Privacy and Cookie Policy

This Privacy and Cookie Policy ("Policy") constitutes the fulfilment of the obligations arising from Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, "GDPR"), in connection with the operation of the Streamo platform ("Platform") and the website streamo.io ("Service").

The Data Controller of your personal data is OceanWeb Technologies s.r.o., with its registered office at Jána Hollého 738/99, 071 01 Michalovce, Slovak Republic, Company ID (IČO): 54805317, Tax ID (DIČ): 2121793344.

You may contact us by e-mail at: info@streamo.io

We process your personal data for the following purposes:

If you are our customers (persons who have or have had an account in Streamo), your personal data will be processed for the purpose of concluding and performing the agreement for the use of Streamo (legal basis: Article 6(1)(b) GDPR), for the purpose of fulfilling our legal obligations, in particular under tax law (legal basis: Article 6(1)(c) GDPR), as well as for the purpose of pursuing our legitimate interests consisting in ensuring the possibility of asserting and defending mutual claims, conducting internal reporting, and marketing our own services (legal basis: Article 6(1)(f) GDPR). These data will be processed until the end of the cooperation and thereafter for the period necessary for the limitation of any mutual civil-law claims and tax obligations (usually five years from the end of the year in which the agreement terminated).

If you are employees or representatives of our (also potential) customers and you perform tasks related to our cooperation with them, your personal data will be processed for the purpose of concluding and performing agreements with these entities, pursuing and defending against possible mutual claims, and marketing our own services. The legal basis is our legitimate interest within the meaning of Article 6(1)(f) GDPR.

If you contact us by e-mail, your data will be processed on the basis of our legitimate interest consisting in responding to the inquiry (Article 6(1)(f) GDPR). These data will be stored at the latest until the end of the year following the year in which the correspondence ended.

When using the Service, users' personal data are processed for the purpose of providing electronic services, including enabling the use of website functionalities such as contact forms, access to content, or account registration. The legal basis is Article 6(1)(b) GDPR.

Personal data are also processed pursuant to Article 6(1)(f) GDPR, i.e. the legitimate interest of the Data Controller consisting in ensuring the proper functioning of the Service, its administration, ensuring security, detecting and preventing unauthorised access and abuse.

When using the Service, technical data are automatically collected, in particular the IP address of the device, information about visited subpages, date and time of access, browser type, operating system, transmission errors, and the address of the page from which access to the Service occurred. As a rule, these data are not used to directly identify the user; however, they may constitute personal data within the meaning of the GDPR.

Your personal data may be disclosed to the following categories of recipients:

• Our employees and subcontractors
• Entities providing hosting services for the Service and the Platform
• Providers of analytical, advertising and other tools supporting online marketing
• Operators of social media platforms integrated with Streamo (Facebook, Instagram)
• Entities providing accounting, legal, IT support and advisory services
• Tax authorities, courts and other public authorities
• Banks and payment service providers (Stripe, GoPay, PayPal, Besteron)
• Shipping carriers (Packeta, Slovak Post, DPD, GLS, SPS, DHL)

Your personal data may be transferred outside the European Economic Area where necessary for the proper provision of services. Such transfers are always based on legal instruments ensuring an adequate level of protection, in particular standard contractual clauses approved by the European Commission.

You have the right to:

• Access your personal data (Article 15 GDPR), including obtaining a copy thereof
• Rectify or complete incomplete personal data (Article 16 GDPR)
• Erasure of personal data in cases provided for by law (Article 17 GDPR)
• Restriction of processing (Article 18 GDPR)
• Data portability — receive your data in a structured, commonly used format and transfer them where processing is based on consent and carried out by automated means (Article 20 GDPR)
• Object to the processing of your personal data where processing is based on the legitimate interest of the Company (Article 21 GDPR)
• Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal. Consent may be withdrawn by sending a message to: info@streamo.io
• Lodge a complaint with the supervisory authority — the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR) — if you believe that the processing of your personal data violates GDPR provisions

Providing personal data is voluntary; however, failure to provide data may prevent the achievement of the processing purpose, in particular the conclusion or performance of a contract.

Cookies are small text files stored on your computer or mobile device and subsequently retrieved from such devices during subsequent visits to our Service. Cookies usually contain the name of the website from which they originate, the period for which they are stored on the device, and a unique identifier.

Cookies that are necessary for the proper functioning of the Service are stored automatically. In the case of other types of cookies, your consent is required. We use the following types of cookies:

• Essential cookies — cookies that enable the use of services available within Streamo and the Service, such as authentication cookies, logging in, and using forms
• Analytical cookies — cookies that allow us to collect statistical data regarding user behaviour, including measuring the number of visits and collecting information about traffic sources; their use is dependent on your consent
• Advertising cookies — cookies that enable us to display personalised advertisements on other websites, such as Facebook or Instagram; their use is dependent on your consent

Both session cookies (deleted after closing the browser) and persistent cookies (stored for a specified period) are used within the Service. You may manage cookie settings via your web browser settings.

