Privacy Policy

Introduction

Last updated: 27 October 2026

Welcome to Datajoy, a data intermediation service ("DIS") that helps connect Individuals and Data Recipients. A further description of Datajoy's services is available at datajoy.eu.

This privacy policy ("Privacy Policy") describes our practices and your rights in relation to the personal data that we collect and process in connection with Datajoy and our other solutions.

This Privacy Policy differentiates the processing of personal data for Datajoy's business operations (see sub-sections "in general"), where it acts independently from specific instructions from Individuals, from the processing where Datajoy acts on the instruction of Individuals in relation to requests it submits on their behalf to Data Holders, and disclosures of those personal data to Data Recipients (see sub-sections "Requests to Data Holders"). If nothing is specified, the section applies to both cases.

1. Data subjects

This Policy is intended for:

1.1. Individuals who are natural persons, and the representatives of Individuals that are legal persons, who use Datajoy, and on whose behalf Datajoy submits privacy, and other data-related, requests to Data Holders, and provides data to Data Recipients.

1.2. Employees and other natural persons who work for or represent Data Holders, Data Recipients, service providers, and other third parties with whom Datajoy interacts.

1.3. Visitors of Datajoy Websites.

1.4. Participants in Datajoy events and others with whom Datajoy interacts for its own purposes.

2. Our solutions

Our solutions ("Solutions") include:

The Datajoy DIS and Related Content, including the additional specific tools and services we may offer (Article 12(e) of the Data Governance Act).

2.1. Our Websites, in particular datajoy.eu.

2.2. Our emails that link to this Privacy Policy and other means of communication.

2.3. Social media pages that we administer.

2.4. Events such as our client receptions that are related to our Solutions.

3. Personal data

The categories of personal data that we collect or obtain are:

3.1. Account data (name, username, password, user or administrator statuses, profile picture, and other account data).

3.2. Atypical data (unusual pattern, reporting, and other irregular activity).

3.3. Authentication data (contact details and personal attributes as described in this section, profile picture, and related technical data such as sender, recipient and logs).

3.4. Communication data (emails and AI prompts and conversations).

3.5. Contact details (first name, last name, email, phone number and postal address).

3.6. Data holder (name and category).

3.7. Data Recipients (name and category).

3.8. Engagement data (online search history, online and physical journey – including shopping itinerary, name of store, loyalty programs, and other interactions with a brand's services, platforms, mobile applications, websites, and social media).

3.9. Financial data (bank account details and payment methods and information) where authorized by law and only on a pass-through basis.

3.10. Marketing data (choices about newsletters, topics of interest, surveys, participation in events and contests, comments and social media interactions).

3.11. Metadata related to the data set out in this section.

3.12. Personal attributes (demographics, place and date of birth, nationality, and gender).

3.13. Preference data (preferred language and settings).

3.14. Professional data (professional title, role, company number, and other professional data).

3.15. Support data (support and other support requests, and customer records).

3.16. Technical data (device number, operating system and version, software configuration, notifications, activity logs, user locales, connection data, IP address, user locale(s), and other technical data).

3.17. Transactional data (purchase history, deliveries, transactions, licenses, contracts, and billing)

4. Data about others

If you provide us with data about another person, you must ensure that you are authorized to do so. Data you ask us to obtain may include data about other people, such as the people you correspond with or items you bought for them. We process them only to carry out your mandate, do not use them for any other purpose, and delete them with the rest of the data (Section 12). Informing each of them individually would require a disproportionate effort (Article 14(5)(b) GDPR); this Section is how we inform them.

5. Purposes

The purposes for which we use personal data are:

In general

5.1. Datajoy Account: Eligible persons may use Datajoy (potentially via an account, where available). We use your personal data to create, administer, and enable you to offer a service or to use an account and the features of Datajoy.

• Personal data used: account data, personal attributes (date of birth), contact details, professional data and technical data.

• Legal basis: (pre)contractual necessity.

• Contractual terms and conditions relating to the account are set out in the relevant general terms and conditions, and Specific Terms where applicable.

5.2. Support: Provide technical or administrative assistance, after-sales service, problem resolution service, and respond to your requests.

• Personal data used: account data, personal attributes (date of birth), contact details, financial data, professional data, support data, technical data and transactional data.

• Legal basis: (pre)contractual necessity.

