Legal

Privacy Notice

Updated: 15 September 2022

How Aposto Technology and Media, Inc. collects, uses and shares your personal data.

At Aposto Technology and Media, Inc. (a Delaware, U.S. corporation registered with Delaware Division of Corporations under file no. 6934720)("Aposto", "we", "us", or "our"), your privacy is of great importance. This Aposto Privacy Notice ("Privacy Notice") describes the information that we collect that personally identifies you ("personal information" or “personal data”) and how we use, protect, and disclose your personal information when you interact with the following (collectively, the “Aposto Applications”):

Our website at “aposto.com” (the “Website”);
Our publications (the “Publications”);
Our mobile applications (the “Mobile Applications”);
Any other communication channels we utilize for content sharing.

This Privacy Notice applies to personal information in situations where we decide how and why your personal information is to be processed (or to use the European terminology, where we act as a data controller). It does not apply where we are acting merely as a service provider to another organization who decides how and why we process your personal information (or to use the European terminology, where we act as a data processor).

What data do we collect?

The personal data we collect from you are not only information that we actively collect while you interact with our services but also information that you voluntarily provide to us in various contexts (such as by sending an email to us). Therefore, it is not possible to define an exclusive list of all potential types of personal data that we may collect from you. However, we provide below the typical types of personal data we collect from each data subject group.

Data Subject Groups

Personal Data Categories

“Users”

(i.e. those persons who access the content on Aposto Applications by any means)

Information Collected from You

On Website visits and, where applicable, use of Mobile Applications:

Information about how our website was used, including the pages visited, the date, time, and duration of the visit, search terms entered, and other interaction with the website and its content
Technical information related to the visit, including online identifiers (including IP address and cookie data) and information about the devices used (including network connection type, browser type, language, operation system)
Non-precise location information (inferred from the IP address)

On sign-ups to and use of Aposto Applications:

Identity and contact information, including name and email address
Payment and purchase information as well as invoice details, if any (except we never store your credit card information)
The Publications you signed up for and their Publisher information

On Publication interactions:

Information about how you interacted with our emails, including whether you opened our email, the links you clicked, and how you use our Website after clicking a link

Information Collected from Third Parties

On Website visits and, where applicable, use of Mobile Applications:

Unique device IDs related to the visit

On sign-ups to Aposto Applications:

Authentication details if you sign up or sign in using third-party services like Apple or Google

“Publishers”

(i.e. the content providers who create content on our Applications pursuant to the agreements they execute with us)

On execution of an agreement with us and creating an account on the publisher panel:

Identity and contact information, including name, email address, phone number
Payment and billing information as well as invoice details, including identity numbers, bank account details, and payment history information
Information about requests and complaints

“Sponsor Contact Persons”

(i.e. the contact persons we have at the sponsors of our Publications)

On reaching an agreement with us for being a sponsor for one of our Publications:

Identity and contact information, including name, and email address, phone number, position, and sponsor details

Other persons who contact us

Identity and contact details as well as the content of communication

How do we collect your data?

You directly provide us with most of the data we collect (for instance, by filling in our sign up form) but we also use automated processes to collect some information about you.

As described above in more detail, we collect and process your data when:

You visit our Website or use our Mobile Applications or Aposto Applications in general, in which case we use cookies and similar technologies (more on this below);
You fill in the forms on the Website or Aposto Applications such as sign-up forms and contact forms,
You interact with and read our Publications and content on Aposto Applications,
You contact us or interact with our services in any other manner.

Cookies and Similar Technologies

Cookies are small text files that are placed on your computer by websites that you visit. They are widely used to make websites work, or work more efficiently, as well as to provide information to the owners of the site.

We limit the information we collect regarding your visit and use of Aposto Applications and only utilize strictly necessary cookies. For instance, we do not have any third party analytics cookies on our Website.

Most web browsers allow some control of most cookies through the browser settings. To find out more about cookies visit www.aboutcookies.org.

Why do we process your data and what are the lawful bases?

We collect your data for the following purposes and pursuant to the legal bases indicated next to them:

Subject	Purposes	Legal Basis
Sign up processes	To allow you to sign up to Aposto Applications including our Publications	Performance of a contract (6(1)(b) of the GDPR)
Order fulfillment	To facilitate and process service orders placed on Aposto Applications, to carry out financial, accountancy, and operational processes in relation to your purchases, to fulfill the requirements of your orders, to collect payment from you	Performance of a contract (6(1)(b) of the GDPR) insofar as the purpose relates to the execution of a contract agreed with you or the provision of a service requested by you. Otherwise, the legal basis is legitimate interests (6(1)(f) of the GDPR).
Customer support	To respond to your requests, to provide customer support on pre-sale and/or post-sale queries and issues, to help you solve any issues you may have with our services, to update you about changes to our terms of service or privacy notice, or to contact you to know how your experience with us was	Performance of a contract (6(1)(b) of the GDPR) and legitimate interests in retaining you as a customer (6(1)(f) of the GDPR)
Service analysis and improvement	To perform analytics and conduct customer research, to evaluate and develop new features and improvements to Aposto Applications by analyzing your interaction with Aposto Applications	Legitimate interests in running our business and improving our website and your experience (6(1)(f) of the GDPR)
Service maintenance	To administer, operate, and maintain Aposto Applications and our services in general, to understand, diagnose, troubleshoot, and fix issues with our services	Legitimate interests in running our business (6(1)(f) of the GDPR)
Cyber security	To ensure information security of our services and prevent any malicious use of Aposto Applications and services	Legitimate interests in ensuring the security of our services (6(1)(f) of the GDPR)
Compliance	To comply with legal obligations and law enforcement requests, including participation in investigations and proceedings, complying with information requests from third parties based on any statutory information rights they have against us, retention and storage of your personal data to comply with specific legal retention requirements	Legal obligation (6(1)(c) of the GDPR)
Legal proceedings	To establish, exercise, or defend legal claims	Legitimate interests in protecting our business (6(1)(f) of the GDPR)

If you are from Canada, we collect, use, disclose and otherwise process the personal information described above with prior notice in the applicable situations or as authorized by Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

To whom do we transfer your data?

