Digistep respects your privacy and is fully aware of your rights as a data subject, which determine our obligation to safeguard the integrity of the personal data we collect. Digistep complies with the various international and local privacy laws by implementing procedures aimed at complying with that legislation.

This Privacy Statement supports our privacy principles and informs website users about the procedures for collecting, storing and using the personal data of the individuals who use our website.

We encourage data subjects to review this information so they can understand how we collect, use and share their personal data.

Should any material change be made to this statement (namely, regarding the data we collect, how we use it, or the reasons we use it), we will highlight such change in the section named “Change history”, found at the end of this Privacy Statement, and a prominent link to it will be displayed for a reasonable period after the change is made and before it takes effect.

Should you have any questions about this, please contact the Data Protection Officer through the following means:

• Email address: info@digistep.io

Data we collect

Digistep collects personal data about the individuals who use its website; most of that data is voluntarily provided by the user when they contact us.

When a user interacts with a Digistep website or application, we collect data related to that interaction, for example, through the use of cookies placed on their device.

Below we provide additional details about the types of personal data we collect, store and use, as well as the reasons why we use your personal data.

Why we collect your data

We will use your personal data whenever:

• you give us consent for the relevant processing activity, taking into account the purposes of which we have informed you. In that case, you will always have the right to withdraw your consent;
• we need to process your data to comply with a legal or regulatory obligation;
• exceptionally, it is necessary due to vital interests related to you or another person (for example, to prevent serious harm to you or others);
• it is necessary for our legitimate interests (or those of a third party), provided that our legitimate interests are not overridden by the prevalence of your interests or rights that require the protection of your data.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you explaining the legal basis that allows us to do so.

Legitimate interests

As mentioned above, we may sometimes use your personal data where necessary for our legitimate interests (or those of a third party). This includes cases where your personal data is necessary to:

• ensure that our assets are protected, kept confidential and not used for improper or unlawful purposes;
• prevent, detect or investigate unauthorized use of our systems and ensure that we comply with the law and our policies;
• support the development and improvement of products, alongside effective marketing through analysis and profiling for commercial information;
• deal with disputes and incidents and obtain legal or other professional advice;
• comply with the laws and regulations of another country;
• prevent fraud and financial crime;
• ensure the security of our networks and information.

If you would like additional information about how our legitimate interests apply to your personal data, please contact the Data Protection Officer.

Retention of your data

Your personal data will be retained for as long as necessary to provide the services requested by the data subject, or for other necessary purposes, such as compliance with the law, regulation or other legal authority, or to fulfil other legal purposes, such as auditing, security, fraud prevention, or the preservation and defence of legal rights.

Where your data may be shared

Any involvement of a supplier or service provider will be governed by appropriate contractual requirements that prohibit the use of your data for any purpose other than those determined by Digistep and that require sufficient administrative and technical security mechanisms to prevent your data from being improperly used, disclosed or accessed.

We also share your data with certain other third parties. However, this will only occur when we obtain your consent or because we need those third parties to access your data in order to provide you with services or for one of the other purposes set out in this Privacy Statement. This may include tax authorities, credit reference agencies, and fraud prevention databases and agencies.

As a result of the global scope of Digistep's activities, sharing your data with other entities, service providers, suppliers and clients may result in your data being sent to countries other than your country of residence, which may have data protection laws different from those of your country of residence. The areas where recipients are located vary depending on the nature of the services.

Regardless of the place of origin or destination of your data, Digistep will always protect it as described in this Privacy Statement and will comply with all applicable data protection laws.

• If we are required to do so by law or under any practice or regulatory code that we observe, or if we are requested to do so by any public or regulatory authority, for example, police forces;
• If we are conducting our defence in legal proceedings, your data may be transferred as required in connection with such proceedings.

Your personal data may be transferred to other third-party organizations in certain scenarios.

Your rights and choices

We respect your right to access and control your data. The amount of personal data you must provide when requesting our services is consistent with Digistep's interest in providing you with our services. Digistep complies with applicable data protection laws and regulations.

The GDPR safeguards the best interests of data subjects, having established rights that protect your personal data; how you can exercise those rights is described below.

Data Subject Rights

For individuals located in the European Economic Area (“EEA”), Digistep complies with the data protection laws of the respective country and, where applicable, the user has the following rights:

• Access: you have the right to request access to your personal data. You have the right to ask us whether we are processing personal data about you and, if so, to request access to it. This allows you to receive a copy of the personal data we hold about you and certain other information about it.
• Rectification: you have the right to request that corrections be made to any inaccuracies in your personal data. In response to your request, we will update any incomplete or inaccurate data we hold about you to ensure it is accurate and correct.
• Erasure: you have the right to request the erasure of your personal data in certain circumstances, subject to our obligations to retain your data under applicable laws or if the retention of your personal data is required in connection with legal proceedings.
• Restriction of processing: you have the right to request the suspension of the processing of certain personal data; for example, if you want us to establish its accuracy or the reason for the processing.
• Portability: you may request to receive the data you provided us in a portable, machine-readable format or the transfer of certain personal data to another party.
• Objection (to automated decisions): you may challenge any automated decision made about you, where it has a legal or similarly significant effect, and request that it be reconsidered.

Right to object: Individuals located in the EEA have the right to object to the processing of their data by Digistep in certain circumstances:

• You have the right to object to the processing of your personal data by Digistep where it is based on Digistep's legitimate interests (or those of a third party). You may challenge our reliance on legitimate interests. However, we may still be entitled to continue processing your personal data based on our legitimate interests or where relevant in the context of legal proceedings. You also have the right to object whenever we process personal data for direct marketing purposes.
• You have the right to lodge a complaint with a Supervisory Authority, in particular in the European Union Member State where you habitually reside, work, or where an alleged infringement of the data protection laws has taken place.
• Since the processing of your data is necessary for the performance of our services, any request to object to the processing or deletion of your data may result in Digistep being unable to continue providing these services.

Direct marketing

We will only use your information with your consent to send marketing materials by email, SMS or push notification, depending on your account or platform settings. Whenever marketing materials are sent, you will be given the option to opt out.

At the stage when we request personal data from the data subject, our website also gives you the opportunity to decide which communications you wish to receive. Where interactions with Digistep have led to registration across several services or resources, you may need to opt out separately for each of them.

You can opt out of receiving direct marketing from us at any time. Every marketing communication will include instructions allowing you to stop receiving similar electronic messages from the registered service or resource. You can also opt out by contacting the Data Protection Officer at info@digistep.io.

Cookies

We record the number of visitors to the relevant sections of our website and track movement between sections through cookies.

Cookies are small data files containing information placed on your computer and automatically downloaded to your device, so as to recognize you as someone who has previously visited our website. We use cookies that identify your browser or device. When you visit our websites, such cookies collect and store information about how you use them.

Protection of your data

Digistep safeguards the protection of your personal data through the following mechanisms:

By regularly monitoring industry standards for data protection and reviewing its physical, technical and organizational security practices to determine the best way to prevent the loss, misuse, alteration, unauthorized access, destruction or disclosure of your personal data.