5.3. Relationship Management: Manage and communicate with you about billing and payments, our relationship, and contractual documents.

• Personal data used: Account data, contact details, financial data, professional data and transactional data.

• Legal basis: (pre)contractual necessity.

5.4. Maintenance: To provide and administer our Solutions, such as ensuring the maintenance and proper functioning of Datajoy and our Websites, such as testing, updating, patching and debugging.

• Personal data used: account data, contact details, feedback, professional data, support data and technical data.

• Legal basis: Datajoy's legitimate interest in the administration and maintenance of its Solutions.

5.5. Security: To prevent, protect, investigate, mitigate, and respond to breaches of the security of Datajoy's and others' assets and infrastructure, including computer attacks, incidents or personal data breaches, fraud, theft, break-ins, identity theft, viruses, phishing, and other malicious practices.

• Personal data used: account data, atypical data, contact details, financial data, professional data, support data, technical data and transactional data.

• Legal basis: Datajoy's legitimate interest in ensuring the security of its resources and infrastructure.

5.6. Marketing: To advertise our Solutions, send you marketing communications, invite you to our events, and allow you to participate in our surveys and polls.

• Personal data used: contact details, feedback, marketing data, professional data, support data, and technical data.

• Legal basis: your consent for marketing emails to you as a person. Without consent, we may email (a) existing company customers, at the address they gave us, about Datajoy's data intermediation service, where we offered them an opt-out when we collected the address, and (b) organisations at their general business address (such as info@). Every marketing email offers a free and easy opt-out. Our legitimate interest for marketing other than by email. This purpose does not use data about Individuals' use of the data intermediation service (Section 5.14), or any address obtained through Google APIs.

5.7. Improvements: To understand how our Solutions are used and collect feedback to improve our Solutions and develop new ones, and our processes.

This processing is carried out in particular by means of surveys, questionnaires, spontaneous feedback or the analysis of statistical data.

Improving our processes involves standardization, task automation, performance management, supply chain optimization, and research and development.

• Personal data used: atypical data, contact details, feedback, professional data and technical data.

• Legal basis: Datajoy's legitimate interest in the improvement and development of its products. This purpose does not use data about Individuals' use of the data intermediation service (Section 5.14).

5.8. Market Analysis: To assess our outlook and report on activities and productivity, we conduct statistical analyses of the use and performance of our Solutions.

• Personal data used: financial data, marketing data, professional data, and technical data.

• Legal basis: Datajoy's legitimate interest in understanding market trends and making informed business decisions. This purpose does not use data about Individuals' use of the data intermediation service (Section 5.14).

5.9. Defending our Rights: To ensure the proper conduct of our business and to protect our interests, in particular with respect to compliance, audits, reporting, reputation, integrity, values and other rights and interests, and those of our directors.

• Personal data used: account data, atypical data, contact details, financial data, professional data, support data, technical data and transactional data.

• Legal basis: Datajoy's legitimate interest in ensuring the proper functioning of its business and managing its litigation.

5.10. Business Transactions: In a reorganisation, merger, sale or similar transaction, we may disclose the personal data processed under Sections 5.1 to 5.9 (in general), except data about Individuals' use of the data intermediation service, to the parties to that transaction and their advisers, under confidentiality.

Data processed under Sections 5.12 to 5.14 (requests to Data Holders), including mandates, requests and data received from Data Holders, are not disclosed to prospective buyers or their advisers. On completion, they pass only to an entity that takes over the data intermediation service and may lawfully provide it under the Data Governance Act. We will inform you before such a transfer, and you may withdraw your mandate. Data obtained through Google APIs pass only with your explicit prior consent (see Section 17).

• Legal basis: Datajoy's legitimate interest in carrying out business transactions.

5.11. Legal Obligations: To meet our legal obligations, in particular in connection with data governance, such as to prevent fraudulent or abusive practices, facilitate interoperability, provide required disclosures and comply with transparency requirements, log records of DIS activity, accounting, financial, tax, civil, commercial, economic, privacy, cybersecurity, health and safety, and cooperation with judicial and administrative authorities.

• Personal data used: account data, atypical data, contact details, feedback, financial data, professional data, support data, technical data and transactional data.

• Our legal basis: compliance with our legal obligations and substantial public interests, including pursuant to the EU Data Governance Act (2022/868).

