1.1. This Privacy Policy determines the Administration's responsibilities towards non-disclosure and protection of the confidentiality of personal data provided by the User on the Administration's request when register on the Tilda Platform (hereinafter — the Platform) and during further interaction with the Platform.

1.2. The Privacy Policy refers to all information that the Platform can collect about a User while they are using the services of the Platform. By registering on this Platform, the User consents to all terms of this Privacy Policy.

1.3. The Privacy Policy may be amended by the Administration without prior notification. The current Privacy Policy is at all times available at https://tilda.cc/privacy/.

2.1. For each purpose of personal data processing, the administration determines the categories and list of personal data processed, the methods, terms of their processing and storage, the procedure for the destruction of personal data when the purposes of their processing are achieved or when other legal grounds arise.

2.2. The Administration has determined the following purposes for processing the User’s Personal Data:
1) Providing access to the Platform (registration);
2) Ensuring the security of the Platform and its correct functioning;
3) Restoring access to the Account (if it was stolen / login and password was lost / login error during registration / it is not possible to use two-factor authentication);
4) Providing access within the framework of paid tariffs when paying by a bank card;
5) Ensuring the reliability of the Platform and the ability to recover data after failures using backup and data recovery technologies;
6) Processing on behalf of the User for the implementation of processes automated by the User using the Platform (regulated by the Data Processing Agreement);
7) Transfer of the User’s Personal Data to another Controller when the User transfers their profile to it.

2.3. The Administration processes Personal Data as described below:

2.3.1. The purpose of processing — to provide access to the Platform (registration)

Processed Personal Data:

• Name;
• Email;
• Unique identifier of the User used on the Platform (ID).

Processing is carried out automatically/with the User's participation:

• IP;
• City/Country (by IP);
• Browser Version;
• Language;
• UTM parameters;
• Partner Tag;
• The address of a website page's referrer;
• Cookie data used to identify the User without the use of technical measures.

Grounds for processing of Personal Data — processing shall be carried out as part of fulfillment of contractual obligations.

Types of processing of Personal Data:

• Collection, recording, systematization, accumulation, storage of Personal Data;
• Clarification (update, modification) is performed by the subject of Personal Data via the profile management form, as well as automatically during the User's interaction with the Website;
• De-identification, blocking, destruction of Personal Data is performed through the Control Panel for User management.

Retention period of Personal Data — Personal Data shall be stored for the entire duration of the agreement/during the periods established by the current United Arab Emirates legislation.

Deletion of Personal Data — Personal Data are deleted by the User in the Personal Account or automatically at the end of the storage period for the data collected in automatic mode. The fact of deletion is recorded in the Platform logs.

2.3.2. The purpose of processing — to ensure the security of the Platform and its correct functioning

Processed Personal Data — phone number.

Grounds for processing of Personal Data — processing is performed within the framework of fulfillment of contractual obligations.

Types of processing of Personal Data:

• Collection, recording, systematization, accumulation, storage (if fraudulent activities, spam or mass registration are suspected, the User shall provide the Administration with a contact phone number to confirm independent actions in the Personal Account);
• Viewing, depersonalization, blocking through the Control panel for user management.

Retention period of Personal Data — Personal Data shall be stored during the entire term of the agreement/during the periods established by the current United Arab Emirates legislation.

Deletion of Personal Data — Personal Data are deleted by the User in the Personal Account. The fact of deletion is recorded in the Platform logs and stored for the period of time specified by the current legislation of the United Arab Emirates.

2.3.3. The purpose of processing — to restore access to the Account (if it has been stolen/lost login and password/error in login during registration/no possibility to use two-factor authentication)

Processed Personal Data:

• The last 4 digits of the bank card;
• Phone number.

Grounds for processing of Personal Data — processing is performed within the framework of fulfillment of contractual obligations.

Types of processing of Personal Data:

• Collection, recording, accumulation, storage, depersonalization, blocking, deletion;
• Viewing through the Control Panel for user management.

Retention period of Personal Data — Personal Data shall be stored for the entire duration of the agreement.

Deletion of Personal Data — Personal Data are deleted by the Administration after the goal is achieved.

