This International Privacy Notice supplements our Privacy Policy and provides additional information for individuals located in the European Economic Area (“EEA”), the United Kingdom, and Switzerland.
Like our Privacy Policy, this notice covers only the Personal Data that Palatial collects and controls for its own purposes, such as information about the individuals who administer and use our business customers’ accounts, website visitors, and people who contact us. It does not cover the material our business customers submit to the Services. We handle that material on their behalf under our Data Processing Agreement, and that customer, not Palatial, decides how it is used. If you are an employee or end user of one of our business customers and have questions about data submitted through the Services, please contact that organization directly.
Data Controller
The entity responsible for your Personal Data under our Privacy Policy is Palatial Platforms Inc., a Delaware corporation located at 450 Bryant St. San Francisco, 94107, United States.
Legal Basis for Processing
We process your Personal Data on the following legal grounds under the GDPR and equivalent laws:
Purpose of Processing | Legal Basis | Categories of Data |
|---|---|---|
Providing and administering accounts and the Services, including authenticating users and enabling core features | Performance of our contract with your organization; Legitimate interests (administering the customer relationship) | Identity, Account and Organization, API Credentials, Usage |
Metering usage, invoicing, and processing payments | Performance of our contract with your organization; Compliance with legal obligations (tax and accounting) | Identity, Billing and Transaction, Usage |
Responding to inquiries and providing support | Legitimate interests (providing a quality service to our customers) | Identity, Support and Communications |
Securing the Services and preventing fraud and abuse | Legitimate interests (protecting our users and the Services); Compliance with legal obligations | Identity, Account and Organization, Device and IP, Usage |
Measuring website traffic in aggregate | Legitimate interests (maintaining and improving our website) | Web Analytics, Device and IP |
Sending marketing communications about our Services | Consent, where required; Legitimate interests (promoting our Services) | Identity, Marketing |
Handling copyright and other legal notices | Compliance with legal obligations; Legitimate interests (protecting our legal rights) | Copyright and Legal Notice |
Complying with legal obligations | Compliance with legal obligations | All categories as required |
Establishing, exercising, or defending legal claims | Legitimate interests (protecting our legal rights) | All categories as relevant to the claim |
Where we rely on legitimate interests, we have balanced our interests against your fundamental rights and freedoms. Where we rely on consent, you may withdraw it at any time by contacting us or adjusting your settings. Withdrawal does not affect the lawfulness of processing before withdrawal.
International Data Transfers
Palatial is based in the United States, and your Personal Data is transferred to and processed there. The United States has data protection laws that differ from those in your country of residence.
When we transfer Personal Data from the EEA, the United Kingdom, or Switzerland, we rely on the following safeguards:
- Where Palatial is certified under the EU-U.S. Data Privacy Framework, including the UK Extension and the Swiss-U.S. Data Privacy Framework, transfers are made in reliance on that certification, and we process the Personal Data in accordance with the Data Privacy Framework Principles
- Where Palatial is not certified, or the framework ceases to provide a valid transfer mechanism for a territory, we rely on the standard contractual clauses approved by the European Commission, together with the International Data Transfer Addendum issued by the UK Information Commissioner’s Office for transfers from the United Kingdom
- Adequacy decisions, where available
The same safeguards apply to the Personal Data we process on behalf of our business customers, as set out in our Data Processing Agreement.
Your Rights
In addition to the rights described in our Privacy Policy, you may have the following rights depending on your location:
EEA, UK, and Switzerland
Under the GDPR and equivalent laws, you have the right to:
- Access your Personal Data and information about how it is processed
- Rectify or update inaccurate Personal Data
- Request deletion of your Personal Data
- Restrict how we process your Personal Data
- Receive your Personal Data in a portable format
- Object to processing based on legitimate interests or for direct marketing
- Withdraw consent at any time
- Lodge a complaint with your local data protection authority
You can find your data protection authority:
- EEA residents: https://edpb.europa.eu/about-edpb/about-edpb/members_en
- UK residents: Information Commissioner’s Office (ICO) at https://ico.org.uk/
- Switzerland residents: Federal Data Protection and Information Commissioner (FDPIC) at https://www.edoeb.admin.ch/
Automated Decisions
We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.
How to Submit a Request
To exercise any of these rights, you may email [email protected]. We will verify your identity before fulfilling your request and respond within the timeframes required by applicable law.
Contact Us
If you have any questions about this notice, please contact us at [email protected].