Privacy Notice

Bilddit ("the Company", "we", "us") owns and manages the Bilddit mobile applications which, together with the website bilddit.com, form the Platform we use to provide our services. This notice explains our policy for collecting, storing, using, processing and safekeeping personal and non-personal data obtained when you interact with us via the Platform.

This Privacy Notice is particularly relevant for the following users of the Platform:

• Buyers - users who create an account with us to buy products and have those delivered.
• Couriers - users who deliver the products to the Buyers.

When you use the Platform, Bilddit is the data controller. Any questions about the personal information we hold, or about this Privacy Notice, can be addressed to us by email at info@bilddit.com.

The terminology used in this notice, and explained in this section, is based on the EU General Data Protection Regulation (GDPR).

GDPR sets out a number of different reasons for which a company may collect and process your personal data, including:

Our Platform uses cookies. A cookie is a small text file that is stored in your browser or device by websites, apps, online media and advertisements for record-keeping purposes. Cookies make web surfing easier for you by saving your preferences while you are on the Platform. A specific Internet browser can be recognised and identified using the unique cookie ID. By showing how and when visitors use the Platform, cookies help us to identify which areas are popular and which are not. Many improvements and updates are based on such data. This information is most easily tracked with cookies. We use the information from cookies only to improve customer experience and to better address our users' needs.

The data subject may, at any time, prevent the setting of cookies through our website by means of a corresponding setting of the Internet browser used, and may thus permanently deny the setting of cookies. Furthermore, already set cookies may be deleted at any time via an Internet browser or other software programs.

When a data subject or automated system calls up the Platform, we collect a series of general data. This information is stored in the server log files. In this process we may collect:

• the browser types and versions used;
• the operating system used by the accessing system;
• the date and time of access;
• IP address;
• the ISP of the accessing system; and any other similar data or information that may be used in the event of attacks on our IT systems.

The above information is needed to deliver the content of our Platform correctly and optimise its content; ensure the long-term viability of our IT systems and website technology; and, if required, to provide law enforcement authorities with the information necessary for criminal prosecution in case of a cyber-attack. The above data is processed to provide the data protection and data security of the Company, and to ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from all personal data of data subjects.

Unless an anonymous setting is activated, we also collect technical information about your use of our services through a mobile device such as location and performance data.

We collect personal data in the following occasions:

• when you create an account with us or you change your account settings;
• when you place an order with us and during the order process (including for payment and order delivery);
• when you contact us directly via email, phone, post, message, or similar.

We collect the following personal data:

• Identification data - names, addresses, dates of birth, email addresses, telephone numbers, and login passwords (encrypted);
• Location data - delivery addresses, live location coordinates;
• Technical data - IP addresses, operating system, the device and connection type;
• Commercial data - order information, receipts and purchasing history;
• Payment data - credit, debit card and Stripe account information.

Personal data is collected for the following purposes:

• Creating your account and keeping it up to date to provide you with access to the relevant parts of the Platform;
• Verifying your identity;
• Screening potential delivery couriers;
• Processing payments;
• Enabling transport and delivery of your purchase. In this process location data is processed automatically to determine the delivery distance, cost of delivery and ETA;
• Tracking the location of couriers to identify ones closest to the respective store and to trace the progress of delivery;
• Responding to your queries and complaints. Handling the information you send enables us to respond. We may also keep a record of these to inform any future communication with us and to demonstrate how we communicated with you throughout;
• Protecting our business and your account from fraud and other illegal activities. This includes using your personal data to maintain, update and safeguard your account. We will also monitor your browsing activity with us to quickly identify and resolve any problems and protect the integrity of our Platform;
• Complying with our contractual or legal obligations that require processing personal data or sharing it with law enforcement;
• Developing, testing and improving the systems, services and products we provide to you;
• Keeping you informed by email, web, text and telephone about relevant products and services updates, new releases, special offers, discounts, promotions, and similar.

The registration on the Platform, together with the voluntary indication of personal data, is intended to enable us to offer you the contents or services that may only be offered to registered users due to the nature of the matter in question. Registered persons are free to change the personal data specified during the registration at any time, or to have them completely deleted from our data stock. In case you choose not to share your personal data with us, or refuse certain contact permissions, we might not be able to provide some services you have asked for.

