Privacy Policy

This Privacy Policy of Socialista ("PromoAccess", "we", "us" or "our") describes how and why we collect, store, use and share ("process") your personal data when you use our services ("Services"), including but not limited to: • Visiting our website at https://www.promoaccess.nl or any subdomains/linked websites to which this privacy policy applies. • Downloading and using our mobile application ("PromoAccess App") or using our web application for promoters. • Participating in communication with us via sales, marketing or events. Do you have questions or concerns? By reading this privacy policy you will get a clear picture of your privacy rights and choices. If you do not agree with our policy and practices, please do not use our Services. For further questions you can contact us at [email protected].

Personal data you provide to us In short: we collect personal data that you provide to us yourself. We collect personal data that you voluntarily provide when you register for our Services, express interest in our products and services, participate in activities within the Services, or when you contact us directly. Personal data we receive from you. What data we collect depends on the context of your interactions with PromoAccess and our Services, the choices you make and the features you use. The personal data we may collect includes: • Name • Email address • Username • Phone number • Date of birth • Gender • TikTok ID, TikTok videos and TikTok statistics (when using TikTok OAuth linking) • Location data (via GPS or manually entered) Why we collect gender information. To ensure the best match between Creators and events, gender information may be collected and used to help filter opportunities. Some event organizers set specific demographic criteria (such as 'male' or 'female') to align with their campaign goals or target audience. This data is used strictly for eligibility matching purposes. Creators will only see whether they qualify for a campaign or not - specific eligibility criteria such as gender requirements are not displayed in the app. The personal information of Creators remains private; Promoters do not have access to Creator profile data and can only view submitted content. Special categories of personal data. PromoAccess does NOT process special categories of personal data as referred to in the GDPR (such as data on religion, health, ethnicity or political opinions). Payment data. If you make a purchase, we may collect data necessary to process your payment, such as your payment method (e.g. credit card number) and the security code associated with your payment method. All payment data is processed and stored exclusively by Stripe. Stripe's privacy policy can be found here: https://stripe.com/en-gb/privacy. App data. When you use our mobile application(s), we may - if you give permission - collect the following information: • Geolocation data. We may request access to or permission to track location information from your mobile device, continuously or only while using the app, to provide location-based features. You can adjust this in your device settings. • Mobile device data. We automatically collect information about your device (such as device ID, model, manufacturer, operating system, version and configuration, browser type and version, internet service provider or mobile network provider, and IP address). We may also collect information about which features of the app you have used. • Push notifications. We may request permission to send push notifications about your account or certain features. You can always disable push notifications in your device settings or in the app. This information is primarily needed to ensure the security and operation of our applications, troubleshoot problems, and perform internal analysis and reporting. All personal data you provide to us must be accurate, complete and up-to-date. You are responsible for reporting changes to your personal data to us in a timely manner.

In short: certain information - such as your IP address and device characteristics - is automatically collected when you use our Services. We automatically collect certain information when you visit, use or navigate our Services. This information does not reveal your specific identity (such as your name or contact details), but may consist of device and usage information, such as: • IP address • Browser and device properties • Operating system • Language settings • Referring URLs • Device name • Country and location • Information about how and when you use our Services • Technical data for troubleshooting and security Like many other companies, we use cookies and similar technologies to collect information. The data we automatically collect includes: • Log and usage data. These are service-related, diagnostic and performance data that our servers automatically collect and record in log files when you use the Services. This data may contain your IP address, device and browser information, settings, date/time of use, pages/files viewed, search queries and system activities (such as error messages or crash dumps). • Device data. Information about the device you use to access our Services, such as IP address, device and app IDs, operating system and configuration. • Location data. We may collect location data, which may be accurate or less accurate depending on your device settings (e.g. via GPS or IP address). If you refuse or disable location data, you may not be able to use certain features.

When you visit our app installation page (promoaccess.nl/install), we collect anonymous analytics to understand which platforms our users prefer. This includes: • Device type (iOS, Android, or Desktop) • Approximate location (country and city, determined from your IP address) • Timestamp of your visit • Browser information Your IP address is used only to determine your approximate location and is not stored. No personally identifiable information is collected. This data helps us improve our service and understand our users' platform preferences.

