PRIVACY POLICY FOR USERS

1. INTRODUCTION - ABOUT US

Turgon Management LTD (Company Registration Number: 13614887) with registered office at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom (hereinafter, "Data Controller"), owner of the website promo.emcomit.com/uk (hereinafter, the "Website" or "Site"), as the data controller of the personal data of users who browse and subscribe to the initiative accessible through the Website (hereinafter, "Users") provides below the Privacy Policy pursuant to art. 13 of EU Regulation 2016/679 and the UK General Data Protection Regulation (hereinafter, respectively, the "Regulation" and the "UK GDPR" and, jointly, the "Applicable Regulation"). Our ICO registration number is ZB496512.

2. HOW TO CONTACT US?

The Data Controller takes the utmost account of Users' right to privacy and personal data protection. For any information related to this Privacy Policy, Users can contact the Data Controller at any time, via any of the following means:

• By sending an e-mail to: info@emcomit.com

Data Protection Officer (DPO)

• Name: Adam Brogden
• Address: 1st Floor Front Suite, 27–29 North Street, Brighton, England BN1 1EB
• Tel: +44 1772 217 800
• Email: dpo.support@gdprlocal.com

EU - Ireland Representative

• Company Name: Instant EU GDPR Representative Ltd
• Name: Adam Brogden
• Email: contact@gdprlocal.com
• Tel: +353 15 549 700
• EU Dublin Address: INSTANT EU GDPR REPRESENTATIVE LIMITED Office 2 12A Lower Main Street, Lucan Co. Dublin K78 X5P8 Ireland

3. HOW DO WE GET INFORMATION?

The Data Controller collects personal data only directly from Users who register via the form on the Website. No data are collected from other sources and no data belonging to special categories or criminal conviction data are processed.

3A. COOKIES

This Privacy Policy explains how we process your personal data. For specific information about how we use cookies on this Site, please see our Cookie Policy at Here.

Our Cookie Policy explains:

• What cookies are and how they work
• Which cookies we use on the Site (only strictly necessary session cookies)
• Why we use cookies
• How you can manage cookies through your browser

Summary of our cookie use:
We only use strictly necessary session cookies that are essential for the Site to function. We do not use analytics cookies, marketing cookies, or third-party tracking cookies. No consent is required for our cookie use under PECR.

4. WHAT DO WE DO? - PURPOSE OF THE PROCESSING

Users' personal data will be processed lawfully by the Data Controller pursuant to Article 6 of the Regulation for the following processing purposes:

Data Retention Period

We retain personal data only for as long as necessary to fulfil the purposes described, and in accordance with legal obligations and ICO guidance.

Security Measures

We implement appropriate technical and organisational measures to protect personal data, including encryption, access controls, and secure storage.

5. LEGAL BASIS

Registration and use of the Site (as described in section 4, lett. a) and e)):

The lawful basis for processing personal data for the purpose of registration and website use is the performance of a contract (Article 6(1)(b) UK GDPR). Specifically, we process your data to provide you access to offers and coupons, which is the service you have explicitly requested by registering.

This processing includes:

• Creating and maintaining your account
• Providing access to the Site and its features
• Enabling you to browse and redeem offers and coupons
• Managing your account preferences
• Providing customer support

Where you choose to provide additional data or preferences beyond what is required for the service, your consent may also apply (Article 6(1)(a) UK GDPR). However, basic registration and access to the Site does not require consent for marketing purposes and is not conditional on providing marketing consent.

You can use the full service even if you do not consent to any marketing communications.

Right to withdraw consent:

Where consent is the legal basis for processing (such as for optional preferences), you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before the withdrawal. To withdraw consent or exercise your rights, contact the data controller at info@emcomit.com.

Legal obligations (as described in section 4, lett. b)):

The processing is necessary to fulfil a legal obligation to which the Data Controller is subject.

Marketing activities (as described in section 4, lett. c)) and communication of data to Third Party Companies for their marketing purposes (as described in section 4, lett. d)):

The legal basis for these processing activities is your explicit, freely-given consent (Article 6(1)(a) UK GDPR and PECR Regulation 22).

PECR Regulation 22 requires explicit opt-in consent for electronic marketing communications (email, SMS, automated calls). We comply with this by:

• Providing separate, optional checkboxes for marketing consent during registration
• NOT pre-checking any marketing consent boxes
• NOT making marketing consent a condition of accessing the Site
• Clearly explaining what each consent covers
• Making consent freely given, specific, informed, and unambiguous
• Providing easy ways to withdraw consent

The Data Controller asks you to provide separate, specific, free and optional consent for each of these processing purposes through distinct checkboxes during registration:

1. Marketing consent checkbox (section 4c):
   "I confirm that Turgon Management LTD and its sponsors may contact me by email, phone, text and/or push notifications with products and special offers. I can decide on the selection of the sponsors myself."
2. Third-party sharing consent checkbox (section 4d):
   "I agree to receive offers by email, phone, text, postal from other selected Partners with whom we will share your details."