Upon your request we will provide information to you as to what personal data are stored by us at any time. In addition, we will correct or erase your personal data at your request or indication, insofar as there are no statutory storage obligations.

We secure access to all transactional areas of our Platform using HTTPS technology to protect personal data of our Platform users. Access to your personal data is password-protected, and sensitive data is secured and tokenised to ensure it is protected.

We monitor our Platform for vulnerabilities and attacks. We conduct penetration testing of the Platform to further strengthen its security.

We will only keep personal data for as long as is necessary for the purpose for which it was collected. At the end of that retention period, if there are no other statutory retention requirements, your data will either be deleted completely or anonymised.

It may be necessary to share some personal data we have collected with the other users of the Platform. For example, if you are a buyer, then we need to share your name and delivery address with a courier. We may also need to enable the courier to contact you in case the delivery location needs to be clarified. Alternatively, if you are a courier, then your location data may be shared with a buyer to show the progress of the delivery and the ETA. If you are applying to become a courier then we may share your information with background check providers. We may also share personal data with trusted third parties we work with such as Stripe for payments; Google/Facebook to show you products or services that might interest you while you are browsing the internet (based on either your marketing consent or your acceptance of cookies on our Platform); and cloud storage providers to store the data.

When working with third parties, we provide only the information they need to perform their specific services and they may only use your data for the exact purposes we specify in our contract with them. If we stop using their services, any of your data held by them will either be deleted or rendered anonymous.

In specific circumstances we may share personal data with third parties for their own purpose. Examples of such circumstances are:

• For fraud management, we may share information about fraudulent or potentially fraudulent activity in our premises or systems. This may include sharing data about individuals with law enforcement bodies.
• We may also be required to disclose your personal data to the police or other enforcement, regulatory or Government body, in your country of origin or elsewhere, upon a valid request to do so. These requests are assessed on a case-by-case basis and take the privacy of our customers into consideration.
• From time to time, we may expand, reduce or sell the Company and this may involve the transfer of parts of or the whole business to new owners. If this happens, your personal data will, where relevant, be transferred to the new owner or controlling party, under the terms of this Privacy Notice.

Google Analytics and Stripe are currently the only third parties we use to process your personal data as part of their contract with us. We use their services to be able to provide the best customer experience.

On our website we have integrated the component of Google Analytics (with the anonymiser function). Google Analytics is a web analytics service. Web analytics is the collection, gathering and analysis of data about the behaviour of visitors to websites. A web analysis service collects, inter alia, data about the website from which a person has come (the so-called referrer), which sub-pages were visited, or how often and for what duration a sub-page was viewed. Web analytics are mainly used for the optimisation of a website and in order to carry out a cost-benefit analysis of Internet advertising.

The operator of the Google Analytics component is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, United States.

For the web analytics through Google Analytics the controller uses the application "_gat._anonymizeIp". By means of this application the IP address of the Internet connection of the data subject is abridged by Google and anonymised when accessing our websites from a Member State of the European Union or another Contracting State to the Agreement on the European Economic Area.

The purpose of the Google Analytics component is to analyse the traffic on our website. Google uses the collected data and information, inter alia, to evaluate the use of our website and to provide online reports, which show the activities on our websites, and to provide other services concerning the use of our Internet site for us.

Google Analytics places a cookie on the information technology system of the data subject. The definition of cookies is explained above. With the setting of the cookie, Google is enabled to analyse the use of our website. With each call-up to one of the individual pages of this Internet site, which is operated by the controller and into which a Google Analytics component was integrated, the Internet browser on the information technology system of the data subject will automatically submit data through the Google Analytics component for the purpose of online advertising and the settlement of commissions to Google. During the course of this technical procedure, the enterprise Google gains knowledge of personal information, such as the IP address of the data subject, which serves Google, inter alia, to understand the origin of visitors and clicks, and subsequently create commission settlements.

The cookie is used to store personal information, such as the access time, the location from which the access was made, and the frequency of visits of our website by the data subject. With each visit to our Internet site, such personal data, including the IP address of the Internet access used by the data subject, will be transmitted to Google in the United States of America. These personal data are stored by Google in the United States of America. Google may pass these personal data collected through the technical procedure to third parties.