Upon granting your consent, we may process your personal data using the following tools:

• Google Analytics — an analytics tool by Google LLC for measuring website traffic and user behaviour. It collects data about visited pages, time spent on the site, traffic sources, and device technical parameters.
• Google Tag Manager — a tool for managing tracking and marketing tags on the website.
• Facebook Pixel — a tracking code by Meta Platforms Inc. enabling the display of personalised advertisements on Facebook and Instagram based on user behaviour analysis.
• Sentry — an error-tracking and performance-monitoring tool by Functional Software, Inc. (45 Fremont Street, Floor 8, San Francisco, CA 94105, USA). When an error occurs in the Platform, Sentry receives technical context including the URL, browser user agent, server identifier and a stack trace. We do not deliberately send personal data to Sentry; however, the URL or stack trace may incidentally contain identifiers. Data is retained for up to 90 days. Sentry processes data under EU Standard Contractual Clauses.

You may manage your privacy settings via your browser cookie settings and within your Facebook profile privacy settings.

If you are persons who make purchases from our customers using Streamo and there is no direct legal relationship between us, your data are processed on the basis of data processing entrustment agreements concluded with our customers.

In such cases, any requests related to your personal data will be forwarded to the entity that entrusted us with the data and acts as the Data Controller within the meaning of the GDPR.

We operate the following social media profiles:

• Facebook: https://www.facebook.com/streamo.io
• Instagram: https://www.instagram.com/streamo.io

We process personal data of users of these platforms for the purpose of contacting them and presenting content prepared by Streamo, promoting our activities, as well as for analytical and statistical purposes, which constitutes the legitimate interest of the Company. Personal data are stored until an objection to further processing is raised. Social media platforms have their own privacy policies and rules governing data processing, which also apply to their users.

If you have any questions regarding this Privacy Policy or wish to exercise your rights related to personal data protection, you may contact us by e-mail at: info@streamo.io

Depending on your relationship with Streamo, we may process the following categories of personal data:

If you are a Seller (account holder):

• Identification data: first and last name, business/trading name
• Contact data: email address, phone number, business address
• Tax data: company ID (IČO / DIČ / VAT ID), invoicing address
• Authentication data: password (hashed), session tokens
• Payment data: handled by Stripe — we do not store full card numbers; only payment-method identifiers and the last four digits
• Facebook / Instagram profile data obtained via OAuth: page ID, page name, profile picture, access tokens (encrypted)
• Co-administrator data: first and last name, email of additional administrators you invite to your Account
• Banking data: IBAN and bank name (used to generate QR codes on invoices)

If you are a Customer of one of our Sellers (and your data is processed on the Seller's behalf — we act as a data processor; the Seller is the data controller):

• Identification data: first and last name
• Contact data: email, phone, delivery and billing address
• Order data: products purchased, prices, shipping method, payment method, order status
• Communication: Messenger conversation contents, live-stream comments tied to your public social-media profile name

If you contact us (e.g. via support email or contact form):

• The content of your message and any data voluntarily provided in it
• Your email address and any other contact details you provide

The Platform enables Sellers to conduct live broadcasts ("Live Streams") via integrations with Facebook Live and Instagram Live.

When a Seller starts a Live Stream through the Platform, the following data may be processed:

• Seller side: the audio and video stream (image and voice of the Seller) is broadcast via Facebook / Instagram. The Platform itself does not host the live video stream — it relays metadata and captures orders from viewer comments.
• Viewer side: the public name (or username) of viewers who comment, react or place orders during the broadcast is retrieved from Facebook / Instagram and stored together with the comment content and timestamps. We do not collect viewers' private profile data — only what they make publicly visible through the social-network functionality.
• Recording and retention: the Seller chooses whether to keep a recording of the Live Stream on Facebook / Instagram (the recording is stored on those platforms — not on Streamo servers). The Platform retains broadcast metadata (start/end timestamps, viewer count, captured comments, reservations, orders, totals) as part of the Seller's order history for the periods set out in §3.
• Third-party platforms: Facebook and Instagram have their own privacy policies governing the processing of broadcast and viewer data, which apply independently of this Policy. See: Facebook, Instagram.

The legal basis for processing live-broadcast data is our and the Seller's legitimate interest within the meaning of Article 6(1)(f) GDPR — namely, enabling the live-selling functionality, capturing orders from public viewer comments, and preserving an audit trail of sales.