BOOSTIFIED—Pay Privacy Policy

This Privacy Policy explains how Boostified AB ("BOOSTIFIED—Pay", "we", "us", "our") collects, uses, stores and shares personal data when you access or use BOOSTIFIED—Pay, including our website, platform, applications, CRM functionality, campaigns, integrations and related services (collectively, the "Service").

We are committed to protecting your privacy and processing personal data in accordance with applicable data protection legislation, including the General Data Protection Regulation ("GDPR").

1. DATA CONTROLLER

BOOSTIFIED—Pay is operated by:

Boostified AB
Kärleksgatan 2A
211 49 Malmö
Sweden
info@boostifiedpay.com

Depending on how the Service is used, Boostified AB may act either as a data controller or as a data processor.

When we determine why and how personal data is processed — for example, when administering your BOOSTIFIED—Pay account, subscription, security or our own communications — Boostified AB acts as the data controller.

When a business, agency or other organisation uses BOOSTIFIED—Pay to store or manage personal data relating to its own contacts, creators, clients, employees or other individuals, Boostified AB may process that data on behalf of that customer as a data processor.

Where required, such processing may be governed by a separate Data Processing Agreement ("DPA").

2. PERSONAL DATA WE COLLECT

The personal data we collect depends on how you interact with BOOSTIFIED—Pay and which features you use.

2.1 Account data

When you create or use an account, we may collect:

• full name;

• email address;

• login credentials;

• profile information;

• profile image;

• company or organisation;

• professional role;

• account type;

• language preferences;

• notification preferences; and

• account settings.

Passwords are stored using appropriate security measures and are not stored as readable plain text.

2.2 Profile and professional information

Users may provide professional information through BOOSTIFIED—Pay, including:

• professional biography;

• portfolio information;

• images;

• videos;

• social media profiles;

• website links;

• professional categories;

• skills;

• location;

• languages;

• audience information;

• rates or pricing information;

• previous collaborations;

• brand relationships; and

• other information users choose to include in their professional profile.

The information visible to other users depends on the relevant feature, profile settings and context in which the information is shared.

2.3 Workspace data

Where users create or participate in Workspaces, we may process:

• Workspace name;

• Workspace settings;

• Workspace members;

• team member names and email addresses;

• roles and permissions;

• uploaded Workspace content;

• contact records;

• activity information;

• campaign information;

• collaboration information;

• notes;

• files;

• Workspace billing settings; and

• other information stored within the Workspace.

2.4 Agency-managed and representative profiles

Agencies, managers, companies and other authorised representatives may create or manage profiles and information relating to creators or other professionals they represent.

This may include:

• name;

• contact details;

• professional information;

• portfolio content;

• social media information;

• campaign history;

• brand relationships;

• rates;

• notes;

• collaboration information; and

• other professional information.

The organisation or person adding this information is responsible for ensuring that it has an appropriate legal basis or other lawful authority to process the relevant personal data.

Where Boostified AB processes such information solely on behalf of the organisation using the CRM, Boostified AB may act as a data processor.

2.5 CRM and contact data

Users may add professional contacts and relationship information to BOOSTIFIED—Pay.

CRM data may include:

• names;

• professional email addresses;

• telephone numbers;

• company names;

• job titles;

• social media profiles;

• websites;

• notes;

• relationship history;

• communication history;

• collaboration history;

• campaign information;

• commercial information;

• tags;

• status information; and

• other information entered by the user.

CRM data may relate to individuals who do not themselves have a BOOSTIFIED—Pay account.

Where a customer enters and manages such information through BOOSTIFIED—Pay for its own purposes, the customer is generally responsible for determining the legal basis for that processing.

Boostified AB processes such data to provide the CRM functionality requested by the customer.

2.6 Campaign and collaboration data

When users create, manage, apply to or participate in campaigns or collaborations, we may process information including:

• campaign applications;

• invitations;

• briefs;

• deliverables;

• campaign status;

• deadlines;

• compensation information;

• agreed terms;

• approvals;

• feedback;

• files;

• messages;

• usage rights information;

• campaign history; and

• other information relating to the collaboration.

The parties to a campaign may determine which information they require from each other.

BOOSTIFIED—Pay provides the technical infrastructure for storing and managing this information unless otherwise expressly agreed.

