What Personal Data We Process about BzzAgent Members and How We Obtain It

We collect Personal Data directly from you, automatically through your use of the Platform, and, where applicable, from third-party services you choose to connect. Most profile questions are optional unless they are required to participate in a specific campaign. If we materially change the categories of Personal Data we collect, we will update this Privacy Notice and, where required, provide additional notice.

1. Account and profile information

When you create a BzzAgent account and complete your profile, we may collect:

• Name, email address
• Mailing address (used to ship products or provide physical coupons). We do not ship to P.O. boxes.
• Date of birth and country of residence (used to confirm eligibility)
• Demographic information you choose to provide, such as gender, ethnicity, household composition, whether you rent or own your home, the type of community you live in (for example, rural/suburban/urban), whether you have children (and age ranges), marital status, pets, employment status and industry, education level, income ranges, and, where relevant for certain campaigns, information such as skin tone and hair type.

This information is used to manage your account and to match you with campaigns based on criteria defined by brands.

2. Campaign participation and eligibility information

When you apply for or participate in campaigns, we collect and generate information such as:

• Campaign applications, invitations, selection status, and participation history
• Campaign-specific questionnaire responses
• Reviews you submit, including ratings, text, photos, timestamps, and associated metadata
• Shipping and fulfillment status related to campaign products
• Compliance and eligibility indicators, such as completion status and moderation flags

3. Instagram and social media information (if you choose to link an account)

If you choose to link a public Instagram digital creator account to participate in Instagram-based campaigns, we may collect:

• Your Instagram handle and confirmation that the account is a public digital creator account
• Public posts created as part of a campaign
• Engagement metrics related to those posts, such as likes, comments, shares, and timestamps
• Public profile information relevant to campaign eligibility or performance, such as follower count or similar metrics that may be used to estimate reach
• Information necessary to verify required hashtags, tags, and campaign timing

We access only public information and only for registered members who have opted into campaigns that require Instagram participation. You may unlink your Instagram account at any time, which will affect eligibility for future campaigns.

Only public Instagram accounts designated as ‘digital creator’ accounts can be linked for Instagram campaigns. We monitor only public information and only during the campaign period to confirm required hashtags/tags and participation. Our systems validate participation by matching the member, required hashtags/tags, and the live campaign timeframe. For Instagram campaigns, you may be required to keep campaign posts live for the duration of the campaign. In limited circumstances, we may re-check or refresh relevant public campaign posts or associated public engagement metrics after a campaign has closed, where reasonably necessary to validate participation, resolve disputes, prevent fraud or abuse, complete reporting obligations, or address technical reconciliation issues. Any such follow-up review is limited to public information related to the campaign.

4. Communications Data

• We collect information related to communications with you, including:
•  Emails and support requests you send to our support inbox or other contact addresses
•  Responses to surveys or feedback requests related to the BzzAgent community or campaigns
•  Communications we send to you, such as campaign invitations, reminders, and operational updates

5. Technical and Usage information

When you access or use the Platform, we automatically collect certain technical information, including:

• IP address and approximate location (country)
• Device type, browser type, and operating system
• Log data, timestamps, and interactions with Platform features

This information is used to operate, secure, and improve the Platform and to prevent fraud and abuse.

6. Information Obtained with Tracking Technologies (such as Cookies)

We use cookies and similar tracking technologies on the Website to support core functionality, security, and analytics. Cookies are small text files stored on your device when you visit a website and are commonly used to make websites work efficiently and to provide information to website operators. You can manage your cookie preferences at any time for the Website through our cookie consent management tool. The cookies used on the Website, their purposes, and their retention periods are described below.

[Cookie list: <!– OneTrust cookies list start –>

<div id="ot-sdk-cookie-policy"></div>

<!– OneTrust cookies list end –>]

7. Information from Social Media Features and Public Social Media Content

The Platform may include features that allow you to connect with or interact with third-party social media platforms, such as Instagram (“Social Media Features”).

Third-party social media platforms operate independently from BzzAgent. Any information collected directly by those platforms, and your interactions with Social Media Features, are governed by the third party’s own terms, policies, and privacy notices.

These platforms may collect information about your visit to our Platform, including through embedded features or tracking technologies,regardless of whether you actively interact with them.

BzzAgent does not control how third-party social media platforms process Personal Data outside the BzzAgent Platform.

Promotions Data

If we offer sweepstakes, contests, giveaways, or similar promotions, and you choose to enter, we may collect information needed to operate the promotion and deliver prizes, such as:

• Promotion entry details (for example, entry submissions, responses, and timestamps)
• Eligibility information (for example, age confirmation, residency, and other eligibility responses)
• Winner selection and verification information (for example, declaration/affidavit responses and communications)
• Prize fulfillment details (for example, shipping address and delivery status)
• Where required by law, tax or regulatory information related to prizes (for example, tax forms)

California Consumer Privacy Act Categories

For purposes of the California Consumer Privacy Act (“CCPA”) and similar U.S. state privacy laws, the personal information we collect about BzzAgent members may fall into the following categories:

