Full Platform Privacy Notice

COLLABOR TECHNOLOGIES LTD (Collabor, we, us or our) is the controller responsible for the personal information described in this Full Platform Privacy Notice (Notice). We are incorporated in England and Wales under company number 16888312. Our registered office is Egerton Mill, 25–27 Egerton Street, Chester, United Kingdom, CH1 3ND.

This Notice explains what personal information we collect through the Platform, how and why we use it, who we share it with, how long we keep it, how it may be transferred internationally, and the rights you have over it. It applies to Brands, Agencies and Creators, and to anyone else whose information reaches us through the Platform, such as a Brand contact or a Creator's authorised representative.

This is our general Notice for the Platform as a whole. Two areas have their own more detailed notice, which this Notice does not repeat in full: our Creator Discovery Data Notice explains how we source and score public Creator information before a Creator registers, and our Seller Tax Reporting Notice explains our HMRC due-diligence and reporting duties. Our Cookie Policy explains cookies and similar technologies used on our website and Platform. Read this Notice alongside those documents, and alongside the Creator Platform Agreement, Brand Platform Agreement and Payments and Payout Protection Policy, which also contain data-handling terms relevant to your use of the Platform.

"Platform" means Collabor's websites, applications, dashboards, communications, creator-discovery, campaign-management, content-review, reporting and payment-facilitation services.

"Brand" means a brand, advertiser, agency or other business using the Platform to engage Creators.

"Creator" means the individual or entity providing content, endorsement or other Campaign services through the Platform.

"Campaign" means a creator marketing opportunity, project or engagement created, negotiated, administered or recorded through the Platform.

"Payment Provider" means Stripe and any other regulated or authorised payment service provider appointed in connection with the Platform.

"KYC Information" means the identity, business, sanctions and tax-verification information we or the Payment Provider collect to verify who you are, confirm you are authorised to hold a payout account, and meet our legal and Payment Provider obligations.

"Service Provider" means a supplier that processes personal information on our behalf under a contract, such as a hosting, analytics, communications, verification or customer-support provider.

"UK GDPR" means the UK General Data Protection Regulation, read together with the Data Protection Act 2018 and applicable guidance from the Information Commissioner's Office (ICO).

When you register or maintain a Creator Account or Brand or Agency account, we collect information such as your name, date of birth or incorporation details, address, country, email address, phone number, tax residence and identification number, payout details, profile description, experience, audience or company information, and any authority you hold to act for another person or organisation.

We collect the information generated as you use the Platform to run or take part in Campaigns: campaign briefs, proposals, offers and negotiated terms, Deliverables and submitted content, revision requests and feedback, approval and dispute records, in-Platform messages between Brands, Agencies and Creators, and support tickets and correspondence with us.

To fund, activate, allocate, release and pay out Campaign amounts, and to meet our legal and Payment Provider obligations, we and our Payment Provider collect KYC Information. Depending on whether you are an individual or an entity, this may include your legal name, date of birth or incorporation details, address, national insurance or tax identification number, VAT number, government-issued identity document details, sanctions and fraud-screening results, connected-account and payout-account identifiers, and transaction, funding, allocation, release, refund, chargeback and payout records. Stripe's role in collecting and processing this information, and Collabor's role as merchant of record, are described in clause 6 below and in our Payments and Payout Protection Policy.

Where you connect a social account, or where we source your public profile through Creator Discovery before you register, we collect platform identifiers, profile information, audience and engagement metrics, content and publication data, and the estimates and scores described in our Creator Discovery Data Notice. That Notice, not this one, is the primary reference for how discovery information is sourced, scored and corrected.

We collect technical information generated by your use of the Platform, such as IP address, device and browser type, log-in and session records, pages viewed, features used, referral source, and cookie or similar-technology identifiers. Our Cookie Policy explains the specific cookies and similar technologies we use and how to manage your preferences.

Where you interact with our marketing communications, or set a communication or marketing preference, we record that choice and related engagement information, such as whether an email was opened or a link followed.

