GDPR Privacy Notice
Last Updated: May 26, 2026
This GDPR privacy notice (“GDPR Notice”) is intended to assist EEA Residents that use our Service in understanding their rights with respect to their data and supplements our Privacy Policy. The European Union General Data Protection Regulation (EU) 2016/679 (“GDPR”) gives natural persons residing in the European Economic Area (EEA) and United Kingdom (UK) (“EEA Residents”) certain control over how their personal data is collected, processed, and maintained by organizations.. Under the GDPR,[Hartbeat Vertical, LLC (“we” “us”) is considered the data controller of the personal data collected through you use of the Service. Any terms not defined in this Notice are defined in our Privacy Policy, and in the event of a conflict between this Notice and our Privacy Policy, this Notice shall prevail. For more information regarding the GDPR, see https://gdpr.eu/.
1. International Transfers. By using the Service and providing us with personal data, you understand and agree that we may transfer and store your information on servers located outside your resident jurisdiction. To the extent you are an EEA Resident, you consent to the transfer of such data to the United States for processing by us in accordance with our Privacy Policy and this Notice.
Some of the entities (such as third-party vendors) to which we disclose information may be located outside of the EEA, including in countries that may not provide the same level of data protection as your home country. We take appropriate steps to ensure that such personnel and third-party vendors are bound to duties of confidentiality and we require that all of the vendors and third party service providers that handle any personal data from users of the Service enter into our Data Processing Addendum (“DPA”), or an agreement of similar form. This DPA sets forth standards that those handling personal data must meet to comply with GDPR.
2. Legal Bases for Processing Your Personal Data. In addition to the information provided in our Privacy Notice about how and why we process your personal information, we use and otherwise process each of the categories of information identified in our Privacy Notice for the following business purposes:
Purpose/activity
The lawful basis for processing, including basis of legitimate interest
To provide you with the information, products and services that you request from us; to allow you to participate in interactive features of our Services, when you choose to do so; to manage accounts; and to manage our relationship with you, including providing you with the information, products and services that you request from us, and notifying you about changes to our terms or Privacy Policy.
(a) Performance of a contract with you
(b) Necessity to comply with a legal obligation
(c) Necessity for our legitimate interests (for instance, to keep our records updated)
To make suggestions and recommendations to you about things that are similar to those that you have enquired about or may otherwise be of interest to you, or to send promotional materials from us or by our affiliates and trusted business partners.
Necessity for our legitimate interests (for instance, to grow our business)
To improve our Services and to ensure that content is presented in the most relevant and effective manner for you and for your device; to administer our Services, including troubleshooting, data analytics, testing, research, statistical and survey purposes; to keep our Services, business and users safe and secure; to comply with applicable laws and regulations; and to protect or exercise our legal rights or defend against legal claims.
(a) Necessity for our legitimate interests (for instance, for running and protecting our business; for provision of administration and IT services; for network security and to prevent cybercrime and fraud; in the context of a business reorganisation or group restructuring exercise; to study how people use our Services, to develop the Services, to keep our Services updated and relevant, to grow our business and to inform our communications strategy)
(b) Necessity to comply with a legal obligation
Where legally required and we have no other valid legal basis to process your information, we will obtain consent (for example, to provide you with marketing information or share information with third parties), which may subsequently be withdrawn at any time by contacting us. Withdrawing consent does not affect the lawfulness of processing based on consent before it is withdrawn.
3. GDPR Rights. GDPR affords EEA Residents the following rights:
· [Right to Access]: The right to request access to any personal data that we collect pertaining to you and request copies of such data. There may be a small fee associated with the request of copies of the data, depending on the size and complexity of the request.
· [Right to Rectification]: The right to request rectification of any data that we collect pertaining to you or completion of incomplete personal data.
· [Right to Data Portability]: Under certain conditions set forth in GDPR, the right to request that the data we have collected from you be transferred to another organization or directly to you in a portable format.
· [Right to Erasure]: The right to request that we erase your personal data which we have collected.
· [Right to Restrict Processing]: Under certain conditions set forth in GDPR, the right to request that we restrict the processing of your personal data.
· [Right to Object to Processing]: The right to object to our processing of your personal data. An objection may prevent processing even where consent is not the lawful basis for processing.
· [Right to Withdraw Consent]: The right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. If you are a user of our Service, you can also withdraw consent from any creator you have signed up with.
· [Right to Lodge Complaint]: The right to lodge a complaint with the Supervisory Authority. Should you wish to file a complaint regarding your GDPR rights or if you feel we have not addressed any concerns you have in a satisfactory manner, you can contact the Information Commissioner’s Office regarding your concerns. You can initiate your complaint by going to https://ico.org.uk/make-a-complaint/.
· [Automatic decision-making]: The right to object to processing based solely on automated decision-making (which includes profiling), when that decision-making has a legal effect on you or otherwise significantly affects you. We do not engage in fully automated decision-making that has a legal or otherwise significant effect.
3. Contact Us. For more information regarding how we handle your data or how we handle EEA Residents rights under GDPR, please see our Privacy Policy or contact us at: legal@hartbeat.com