• Identifiers, such as name, email address, username, IP address, online identifiers, and social media handles where you choose to link an account.
• Personal information categories listed in California Civil Code § 1798.80,such as contact information, mailing address used to deliver products, samples, rewards, or promotional materials, and, where applicable, information needed for prize fulfillment or tax reporting.
• Characteristics of protected classifications, such as age range, gender, or ethnicity, where you choose to provide this information as part of your profile or in response to campaign or promotion questionnaires.
• Commercial information, such as records of campaign applications and participation, products or samples received, promotion or sweepstakes entries, prize or reward fulfillment, reviews submitted, and related engagement or completion status.
• Internet or other electronic network activity information, such as interactions with the Platform, log data, device information, IP address, browsing activity on the Website, and usage activity related to campaigns or promotions.
• Audio, electronic, visual, or similar information, such as photos, videos, reviews, ratings, and other content you submit as part of campaign participation, including public social media content (for example, public Instagram posts) created in connection with a campaign.
• Inferences, such as profiles or insights reflecting interests, preferences, demographics, or eligibility for certain campaigns or promotions, generated based on the information you provide and your activity on the Platform.

User Content and Public Posts

The Platform allows you to submit content as part of your participation in campaigns, including reviews, ratings, photos, and, where applicable, public social media posts created in connection with a campaign (“User Content”).

If you participate in a BzzAgent sampling or influencer campaign, the content you create and submit as part of that campaign is governed by the applicable Influencer Agreement and Terms of Use. That agreement describes the rights you grant to brands and, where applicable, to BzzAgent, including the use of campaign-related content for campaign administration, reporting, and BzzAgent’s own marketing and promotional purposes.

Some User Content is public by design. For example, reviews you submit and social media posts you create as part of a campaign may be publicly visible to brands, other users, and the general public. Public content may include your username or social media handle and other information you choose to include. We are not responsible for how others use or share content that you choose to make public.

Where you choose to link or post content on third-party platforms, such as Instagram, that content is also subject to the terms and privacy practices of those third-party services. We do not control how third-party platforms process Personal Data outside the BzzAgent Platform.

By choosing to participate in a social media campaign, you acknowledge that your public posts and handle created as part of that campaign may be viewed by BzzAgent and the sponsoring brand in accordance with the campaign terms and applicable agreements.

For What Purposes Do We Use Your Personal Data?

We process your Personal Data for the following purposes:

• To create and manage your BzzAgent account, including verifying your eligibility, maintaining your profile, and enabling access to the Platform.
• To match you with campaigns based on campaign criteria defined by brands and the information you choose to include in your profile.
• To administer campaigns, including allowing you to apply for campaigns, allowing us to select participants based on campaign criteria, to ship products or providing coupons, and manage campaign participation. Brands define the criteria for each campaign. Where more members qualify than there are available spots, selection is typically random among qualified applicants, and in limited cases a human review may be used for high-value or sensitive campaigns.
• To verify and validate campaign participation, including reviewing submitted reviews, monitoring required actions (such as validating required hashtags/tags during campaign or ensuring that campaign-specific requirements set by the sponsoring brand are met, such as minimum review length or other quality requirements), and, where applicable, monitoring public social media posts and engagement metrics during the campaign period. For campaign verification and review purposes, we may store references to public Instagram posts (such as URLs) and may display or render such content within the Platform. Depending on technical implementation, we may also temporarily process or store copies of public content as necessary to operate campaign features.
• To provide campaign reporting to brands, including generating campaign-level insights, performance metrics, and aggregated analytics, including demographic analysis, while limiting the sharing of individual profile data. Note that only BzzAgent/PowerReviews personnel who manage the BzzAgent community and campaigns have access to detailed member profiles and internal status indicators. Brands do not have direct access to member profiles within the Platform.
• To allow brands to send you the samples: In some cases, we may provide your mailing address to the Brand associated with your Campaign such that they can fulfill the samples you requested.
• To facilitate pharmacovigilance: If you consent, we will also pass along email, city, state and phone number to the brand in the event that you report an adverse event for pharmacovigilance.
• To communicate with you, including sending campaign invitations, reminders, operational messages, updates about your account, responding to your questions or support requests, and honoring your account settings (for example, if you turn off campaign invitations).
• To operate, maintain, and improve the Platform, including troubleshooting issues, monitoring usage patterns, improving functionality, and developing new features.
• To ensure the security and integrity of the Platform, including detecting and preventing fraud, abuse, misuse, multiple accounts, policy violations, and other activity that could undermine the community or campaigns.
• To moderate content and manage community quality, including identifying and reviewing potentially non-compliant behavior, enforcing our terms and influencer guidelines, and maintaining campaign standards. We use automated checks to detect suspected fraud, misuse, and policy violations (for example, multiple accounts, non-compliance with campaign requirements, or content quality issues). Flagged activity is reviewed by a human moderator. Where an account is restricted due to these checks, the member may stop receiving campaign invitations and may contact support if they believe a mistake has been made. Certain moderation thresholds may vary by campaign or client requirements.
• To run sweepstakes, contests, and promotions, including to operate and administer sweepstakes, contests, giveaways, and similar promotions, specifically to:
  • Register and verify eligibility of participants
  • Communicate with participants about the promotion
  • Select winners in accordance with the applicable rules
  • Deliver prizes, samples, rewards, or other benefits
  • Prevent fraud, abuse, or multiple entries
  • Comply with legal, tax, and regulatory requirements
  • Enforce the official rules and resolve disputes
  • Where permitted by law and described in the applicable promotion rules, we may also use Personal Data to announce or publish winner information, such as name, username, and state or country of residence. Participation in any promotion is subject to the official rules made available at the time of entry, which may contain additional details about how Personal Data is used in connection with that promotion.
• To use public content created in connection with BzzAgent campaigns, including public Instagram posts, for BzzAgent’s own marketing, promotional, and business purposes, in accordance with the Influencer Agreement and subject to your account settings and applicable law.
• To support analytics and benchmarking, using aggregated or de-identified data to understand campaign performance, platform trends, and service improvements.
• To comply with legal and regulatory obligations, including recordkeeping, responding to lawful requests from authorities, and establishing, exercising, or defending legal claims.

