and made aware of the sensitivity of your Personal data and the requirements necessary to ensure the protection of your right to privacy.

7)RETENTION TIME

We will store your personal information for as long as it is required for us to fulfil the purposes for which we have collected it, as described in this Policy, and for such further period that is necessary to comply with our legal and regulatory obligations, to exercise our legal rights and to protect our business from legal claims.

We will retain your Personal data for the duration required to provide our Services, and as necessary to comply with our legal obligations, resolve disputes, and enforce our policies. Retention periods will be determined taking into account the type of information that is collected and the purpose for which it is collected, bearing in mind the requirements applicable to the situation and the need to destroy outdated, unused information at the earliest reasonable time.

Therefore:

• Personal Data collected for purposes related to the performance of a contract between the Owner and the User shall be retained until such contract has been fully performed.
• Personal Data collected for the purposes of the Owner's legitimate interests shall be retained as long as needed to fulfil such purposes.

Athenum may be allowed to retain Personal Data for a longer period whenever the User has given consent to such processing, as long as such consent is not withdrawn. Furthermore, the Owner may be obliged to retain Personal Data for a longer period whenever required to do so for the performance of a legal obligation or upon order of an authority.

Once the retention period expires, Personal Data shall be deleted. Therefore, the right of access, the right to erasure, the right to rectification and the right to data portability cannot be enforced after expiration of the retention period.

8)YOUR RIGHTS UNDER GDPR (EEA/UK USERS)

Users in the European Economic Area and United Kingdom may exercise certain rights regarding their Data processed by Athenum. In particular, Users have the right to do the following:

• Request access to your Personal data: This enables you to receive a copy of the Personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the Personal data that we hold about you: This enables you to have any incomplete or inaccurate data we hold about you corrected.
• Request erasure of your Personal data: This enables you to ask us to delete or remove Personal data where there is no good reason for us continuing to process it. Note that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your Personal data: In the event we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your Personal data for direct marketing purposes.
• Request restriction of processing of your Personal data: This enables you to ask us to suspend the processing of your Personal data.
• Request the transfer of your Personal data to you or to a third party: We will provide to you, or a third party you have chosen, your Personal data in a structured, commonly used, machine-readable format.
• Withdraw consent at any time (where we are relying on consent to process your Personal data): However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.
• Lodge a complaint: If you have unresolved concerns, you have the right to complain to the data protection authority in your country of residence.

Any requests to exercise User rights can be directed to Athenum through the contact details provided in this document. These requests can be exercised free of charge and will be addressed by the Owner as early as possible and always within one month.

9)CALIFORNIA RESIDENTS' RIGHTS (CCPA)

This section applies solely to residents of the State of California who are subject to the California Consumer Privacy Act of 2018, as amended ("CCPA").

Categories of Personal Information Collected

Sale of Personal Information

We do not sell, disclose, or transfer any Consumer's personal information to a third party which does not meet the definition of Service Providers under the CCPA.

California Residents' Rights

We extend the following rights to California Users relating to their personal information:

• The Right to Know: A User has a right to request that we disclose certain information about our collection and use of the User's personal information over the past 12 months.
• The Right of Deletion: In some circumstances, a User has the right to request that we delete personal information that we have collected from or about the User.
• The Right to Data Portability: A User has the right to access the specific pieces of their personal information in a portable, readily useable format.
• Right to Opt-Out: If and to the extent we are deemed to Sell a User's personal information, the User has the right to direct us to stop selling their personal information.
• Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising any of your rights.

Authorized Agent

The CCPA allows California consumers to designate an authorized agent to submit requests on your behalf. However, we will require written proof of the agent's permission to do so and verify your identity directly.

We will promptly confirm receipt of any such request (generally within ten (10) days) and endeavour to substantively respond to it after verification within forty-five (45) days of its receipt.

10)ADDITIONAL REGIONAL RIGHTS

In addition to the rights described in Sections 8 (GDPR) and 9 (CCPA), users in other jurisdictions may have the following rights under their local data protection laws:

10.1 Brazil (LGPD)

If you are a resident of Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD), including:

• Confirmation of the existence of data processing
• Access to your personal data
• Correction of incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion of unnecessary or excessive data
• Data portability to another service provider
• Deletion of personal data processed with consent
• Information about entities with which your data has been shared
• Information about the possibility of denying consent and the consequences
• Revocation of consent

To exercise these rights, contact us at the email address below. We will respond within the timeframes required by the LGPD.

