Privacy Policy

1. DEFINITIONS

When we say "you", "your" or "Data Subject" we mean any natural person that shares personal data with us via Website.
When we say "processing" we mean any operation or set of operations which is performed on personal data or sets of personal data. This includes activities such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

When we say "personal data" or "data" we mean any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, either directly or indirectly. Therefore, data about a company or any legal entity is not considered to be personal data but registering on behalf of a legal entity may include sharing personal data. For example, the information in relation to one-person companies may constitute personal data where it allows the identification of a natural person. The rules also apply to all personal data relating to natural persons in the course of professional activity, such as the employees of a company or organization, business e-mail addresses like "firstname.surname@company.com". This Privacy Policy does not apply to information from which no individual can reasonably be identified (anonymized information).

When we say "Data Processors" or "processor" we mean any natural or legal person who processes the data on behalf of the Data Controller. In some cases, COING is a Data Processor and in others, Data Controller (as further explained in Section 2). In addition, we may use the services of various service providers to process your data more effectively. In such cases, they are either our processors or sub-processors.

When we say "cookies" we mean small pieces of data stored on your device (computer or mobile device). This information is used to track your use of the Website and to compile statistical reports on website activity. For further information about the use of cookies and how you can manage them, please read our Cookie Policy.

When we say "consent" we mean your explicit consent on the processing of personal data. Persons who are 15 years of age or older may give free consent to the processing of their personal data.

2. DATA CONTROLLER OR DATA PROCESSOR

In relation to your personal data processed on or via the Website and the Service, COING may be either a Data Controller or Data Processor.
When COING acts in the capacity of a Data Controller, COING determines the purposes and means of the processing of personal data. The purpose of data processing is the reason why we process your personal data. The table in Section 4.1 of the Privacy Policy presents the purposes and legal basis for data processing. In such cases, COING is responsible for your personal data.

Apart from Section 4.2, this Privacy Policy primarily contains information on processing your data in the capacity of a Data Controller. Should you have any inquiries, or you wish to exercise any of the rights of a Data Subject stipulated in Section 10, please contact us:

COING Inc.
2100 Geng Road, Suite 210
Palo Alto, CA 94303
USA
Email: support@pumble.com

By using the Service, you may disclose, share, record, or otherwise use various types of data via a Workspace as the User Content. The type of User Content is determined by the person that owns the Workspace and not by us. The extent to which personal data is processed while using the Service also depends on the Pumble functionalities that the owner of the Workspace decides to use. In that event, COING is a Data Processor and Data Controller is the owner of the Workspace. Thus, COING does not analyze, disclose or access such data unless a User (including an Enterprise as a User) sends a request for support and, in these cases, the access is limited to enabling the functioning of the Service.

Given that COING strongly supports the principle of transparency of personal data processing, despite being a Data Processor, COING made an additional effort to explain personal data processing via the Service in Section 4.2 of this Privacy Policy. The information contained therein outlines how personal data processing via Pumble functions in general. Nevertheless, should you wish to send an inquiry or exercise any of your Data Subject's rights which you may have under the applicable data protection legislation to the owner of the Workspace, please contact such owner of the relevant Workspace as Data Controller.

Please also note that we do not collect or process your personal data if you are an End User of Server Pumble. In that case, the Client (the company that has Pumble installed on their server) is responsible for your personal data.

If you represent a User that falls under the scope of application of the GDPR or similar data protection legislation, you may sign the Data Protection Addendum to these Terms of Use ("DPA"), with COING as a Data Processor based outside the EEA. The DPA includes the Standard Contractual Clauses adopted by the European Commission, as applicable, and reflects the Parties' agreement with respect to the terms governing the processing of personal data under the Terms of Use. Signing the DPA will be considered as an amendment to the Agreement (within the meaning of Section 1 of the Terms of Use) and will be considered to form a part of the Agreement.

If you would like to sign a DPA with us, please contact us at support@pumble.com for more information.