Subject to the Influencer Agreement, BzzAgent may also use public Instagram posts created in connection with a BzzAgent campaign for BzzAgent’s own marketing, promotional, and business purposes, such as on our websites, presentations, sales materials, or social media channels. We use only content that is publicly available and created as part of a campaign. Where feasible, we attribute content using your public username or handle. You may remove posts or unlink your Instagram account at any time, which will apply prospectively and may affect eligibility for future campaigns.

To achieve the above purposes, we need to perform different types of processing activities on your Personal Data, such as storage, access, transmission, consultation, manipulation, and combination.

Legal Bases / Lawful Bases for Processing

Where required under applicable data protection laws, such as the UK GDPR, we rely on the following legal bases to process your Personal Data:

• Performance of a contract: We process your Personal Data where it is necessary to provide the BzzAgent Platform, create and manage your account, administer campaigns you choose to apply for, validate participation, ship products or provide coupons, and deliver core Platform functionality in accordance with our Terms of Use and Influencer Agreement.
• Legitimate interests: We process your Personal Data where it is necessary for our legitimate interests in operating and improving the BzzAgent community and Platform, provided those interests are not overridden by your rights and interests. This includes processing to:
  • Operate, maintain, and improve the Platform and its features;
  • Ensure platform security, prevent fraud, abuse, misuse, and policy violations;
  • Moderate content and manage community quality;
  • Generate campaign-level analytics, reporting, and benchmarking using aggregated or de-identified data;
  • Communicate with you about operational matters related to your account or participation; and
  • Use public, campaign-related content and associated engagement information to promote the BzzAgent Platform, demonstrate campaign outcomes, and support marketing and business development activities, in a manner consistent with the Influencer Agreement and applicable law.
  • Run and protect promotions (for example, administering sweepstakes, contests, and giveaways; verifying eligibility; preventing fraud, abuse, and multiple entries; selecting and verifying winners; delivering prizes; and enforcing the official rules), where this processing is not otherwise covered by our contract with you.
• Consent: We rely on your consent for certain processing activities, such as:
  • Facilitating adverse event reporting to brands in connection with campaigns and, where applicable, sharing your contact details with the brand for that purpose;
  • When you choose to link a third-party social media account, including Instagram, to participate in specific campaigns; and
  • Any optional use of your content beyond the scope of a specific campaign, where such use is not necessary to provide the Platform.

  You may withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal but may affect your ability to participate in certain features or campaigns.

• Legal obligation: We process your Personal Data where necessary to comply with applicable legal or regulatory obligations, including recordkeeping, responding to lawful requests from authorities, and establishing, exercising, or defending legal claims.

When we rely on legitimate interests as a lawful basis of processing, you have the right to ask us more about how we decided to choose this legal basis. To do so, please use the contact details provided at the end of this Notice.

Where we process your Personal Data based on your consent, you may withdraw it at any time. However, this will not affect the lawfulness of our processing before you withdrew your consent. It will also not affect the validity of our processing of Personal Data performed on other lawful grounds.

Where we receive your Personal Data as part of providing our Services to you based on a contract, we require such Personal Data to be able to carry out the contract. Without that necessary Personal Data, we will not be able to provide the Services to you.

Disclosures of Personal Data

We disclose Personal Data in the following circumstances and for the purposes described below.

Disclosures to Brands Running Campaigns

When you choose to participate in a campaign, we disclose limited Personal Data to the brand sponsoring that campaign to administer the campaign and report on performance. This may include:

• Confirmation of participation and completion status
• Campaign-level performance metrics and analytics
• Reviews, ratings, photos, or other content you submit as part of the campaign
• Shipping information where required to deliver products or rewards

Information disclosed to brands is generally limited to what is necessary to operate the campaign and provide reporting. Brands do not have direct access to your full BzzAgent profile or internal moderation indicators. For social media campaigns, brands may view public Instagram content or handles that members have agreed to share as part of the campaign, but reporting is otherwise limited to aggregated campaign- level metrics.

Brands act as independent controllers for their own use of Personal Data they receive, and their privacy notices apply.