Requests to Data Holders

5.12. DIS Provision: Datajoy will submit requests to Data Holders where you have instructed it to do so, and in line with Datajoy's Terms and Conditions for Individuals (datajoy.eu/terms/en). It will make those data available to the Data Recipients consistent with your choices.

• Personal data used: the data that you instruct us to obtain, disclose, and otherwise process on your behalf, including, if you have selected these items pursuant to your relevant mandate or your choices (including based on and as inferred from the name or categories of Data Holders), account data, atypical data, authentication data, contact details, communication data, data holder, data recipients, engagement data, feedback, financial data, marketing data, personal attributes, preference data, professional data, support data, technical data, transactional data and metadata in relation to these items where relevant.

• Legal basis: (pre)contractual necessity, i.e., the performance of your mandate to us and performance our DIS.

• Special categories of data: Data you ask us to obtain may include data concerning health or other special categories under Article 9 GDPR. This can happen in two ways: through the categories of data you select in the form, and through the content of a Google account you connect (for example emails or files). Where you are a natural person, we process your own special-category data on the basis of your explicit consent, given by a separate box in the form that is not ticked in advance and that names both sources (Article 9(2)(a) GDPR). You can withdraw this consent at any time; we then stop retrieving such data for your mandate. Data already delivered stay with the Data Recipient, which needs its own legal basis. That consent box is not shown to legal persons: an Individual that is a legal person is the controller of those data and must have its own lawful basis (see Section 15).

• Other people's data in what we retrieve: emails, files and other records may mention other people, sometimes including their health or other special-category data. We cannot ask those people for consent. We handle such data only as part of carrying out your request: we do not read, sort, analyse or use them, we make them available only to the Data Recipient you chose, and we delete them as set out in Section 12. If someone tells us that data about them were transmitted in this way, we take the steps within our control, such as deleting what we still hold. The Data Recipient must have its own legal basis before it uses them.

• Only staff who need data received from Data Holders to handle your request can access them, and they are bound to confidentiality.

5.13. Additional specific tools and services: at your request, Datajoy stores data temporarily for delivery and converts their format (Section 7.8).

• Where applicable, data are stored with Amazon Web Services (EU), Supabase (EU), Proton AG (Switzerland) and Google (EU and US, see Section 10). See the supplier table in Section 9.

• The personal data and legal basis are those regarding the sub-section on DIS Provision above.

5.14. Operations and Compliance: We use personal data processed under Sections 5.12 and 5.13 only to provide the data intermediation service, to keep it secure, to handle your support requests and complaints, to defend our rights in a dispute about a request, and to meet our legal obligations, including keeping the log record required by Article 12(o) of the Data Governance Act. If Datajoy becomes insolvent, we also use them to keep the service running or transfer it, as described in the Terms and Conditions for Individuals (Section 11.5). We do not use these data for Sections 5.6 (Marketing), 5.7 (Improvements) or 5.8 (Market Analysis), and transfer them only as described in Section 5.10. Data about the use of the service (such as date, time, duration and connections with Data Holders and Data Recipients) are used only to develop the data intermediation service, including fraud detection and cybersecurity, to keep the log record, and where the law requires. On request, they are made available to a Data Holder for the activity concerning the data it provided, as far as data protection law allows.

• Personal data used: see sub-sections above (DIS Provision and Additional specific tools and services).

• Legal basis: (pre)contractual necessity for the service and support; our legitimate interest in security and in defending our rights; compliance with our legal obligations.

Where the legal basis is (pre)contractual performance or compliance with our legal obligations, if you do not provide your personal data we will not be able to provide you with all or part of the functionalities of our Solutions.

To review data that a Data Recipient has received, you may contact that Data Recipient directly.

6. Sources

The sources from which we obtain your personal data are:

6.1. Through our Solutions: When you create a user account on Datajoy, fill in information about Datajoy, subscribe to our newsletters, or otherwise interact with our Solutions online and offline.

6.2. From Data Holders: Where you instruct us to obtain data from them on your behalf. Data may include data derived from the cookies they operate or connected product data, and related service data, they provide or manufacture. For connected products and related services, we may also make the request under the Data Act (Regulation (EU) 2023/2854). Where those data are personal data, the GDPR applies and prevails.