3. WHAT DATA DO WE COLLECT ABOUT YOU AND WHEN?

We may collect and receive information about you in various ways:

• Information you provide through the use of the Service (for example, by creating the account on Cloud Pumble).
• Information you decide to provide through getting in touch with us via support@pumble.com
• Information we collect through the use of cookies in accordance with our Cookie Policy (for example, your time zone).

4. PERSONAL DATA WE PROCESS

4.1. COING as Data Controller

4.2. COING as Data Processor

As previously stated, concerning your personal data processed on or via the Service, COING is a Data Processor and the Customer is the Data Controller. COING processes personal data following instructions from the Data Controller and under the Terms of Use and DPA (if any). The purpose of such personal data processing is enabling a correspondence and chat service between team members.

As a processor, COING is permitted to collect, use, disclose and/or otherwise process your personal data only following the instructions of the Customer.

1. Processing prior to using the Service

The Customer shares your email address to enable you to access the Service. If you have any questions regarding the legal basis for such personal data processing, please contact the Customer who invited you to the Service.

2. Processing during the usage of the Service

If you decide to accept the invitation to use the Service, you will be required to create an account. To create the User Account, you will need to share your email address and password. You manage personal data you share via your account such as name and surname, photo, email data (personal email address and/or work email address).

In the course of the use of the Service we may process system usage data, IP address, work position, chat correspondence, application integration data, navigational data (including website usage information such as interactions with Pumble, and other electronic data submitted, stored, sent, or received by the Data Controller via the Service.

COING does not undertake analysis of any special categories of personal data (including racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, sex life or sexual orientation) and Pumble functionalities are not meant to be used for the processing of any such personal data. However, if you decide to provide such personal data to us or Data Controller via the Service, you will be deemed to have consented to such processing of the data.

5. WHAT WE DO NOT DO?

COING will never:

• Sell any kind of personal information or data
• Disclose this information to marketers or third parties not specified in Section 7
• Process your data in any way other than stated in this Privacy Policy

6. PERSONAL DATA SECURITY

We take administrative, technical, organizational and other measures to ensure the appropriate level of security of personal data we process. Upon assessing whether a measure is adequate and which level of security is appropriate, we consider the nature of the personal data we are processing and the nature of the processing operations we perform, the risks to which you are exposed by our processing activities, the costs of the implementation of security measures and other relevant matters in the particular circumstances.

Some of the measures we apply include access authorization control, information classification (and handling thereof), protection of integrity and confidentiality, data backup, firewalls, data encryption and other appropriate measures. We equip our staff with the appropriate knowledge and understanding of the importance and confidentiality of your personal data security.

7. WITH WHOM DO WE SHARE YOUR PERSONAL DATA?

COING utilizes external processors for certain processing activities. We use information audits to identify, categorize and record all personal data that is processed outside the company, so that the information, processing activity, processor and legal basis are all recorded, reviewed and easily accessible.

We have strict due diligence procedures and measures in place and review, assess and background check all processors prior to forming a business relationship. We obtain company documents, certifications, references and ensure that the processor is adequate, appropriate and effective for the task we are employing them for.

We audit their processes and activities prior to contract and during the contract period to ensure compliance with the data protection regulations and review any codes of conduct that oblige them to confirm compliance.

This is the list of processors and sub-processors with whom we share your personal data:

We may also share your personal data with our outside accountants, legal counsels and auditors.
Please keep in mind that, subject to your instructions to us while using the Service, your data may be shared with third parties in the following situations:

• If you join another User's Workspace
• If you invite another User to join you Workspace
• If you invite a non-user to join Pumble
• If you decide to share User Content from your Workspace to persons who do not have an account on Pumble by providing links to such User Content.

8. INTERNATIONAL TRANSFER OF YOUR PERSONAL DATA

We may transfer your personal data to countries other than the one you reside in. Given that we follow internal rules for the protection of personal data that are stricter than the applicable law (see Section 22 of the Terms of Use), in these cases, we transfer your personal data only:

• 1. To the countries within the EEA
• 2. To the countries which ensure an adequate level of protection;
• 3. To the countries which do not belong to those specified under item 1. and 2, but only by applying the appropriate safeguard measures.