Pharmacovigilance and Product Safety Reporting

In limited circumstances, campaigns may involve products subject to product safety or pharmacovigilance obligations that apply to the sponsoring brand. If you voluntarily report an adverse event or product safety concern and provide consent where required, we may disclose limited Personal Data to the sponsoring brand so it can meet its legal and regulatory obligations. This may include contact details and information related to the reported event. The brand is responsible for pharmacovigilance reporting and acts as an independent controller for that processing.

Sweepstakes, Contests, and Promotions

If you choose to participate in a sweepstakes, contest, giveaway, or similar promotion, we may disclose Personal Data as necessary to administer the promotion, including to verify eligibility, select winners, deliver prizes, prevent fraud, and comply with legal or regulatory requirements. This may include disclosures to prize fulfillment providers, shipping carriers, communications providers, co-sponsors (where applicable), and public authorities where required by law. Where permitted by law and consistent with the promotion rules, winner information may be publicly disclosed.

Disclosures to Service Providers and Affiliates

We disclose Personal Data to our affiliates and to third-party service providers that perform services on our behalf and help us operate the Platform, including:

• Hosting and cloud infrastructure providers
• Fulfillment and shipping partners
• Customer support and community management providers
• Security, fraud prevention, and abuse detection providers
• Analytics providers that support Platform operations and reporting

These parties are permitted to use Personal Data only to provide services to us and in accordance with contractual obligations. We enter into agreements with our service providers (also known as “processors”) to ensure that they keep your Personal Data confidential, only use it for the services they provide to BzzAgent and treat your Personal Data with the same level of protection that we do.

Interaction with Third-Party Platforms (such as Instagram)

If you choose to link a public Instagram account to participate in certain campaigns, BzzAgent accesses limited public information from Instagram using Instagram’s official APIs, such as your public handle, public posts created as part of a campaign, and associated public engagement metrics.

BzzAgent does not send your BzzAgent profile information, campaign analytics, or other personal data to Instagram. Any processing that occurs on the Instagram platform is governed by Meta’s terms and privacy notices, and Meta acts as an independent controller for that processing.

Disclosures Required by Law or to Protect Rights

We may disclose Personal Data where we believe disclosure is necessary to:

• Comply with applicable laws, regulations, legal processes, or lawful requests from public authorities
• Enforce our Terms of Use, Influencer Agreement, or other agreements
• Detect, prevent, or address fraud, security incidents, or technical issues
• Protect the rights, property, or safety of BzzAgent, our members, brands, or others

If we have to disclose your Personal Data to governmental/law enforcement officials, we may not be able to ensure that those officials will maintain the privacy and security of your Personal Data.

Disclosures in Connection with Corporate Transactions

Personal Data may be disclosed or transferred as part of a corporate transaction, such as a merger, acquisition, reorganization, or sale of assets, including during due diligence. In such cases, Personal Data may be transferred as a business asset, subject to applicable law.

Aggregated and de-identified information

We may disclose aggregated, anonymized, or de-identified information that does not identify you for purposes such as analytics, benchmarking, reporting, and service improvement.

Does BzzAgent Sell or Share Your Personal Data?

BzzAgent does not sell your Personal Data in the conventional sense (for money). Like many companies, however, we use services that help deliver interest-based ads to you or analyze our Website traffic and we share your Personal Data with these business partners for this purpose and their use. Making Personal Data (such as online identifiers or browsing activity) available to these companies may be considered a “sale” or “sharing” under applicable data protection and privacy laws. Syndigo does not operate as a data broker. Our primary activities involve providing technology and related services to our customers and managing our own corporate operations. We do not buy or sell Personal Data as a standalone business model.

How Long We Keep Your Personal Data

We retain Personal Data for the period necessary to fulfill the purposes outlined in this Privacy Notice, unless a longer retention period is required or permitted by law, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. In determining appropriate retention period for Personal Data, we may consider factors such as the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements. When we no longer require the Personal Data we have collected about you, we may either delete or anonymize it.

Accounts that remain inactive for 365 consecutive days may be scheduled for closure. Members will receive a notification and will have 30 days to log in and prevent the account from being closed. When an account is deleted, either due to inactivity or because a member chooses to delete their account, personally identifiable profile and account information is removed from our systems. We may retain limited information necessary to support aggregated campaign reporting, comply with legal obligations, or prevent fraud and abuse.

Campaign participation records and campaign-level metrics may be retained after a campaign closes to support reporting to brands, analytics, benchmarking, and the ongoing operation and improvement of the Platform. These records may include information such as campaign participation status, reviews or other content submitted as part of the campaign, and related engagement metrics. Where feasible, we retain this information in aggregated, de-identified, or pseudonymized form.

To operate certain campaign features, display campaign activity within the Platform, verify participation, or address campaign administration needs, we may temporarily store copies of public campaign-related content (for example, public social media posts created as part of a campaign). These copies are retained only for the period reasonably necessary to support the campaign and related follow-up activities, after which we rely on references to the original public content where available.

Aggregated, platform-level analytics may be retained for longer periods in a non-identifiable or pseudonymized form to support business insights and improve our services. We apply appropriate safeguards to ensure that any extended retention remains consistent with legal obligations and business needs.