2.3.4. The purpose of processing — to ensure the reliability of the Platform operation and the possibility of data recovery after failures using data backup and recovery technologies

Processed Personal Data — all data processed by the Administration and listed in this document.

Grounds for processing of Personal Data — processing is carried out within the framework of fulfillment of contractual obligations.

Types of processing of Personal Data:

• Storage;
• Transfer for realization of geo-distributed storage of backup copies;
• Deletion is performed automatically upon expiration of the retention period of the backup copies of the data

Processing shall be carried out by hosting the Platform on the facilities leased by the Processor in data processing centres provided by partners with whom agreements have been concluded to guarantee the security of the Personal Data processed by them:

• Hetzner;
• GCore.

Retention period of Personal Data — Personal Data shall be stored for the entire term of the agreement/for the terms established by the applicable laws of the United Arab Emirates.

Deletion of Personal Data — Personal Data is deleted automatically upon expiration of the retention period of the backup copies of the data, as part of the backup and recovery process in place.

2.3.5. Purpose of processing — granting access within the framework of paid plans when paying by bank card

Processed Personal Data:

• Surname and first name on the card;
• Last 4 digits of the card;
• Card validity period;
• Eemail;
• User ID;
• Information about the completed purchase (tariff name, price, currency);
• Ttransaction number;
• Invoice ID;
• Country of issue of the card;
• Unique card identifier (fingerprint).

Grounds for processing of Personal Data — processing is carried out within the framework of fulfillment of contractual obligations.

Types of processing of Personal Data:

• Receipt of Personal Data from third parties, recording, systematization, accumulation, storage of Personal Data is carried out after payment for the plans on the page;
• Clarification (update, modification) is not performed;
• Deletion, depersonalization, blocking, destruction of Personal Data is performed through the Control Panel for User management.

Retention period of Personal Data — Personal Data shall be stored for the entire term of the agreement/for the terms established by the applicable laws of the United Arab Emirates.

Deletion of Personal Data — Personal Data shall be deleted after the expiration of the retention period specified by the applicable laws of the United Arab Emirates.

Payment for the Plan, in accordance with which the User uses the services of the Platform, shall be carried out using the payment systems Stripe, Telr. These payment systems collect and store financial information in accordance with their user agreements and privacy policies.

The administration does not store full card details and does not process payments, receiving only a notification from the payment system about the fact of successful payment.

In the process of receiving payment for the Plan, the Administration may collect additional information related to the payment made by the User, including, but not limited to, the transaction number, time of the transaction, type and expiration date of the card used for payments, as well as the last four digits of the card number, name of the cardholder, country and city in which funds were written off from the card.

2.3.6. The purpose of processing — to transfer of the User’s Personal Data to another Personal Data Controller when the User transfers profile to it

Processed Personal Data:

• Name;
• Email.

Grounds for processing of Personal Data — processing is carried out as part of the User’s consent expressed by action.

Types of processing of Personal Data: cross-border transfer of Personal Data. Shall be initiated by the Personal Data Subject by instructing the Administration to transfer his/her Personal Data to another Personal Data Controller located in another jurisdiction. Carried out by the User independently by interacting with the Platform through the User interface.

Retention period of Personal Data — Within the framework of this processing of Personal Data, they are not store.

Deletion of Personal Data — deletion of Personal Data is not performed due to the fact that it is not stored.

5.1. The main ways in which the Administration obtains the User's Personal Data:
1) The User provides Personal Data directly (for example, when registering or connecting and using third-party services integrated into the Platform);
2) Personal Data is collected automatically when the User browses or uses the Platform, for example by means of cookies (more details in the Cookie Policy);
3) Personal Data may be obtained from third parties and services integrated into the Platform and used by the User.

7.1. The processing and storage of the User's Personal Data is carried out legally during the existence of the User's Account, as well as within the terms established by the current legislation of the United Arab Emirates. In case of deletion of the Account, it is possible to retain part of the information to the extent necessary to fulfill legal obligations, settle disputes, prevent fraud, and protect the legitimate interests of the Administration.