Data Holders normally send your data directly to the Data Recipients you have selected, and Datajoy does not receive them. Datajoy receives data from a Data Holder only where: (a) the Data Holder makes the data available only to an authorised intermediary through a technical interface, for example Google's Data Portability API; (b) the Data Holder refuses, or is not technically able, to send the data directly to the Data Recipient, and sends them to Datajoy instead; or (c) the Data Holder has not sent the data to the Data Recipient within the time limit set by law (one month from the request, which may be extended by two further months under Article 12(3) GDPR), and you ask Datajoy to receive them on your behalf. In each case, Datajoy receives the data only to pass them on to the Data Recipients you have selected, and keeps them no longer than set out in Section 12.2.

In the mandate, we may use the brand or household names of the Data holder, to allow you obtain your data from them. However mandate is meant to be addressed to the legal entity that operates under that brand or name as well as its affiliates that hold your data.

6.3. From Data Recipients: To the extent they provide information about you back to us. For example, where the Data Recipient has difficulties answering the request, or is legally required to contact us.

6.4. From our suppliers or partners who contribute to the development and marketing of our Solutions, to pursue our legitimate interests.

6.5. From third party authorities: For example, in connection with an investigation.

6.6. From public sources: the names and business contact details of Data Holders' and Data Recipients' privacy and legal teams, taken from their websites, privacy notices and public registers.

7. Your rights

In general

You have the following rights in relation to your personal data:

7.1. Right of access

• Request confirmation as to whether we hold personal data about you, access those data and other information relating to those data.

• Request a copy of your personal data.

7.2. Right to rectification

• Request the correction of your personal data if they are incorrect or incomplete.

7.3. Right to erasure

• Request the deletion of your personal data in certain cases, such as where you have consented to their use and subsequently withdrawn your consent, or where they are used unlawfully. In some cases, we may not be able to delete your personal data or certain content, for example for the management of our litigation, or where the law requires the retention of data such as for accounting purposes.

7.4. Right to restriction

• Request the restriction of the use of personal data in certain circumstances, such as the time it takes to verify the accuracy of those personal data.

7.5. Right to portability

• Request receipt of the personal data you have provided to Datajoy, in a structured, commonly used and machine-readable format.

• Request to transmit or have transmitted such personal data, where technically feasible, to another data controller, under certain circumstances.

7.6. Right to object

• Object to the use of your personal data in certain circumstances, including in the context of marketing and where your personal data are used based on a legitimate interest of Datajoy. If you no longer wish to receive direct marketing, you can opt out by unsubscribing to emails you receive from us.

7.7. Digital inheritance law

• In some countries, such as France, individuals have the right to set directives on the fate of their personal data after their death.

7.8. Right to opt-out from data conversion

• You may ask us not to convert data, or to deliver them in another format we can obtain, unless Union law requires the conversion. Some files can only be exported from their provider in a converted format; we then use the most reusable format available.

7.9. Right to withdraw your consent

• You may withdraw your consent at any time if the use of your personal data is based on such consent. Withdrawing consent will not affect the use of your personal data prior to such a withdrawal.

If you wish to exercise your rights, please feel free to contact us at privacy@datajoy.eu. Please note that these rights may be limited in accordance with applicable law. For example, where the personal data you request contain personal data of other persons or anti-fraud information, those data may be redacted. A request may be refused if it is manifestly unfounded or excessive.

You may also lodge a complaint with a supervisory authority in your country or in the place where there is an alleged breach of applicable privacy law. A list of supervisory authorities is available on https://www.edpb.europa.eu/about-edpb/our-members_en. The supervisory authority responsible for Datajoy in Belgium is the Data Protection Authority, rue de la Presse, 35, 1000 Brussels. For data requested under the Data Act, you may also complain to the competent authority designated under Article 37 of that Regulation (Article 38).

Requests to Data Holders

To the extent that you have instructed Datajoy to retrieve or perform other actions in relation to your personal data with a Data Holder on your behalf, or otherwise process such data, we will exercise the rights for which you have granted us a mandate or other instruction.

Please note that you retain the right to exercise such rights independently and can withdraw your mandate or instruction at any time.

In addition, where we are not acting on your behalf, we are not able to submit requests for you. In that case, please direct your questions or requests directly to the relevant data controller. For example, while we may retrieve data for you from a Data Holder, our mandate regarding a Data Recipient may be limited to sending your data to that Data Recipient. Any subsequent request for access or deletion of those data that are in possession of the Data Recipient should be made by you directly, not through Datajoy, unless we specifically agree otherwise.