We have set out the categories of recipients of your personal data and why we share your data with them below:

Categories of Recipients	Reason for sharing
Technical service providers	We work with technical service providers who operates the technical infrastructure that we need, assist in protecting and securing our systems and services, and provide technical services to us for the provision of our services to you. These include but are not limited to email service providers, hosting service providers, and archiving service providers.
Payment service providers	As we offer different payment options to our customers, we partner with payment service providers to ensure a smooth purchase experience for you. Naturally, some payment data can be transferred to these payment service providers to collect payment from you and confirm that the payment has been affected.
Consultants	We work with advisors (legal, financial, tax, or similar) to comply with applicable laws and exercise our rights, and these advisors may, from time to time, require access to your personal data to provide services to us.
Authorities	We share your personal data when we, in good faith, believe it is necessary for us to do so to comply with a legal obligation under applicable law or respond to a valid legal process.

We may share your personal data with our group companies and third parties located in countries other than your country. Your personal data, therefore, may be subject to privacy laws that are different from those in your country. Personal data collected within the European Union may, for example, be transferred to and processed by third parties located in a country outside of the European Union. In such instances, we ensure that the transfer of your personal data is carried out in accordance with applicable privacy laws and, in particular, that appropriate contractual, technical, and organizational measures are in place such as the Standard Contractual Clauses approved by the EU Commission.

How long do we keep your data?

We will store your personal data as long as is necessary for the purposes named in this privacy notice, especially for the fulfilment of our contractual and legal obligations. In general, we retain the data you provide to us for as long as you have your account with us and thereafter for such period as you may have questions or a claim in relation to our services, notwithstanding any superior retention period that we may be obliged to observe in accordance with legal requirements applicable to us.

The specific retention periods for personal data are documented in our regional data retention guidelines because how long we retain personal data may vary depending on the services we provide and our legal obligations under applicable national law. The following factors typically affect the retention period:

Necessity for the provision of our services. This includes executing the user agreement with you, maintaining, and improving the performance of our products, keeping our systems secure, and maintaining appropriate business and financial records. Most of our retention periods are determined based on this general rule.
Consent-based processing of personal data. If we process personal data based on consent, we store the data for as long as necessary in order to process it according to your consent.
Statutory, contractual, or other similar obligations. Retention obligations may arise, for example, from laws or official orders. It may also be necessary to store personal data regarding pending or future legal disputes. Personal data contained in contracts, notifications and business letters may be subject to statutory storage obligations depending on national law.

What are your data protection rights?

Depending on relevant laws in your country, you may have rights such as rights to request access, port, object, correct and erase the personal information that we hold about you.

Your EEA, UK, and Swiss Rights

If you are located in the European Economic Area (EEA), the UK or Switzerland, you have the following privacy rights:

You can access, correct, update, or delete your personal information.
You can object to processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information.
If you do not want us to use your email address to promote our own or third parties’ products or services, you can opt-out of receiving marketing emails at any time.
If we have collected and processed your personal information with your consent, then you can withdraw your consent at any time.
You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority. Contact details are available here.

Your California Privacy Rights

This Section of our Privacy Policy provides information for California consumers, as required under California privacy laws, including the California Consumer Privacy Act (“CCPA”).

You may request access to, or for a copy of the personal information we have collected, used, disclosed, and sold about you over the past twelve (12) months.
You may also request that we delete certain personal information we have collected from you.
You have a right not to receive discriminatory treatment for the exercise of your CCPA privacy rights
You can request, under California Civil Code Section 1798.83, certain information regarding our disclosure of personal information to third parties for their direct marketing purposes.
California consumers have the right to opt-out of the sale of their personal information. We do not and will not sell your personal information. We may provide third parties with certain personal information to provide or improve our products and services, for example to deliver services at your request. In such cases, we require those third parties to handle the information in accordance with applicable laws and regulations.

California privacy laws also require that we provide California consumers information about how we use their personal information, whether collected online or offline. This document and specifically the sections above are intended to satisfy that requirement.

Your Canadian Privacy Law Rights

If your information is collected from within Canada, you have the following privacy rights:

You can access, correct, update, or delete your personal information.
If we have collected and processed your personal information with your consent, then you can withdraw your consent at any time.
If you wish to make a complaint about a breach of Personal Information Protection and Electronic Documents Act (PIPEDA), please contact us using the details below and we will take reasonable steps to investigate the complaint and respond to you. If after this process you are not satisfied with our response, you can submit a complaint to the Office of the Privacy Commissioner of Canada.

Inquiries and requests

You can reach out to our privacy team for general questions on privacy and to exercise your data protection rights by sending an email to [email protected]. Please note that to protect your personal information, we may need to verify your identity by a method appropriate to the type of request you are making.

Changes to this notice

We keep our privacy notice under regular review and might introduce updates from time to time. This privacy notice was last updated on September 15, 2022.

Privacy Notice (PDF)Download PDF