Automated Decision-Making

BzzAgent uses limited automated processing to support the operation of the Platform and the administration of campaigns. These processes are used to assist with tasks such as:

• Matching members to campaigns based on campaign eligibility criteria defined by brands and the information members choose to include in their profiles;
• Randomized selection among qualified applicants where the number of eligible members exceeds available campaign spots;
• Identifying potential fraud, misuse, or non-compliance with campaign requirements (for example, missing required actions or patterns suggesting multiple accounts); and
• Tracking campaign completion status.

These automated processes are not used to make decisions that produce legal effects or similarly significant effects on members without human involvement. Where automated checks flag an account or activity, the outcome is reviewed by a human moderator before any action is taken that affects campaign eligibility or participation.

You may contact BzzAgent support if you believe an automated process has affected your participation in error.

Where Do We Store and Transfer Your Personal Data To

BzzAgent is a brand of PowerReviews, Inc., a company owned by Syndigo LLC (“Syndigo”), headquartered in the United States of America (“U.S.”). Its data centers are primarily in the U.S. Syndigo also uses many U.S.-based services providers. This means that your Personal Data is primarily stored by us and our service providers in the U.S. However, we operate globally through our affiliates, subsidiaries, and services providers. This means that we may store and transfer your Personal Data to our affiliates, subsidiaries, and service providers who are in different countries if it is relevant for the delivery of our Services and products, or applicable for business operations.

For individuals whose Personal Data is safeguarded by the Data Privacy Framework: Before sending your Personal Data to a third party, we will do one of two things:

• Seek your consent; or
• Demand privacy and security: We will ensure the third party maintains the same level of privacy and security for your data as we do.We are accountable or liable for the protection of your Personal Data when we transfer it to others except when we can prove that we are not responsible for an event that leads to any unauthorized or improper processing. We either send it to a country, territory or sector within a country that is recognized as providing the same level of Personal Data protection as the country of origin or the Data Privacy Framework, or use safeguards like the Data Privacy Framework or the SCCs with necessary adjustments for transfers from the UK, or use specific transfer instruments like theUK International Data Transfer Agreement.

We are accountable and liable for the protection of your Personal Data when we transfer it to others except when we can prove that we are not responsible for an event that leads to any unauthorized or improper processing.

EU-U.S. and Swiss-U.S. Data Privacy Frameworks, and the UK Extension

With respect to Personal Data processed in the scope of this Notice, Syndigo LLC complies with the EU-U.S. Data Privacy Framework (and its UK Extension) and Swiss-U.S. Data Privacy Framework (the “Data Privacy Framework”) as adopted and put forward by the U.S. Department of Commerce regarding the processing of Personal Data. Syndigo LLC commits to upholding the Data Privacy Framework Principles. If there is any conflict between the terms in this Notice and the Data Privacy Framework Principles, the Data Privacy Framework Principles shall govern.

To learn more about the Data Privacy Framework, please visithttps://www.dataprivacyframework.gov/s/.

U.S. Regulatory Oversight

Syndigo LLC is subject to the investigatory and enforcement powers of the United States Federal Trade Commission.

Dispute Resolution

Where a privacy complaint or dispute cannot be resolved through our internal processes, we have agreed to participate in thexVeraSafe Data Privacy Framework Dispute Resolution Procedure. Subject to the terms of the VeraSafe Data Privacy Framework Dispute Resolution Procedure,VeraSafe will provide appropriate recourse free of charge to you. To file a complaint with VeraSafe and participate in the VeraSafe Data Privacy Framework Dispute Resolution Procedure, please submit the required information through the web form located here:https://www.verasafe.com/privacy-services/dispute-resolution/submit-dispute/.

If a complaint or dispute related to Personal Data cannot be resolved through Syndigo’s internal process, in addition to the VeraSafe Dispute Resolution Procedure, Syndigo has agreed to cooperate with the EU data protection authorities (“DPAs”), the UK Information Commissioner’s Office (“ICO”), and the Swiss Federal Data Protection and Information Commissioner (“FDPIC”), and to take part in the dispute resolution procedures of the panel established by such data protection authorities.

Binding Arbitration

If your dispute or complaint cannot be resolved by us, nor through the dispute resolution program established by VeraSafe or the dispute resolution procedures established by the DPAs, the ICO or the FDPIC, you may have the right to require that we enter into binding arbitration with you pursuant to the Data Privacy Framework’s “Recourse, Enforcement and Liability Principle” and Annex I of the Data Privacy Framework.

Risk of Harm

Whenever Personal Data is collected and processed, there is always a slight risk that the Personal Data may be breached, misused, or otherwise result in a harm to you. However, we take several measures to ensure that this risk is mitigated as much as possible. These measures include limiting the Personal Data about you that we collect and process to solely what is necessary, not collecting sensitive Personal Data about you, and implementing appropriate security measures, as described in this Notice.

What Privacy Rights Do You Have?

You have specific rights regarding your Personal Data collected and processed by us. Please note that you can only exercise these rights with respect to Personal Data that BzzAgent processes about you when we act as a data controller or as a “business”. To exercise your rights with respect to information processed by us on behalf of one of our customers or Instagram, please read the privacy notice of that customer or Meta’s applicable privacy notice.