We collect personal information directly from you, for example when you register, complete your profile, message another user, submit a Deliverable or contact support; automatically, through your use of the Platform and the cookies and similar technologies described in our Cookie Policy; and from third parties, including the Payment Provider, identity- and sanctions-verification providers, connected social platforms, other Platform users (such as a Brand adding notes about a Creator, or a Creator's authorised representative), and, before registration, the public and licensed sources described in our Creator Discovery Data Notice.

We use account, campaign, messaging and payment information to operate your Creator Account or Brand or Agency account, facilitate Campaigns, process Deliverables and approvals, coordinate payment and payout, provide support, and otherwise perform the Creator Platform Agreement, Brand Platform Agreement or Payments and Payout Protection Policy, or take steps you request before entering into one of those agreements.

We rely on legitimate interests to operate, secure and improve the Platform, prevent and investigate fraud and misuse, understand usage through analytics, communicate operationally with users, enforce our terms, and support Creator Discovery as described in our Creator Discovery Data Notice. Where we rely on legitimate interests, we consider the purpose, necessity and impact on you, and apply the safeguards described in this Notice. You can object to processing based on legitimate interests as described in clause 14.

We use KYC Information, transaction records and related information to meet obligations under anti-money-laundering, sanctions, payment-services and tax law, including the digital-platform seller-reporting duties explained in our Seller Tax Reporting Notice, and to respond to lawful requests from regulators, courts and public authorities.

We rely on consent where the law requires it, such as for certain non-essential cookies described in our Cookie Policy, optional marketing communications, or an optional feature offered on that basis. You can withdraw consent at any time for future processing without affecting processing that was already lawfully carried out.

Payment processing, connected-account, identity-verification, balance, transfer and payout infrastructure is provided by Stripe as our Payment Provider, under the Stripe Connect structure described in our Payments and Payout Protection Policy. Stripe collects and processes KYC Information both as our processor and, for its own regulatory identity-verification, sanctions-screening and payment-services obligations, as an independent controller under Stripe's own privacy terms, which we encourage you to read.

For payments processed under the configured Stripe Connect model, Collabor is the merchant of record and uses payment and KYC Information to allocate, release, refund and reconcile Campaign payments, apply the Payment Protection process, investigate payment disputes and chargebacks, and meet our own tax-reporting duties, described in our Seller Tax Reporting Notice. We do not use KYC Information collected for payment verification for unrelated marketing profiling.

Where you connect a social account to the Platform, or use it to apply for or accept a Campaign, we use the connection to display your profile and audience information to Brands and Agencies, verify claims made in your profile, and support Campaign matching and reporting. Where your public profile was sourced before you registered, the collection, scoring, correction and suppression process is explained in full in our Creator Discovery Data Notice, which takes precedence over this clause for that subject matter.

We use cookies and similar technologies on our website and Platform for purposes that may include keeping you signed in, remembering preferences, measuring usage and, where you consent, supporting marketing. The categories of cookie we use, their purposes, providers and durations, and how to accept, reject or change your choices, are set out in full in our Cookie Policy.

We may disclose personal information to:

● our Payment Provider, for the payment, identity-verification, sanctions-screening and payout purposes described in clause 6;

● other Brands, Agencies or Creators, to the extent necessary to run a Campaign, such as showing a Creator's profile to a Brand, or a Brand's campaign brief and payment status to a Creator;

● Service Providers supporting hosting, security, communications, customer support, analytics, identity verification and other functions described in this Notice, under contracts requiring appropriate confidentiality and security;

● professional advisers, auditors, insurers and, where relevant, prospective investors or purchasers in a genuine corporate transaction, subject to confidentiality; ● HMRC and, where applicable, another tax authority, as described in our Seller Tax Reporting Notice;

● regulators, law-enforcement bodies and courts, where disclosure is required or permitted by law; and

● another company involved in a merger, reorganisation, financing or sale of our business, subject to appropriate safeguards.

Where a Brand, Agency or Creator receives personal information through the Platform and uses it for its own purposes outside the Campaign for which it was shared, it becomes an independent controller for that use and is responsible for its own lawful basis, security, retention and response to rights requests, consistent with clause 14.2 of our Creator Platform Agreement.