Your rights may be limited under applicable law, in particular where they may affect the rights of others. For example, data may be expunged of confidential information or company secrets before being transferred to us. You may also be able to set restrictions on the data you would like us to request, or we may do so to avoid duplicate requests, which will accordingly narrow the scope of data we receive.

8. Authentication and signature

Before sending a request to a Data Holder, Datajoy checks the person who grants the mandate and has the mandate signed electronically. Datajoy needs to provide proof of such authentication and signature to Data Holders or other Data Participants.

To do so, Datajoy verifies your phone number by SMS code and may verify your email addresses. You sign the mandate electronically through DocuSeal; some mandates are signed with a qualified electronic signature after electronic identification through itsme or another provider. Each mandate and its audit pdf state how it was signed and how the signer was verified. Where the Individual is a legal person, Datajoy also checks that the representative who signs is authorised to act for it. Datajoy may provide a report containing a fingerprint of your identification or signature, along with other relevant data, such as the sender and receiver of the authentication or signature request, and information on the document and logs.

To prevent fraud, Datajoy verifies your phone number by SMS code when you sign, and may check your phone number, email address and IP address with the suppliers listed in Section 9. A member of staff reviews every request before it is emailed to a Data Holder, and does not send it where these checks or the request suggest fraud or abuse. Retrieval through Google's interfaces starts automatically after you sign (Section 17.2). You can give your view and contest a refusal at privacy@datajoy.eu. Legal basis: our legitimate interest in preventing fraud and Article 12(g) of the Data Governance Act.

Datajoy does not routinely ask for a copy of your identity document. If a Data Holder has reasonable doubts about your identity and asks for more information, we first offer it the evidence already attached to the mandate. If it still asks for more, we tell you, and you choose whether to provide it.

9. Recipients

In general

We share your personal data with the following recipients:

9.1. Persons with whom you interact or disclose information through our Solutions

• When you transmit, or allow persons to access, your personal data, for example to user account administrators.

• If you use a third-party product to connect to our Solutions, you will share information about yourself with that third-party product.

9.2. Our suppliers in relation to the services they provide

• These services include account administration and development, support, relationship management and payment processing, maintenance, security, marketing, improvements, market analysis, advocacy, business transactions, compliance with our legal obligations, and ancillary functions. Data processed under Sections 5.12 to 5.14 are never shared for marketing, improvements or market analysis, and are transferred only as described in Section 5.10.

• Public authorities, where the law requires disclosure, or where it is necessary to establish or defend legal claims

• To enforce your rights or our rights.

• To comply with our legal obligations.

• The FPS Economy, as the authority competent for data intermediation services, when it monitors Datajoy's compliance with the Data Governance Act.

• Our business partners in the context of our business relationships with them.

• As part of improving our processes such as collaboration.

• For a business transaction, subject to Section 5.10.

• Where disclosure is required with third parties under laws and regulations, our terms and conditions or to defend our rights and those of our employees, directors and representatives.

The full list of our suppliers is available on request at privacy@datajoy.eu.

9.3. Requests to Data Holders

To the extent that you have instructed Datajoy to retrieve or perform other actions in relation to your personal data with a Data Holder on your behalf, or otherwise process such data, we will provide those data to the recipients or categories of recipients that you have selected. This may include, as appropriate, Data Holders and Data Recipients, or other Data Participants. You may, at any time, modify your instructions. However, please note that this modification will not affect prior disclosures. If you reach the Datajoy form through another organisation's website, Datajoy SRL/BV still runs the form and is responsible for the data you enter in it.

10. International transfers

Due to the local nature of our operations, your personal data are generally stored and processed within the European Union. We do, however, use suppliers and other third parties who may, under certain circumstances, process your data outside the European Union. For example, given the distributed nature of their services, IT service providers may process data in various jurisdictions, including outside the European Union or the European Economic Area. Certain countries that are not members of the European Economic Area are recognized by the European Commission as ensuring an adequate level of data protection in accordance with European Union standards (the full list of these countries is published on the European Commission's website). For transfers from the European Economic Area to other countries, we rely on an adequacy decision that covers the recipient (such as the EU-US Data Privacy Framework for certified US companies) or on the European Commission's standard contractual clauses. Where we pass data to a Data Recipient outside the EEA, we do so under an adequacy decision or standard contractual clauses or, where neither is available, because the transfer is necessary to carry out your mandate (Article 49(1)(b) GDPR); the form shows you the countries concerned before you sign. You can obtain a copy of the safeguards at privacy@datajoy.eu.