2.7 Communications

When you communicate through BOOSTIFIED—Pay or contact us, we may process:

• messages sent through the Service;

• emails;

• support requests;

• responses;

• attachments;

• feedback;

• customer service history; and

• other communications.

Where users communicate with each other through the Service, the relevant communication may be stored as part of the applicable Workspace, CRM relationship or collaboration.

2.8 Billing and subscription data

Where you purchase a paid Service, we may process:

• billing name;

• company information;

• billing address;

• VAT information;

• subscription information;

• transaction history;

• invoice information;

• payment status; and

• limited payment-related information provided by our payment service providers.

Payment card information may be processed directly by an independent payment service provider.

BOOSTIFIED—Pay does not necessarily receive or store complete payment card details.

2.9 Technical and usage data

When you access or use BOOSTIFIED—Pay, we may automatically collect technical information including:

• IP address;

• device identifiers;

• device type;

• browser;

• operating system;

• login timestamps;

• session information;

• pages or features accessed;

• navigation information;

• interactions with the Service;

• error logs;

• security events; and

• diagnostic information.

This information is used to operate, secure, troubleshoot and improve the Service.

3. SOCIAL MEDIA AND THIRD-PARTY INTEGRATIONS

BOOSTIFIED—Pay may allow users to connect social media accounts and other third-party services.

Connecting an external account is optional unless clearly stated otherwise for a particular feature.

When you choose to connect an account, we may receive information made available by the relevant third-party provider and authorised by you.

Depending on the provider, integration and permissions granted, this may include:

• account name;

• username;

• profile information;

• profile image;

• audience or follower information;

• content metadata;

• engagement information;

• performance statistics;

• public content; and

• other information authorised through the relevant integration.

We only process information made available through the relevant integration in accordance with the permissions granted and the functionality of the Service.

Certain information may be displayed to other BOOSTIFIED—Pay users where this is part of the functionality you are using.

BOOSTIFIED—Pay does not sell personal data obtained through connected social media accounts.

You may disconnect supported integrations, subject to the functionality and requirements of the relevant third-party provider.

Third-party platforms operate under their own terms and privacy policies.

4. HOW WE USE PERSONAL DATA

Depending on the context, we may use personal data to:

• create and administer accounts;

• authenticate users;

• provide CRM functionality;

• provide professional profiles;

• create and manage Workspaces;

• allow agencies and teams to manage authorised profiles;

• enable users to discover professional contacts;

• enable users to discover brands, creators and opportunities;

• enable campaign and collaboration management;

• facilitate communication between users;

• provide portfolio functionality;

• provide social media integrations;

• provide analytics and insights;

• process subscriptions and payments;

• provide customer support;

• maintain and improve the Service;

• monitor platform performance;

• detect and prevent fraud or abuse;

• protect the security of accounts and the Service;

• troubleshoot technical issues;

• send important service communications;

• send product updates;

• send marketing communications where legally permitted;

• comply with legal obligations;

• establish, exercise or defend legal claims; and

• enforce our Terms & Conditions.

We will not process personal data for purposes that are incompatible with the purposes for which it was collected unless permitted by applicable law.

5. LEGAL BASES FOR PROCESSING

Under the GDPR, we rely on different legal bases depending on the processing activity.

5.1 Performance of a contract

We may process personal data where necessary to provide BOOSTIFIED—Pay and perform our contractual obligations to you.

This may include:

• creating and maintaining your account;

• providing requested platform functionality;

• administering subscriptions;

• providing customer support; and

• providing requested integrations.

The legal basis is Article 6(1)(b) GDPR.

5.2 Legitimate interests

We may process personal data where necessary for our legitimate interests or those of another party, provided those interests are not overridden by your fundamental rights and freedoms.

Legitimate interests may include:

• securing the Service;

• preventing fraud and abuse;

• improving BOOSTIFIED—Pay;

• understanding Service usage;

• maintaining business operations;

• providing relevant professional functionality; and

• protecting our legal rights.

The legal basis is Article 6(1)(f) GDPR.

5.3 Consent

Where required, we may process personal data based on your consent.

This may apply to certain:

• marketing communications;

• cookies;

• tracking technologies;

• integrations; or

• other optional processing activities.

The legal basis is Article 6(1)(a) GDPR.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

5.4 Legal obligations

We may process personal data where necessary to comply with legal obligations, including:

• accounting;

• taxation;

• regulatory requirements;

• lawful requests from authorities; and

• other applicable legal obligations.

