Privacy Policy

1. Introduction

Welcome to TRNSFR's privacy policy.

TRNSFR respects your privacy and is committed to protecting your personal data. This privacy policy will inform you of how we look after your personal data, your privacy rights, and how the law protects you.

2. Important information and who we are

TRNSFR is both a controller and a processor of your data, depending on our business interaction with you. Therefore, we are responsible for your personal data. We have appointed a data protection officer ('DPO') who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the DPO using the details set out below.

Full name of legal entity: CTRL+ALT+DEL Ltd Name of data protection officer: Steven Rowe Email address: [email protected] Company registered in England under Company Number 16799634 ICO registered under number – ZBxxxxx

You have the right to make a complaint at any time to the Information Commissioner's Office ('ICO'), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

3. We do not sell your data

TRNSFR does not sell, rent, or trade your personal data to third parties — ever. This applies to our website visitors, our customers, and the customers of our customers (the buyers who download files through your TRNSFR-powered store).

We share data only with the service providers we depend on to actually operate the platform (hosting, payment processor, anti-virus scanning pipeline, transactional email provider, and live-chat platform). These providers act as data processors under our instructions, are bound by contract to handle data securely, and cannot use it for their own marketing or resale.

We will never trade your personal data, sell mailing lists, hand information to advertising networks, or use your data to train third-party AI models.

4. The data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you, which we have grouped together as follows:

- Identity Data includes username, first name, last name, date of birth, ethnicity, and gender. - Contact Data includes email address, telephone numbers, and address. - Technical Data includes internet protocol (“IP”) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website. - Profile Data includes your username and password, preferences, feedback and survey responses. - Usage Data includes information about how you use our website, products and services. - Marketing and Communications Data includes your preferences for receiving marketing from us as well as your communication preferences.

This website/app is not intended for children under 14 years of age, and we will comply with data protection laws. This includes the General Data Protection Regulation 2018 (“GDPR”), including the Children’s Code 2020 and the Privacy and Electronic Communications Regulation (“PECR”).

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us, but we will notify you if this is the case at the time.

5. How is your personal data collected?

We use different methods to collect data from and about you, including:

Direct Interactions. You may give us your Identity, Contact, Profile and Marketing and Communications Data by filling in forms on our website. This includes but is not limited to, personal data you provide when you: - Use our products or services - Create an account on our website or app - Request marketing to be sent to you - Give us feedback or contact us.

Automated technologies or interactions. As you interact with our website, we will automatically collect Technical and Usage Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our cookie policy for further details.

Third parties. We may receive personal data about you from various third parties and public sources as set out below: - Technical Data from analytics providers, such as Google Analytics.

6. Processing activities

TRNSFR processes your personal data for the processing activities as described below:

Marketing Newsletters TRNSFR uses email to distribute marketing communications; however, only if you have consented in accordance with national marketing legislation (if required). The personal data processed for this purpose is name and email address. Our legal basis for this processing of personal data is our legitimate interests to provide interested individuals with marketing communications, cf. GDPR article 6 nr. 1 f). The personal data will be deleted when you decide to opt out of receiving marketing communications from TRNSFR. This can be done in the following ways: - Following the instructions for opt-out in the relevant marketing communication - Changing preferences under the relevant account settings if you have an account with TRNSFR - Contacting us via e-mail at contact form Please note that when opting out of receiving marketing communications, you may still receive communications from TRNSFR, such as order confirmations and notifications necessary to manage your account or the services provided to Customers.

Profiling When you interact with TRNSFR e.g. by visiting our web pages, downloading content, attending webinars, and as part of using our services, TRNSFR will be processing your personal data to provide relevant content to you through direct marketing on social media platforms and emails, webpages or in a service, based on your preferences. The purpose of this profiling is to deliver customised marketing to you, improve your user experience with our services / websites and deliver products that our customers are satisfied with. The personal data processed includes aggregated details about you, such as IP address, interests (where you have clicked, etc.), username and device. This is done through technologies like cookies. See our Cookie Policy add link for a complete list of cookies that we use on our website, storage time for each cookie, recipient of cookie-data, and purpose for using said cookie-data. Our legal basis for this processing of personal data is our legitimate interests to provide relevant content to you, cf. GDPR article 6 nr. 1 f). TRNSFR's services are generally used as tools for work-related purposes, and your behaviour in these tools says little about your personal life. No sensitive data is processed. Your personal data is processed from a business perspective in a way that we believe does not conflict with your freedoms and rights as an individual. The personal data will be deleted when you opt out of being subject to profiling by contacting us via e-mail at contact form. Cookies are also subject to different retention policies. You will also always have the option to change cookie settings and to exercise your right to protest, cf. GDPR article 21. This can be done by clicking on "Cookies Settings" at the bottom of the webpage. In general, the personal data is only stored as long as necessary to fulfil the purpose of processing, and no longer than 3 years after the last registered activity.