Collabor is based in the United Kingdom. The Payment Provider, social platforms and some Service Providers operate internationally, so personal information may be accessed or processed outside the UK. Where the law requires a transfer mechanism, we rely on an applicable adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another valid safeguard, and we apply contractual, organisational and technical measures appropriate to the risk. Information about relevant safeguards is available through the privacy request process described in clause 16, subject to lawful confidentiality restrictions.

We keep personal information only for as long as reasonably necessary for the purposes described in this Notice, considering the type of information, why we hold it, and our legal and regulatory obligations. As a guide:

● account and campaign information: for as long as your account is active, and for a reasonable period afterwards to handle queries, disputes and legal claims;

● messages and Deliverable records: for the duration of the relevant Campaign and a reasonable retention period afterwards for evidential purposes;

● KYC Information and payment records: for as long as required by anti-money-laundering, payment-services and tax law, including the seller-reporting retention approach described in our Seller Tax Reporting Notice;

● discovery information sourced before registration: as described in our Creator Discovery Data Notice; and

● cookie and analytics identifiers: for the durations set out in our Cookie Policy.

We use proportionate technical and organisational measures designed to protect personal information, including access controls, authentication, encryption in transit, Service Provider due diligence, staff confidentiality obligations and incident-response procedures. No internet or storage system is completely secure. We investigate suspected incidents and notify affected people and authorities where the law requires it.

We use automated tools to support fraud detection, sanctions screening, content and profile analysis, and Creator Discovery scoring. Where an automated Creator Discovery score is involved, clause 6.5 of our Creator Discovery Data Notice explains that Collabor does not use a discovery score alone to make a solely automated decision producing legal or similarly significant effects on a Creator, and that Brands and Agencies must exercise meaningful human judgment. If we introduce a materially different automated decision process elsewhere on the Platform, we will assess it and update this Notice before use.

Depending on your location and the circumstances, you may have rights to:

● be informed about how your personal information is used;

● obtain confirmation and access to personal information held about you;

● correct inaccurate or incomplete information;

● request erasure or restriction of processing;

● object to processing based on legitimate interests, including related profiling;

● object at any time to direct marketing and related profiling;

● receive qualifying information in a portable format; ● withdraw consent where processing relies on consent;

● request human intervention and challenge a qualifying solely automated significant decision; and

● complain to the Information Commissioner's Office or another competent supervisory authority.

To exercise a right or make a data-protection complaint, use the privacy request and complaint process published in Collabor's Help Centre or write to COLLABOR TECHNOLOGIES LTD at Egerton Mill, 25–27 Egerton Street, Chester, United Kingdom, CH1 3ND. We will acknowledge, investigate and respond within the period required by applicable law. We may request proportionate identity or account-control information and may extend or refuse a request only where the law permits, explaining the reason and available appeal route.

Where you have agreed to receive marketing communications, or another legal basis applies, we may contact you about relevant Platform features, Campaign opportunities or content. You can opt out at any time using the unsubscribe link in a marketing message or through your account settings. Opting out of marketing does not stop operational or transactional communications, such as Campaign, payment or security notices, which are necessary to provide the Platform.

The Platform is intended for adults. We do not knowingly collect account information from, or make Creator Discovery profiles searchable for, anyone under 18. If we become aware that we hold information about a person under 18 in a way this Notice does not intend, we will assess and, ordinarily, delete or restrict it, consistent with clause 16 of our Creator Discovery Data Notice.

We will review this Notice when our processing activities, purposes, lawful bases, sharing, retention, international transfers or legal obligations materially change. The current version and effective date will be published in the Legal Centre. Where a change is material or unexpected, we will take reasonable steps to bring it to affected people before the new use begins.

Privacy requests and complaints should be submitted through the electronic privacy and complaint form in Collabor's Help Centre or to the privacy email address published in the Legal Centre. Postal correspondence may be sent to: COLLABOR TECHNOLOGIES LTD, Egerton Mill, 25–27 Egerton Street, Chester, United Kingdom, CH1 3ND.

You may also complain to the Information Commissioner's Office at ico.org.uk. If you live outside the UK, you may have the right to complain to the supervisory authority responsible for your location.