In short: we process your personal data to provide, improve and manage our Services, to communicate with you, for security and fraud prevention, and to comply with laws and regulations. Additionally, we may process your data for other purposes, but only with your consent. • Account creation and authentication. We process your data to enable you to create an account, log in and keep your account active. • Delivery of Services. We process your data to provide the services you request and to facilitate collaboration between creators and promoters. • Communication. We use your data to keep you informed about updates, changes to our Services, or important notifications regarding your account. • Security and fraud prevention. We process data to prevent abuse and fraud and to ensure the security of our Services. • Legal obligations. We process data when we are legally required to do so, for example for tax purposes or to comply with requests from regulators or authorities. • Vital interests. If necessary, we may process your data to protect your vital interests or those of another, for example to prevent harm or abuse. PromoAccess does not use automated decision-making or profiling that has legal effects or similarly significantly affects you, as referred to in Article 22 GDPR. We do use limited forms of data analysis (for example to analyze usage patterns and improve our platform), but these have no binding consequences for users.

In short: our app measures which advertisements lead to installs and sign-ups. This uses an advertising identifier and a TikTok measurement tool. We advertise PromoAccess on TikTok to reach new creators. To understand which of those advertisements work, our mobile app includes the TikTok Business SDK, also called the TikTok App Events SDK. This is separate from logging in with TikTok. What this involves: • Advertising identifier. On Android we use the Google Advertising ID. On iOS we use the Identifier for Advertisers (IDFA), which is only available if you allow tracking when your device asks you. You can reset or limit this identifier at any time in your device settings. • App events. The SDK reports that the app was installed and opened, and reports three milestones: completing sign-up, completing onboarding, and joining your first campaign. • Matching data. So that TikTok can link those events to an advertisement you saw, the SDK also sends your email address, your phone number if you provided one, and your PromoAccess user ID. These values are converted into an irreversible hash on your device before they are sent. TikTok cannot read the original values, but the hash can still be matched against TikTok's own records, so we treat it as personal data. • Technical data. Each event carries information about your device, such as device model, operating system version, language, screen size, network type and the Google Play install referrer. For this measurement TikTok acts as an independent party, not only as a processor acting on our instructions. TikTok's own privacy policy applies to what TikTok does with this data. How to limit this. On iOS, declining the tracking request prevents the advertising identifier from being used. On Android you can enable "Delete advertising ID" in your Google settings. The app events and the hashed matching data described above are currently sent regardless of that choice. If you want this processing stopped for your account entirely, contact us at [email protected] and we will arrange it.

We only share your personal data with third parties when this is necessary for the performance of our Services, when we are legally obliged to do so, or when you have given consent. We always conclude a processing agreement with parties that process personal data on our behalf, so that the same level of security and confidentiality is guaranteed. Categories of third parties with whom we may share data: • Payment processors - for processing payments and refunds. • Hosting and infrastructure providers - for hosting our website, apps and databases. • Authentication and login services (e.g. TikTok OAuth) - for secure login and account management. • Communication and notification tools - for push notifications, email and customer service. • Analytics and monitoring services - for insight into use and performance of our Services. • Marketing and advertising networks (TikTok) - to measure which advertisements lead to app installs and sign-ups. See "Advertising and measurement in the app" below. • Social media platforms (e.g. TikTok) - if you make a connection with your account yourself. • Legal and supervisory authorities - when legally required (for example in case of fraud investigation or tax obligation). Special situations: • Business transfer: In case of merger, sale of business units or financing, your information may be transferred to the party involved, provided this is in accordance with the GDPR. • Google Maps Platform APIs: If we use Google Maps or Places APIs (for example for location validation), your information may be shared with Google. See Google's privacy policy for more information. Apart from the advertising measurement described under "Advertising and measurement in the app", we do not share personal data with third parties for their own commercial purposes without your explicit consent.