The legal basis is Article 6(1)(c) GDPR.

6. WHEN CUSTOMERS ACT AS DATA CONTROLLERS

BOOSTIFIED—Pay is a CRM platform.

Businesses, agencies and other organisations may use the Service to process personal data relating to their own creators, contacts, clients, employees, freelancers or other individuals.

In these situations, the customer may determine why and how that personal data is processed and therefore act as the data controller.

Boostified AB may act as a data processor by storing and otherwise processing the data according to the customer's instructions and for the purpose of providing the Service.

The relevant customer is responsible for:

• determining an appropriate legal basis;

• providing required privacy information;

• responding to data subject requests where applicable;

• ensuring that information entered into the CRM is processed lawfully; and

• complying with its own obligations under applicable data protection law.

Where required, our Data Processing Agreement governs Boostified AB's processing on behalf of the customer.

7. SHARING BETWEEN BOOSTIFIED—PAY USERS

Certain personal information is intended to be shared with other users as part of the Service.

For example, depending on the functionality used:

• creators may make professional profiles visible to brands or agencies;

• brands may make company information or opportunities visible to creators;

• agencies may manage information on behalf of creators;

• campaign participants may access information necessary for a collaboration; and

• Workspace members may access information according to their permissions.

The information shared depends on the relevant feature and user settings.

BOOSTIFIED—Pay does not make all account or CRM information publicly available merely because it is stored in the Service.

8. SERVICE PROVIDERS AND SUBPROCESSORS

We use third-party service providers to operate and support BOOSTIFIED—Pay.

These providers may include:

• cloud hosting providers;

• database providers;

• authentication providers;

• payment processors;

• email and communication providers;

• analytics providers;

• monitoring and security providers;

• customer support providers;

• infrastructure providers; and

• integration partners.

These providers may process personal data only to the extent necessary to provide their services to us and subject to appropriate contractual and data protection requirements.

Where required by GDPR, processors acting on our behalf are subject to data processing agreements.

9. OTHER DISCLOSURES OF PERSONAL DATA

We may also disclose personal data:

• where required by law;

• in response to a valid legal request;

• to protect the rights, property or safety of BOOSTIFIED—Pay, our users or others;

• to investigate fraud, abuse or security incidents;

• in connection with legal proceedings; or

• in connection with a merger, acquisition, financing, restructuring or sale of all or part of our business.

Where legally required, appropriate safeguards will apply.

BOOSTIFIED—Pay does not sell personal data.

10. INTERNATIONAL DATA TRANSFERS

Some service providers used by BOOSTIFIED—Pay may process personal data outside Sweden or the European Economic Area ("EEA").

Where personal data is transferred outside the EEA, we use appropriate safeguards as required by applicable data protection law.

Depending on the circumstances, these may include:

• an adequacy decision adopted by the European Commission;

• EU Standard Contractual Clauses ("SCCs");

• additional contractual or technical safeguards; or

• another lawful transfer mechanism available under GDPR.

11. DATA RETENTION

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected or as required by law.

Retention periods depend on the type of information and context in which it is processed.

In general:

• account data is retained while the account remains active and for a reasonable period afterwards where necessary;

• Workspace and CRM data is retained according to the customer's use of the Service and deletion instructions;

• campaign and collaboration information may be retained while necessary to provide the Service and document relevant activity;

• support communications may be retained where necessary for customer service, security and legal purposes;

• billing and accounting records are retained for the period required by applicable accounting and tax legislation;

• security and technical logs are retained only for as long as reasonably necessary for security, diagnostics and fraud prevention; and

• backups may temporarily contain deleted information until those backups are overwritten in accordance with our backup procedures.

We may retain information for longer where necessary to comply with legal obligations or establish, exercise or defend legal claims.

12. ACCOUNT AND WORKSPACE DELETION

Users may be able to delete accounts, profiles, content or Workspaces through the Service or by contacting us.

Deleting a personal account does not necessarily delete information controlled by another user or organisation.

For example, if an agency or company lawfully stores professional CRM information relating to an individual, deletion of that individual's separate BOOSTIFIED—Pay account does not automatically require deletion of information controlled by that organisation.

Where Boostified AB acts as a processor, deletion and retention may be determined by the relevant data controller.