Security TRNSFR processes personal data to detect, mitigate, and prevent security threats and abuse, as well as to perform necessary maintenance and debugging. The personal data involved includes your name, email address, user and web traffic data such as login ID, username, IP address, and device information. Our legal basis for this processing of personal data is our legitimate interests, cf. GDPR article 6 nr. 1 f). The legitimate interest is to maintain a secure environment for our customers and operations. We will only store your personal information for as long as necessary to fulfil the purpose of processing, and your personal data will be deleted after 90 days.

Deliver products and services to customers TRNSFR processes personal data to manage customer orders, agreements, and payments for the products and services we provide. The data processed includes basic personal details, such as name, address, telephone number, and email, along with invoice-related information. Our legal basis for this processing of personal data is our legitimate interests, cf. GDPR article 6 nr. 1 f). The legitimate interest is to facilitate the delivery of products and services to the customers' contact person. We will only store your personal information for as long as necessary to fulfil the purpose of processing, but in most cases, never longer than 90 days after your last registered activity.

Registration for webinars and courses When registering for webinars and courses, we collect personal data, which is also used for follow-up after the course, such as issuing course certificates. The personal data processed is contact information such as name and email, billing details, and details of the registered course. Our legal basis for this processing of personal data is our legitimate interests, cf. GDPR article 6 nr. 1 f). The legitimate interest is to provide webinars and courses to interested individuals. We will only store your personal information for as long as necessary to fulfil the purpose of processing, and your personal data will be deleted after 90 days.

Service improvement TRNSFR continuously strives to improve and develop the quality, functionality, and user experience of our products, services, and websites. The personal data we process includes your name, email address, user and web traffic information such as login ID, username, and IP address. Additionally, we process statistics that indicate how you use our software and engage with content on our website. Our legal basis for processing your personal data is our legitimate interest, cf. GDPR article 6 nr. 1 f). The legitimate interest is to ensure that we meet our customers' expectations and fulfil all contractual commitments. We will process your personal data only as long as necessary to fulfil the purpose. After three years, the personal data is deleted.

Handling requests and providing support The purpose of handling questions and concerns raised through a contact form, chatbot, or similar feature on our website is to facilitate communication and support for users who interact with us. If you contact us via these channels, we will process the personal data you include in your request. Our legal basis for this processing of personal data is our legitimate interests, cf. GDPR article 6 nr. 1 f). The legitimate interest is to respond to questions and concerns raised by visitors on our website. Requests and related correspondence are stored only as long as necessary to fulfil the purpose of processing, and no longer than 3 years after the last correspondence related to the request.

7. Your rights under UK GDPR

Under UK GDPR you have the following rights in relation to your personal data. These are free to exercise — email [email protected] and we will respond within one calendar month.

Right to be informed. You can ask us what data we hold about you, why we hold it, who we share it with, and how long we keep it. Right of access. You can request a copy of all the personal data we hold about you (a "subject access request"). Right to rectification. If anything we hold is inaccurate or incomplete, you can ask us to correct it. Right to erasure ("right to be forgotten"). You can ask us to delete your personal data where there is no compelling reason for us to keep it. Right to restrict processing. You can ask us to pause processing your data while we resolve a query about its accuracy or your objection to its use. Right to data portability. You can request a copy of the data you have provided to us in a common, machine-readable format. Right to object. You can object to us processing your data on the basis of legitimate interests, and to direct marketing at any time. Rights related to automated decision-making and profiling. You can ask not to be subject to a decision based solely on automated processing.

You also have the right to complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk.

8. Third-Party Links

The website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website or exit our app, we encourage you to read the privacy policy of every website you visit.We do not sell, trade, or otherwise transfer your personal information to third parties. We may share information with trusted service providers who assist us in operating our website, conducting our business, or servicing you.

9. Changes

We encourage you to review the Privacy Statement regularly. If we make significant changes to the Privacy Statement that materially alter our privacy practices, we will notify you of this.