You can manage much of your Personal Data through your account settings, including updating your profile, unlinking your Instagram account, pausing campaign invitations, or deleting your account.

Syndigo acknowledges the right of EU, UK and Swiss individuals to access their Personal Data pursuant to the Data Privacy Framework and will grant individuals reasonable access to Personal Data we received pursuant to the Data Privacy Framework Principles. In addition, we will take reasonable steps to permit individuals to correct, amend, or delete such information that is demonstrated to be inaccurate or processed in violation of the Data Privacy Framework Principles. Additionally, if we have received your Personal Data in reliance on the Data Privacy Framework, you may also have the right to opt out of having your Personal Data shared with third parties and to revoke your consent to our sharing your Personal Data with third parties. You may also have the right to opt out if your Personal Data is used for any purpose that is materially different from the purpose(s) for which it was originally collected or which you originally authorized. An individual may request to access their Personal Data, or otherwise correct, amend, delete, withdraw their consent or limit the processing of their Personal Data in line with the Data Privacy Framework Principles by contacting us.

In this section, we first describe those rights and then we explain how you can exercise those rights.

Right to Know What Happens to Your Personal Data

This is called the right to be informed. It means that you have the right to obtain from us all information regarding our data processing activities that concern you, such as how we collect and use your Personal Data, how long we will keep it, and who it will be shared with, among other things.

We are informing you of how we process your Personal Data with this Notice.

Right to Know What Personal Data BzzAgent Has About You

This is called the right of access. This right allows you to ask for full details of the Personal Data we hold about you.

You have the right to obtain from us confirmation as to whether or not we process Personal Data concerning you, and, where that is the case, a copy or access to the Personal Data and certain related information. Once we receive and confirm that the request comes from you or your authorized agent, we will disclose to you:

• The categories of Personal Data we collected about you;
• The categories of sources for the Personal Data we collected about you;
• Our purposes for processing that Personal Data;
• Where possible, the envisaged period for which the Personal Data will be stored, or, if not possible, the criteria used to determine that period;
• The categories of third parties with whom we share that Personal Data;
• The specific pieces of Personal Data we collected about you;
• If we sold or disclosed your Personal Data for a business purpose, two separate lists laying out the:
  • categories of Personal Data sold, and the categories of recipients who purchased the Personal Data; and
  • categories of Personal Data disclosed for a business purpose, identifying the categories of recipients who obtained the Personal Data;
• If we rely on legitimate interests as a lawful basis to process your Personal Data, the legitimate interests pursued by us or by a third party; and
• The appropriate safeguards for transferring data from one country to a third country, if applicable.

Please take into account that certain data protection laws allows us not to satisfy your access request when:

• you already have the information;
• providing such information proves impossible or would involve a disproportionate effort, or in so far providing such information is likely to render impossible or seriously impair the achievement of the objectives of that processing; and
• that Personal Data must remain confidential subject to an obligation of professional secrecy regulated by applicable law, including a statutory obligation of secrecy.

Certain data protection laws do not allow us to disclose account passwords or security questions and answers. We can inform you that we have this information generally, but we may not provide the specific items to you for security and legal reasons.

Right to Correct Your Personal Data

This is called the right to rectification. It gives you the right to ask us to correct anything that you think is wrong with the Personal Data we have on file about you and to complete any incomplete Personal Data.

Right to Delete Your Personal Data

This is called the right to erasure, right to deletion or the “right to be forgotten”. This right means you can ask for your Personal Data to be deleted.

You may be able to remove information from your account after logging in or even to delete your account on our Services. When you delete your account, we remove your profile information, but we may retain campaign history (for example, reviews you submitted) for recordkeeping and compliance purposes.

If there is any other Personal Data you would like deleted, you can ask us to do so using the contact information listed in this Notice. Sometimes we can delete your information, but other times it may not be possible, such as when the law tells us we cannot do so. If that is the case, we will consider if we can limit how we use it. There may also be circumstances where we deny your request to delete your information under applicable law, such as if we or our service providers need to retain the Personal Data to:

• Complete the transaction for which we collected the Personal Data;
• Provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you;
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;
• Debug products to identify and repair errors that impair existing intended functionality;
• Enable solely internal uses reasonably aligned with your expectations based on your relationship with us;
• Comply with a legal obligation; or
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

Right to Ask Us to Change How We Process Your Personal Data

This is called the right to restrict processing. It is the right to ask us to only use or store your Personal Data for certain purposes.

You have this right on certain occasions, such as where you believe the data is inaccurate or the processing activity is unlawful. This right enables you to ask us to suspend the usage of Personal Data about you, for example if you want us to establish its accuracy or the reason for processing it.

Right to Ask Us to Stop Using Your Personal Data

This is called the right to object. This is your right to tell us to stop using your Personal Data in a particular way. You have this right where we rely on a legitimate interest of ours (or of a third party). Also, you have the right to object at any time to the processing of your Personal Data for direct marketing purposes.

If you sign up to receive emails from us, you can opt out at any time by using the unsubscribe link in the email or by updating your preferences in your account settings. Even if you opt out of marketing messages, we may still send you non-marketing messages that are necessary to operate your account and the Platform, such as campaign invitations you request to receive, service and security notices, and other administrative or transactional communications.