10.2 Canada (PIPEDA)

If you are a resident of Canada, your personal information is protected under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. You have the following rights:

• Access: You may request access to the personal information we hold about you
• Correction: You may request correction of inaccurate or incomplete information
• Consent Withdrawal: You may withdraw consent to the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions
• Complaint: You have the right to file a complaint with the Office of the Privacy Commissioner of Canada

We will only collect, use, and disclose your personal information with your knowledge and consent, except where permitted or required by law.

10.3 Australia (Privacy Act)

If you are a resident of Australia, your personal information is protected under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). You have the following rights:

• Access: You may request access to your personal information held by us
• Correction: You may request correction of personal information that is inaccurate, out-of-date, incomplete, irrelevant, or misleading
• Anonymity/Pseudonymity: Where practicable, you have the option to interact with us anonymously or using a pseudonym
• Complaint: You have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we have breached the APPs

If your personal information is disclosed to overseas recipients, we will take reasonable steps to ensure they do not breach the APPs, or you will consent to such disclosure.

10.4 South Africa (POPIA)

If you are a resident of South Africa, you have rights under the Protection of Personal Information Act (POPIA), including:

• The right to be notified when personal information is collected
• The right to access your personal information
• The right to request correction or deletion of personal information
• The right to object to the processing of your personal information
• The right not to be subject to automated decision-making
• The right to lodge a complaint with the Information Regulator

10.5 Other Jurisdictions

We respect the data protection rights of users in all jurisdictions. If you are located in a jurisdiction with specific data protection laws not mentioned above (including but not limited to Singapore PDPA, New Zealand Privacy Act, Japan APPI, South Korea PIPA, or other applicable laws), please contact us and we will work to accommodate your rights under applicable local law.

11)COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar tracking technologies to track activity on our Platform and store certain information. In accordance with the ePrivacy Directive (Directive 2002/58/EC, as amended), GDPR, and applicable local laws, we distinguish between different categories of cookies.

Cookie Categories and Consent

Your Consent Choices

Active Consent (Opt-in): In compliance with the ePrivacy Directive, GDPR, and the CJEU ruling in Planet49 (C-673/17), we obtain your active, informed, and freely given consent before placing non-essential cookies on your device. This means:

• Non-essential cookies are not pre-selected and require your explicit opt-in
• We provide clear information about each cookie category before you consent
• You may selectively consent to specific cookie categories
• You can withdraw your consent at any time with the same ease as giving it
• Refusing non-essential cookies will not affect your access to core Platform functionality

Managing Your Cookie Preferences

You can manage your cookie preferences at any time through:

• Our Cookie Consent Banner: Accessible at any time via the cookie settings link in the Platform footer
• Browser Settings: You may configure your browser to block all cookies, though this may impact Platform functionality
• Opt-Out Links: For third-party advertising networks, you may use the opt-out mechanisms provided by the Digital Advertising Alliance (DAA), Network Advertising Initiative (NAI), or European Interactive Digital Advertising Alliance (EDAA)

For detailed information about the specific cookies we use, their retention periods, and the third parties involved, please refer to our Cookie Policy available on our Platform.

12)CHILDREN'S PRIVACY

Our Service does not address anyone under the age of 18 ("Children"). We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your Child has provided us with Personal Data, please contact us.

If we become aware that we have collected Personal Data from children without verification of parental consent, we take steps to remove that information from our servers.

13)THIRD-PARTY LINKS

Our Platform may contain links or references to third party websites. These websites are outside of our control, and the privacy policies of these sites may differ from our own. Please be aware that we have no control over these third-party websites and our Privacy Policy does not apply to such websites. We encourage you to check the terms of use and privacy policies of such sites before disclosing any personal information via such sites.

14)CHANGES TO THIS PRIVACY POLICY

Athenum reserves the right to make changes to this privacy policy at any time by notifying its Users on this page and possibly within this Platform and/or – as far as technically and legally feasible – sending a notice to Users via any contact information available to Athenum. It is strongly recommended to check this page often, referring to the date of the last modification listed at the bottom.

Should the changes affect processing activities performed on the basis of the User's consent, Athenum shall collect new consent from the User, where required.

15)CONTACT US

If you have any questions about this Privacy Policy, please contact us at athenum.xyz@proton.me.

If you have any issues regarding data processing done by Athenum, you may also send a request to the data protection authority in your country of residence.