These consents are:

• NOT bundled together
• NOT bundled with Terms and Conditions acceptance
• NOT required to access the Site or its services
• Completely optional
• Can be given independently of each other
• Can be withdrawn at any time independently

Third Party Companies' legal bases:

Third Party Companies who receive your data (if you consented under section 4d) may rely on different legal bases for their further processing activities, such as:

• Consent (Article 6(1)(a) UK GDPR): For electronic marketing that requires explicit opt-in under PECR
• Legitimate Interest (Article 6(1)(f) UK GDPR): For certain marketing activities where consent is not legally required, such as:
  • Postal marketing
  • Some telephone marketing
  • Combining data with other sources to create audience profiles
  • Verifying and updating data accuracy
  • Identifying people with similar interests
  • Analytics and measurement
  • Identity resolution

When Third Party Companies process data based on Legitimate Interest:

• They must conduct a Legitimate Interest Assessment (LIA)
• They must balance their commercial interests against your rights and freedoms
• They must implement appropriate safeguards
• You have the right to object to such processing at any time
• They must honor your objection, especially for direct marketing

Each Third Party Company's specific legal bases are detailed in their own privacy policies, which are linked on the sponsor list available at: https://promo.emcomit.com/uk/sponsor-uk.html

Your right to object:

For any processing based on Legitimate Interest (by us or Third Party Companies), you have the right to object at any time. For direct marketing purposes, your right to object is absolute - we or they must stop immediately.

To exercise your right to object, contact:

• Us at info@emcomit.com (we will coordinate with Third Party Companies)
• The Third Party Company directly (contact details in their privacy policy)

Consent withdrawal:

You can withdraw your marketing consent at any time. Withdrawal:

• Does not affect the lawfulness of processing before withdrawal
• Takes effect within 7 working days
• Does not affect your access to the Site or services
• Can be done via unsubscribe links, contacting us, or account settings

6. PROCESSING METHODS AND DATA RETENTION TIMES

Users' personal data will be processed by the Data Controller using manual and IT tools, as strictly necessary to achieve the purpose for which they are processed, and in any event, to ensure confidentiality of the data. The Data Controller implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:

(i) the pseudonymisation and encryption of personal data; (ii) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; (iii) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; (iv) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

The personal data of the Users of the Website will be kept for the time strictly necessary to carry out the primary purposes connected to the User's use of the Site and access to offers (illustrated in article 4 above) and in any case for the time necessary for the civil protection of both User's and the Data Controller's interests (therefore, indicatively, between 2 and 4 years).

Personal Data Retention Periods:

We retain your personal data for different periods depending on the purpose:

1. Registration and Account Data (Section 4a and 4e):
   • Active accounts: For the duration of your account
   • After account closure: 3 years (for potential legal claims under UK limitation periods)
   • Includes: Name, email, address, date of birth, account credentials
2. Marketing Consent Records (Sections 4c and 4d):
   • Duration: For as long as consent is active, plus 3 years after withdrawal
   • Purpose: To prove we obtained valid consent and to honor withdrawal
   • Includes: Consent timestamp, consent text shown, withdrawal date (if applicable)
3. Marketing Communication Data (if you consented under 4c):
   • Active consent: Retained while you remain subscribed
   • Inactive users: If you don't interact with our marketing or use the Site for 36 months, we will delete your data unless you explicitly request to remain subscribed
   • Interaction history (opens, clicks): 2 years from last interaction
4. Third Party Sharing Data (if you consented under 4d):
   • Sharing records: 3 years from sharing date (to prove we had valid consent)
   • Suppression lists: If you withdraw consent, we maintain a suppression record indefinitely to ensure partners don't receive your data again
5. Transaction and Offer Redemption Data:
   • Retention: 6 years from transaction date
   • Purpose: UK limitation period for contract claims, tax records
   • Includes: Offers redeemed, dates, any associated data
6. Legal Compliance and Fraud Prevention:
   • Retention: As required by applicable law (typically 6 years)
   • Includes: Fraud prevention records, legal correspondence, regulatory requirements
7. Aggregated and Anonymized Data:
   • Retention: Indefinitely
   • Reason: Cannot identify individuals, therefore not personal data under UK GDPR

Inactive Account Policy:

If you do not carry out any activity (login, email interaction, offer redemption, or any use of the Site) for a period of 36 months, we will:

• Send you an email warning before deletion (to the email on record)
• Give you 30 days to indicate if you want to keep your account active
• If no response, delete your personal data except for:
  • Data we must retain by law
  • Anonymized/aggregated data
  • Suppression records (if you previously withdrew marketing consent)

Data Deletion Process:

• Personal data is reviewed quarterly for deletion eligibility
• When retention periods expire, data is securely and permanently deleted
• Deletion includes all backups within 90 days
• You can request early deletion by exercising your right to erasure (see section 8), subject to our legal obligations and legitimate interests

Third Party Companies' Retention:

The data retention periods applied by Third Party Companies who receive your data (if you consented under section 4d) are specified in their own privacy policies available at https://promo.emcomit.com/uk/sponsor-uk.html.