We will stop processing the relevant Personal Data unless: (i) we have compelling legitimate grounds for the processing that override your interests, rights, or freedoms; or (ii) we need to continue processing your Personal Data to establish, exercise, or defend a legal claim

You may contact us if you believe an automated process has affected your participation in error, and request a human review.

Right to Port or Move Your Personal Data

This is called the right to data portability. It is the right to ask for and download Personal Data about you that you have given us or that you have generated by virtue of the use of our services, so that you can:

• move it;
• copy it;
• keep it for yourself; or
• transfer it to another organization.

We will provide your Personal Data in a structured, commonly used, and machine-readable format. When you make a data portability request electronically, we will provide you a copy in electronic format.

Right to Withdraw Your Consent

Where we rely on your consent as the legal basis for processing your Personal Data, you may withdraw your consent at any time. If you withdraw your consent, our use of your Personal Data before you withdraw is still lawful.

If you have given consent for your details to be shared with a third party, and wish to withdraw this consent, please also contact the relevant third party in order to change your preferences.

Right Not to be Discriminated Against for Exercising your Privacy Rights

We will not discriminate against you for exercising any of your privacy rights, meaning we will not:

• deny you access to our services;
• charge you different prices or rates for goods or Services, including through granting discounts or other benefits, or imposing penalties;

or
• provide you a different level or quality of goods or Services.

Right to Lodge a Complaint with a Supervisory Authority / Regulator

If the UK GDPR applies to the processing of your Personal Data with us, the UK GDPR grants you the right to lodge a complaint with a supervisory authority if you are not satisfied with how we process your Personal Data. In particular, you can lodge a complaint with the UK ICO. Depending on your location, you may have the right to appeal our response to a privacy request. To submit an appeal, please contact us at privacy@syndigo.com, include the words “Privacy Appeal” in the subject line, and describe the basis for your appeal. If you are not satisfied with the outcome, you may file a complaint with your state’s data protection or consumer protection authority.

Right to Opt Out of the Sale or Sharing of Your Personal Data

Depending on the region where you are located, you have the “right to opt out” of the “sale” or “sharing” of your Personal Data, which means you have the right to ask us to not sell or share your Personal Data at any time for specified purposes.

A “sale” includes disclosing or making available Personal Data to a third party (other than a service provider) in exchange for monetary or other valuable consideration. Under certain data protection laws, “sharing” includes disclosing or making available Personal Data to a third party for cross-context behavioral advertising. Our use of some online tracking technologies for statistical and marketing purposes is the only sale or share of your Personal Data by BzzAgent. To opt out of the sale or sharing of Personal Data, you can change your consent preferences through our cookie consent management platform, which you can open by clicking on the below button. To opt out, disable Performance, Social Media and Targeting cookies.

Please consider that the preferences you submit through the cookie consent management platform, including your requests to opt out from the sale or sharing of Personal Data, may be stored in cookies or similar technologies that are specific to your browser. If this browser is configured to block cookies or similar technologies, our tool may not be able to store your preferences. In addition, deleting cookies on this browser may result in your preferences being removed. If your preferences are removed after you delete cookies from this browser, you will have to update these preferences again. Also, remember that private browsing technologies (such as incognito mode) automatically delete all local storage and cookies when the browsing session ends, preventing us from recording your choice made during the session, and from accessing any local storage created outside of the current session, which does not enable us to access the choice you made during a normal or previous private browsing session.

We’ll only store your preferences in this browser. Because some companies may not connect information about this browser with other web browsers or devices you may use (such as a web browser on another computer you may use, or one on a mobile device), you need to update your preferences through the cookie consent management platform to set your preferences separately for other browsers or devices you may use.

You can also alter the configuration of your browser to reject certain types of online tracking technologies. Some browsers have a “Do Not Track” (DNT) feature, but there’s no agreed-upon standard for how websites should respond. Therefore, we currently do not support DNT requests. For more information about how to manage and delete cookies in your browser, please visit https://www.aboutcookies.org/how-to- manage-and-delete-cookies.

Our Website is set to respect “Global Privacy Control” signals received from web browsers where technically feasible. However, please note that the technology to detect whether a website honors Do Not Track and Global Privacy Control signals does not always work as intended.

Some of the companies we use may be members of the Network Advertising Initiative (“NAI”) or Digital Advertising Alliance (“DAA”). The NAI provides information regarding targeted advertising and the opt-out procedures of NAI members, including opt-out mechanisms for web browsers, mobile and other connected devices, and a tool to opt out from participating NAI members using your hashed email address for interest-based advertising. You may also want to visit the DAA’s website, which provides information regarding targeted advertising and offers an opt-out for DAA-participating companies. To learn more about interest-based advertisements from participating third parties in Canada, please visit the DAA online choice page.