PromoAccess uses cookies and similar technologies to collect and store information. We use these technologies for the following purposes: • Functional cookies: necessary for the website and app to function properly (for example for logging in, language settings or security). • Analytical cookies: to gain insight into the use of our website and app, so that we can improve them. Where possible we anonymize data. • Marketing and tracking cookies (if applicable): to make content and advertisements more relevant and to measure the effectiveness of campaigns. These are only placed if you consent. On your first visit to our website and/or app, we display a cookie banner explaining these cookies. For more details about the cookies and technologies used, please refer to our Cookie Policy.

When you choose to register or log in to PromoAccess with your social media account (such as TikTok), we gain access to certain information from that account. What data we receive depends on the platform and the permissions you grant. In the case of TikTok OAuth, this may include your profile information, user ID, videos, email address, video statistics and other data that you have made public or for which you have given permission. We use this information only for the purposes described in this privacy policy, such as account registration, matching with promoters and displaying your content in our app & on our website. We have no write permissions and never post or modify content on your behalf. It is important to know that we have no control over how TikTok or other social media platforms use your data. We recommend that you read their own privacy policy to understand how they collect, use and share your data, and how you can set your privacy preferences. Revoking the connection You can revoke the connection with your social media account at any time: • via your account settings in the PromoAccess app, and/or • via the settings of the relevant social media platform (e.g. TikTok). When you revoke the connection, no new data will be retrieved from your social media account. Data that has already been retrieved and is necessary for the use of your PromoAccess account (such as your profile and linked content) will be retained as long as your account is active. Once you delete your PromoAccess account, this data will be deleted or anonymized in accordance with our retention periods.

We do not retain your personal data longer than strictly necessary for the purposes described in this privacy policy, unless a longer retention period is legally required or permitted (for example fiscal retention obligation). • Account data: as long as your account is active. After deletion or termination of your account, the data will be deleted or anonymized within 30 days. • Payment and invoice data: at least 7 years, in accordance with the legal retention obligation for administration and tax. • Log files and analytics (including IP address, device data): maximum 36 months for security, troubleshooting and analysis. After that they are deleted or anonymized. • Location data: as long as your account is active or until you withdraw your consent in the app settings. • Support requests: maximum 12 months after completion of the request, so that we can better help you with follow-up questions. • Backups: maximum 90 days, after which they are automatically deleted or overwritten. If deletion or anonymization is not immediately possible (for example because data is in backup systems), we will securely store the data and only use it for necessary purposes until deletion is possible.

We only process your personal data when there is a valid legal basis under the General Data Protection Regulation (GDPR). Depending on the situation, we rely on the following grounds: • Consent (Art. 6(1)(a) GDPR) When you give us explicit consent, for example for: - receiving marketing communications or push notifications, - sharing your content in the Inspire Feed & on our website, - the use of location data (GPS). You can always withdraw your consent via your account settings or by contacting us. • Performance of a contract (Art. 6(1)(b) GDPR) When processing is necessary to perform a contract with you or to take measures at your request before concluding a contract. For example: - creating and managing an account, - facilitating collaborations between creators and promoters, - processing payments via Stripe. • Legal obligation (Art. 6(1)(c) GDPR) When processing is necessary to comply with a legal obligation. For example: - retaining payment and invoice data for the tax authorities (7 years). • Legitimate interest (Art. 6(1)(f) GDPR) When processing is necessary for our legitimate interest, provided your interests or fundamental rights do not outweigh this. For example: - improving and securing our app and website, - analyzing usage data to optimize our services, - preventing fraud or abuse of our platform, - internal administration and reporting. You can object to processing based on legitimate interest. • Vital interests (Art. 6(1)(d) GDPR) In exceptional situations, when processing is necessary to protect someone's life or safety. For example: passing on data to emergency services in case of acute emergency. With your consent, we may contact you for marketing purposes, for example via email, push notifications or social media. You can always withdraw your consent for these messages via the unsubscribe link in our messages or by contacting us.