7.2. In case of loss or disclosure of the User's Personal Data, the Administration shall notify the User of the fact of their personal data loss or disclosure.

7.3. In order to ensure adequate protection of the User's Personal Data, the Administration:
1) Appoints a person responsible for organizing the processing of Personal Data (Data Protection Officer;
2) Issues documents defining the Administration's policy regarding the processing of Personal Data, local acts on the issues of Personal Data processing, defining for each purpose of Personal Data processing the categories and list of processed Personal Data, categories of subjects whose Personal Data are processed, methods, terms of their processing and storage, the procedure for destruction of Personal Data upon achievement of the goals of their processing or upon occurrence of other legitimate grounds, as well as local acts establishing procedures aimed at detecting and preventing violations of the United Arab Emirates legislation and eliminating the consequences of such violations;
3) Applies legal, organizational and technical measures to protect Personal Data from unlawful or accidental access to it, destruction, modification, blocking, copying, provision, distribution of Personal Data, as well as from other unlawful actions in relation to Personal Data, necessary to fulfill the requirements to the protection of personal data established by the Law.;

4) Identifies threats to the security of personal data during its processing in personal data information systems;

5) Evaluates the effectiveness of the measures taken to ensure the security of Personal Data prior to the commissioning of Personal Data information systems;
6) Detects unauthorized access to Personal Data and takes measures to detect, prevent and eliminate the consequences of computer attacks on Personal Data information systems and respond to computer incidents therein;
7) Restores Personal Data modified or destroyed due to unauthorized access to it;
8) Establishes rules of access to Personal Data processed in Personal Data information systems, as well as ensures registration and record keeping of all actions performed with Personal Data in Personal Data information systems;
9) Exercises control over the measures taken to ensure the security of Personal Data and the level of protection of Personal Data information systems;
10) Exercises internal control and (or) audit of compliance of Personal Data processing with the Law, regulatory legal acts adopted in accordance with it, requirements to Personal Data protection, operator's policy on Personal Data processing, local acts of the operator;
11) Assesses the harm that may be caused to the subjects of Personal Data in case of violation of the Law, the correlation between this harm and the measures taken by the operator to ensure the fulfillment of obligations under this Law.

7.4. The Administration shall organize, inter alia:
1) A system of continuous monitoring of detection of non-standard behavior of information systems with subsequent analysis for unauthorized access or common errors;
2) Provision of a secure channel for accessing/processing Personal Data (HTTPS, TLS1.2+);
3) Introduction of two-factor authorization for both Administration employees and Users;
4) Annual audit of the information system, which is a control over the measures taken to ensure the security of Personal Data and the level of protection of the information system of Personal Data;
5) Loosely coupled microservice architecture, where each microservice processes only those Personal Data and the minimum necessary for its operation;
6) Storage of sensitive data in encrypted form with a variable encryption key;
7) Implementation of the public Bug Bounty vulnerability search program, within the framework of which each User can inform the Administration about the vulnerabilities they have discovered.

7.4. The Administration detects facts of unauthorized access to Personal Data and takes measures, including detection, prevention and elimination of consequences of computer attacks on information systems of Personal Data and response to computer incidents in them.
The Administration has adopted local acts on Personal Data security issues.

7.5. Employees of the Administration having access to Personal Data are familiarized with this Policy and local acts on Personal Data security issues.

8.1. The User can independently, by authorizing in the Personal Account, update, restrict the use or change Personal Data they have provided.

8.2. In order to withdraw Personal Data and delete the Account, the User should send a relevant request to the legal@tilda.cc email address, in response to which the User will receive a letter with a link to the page in the Personal Account, where they will have to confirm their intention to delete Personal Data and the Account.
The deadline for deleting Personal Data is 30 days.

8.3. For technical reasons, the information may be deleted not immediately, but with a delay. In this case, the Administration blocks such Personal Data until their complete deletion from its databases, in connection with which, such Personal Data become inaccessible and their use - impossible.
It should also be taken into account that it is possible to retain some of the information to the extent necessary for the fulfillment of legal obligations, dispute resolution, fraud prevention and protection of legitimate interests of the Administration.