13. YOUR GDPR RIGHTS

Subject to applicable law, you may have the right to:

• access personal data we hold about you;

• request correction of inaccurate or incomplete personal data;

• request deletion of your personal data;

• request restriction of processing;

• object to processing based on legitimate interests;

• receive certain personal data in a portable format;

• withdraw consent where processing is based on consent; and

• lodge a complaint with a competent data protection authority.

These rights are not absolute and may be subject to legal exceptions.

Where Boostified AB is the data controller, you may contact us to exercise your rights.

Where personal data is controlled by one of our business customers and Boostified AB acts only as a processor, your request may need to be handled by that customer. We will provide reasonable assistance where required.

14. MARKETING COMMUNICATIONS

BOOSTIFIED—Pay may send marketing communications where permitted by applicable law.

Where consent is required, we will request consent before sending such communications.

You may unsubscribe from marketing communications at any time by:

• using the unsubscribe link included in the communication;

• changing available notification settings; or

• contacting us.

Unsubscribing from marketing communications does not prevent us from sending essential transactional or service-related communications, such as:

• security alerts;

• account notifications;

• billing information;

• important Service updates; or

• other communications necessary to provide the Service.

15. COOKIES AND SIMILAR TECHNOLOGIES

BOOSTIFIED—Pay may use cookies and similar technologies for purposes including:

• authentication;

• security;

• remembering preferences;

• essential Service functionality;

• performance monitoring;

• analytics; and

• understanding how the Service is used.

Where required by applicable law, non-essential cookies or similar technologies will only be used after appropriate consent has been obtained.

Users can manage available cookie preferences through our cookie consent tools.

More detailed information about cookies may be provided in our cookie notice or consent interface.

16. SECURITY

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Depending on the relevant systems and risks, these measures may include:

• encryption in transit;

• encryption at rest where appropriate;

• access controls;

• authentication controls;

• monitoring;

• logging;

• infrastructure security;

• backup procedures;

• secure development practices; and

• internal access restrictions.

No online system can be guaranteed to be completely secure.

Users are also responsible for protecting their account credentials and maintaining appropriate security over devices used to access BOOSTIFIED—Pay.

17. DATA BREACHES

Where a personal data breach occurs, BOOSTIFIED—Pay will assess the incident and take appropriate action in accordance with applicable data protection law.

Where Boostified AB acts as a data processor, we will notify the relevant data controller without undue delay where required by GDPR.

Where Boostified AB acts as a data controller and notification is legally required, we will notify the relevant supervisory authority and affected individuals in accordance with applicable law.

18. AUTOMATED DECISION-MAKING

BOOSTIFIED—Pay does not currently use solely automated decision-making that produces legal effects or similarly significant effects on individuals within the meaning of Article 22 GDPR.

The Service may use algorithms, filters, search functionality, recommendations or other automated functionality to organise or present information.

Such functionality does not by itself constitute automated decision-making under Article 22 GDPR.

If we introduce qualifying automated decision-making in the future, we will provide the information and safeguards required by applicable law.

19. CHILDREN

BOOSTIFIED—Pay is intended for professional and business use and is not intended for children.

Users must meet the age requirements stated in our Terms & Conditions.

We do not knowingly collect personal data directly from children through standard account registration.

Where information relating to a minor is lawfully managed by an authorised representative, agency, parent or other organisation through the Service, that party is responsible for ensuring that it has the necessary legal authority and complies with applicable law.

20. THIRD-PARTY LINKS AND SERVICES

BOOSTIFIED—Pay may contain links to or integrations with third-party websites, platforms or services.

This Privacy Policy does not govern the independent processing activities of those third parties.

Users should review the privacy policies of relevant third-party services before providing personal data to them.

21. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect:

• changes to BOOSTIFIED—Pay;

• new functionality;

• changes in our processing activities;

• changes to third-party services;

• legal or regulatory requirements; or

• improvements to how we explain our privacy practices.

The latest version will be made available through BOOSTIFIED—Pay and will state the date on which it was last updated.

Where changes materially affect how we process personal data, we will provide additional notice where required by applicable law.

22. DATA PROTECTION AUTHORITY

If you are located in Sweden, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

If you are located elsewhere in the EU or EEA, you may also have the right to contact the competent data protection authority in your country.

We encourage you to contact us first if you have questions or concerns about how we process your personal data so that we have an opportunity to address them.

23. CONTACT

BOOSTIFIED—Pay is operated by:

Boostified AB
Kärleksgatan 2A
211 49 Malmö
Sweden
info@boostifiedpay.com