Generally, Third Party Companies retain data:

• For as long as you remain on their marketing lists
• For their legitimate business needs (typically 2-3 years after last interaction)
• As required by law
• Suppression records may be kept indefinitely to honor opt-outs

To request information about Third Party retention or request deletion from their systems, contact them directly using details on our sponsor list or contact us at info@emcomit.com to coordinate.

7. SCOPE OF DISCLOSURE AND DISSEMINATION OF DATA

We store your personal data within the European Economic Area and it is transferred to countries within the European Economic Area. In agreement with our partners in article 4(d), it is possible that your data will be transferred to "third countries". Third countries are countries located outside the European Union. In relation to such data transfers, a secure transfer within the scope of EU specifications on data protection and privacy are ensured. The Applicable Regulation permits the transfer of personal data from United Kingdom to the EEA and to any countries which, as at 31 December 2020, were covered by a European Commission 'adequacy decision' (this is to be kept under review by the UK Government).

Users' personal data may be disclosed to the employees and/or collaborators of the Data Controller in charge of managing the Website. These subjects, who are formally appointed by the Data Controller as "data processors", will process the User's data exclusively for the purposes indicated in this policy and in compliance with the provisions of the Applicable Regulation.

Third parties who may process personal data on behalf of the Data Controller as Data Processors may also become aware of the Users' personal data, such as, for example:

• service providers (such as administrative, IT, mailing services, credit recovery companies, etc.);
• consultants (such as accountants, auditing firms, lawyers, etc.);
• companies of the same group, associated companies.

Users have the right to obtain a list of any data processors appointed by the Data Controller, by making a request to the Data Controller in the manner indicated in article 8 below.

Furthermore, the personal data of the Users may be communicated by the Data Controller, as well as to the Third-Party Companies referred to in article 4, let. d), to other third parties to the extent that this is necessary to fulfil legal obligations, such as any public authority in charge of controlling the application of the rules on coupons delivery, as well as third parties indicated in the terms, to which the data must necessarily be communicated to allow the User to take advantage of any coupons (e.g. travel agencies, ticket offices, hotels, etc.).

8. RIGHTS OF DATA SUBJECTS

Users may exercise their rights pursuant to the Applicable Regulations by contacting the Data Controller as follows:

• By sending an e-mail to: info@emcomit.com

Pursuant to the Applicable Regulations, the Data Controller hereby declares that Users have the right to obtain information on (i) the source of their personal data; (ii) the purposes and methods of the processing; (iii) the logic applied to the processing, if carried out by means of electronic tools; (iv) the identity of the Data Controller and the Data Processor; (v) the parties or categories of party to whom the personal data may be communicated or who may gain knowledge of them in their capacity as data processing managers or persons in charge of processing.

Furthermore, Users have the right to obtain:

a) access, update, rectify or, should they wish to do so, integrate their data; b) the cancellation, transformation into anonymous form or blocking of data which have been processed unlawfully, including data whose retention is unnecessary for the purposes for which they have been collected or subsequently processed; c) confirmation that the operations under a) and b) have been made known, including regarding their contents, to those to whom the data has been communicated or distributed, except in the event such compliance proves to be impossible or leads to the use of manifestly disproportionate means in respect of the right defended.

Furthermore, Users have:

a) the right to withdraw consent at any time, if the processing is based on their consent (it should be noted that this withdrawal does not affect the lawfulness of the processing based on consent before the withdrawal); b) the right to data portability (the right to receive all their personal data in a format that is structured, commonly used and readable by automatic devices), the right to limit the processing of personal data and the right to cancellation ("right to be forgotten"); c) the right to object: i) in whole or in part, for legitimate reasons, to the processing of their personal data, even if pertinent to the purpose of the collection; ii) in whole or in part, to the processing of their personal data for the purpose of sending advertising and direct marketing materials, or for carrying out market research or business communications; iii) if personal data is processed for direct marketing purposes, at any time to object to the processing of their data for this purpose, including profiling in so far as it is connected to such direct marketing. d) Whereby it is believed that processing of the data is in breach of the Regulation, the right to file a complaint with the Supervisory Authority (in the Member State in which they normally reside, in which they work or in which the alleged violation has occurred). The UK supervisory authority is the Information Commissioner Office and their contact details are:

You can also lodge a complaint with the UK Information Commissioner’s Office (ICO) if you believe your data has been processed unlawfully. For more information, please visit https://ico.org.uk.

The Data Controller is not responsible for updating all links that can be viewed in this Policy, therefore whenever a link is not functional and/or current, Users acknowledge and accept that they must always refer to the document and/or section of the websites referred to by the link.

9. UPDATES TO THIS PRIVACY POLICY

We keep our privacy notice under regular review to make sure it is up to date and accurate. We may make changes to this privacy policy from time to time. You should check this page regularly to see our most up to date policy. This privacy policy was last updated on 1 April 2024