11. Third-party products

Your use of third-party products, and the use of your personal data by the third-party providers, such as websites that link to our Solutions, Data Holders, or Data Recipients, are governed by the practices and legal terms of that third party. Datajoy is not responsible for the processing of your personal data and does not exercise control over these third parties, unless they act as processors to Datajoy. We encourage you to consult their privacy policies and other documentation accordingly.

12. Retention

The criteria used to determine our retention periods include:

12.1. The length of time we have a relationship with you and provide Solutions to you (for as long as you have an account with us or use our Solutions), or to enable you to conduct your business and meet your needs.

12.2. For Individuals, we keep each type of data for no longer than the following periods. The same periods apply where we act as processor for an Individual that is a legal person (Section 15).

12.3. If there is a legal obligation to retain data, in particular in relating to accounting, tax, civil or commercial matters. In general, relevant documents (invoices, balance sheets, annual accounts, and other accounting and business documents, contracts, declarations, correspondence, and administrative or regulatory documents) are kept for 7 to 10 years. Some records are kept for a shorter time, such as emails, or longer, such as corporate or real estate or intellectual property documents that are retained at least for the life of the company, asset or right to which they relate.

12.4. To defend and enforce our rights. For example, in relation to litigation or investigations.

13. Security

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access restricted to staff who need it, and strong authentication for staff access. We review these measures regularly. Unfortunately, no data transmission over the Internet or data storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you believe that the security of any of your account with us has been compromised), please notify us immediately at privacy@datajoy.eu.

14. Updates

Datajoy may update this Privacy Policy from time to time. The online version is authoritative. You can find the date of the last version at the top of this Privacy Policy. Where we have your email address, we notify you of a material change in advance, and always before we use your personal data for a new purpose. Other changes take effect when published. Before using Google user data in a new way or for a new purpose, Datajoy will ask for your consent.

15. Contact

Datajoy SRL/BV, 7 Sainte Gertrude Street, 1040 Etterbeek (Brussels), Belgium, enterprise number 1022.271.122, RPM/RPR Brussels, VAT BE1022.271.122, is the data controller for Datajoy and its other Solutions to the extent described in this Privacy Policy. If you have any questions about this Privacy Policy, please contact us at privacy@datajoy.eu.

Where the Individual is a natural person acting for themselves, Datajoy SRL/BV is also the controller for the data it obtains from Data Holders on the Individual's instruction, and uses them only to carry out the mandate and for the limited purposes in Section 5.14. Where the Individual is a legal person, that legal person is the controller of the personal data contained in those data, and Datajoy processes them as its processor under the data processing terms that form part of the mandate (Article 28 GDPR; Terms and Conditions for Individuals, Section 17). Datajoy remains the controller of the data it processes for its own purposes, such as the account, verification, the log record and evidence of the mandate, and of the data about the legal person's representative. If you are a data subject whose data an Individual that is a legal person asked us to obtain, please address your request to that legal person; we will forward any request we receive. Our privacy contact is privacy@datajoy.eu.

Datajoy SRL/BV is a private limited company under Belgian law. It provides data intermediation services between data subjects and data users (Article 10(b) of the Data Governance Act) and between data holders and data users (Article 10(a)): on an Individual's mandate, it requests the Individual's data from Data Holders and makes them available to the Data Recipient the Individual chooses. It has notified the FPS Economy, the Belgian authority competent for data intermediation services. The FPS Economy has confirmed that Datajoy SRL/BV complies with Articles 11 and 12 of the Data Governance Act, so Datajoy may use the label "data intermediation services provider recognised in the Union" and the common logo.

Datajoy SRL/BV provides only data intermediation services and the additional specific tools and services allowed by Article 12(e) of the Data Governance Act.

16. Definitions

• "Data Holder" means a person from whom an Individual, or Datajoy on the Individual's behalf, requests data. For the avoidance of doubt, "Data Holder" includes the meaning attributed to data holder under the Data Act (2023/2854). Where the Individual is a legal person, or a natural person making non-personal data available, the Individual is the "data holder" within the meaning of Article 2(8) of the Data Governance Act, and the commitments to data holders in Section 13 of the Terms and Conditions for Individuals are owed to the Individual.