We take the protection of your personal data very seriously and have taken appropriate technical and organizational measures to prevent abuse, loss, unauthorized access, unwanted disclosure and unauthorized modification. Our measures include: • Encryption (TLS/SSL) for data transfer between you and our servers. • Access security and authorization: only authorized employees have access to personal data, and only insofar as this is necessary. • Backups and monitoring of our systems, so that data can be recovered in case of incidents. • Password security. • Processing agreements with our suppliers to ensure that they also apply appropriate security. Although we do our utmost to protect your data, no system or transmission over the internet can be fully guaranteed against unauthorized access or abuse. The use of our services is therefore always at your own risk. We recommend that you also take measures yourself, such as using strong passwords and securing your devices. Data breach notification Should a security incident or data breach involving your personal data occur, we will carefully investigate this. If necessary, we will notify the Dutch Data Protection Authority and - if there is a high risk to your rights and freedoms - also you, within the legal deadlines.

PromoAccess is intended exclusively for users aged 18 and older. We do not knowingly collect or use personal data from minors and we do not target our marketing at persons under 18 years of age. By using our services, you declare that you are at least 18 years old. If we discover that we have collected personal data from someone under 18 years of age, we will delete this data as soon as possible. If you suspect that we have collected data from a minor without consent, please contact us immediately at [email protected], so that we can correct this.

If you live in the European Economic Area (EEA), you have various rights regarding your personal data under the GDPR. These rights include: • Right of access - you can request a copy of the personal data we process about you. • Right to rectification - you can ask us to correct inaccurate or incomplete data. • Right to erasure - you can request us to delete your data ('right to be forgotten'). • Right to restriction of processing - you can request us to (temporarily) stop processing your data. • Right to data portability - you can request to receive your data in a structured, commonly used and machine-readable format (e.g. CSV or JSON), or to have it transferred directly by us to another organization, insofar as this is technically feasible. • Right to object - you can object to the processing of your personal data, including profiling or use for direct marketing. • Right to withdraw consent - if you have given us consent to process your data, you can withdraw it at any time. Withdrawing your consent does not affect the lawfulness of the processing before the withdrawal. Even if you unsubscribe from marketing communications, we may still send you messages that are necessary for managing your account or performing our services (such as service messages or payment notifications). Do you want to exercise one of these rights or do you have questions about your privacy? Contact us at [email protected]. We respond as soon as possible, but at the latest within one month. If necessary, this period can be extended by a maximum of two months in case of complex or many requests. Do you believe that we are processing your data unlawfully? You have the right to file a complaint with the Dutch Data Protection Authority via: https://autoriteitpersoonsgegevens.nl.

Some web browsers, mobile device operating systems and mobile applications offer a "Do Not Track" (DNT) feature or setting. This allows you to indicate that you do not want your online browsing behavior to be tracked and collected. However, there is currently no generally accepted standard for how DNT signals should be applied or recognized. Therefore, PromoAccess does not currently respond to DNT signals or other automatic mechanisms that communicate your preferences for online tracking. If a standard is developed in the future that we must legally comply with, we will adapt our systems and this privacy policy accordingly and inform you.

We may update this privacy policy from time to time to comply with applicable laws and regulations or to further improve our services. The most recent version is always recognizable by the "Last updated" date at the top of this document and takes effect immediately upon publication. When material changes are made, we will clearly communicate this, for example via a notification on our website or in the app, or - if appropriate - via email. We recommend that you consult this privacy policy regularly, so that you stay informed about how we protect your personal data.

If you have questions or comments about this privacy policy, you can contact us via: Email: [email protected] Address: Casembrootstraat 60RD, 1972 CC IJmuiden, The Netherlands KvK 61396478

Depending on applicable legislation (such as the GDPR in the EU), you have the right to view, correct, restrict, transfer or have deleted the personal data we process about you. You can also object to the processing or withdraw previously given consent. A request for access, correction, deletion, data transfer or objection can be submitted via [email protected]. To ensure that the request is made by you, we ask you to send a copy of a valid identity document. Make your passport photo, MRZ (the strip with numbers at the bottom of the passport), passport number and citizen service number (BSN) black. We recommend using the KopieID app from the Dutch government for this. The copy is only used for verification and is deleted immediately after verification. We respond as soon as possible, but at the latest within one month, to your request.