8.4. After the final deletion of data and Account, all Personal Data and information will be deleted from the databases of the Administration (after the expiration of storage periods established by applicable law). Upon completion of this process, the User will no longer be able to use the Platform services, and the Account and all data will be deleted without the possibility of recovery.

9.1. In relation to the Administration, the User provides their Personal Data and keeps it up to date.

9.2. The User independently regulates relations with third parties, with whom they interact through their website, regarding the data collected on the User's website and bears responsibility both to third parties and to regulatory authorities.

9.3. In accordance with the applicable law, the User has the following rights in relation to Personal Data processed by the Administration:
1) The right to receive information about the processing of Personal Data by the Administration;
2) The right of access to processed Personal Data;
3) The right to receive from the Administration the Personal Data processed by it in a generally accepted machine-readable format (right to data portability);
4) The right to clarify and correct Personal Data;
5) The right to stop processing and delete Personal Data (the right to be "forgotten")
6) The right to restrict the processing of Personal Data;
7) The right to restrict decision-making based solely on the automated processing of Personal Data (including refusal of profiling);
8) The right to receive information about the restriction or termination of processing of Personal Data at the initiative of the Administration;
9) The right to object to the processing of Personal Data.

9.4. To exercise the listed rights, the User should contact the Administration, as described in the Contacts section hereof.

9.5. Also, according to the applicable law, the user has the right to contact the government body supervising the processing of Personal Data — UAE Data office.

10.1. The Administration undertakes to:
1) Use Personal Data provided by the User exclusively for the purposes specified in this Privacy Policy;
2) Keep the confidentiality of Personal Data; not to disclose Personal Data of the User without prior permission of the User, except as expressly provided by law; not to sell, exchange, publish or disclose it Personal Data by any other means, except as specified in this Privacy Policy;
3) Take measures to protect the confidentiality of the User's Personal Data in accordance with the internal procedures of the Administration;
4) Immediately block the User's Personal Data after receiving a request from the User or their legal representative or the appropriate authority for the protection of the User's Personal Data during the verification of this information in case of detection of invalid data or unauthorized actions.

10.2. In accordance with the applicable law, the Administration may request from the User confirmation of the existence of legal grounds regarding the User’s processing of personal data processed by him/her using the Platform.

10.3. The Administration shall be entitled not to respond to the User’s request in the following cases:
1) The request is not related to the User’s Personal Data, or is repeated too often;
2) The request is contrary to judicial procedures or investigations carried out by the competent authorities;
3) The request has a negative impact on the Administration’s efforts to ensure information security;
4) The request concerns the confidentiality of Personal Data of third parties which are not Clients of the User;
5) The request contradicts other legislation to which the Administration is subject.

10.4. The Administration shall be entitled to continue processing of Personal Data without the Consent of the Personal Data subjects in the following cases:
1) When processing is limited to storage of Personal Data;
2) When processing is necessary for initiation or defense of any proceedings relating to a claim of rights or legal action, or connected with legal proceedings;
3) If processing is necessary to protect the rights of third parties in accordance with the applicable law.
4) When processing is necessary for reasons of public interest.

10.5. In case of failure to perform its obligations, the Administration accepts liability for any losses, which amount is limited to the cost of the Plan, incurred by the User as a result of the unauthorized use of their Personal Data, in accordance with the legislation of the United Arab Emirates, except for the cases when Personal Data:
1) Was disclosed to the competent authorities of the United Arab Emirates;
2) Was disclosed by the third party after it was shared by the Administration with the User's consent;
3) Became public before it was lost or disclosed;
4) Was received from a third party before it was provided to the Administration;
5) Was disclosed with the User's consent;
6) Was disclosed as a result of a force majeure event;
7) Was disclosed as a result of a justified claim addressed to the User regarding the violation of the third parties' rights and/or the Terms of Service Agreement.

If you have any questions, comments or complaints about this Privacy Policy, please send us a request to the ticket system if you are an authorized User of the Platform.

If you are not an authorized User of the Platform, please contact us by sending an email to legal@tilda.cc — on legal issues and dpo@tilda.cc — on issues related to the organisation of processing and protection of personal data.