• "Data Recipient" means a person authorized or required in accordance with applicable law to use data provided to it by, or in connection with, Datajoy. For the avoidance of doubt, "Data Recipient" includes a data user under the Data Governance Act (2022/868) and a data recipient or third party under the Data Act (2023/2854).

• "Datajoy" refers to the data intermediation service provided by Datajoy SRL/BV, and/or to Datajoy SRL/BV depending on the context.

• "Individual" means the natural or legal person who uses Datajoy to prepare or grant a mandate, and on whose behalf Datajoy acts in relation to that person's data and data rights.

• "Related Content" means related products and services controlled by Datajoy and in connection with Datajoy, such as commercial presentations and materials, including the Website.

• "Sensitive Data" means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

• "Specific Terms" means any contract or other document referring to the applicable terms and conditions and establishing between the parties additional terms and conditions relating to Datajoy, including any mandate, subscription or data sharing agreement, license or letter of intent.

• "Website" means any website owned or validly bearing the Datajoy trademark, including datajoy.eu.

17. Google user data

17.1. What we access. When you choose to connect your Google account, we request only the permissions needed for your request: (a) through the Google Data Portability API, the categories you select among Chrome (autofill, history, bookmarks, extensions, settings), Maps (aliased places, commute routes, starred places), My Activity (Maps, My Ad Center, Play, Search, Shopping, YouTube), purchases and reservations, and shopping addresses; (b) where you also connect Google Workspace data, read-only access to Gmail, Google Drive, Google Calendar, your other contacts and directory, and your profile information (age range, language, addresses, birthday, email addresses, gender, organisation and phone numbers); and (c) your email address, to know which account you connected.

17.2. Why and when. We use these data only to fulfil the request you made: to retrieve the data you selected and deliver them to you or to the Data Recipient you chose. We start retrieving your Google data only after you have signed the mandate and your phone number has been verified (Section 8). If you do not sign it, we revoke the access you gave and retrieve nothing.

17.3. What we never do. We do not use Google user data for advertising, marketing, market analysis, product development or creditworthiness assessment. We do not sell them or transfer them to advertising platforms, data brokers or information resellers. We do not use Google Workspace data (such as Gmail, Drive, Calendar or Contacts data) to develop, improve or train generalised artificial intelligence or machine-learning models. Data Recipients pay Datajoy a fee per mandate for the intermediation service; the fee does not depend on whether Google user data are included, or on their volume or content.

17.4. Transfers. We transfer Google user data only (a) to the Data Recipient you chose, on your instruction; (b) for security purposes, such as investigating abuse; (c) to comply with the law; or (d) in a merger, acquisition or sale of assets, after obtaining your explicit prior consent.

17.5. Human access. Our staff do not read your Google user data unless you ask us to (for example to resolve a support request about specific files), it is necessary for security, or the law requires it.

17.6. Storage and security. OAuth tokens are encrypted at rest (AES-256). Data are encrypted in transit and delivered through Amazon S3 (EU region) or, where our staff deliver them manually, Proton Drive. We delete the data automatically 30 days after we receive them, unless our staff keep them as evidence of an incomplete delivery (Section 12). We revoke the access token when your request is complete or, where you chose ongoing access, when that period ends, the mandate ends or you revoke access. You can revoke access at any time in your Google Account settings.

17.7. Datajoy's use of information received from Google APIs will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

17.8. The use of information received from the Data Portability API adheres to the Data Portability API user data and developer policy (developers.google.com/data-portability/policy), including the Limited Use requirements.

18. Cookies and similar technologies

On our forms and on the pages where you sign or manage your mandate, we store or read information on your device only where this is strictly necessary for the service you ask for, for example to keep you signed in, protect our forms against forgery, remember a language you chose or complete a signature. This does not require your consent. We use no advertising, profiling or cross-site tracking technologies. We measure the audience of datajoy.eu with Plausible Analytics, which stores nothing on your device and identifies no one. Pages still hosted by our former website provider, Webflow, may use that provider's technical cookies, which are described in its cookie policy. If we add anything that is not strictly necessary, we will ask your consent first.