We use Google Analytics, a web analytics service provided by Google, Inc. on the Platform. Google Analytics uses cookies or other tracking technologies to help us analyze how users interact with and use the Platform, compile reports on the activity on the Platform, and provide other services related to our activity on our Platform and usage. The technologies used by Google may collect information such as your IP address, time of visit, whether you are a return visitor, and any referring website. The information generated by Google Analytics will be transmitted to and stored by Google and will be subject to Google’s privacy policies. You can learn about Google’s practices, and opt out of them by downloading the Google Analytics opt-out browser add-on.

Please note that opting out through these mechanisms does not opt you out of being served advertising, and that you will continue to receive generic ads while online. Your opt-out choices are typically browser and device specific. If you disable your cookies, upgrade your browser after opting out or if you use multiple different devices, please opt-out each device and each browser separately.

Your Right to Opt In to the Sale of Your Personal Data

As our use of some of the cookies for statistical and marketing purposes is the only sale of your Personal Data that BzzAgent may be engaging in, the only way to opt in to sales of Personal Data is to change your cookie preferences through our cookie consent management platform. In particular, you need to choose to allow the following categories of cookies: Statistics and Marketing.

How Can You Exercise Your Privacy Rights?

To exercise any of the rights described above, please submit a request by either:

• Calling us at 1-877-847-5467; or
• Contacting us by email at privacy@syndigo.com (Preferred method)

Verification of Your Identity

Bear in mind that to evaluate your privacy rights requests, we need to be sure it was you who made the request. Consequently, we may need some information to confirm that you are who you say you are.

For requests submitted via password-protected accounts, your identity is already verified.

For requests sent by other means, you will need to provide us with sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Data. Generally, we will request only information that we may have about you to confirm your identity, but under some circumstances we may require additional information or documentation to complete your request. We cannot respond to your request or provide you with Personal Data if we cannot verify your identity or authority to make the request. Making a request does not require you to create an account with us.

We will only use the Personal Data you provide us in a request to verify your identity or authority to make the request.

Please note that you may only make a consumer request to know or data portability twice within a 12-month period under the CCPA.

Verification of Authority

If you are submitting a request on behalf of somebody else, we will need to verify your authority to act on behalf of that individual. When contacting us, please provide us with proof that the individual gave you signed permission to submit this request.

Alternatively, you may ask the individual to directly contact us by using the contact details above to verify their identity with us and confirm that they gave you permission to submit this request.

We will only use the Personal Data you provide us in a request to verify your authority.

Response Timing and Format of Our Responses

We will confirm receipt of your request within ten (10) days and, in that communication, we will also describe our identity verification process (if needed) and when you should expect a response, unless we have already granted or denied the request.

Please allow us up to thirty (30) days to reply to you from the day we received your request. If we need more time (up to 90 days in total), we will inform you of the reason why, and the extension period, in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will send our written response by mail or electronically, at your option. 

If we cannot satisfy a request from you, we will also explain why in our response. 

We will not charge a fee for processing or responding to your requests unless we determine that your request is excessive, repetitive, or manifestly unfounded. In those cases, we will tell you why we made that determination and provide you with a cost estimate before completing your request.

Privacy of Children

The Website and the Platform are not directed at, or intended for use by, children.

Data Integrity & Security

We are strongly committed to keeping your Personal Data safe. We have implemented and will maintain technical, administrative, and physical measures that are reasonably designed to help protect your Personal Data from unauthorized processing. Unauthorized processing includes unauthorized access, exfiltration, theft, disclosure, alteration, or destruction.

Changes to This Notice

If we make any material change to this Notice, we will post the revised Notice to this web page. We will also update the “Effective” date. By continuing to use the Website after we post any of these changes, you accept the modified Notice.

In our latest update as of the Last Updated Date, we implemented the following changes:

• We have included information about our commitment to comply with the Data Privacy Framework and your rights under it.
We have restructured our Privacy Notice to align it with Syndigo’s structure for privacy notices.
• We have clarified our data uses and data flows.
• We have added explanations about the integration with Instagram.

Contact Us

If you have any questions about this Notice, our processing of your Personal Data, or want to submit a verifiable consumer request, please write to the Syndigo privacy team by email at privacy@syndigo.com or contact us by postal mail at:

Syndigo LLC

Attn: Head of Global Privacy

141 W. Jackson Blvd., Suite 1375

Chicago, IL 60604

United States

Please allow up to four weeks for us to reply.

United Kingdom Representative

We have appointed VeraSafe as our representative in the UK for data protection matters. While you may also contact us, VeraSafe can be contacted on matters related to the processing of Personal Data. To contact VeraSafe, please use this contact form:https://verasafe.com/public-resources/contact-data-protection-representative or via telephone at +44 (20) 4532 2003.

Alternatively, VeraSafe can be contacted at:

VeraSafe United Kingdom Ltd.

37 Albert Embankment

London SE1 7TL

United Kingdom

Data Protection Officer

We have appointed VeraSafe as our Data Protection Officer (“DPO”). While you may contact us directly, VeraSafe can also be contacted on matters related to the processing of Personal Data. VeraSafe’s contact details are:

VeraSafe, LLC

100 M Street S.E., Suite 600

Washington, D.C. 20003

USA

Email: experts@verasafe.com

Web: https://www.verasafe.com/about-verasafe/contact-us/

+1 (617) 398-7067

Your grievance will be addressed within one month from the date of receipt.