The data subject may, as stated above, prevent the setting of cookies through our website at any time by means of a corresponding adjustment of the web browser used and thus permanently deny the setting of cookies. Such an adjustment to the Internet browser used would also prevent Google Analytics from setting a cookie on the information technology system of the data subject. In addition, cookies already in use by Google Analytics may be deleted at any time via a web browser or other software programs.

In addition, the data subject has the possibility of objecting to a collection of data that are generated by Google Analytics, which is related to the use of this website, as well as the processing of this data by Google and the chance to preclude any such. For this purpose, the data subject must download a browser add-on under the link https://tools.google.com/dlpage/gaoptout and install it. This browser add-on tells Google Analytics through a JavaScript that any data and information about the visits of Internet pages may not be transmitted to Google Analytics. The installation of the browser add-on is considered an objection by Google. If the information technology system of the data subject is later deleted, formatted, or newly installed, then the data subject must reinstall the browser add-on to disable Google Analytics. If the browser add-on was uninstalled by the data subject or any other person who is attributable to their sphere of competence, or is disabled, it is possible to execute the reinstallation or reactivation of the browser add-on.

Further information and the applicable data protection provisions of Google may be retrieved under https://www.google.com/intl/en/policies/privacy/ and under https://www.google.com/analytics/terms/us.html. Google Analytics is further explained under https://www.google.com/analytics/.

On this website, we have integrated components of Stripe. Stripe is an online payment service provider. Payments are processed via so-called Stripe accounts, which represent virtual private or business accounts. Stripe is also able to process virtual payments through credit cards when a user does not have a Stripe account. A Stripe account is managed via an email address, which is why there are no classic account numbers. Stripe makes it possible to trigger online payments to third parties or to receive payments.

The entity responsible for the collection and processing of Personal Data for residents of the European Economic Area (EEA) and Switzerland is Stripe Payments Europe, Ltd., a company incorporated in Ireland and with offices at 1 Grand Canal Street Lower, Grand Canal Dock, Dublin. To exercise your rights, the Data Protection Officer may be contacted via dpo@stripe.com. By selecting a payment option, the data subject agrees to the transfer of personal data required for payment processing. The personal data transmitted to Stripe is usually first name, last name, address, email address, IP address, telephone number, mobile phone number, or other data necessary for payment processing. The processing of the purchase contract also requires such personal data, which are in connection with the respective order.

The transmission of the data is aimed at payment processing and fraud prevention. The controller will transfer personal data to Stripe, in particular, provided that a legitimate interest in the transmission exists. The personal data exchanged between Stripe and the controller for the processing of the data will be transmitted by Stripe to economic credit agencies. This transmission is intended for identity and creditworthiness checks.

Stripe will, if necessary, pass on personal data to affiliates and service providers or subcontractors to the extent that this is necessary to fulfil contractual obligations or for data to be processed in the order.

The data subject has the possibility to revoke consent for the handling of personal data at any time from Stripe. A revocation shall not have any effect on personal data which must be processed, used or transmitted in accordance with (contractual) payment processing.

The applicable data protection provisions of Stripe may be retrieved under https://stripe.com/privacy.

If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner's Office: https://ico.org.uk/make-a-complaint/.

We may provide public forums like bulletin boards, blogs, or chat rooms on our website. These forums are provided as a service to our users to help them exchange ideas and information related to our services. Any personal information you choose to submit in such a forum may be read, collected, or used by others who visit these forums, and may be used to send you unsolicited messages. We are not responsible for the personal information you choose to submit in these forums.

We also post users and customer testimonials on our website that may contain information such as the users' names and titles. We will obtain the consent of each user prior to posting any information or testimonials on the website.

Our website may contain links to third-party websites. These third-party websites maintain their own policies regarding cookies and the collection and use of personal information. We assume no responsibility or liability for the actions of such third parties with respect to their collection or use of information. We encourage visitors and users to read the privacy policies of every website that you visit through a link on our website.

We may need to update this Privacy Notice from time to time. Any changes will be posted on the Platform and we will also notify you about the changes as appropriate through push notifications or emails.