9. HOW LONG DO WE KEEP YOUR DATA?

The period for which we store your personal data depends on a particular purpose for the processing of personal data, as explained in detail in Section 4. We retain personal data for as long as we reasonably require it for legal or business purposes. In determining data retention periods, we take into consideration the applicable law (see Section 22 of the Terms of Use), contractual obligations, and the expectations and requirements of our Users. When we no longer need personal information, or when you request us to delete your information, where this is legal, we will securely delete or destroy it.
However, as an exception to the retention periods in Section 4 the data may be processed to determine, pursue or defend claims and counterclaims.

10. YOUR RIGHTS

Given that transparency is one of our cornerstone principles, we grant Data Subjects certain rights in relation to their personal data. These rights may be exercised by Data Subject when COING operates as a Data Controller.
If your inquiry or exercise of any of the Data Subject's rights relates to the data on a Workspace processed as explained in Section 4.2 of the Privacy Policy, please contact the owner of the relevant Workspace via which your personal data has been processed.
In the event COING receives a request for exercising any of these rights directly from a Data Subject, we are obliged to notify the owner of the relevant Workspace before responding to such a request.

RIGHT OF ACCESS

You can send us a request for a copy of the personal data we hold about you.
We have ensured that appropriate measures have been taken to provide such in a concise, transparent, intelligible and easily accessible form, using clear and plain language. Such information is provided in writing free of charge. It may be provided by other means when authorized by the Data Subject and with prior verification as to the subject's identity. Information is provided to the Data Subject at the earliest convenience, but at a maximum of 30 days from the date the request was received. Where the retrieval or provision of information is particularly complex or is subject to a valid delay, the period may be extended by two further months where necessary.

RIGHT TO CORRECTION OF YOUR PERSONAL DATA

If the personal data we have about you is incorrect, you have the right to request that we correct those data. Where notified of inaccurate data by the Data Subject, we will rectify the error within 30 days and inform any third party of the rectification if we have disclosed the personal data in question to them.

RIGHT TO ERASURE

You have the right to request from us that your personal data is deleted in certain circumstances including:

• The personal data are no longer needed for the purpose for which they were collected;
• You withdraw your consent (where the processing was based on consent);
• You object to the processing and no overriding legitimate grounds are justifying us processing the personal data;
• The personal data have been unlawfully processed; or
• To comply with a legal obligation.

However, this right does not apply where, for example, the processing is necessary:

• To comply with a legal obligation; or
• For the establishment, exercise or defense of legal claims.

RIGHT TO RESTRICTION OF PROCESSING

If the accuracy of the personal data is contested, you consider the processing is unlawful but you do not want it erased, we no longer need the personal data but you require it for the establishment, exercise or defense of legal claims or you have objected to the processing and verification, you can exercise your right to the restriction of the processing.

RIGHT TO DATA PORTABILITY

Where you have provided personal data to us, you have the right to receive such personal data back in a structured, commonly used and machine-readable format, and to have those data transmitted to a third-party Data Controller without hindrance but in each case only where:

• The processing is carried out by automated means; and
• The processing is based on your consent or the performance of a contract with you.

RIGHT TO WITHDRAW THE CONSENT

If you have provided your consent to the collection, processing and transfer of your personal data, you have the right to fully or partly withdraw your consent. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose(s) to which you originally consented unless there is another legal ground for the processing.

RIGHT TO LODGE A COMPLAINT

If you have any concerns or requests in relation to your personal data, please contact us at support@pumble.com and we will respond as soon as possible but not later than within 30 days.

11. CHANGES TO PRIVACY POLICY

We reserve the right to change Privacy Policy from time to time at our sole discretion. If we make any changes, we will publish the new rules on the Website and, if we have your email, we will notify you directly.
Where you have previously consented to our Privacy Policy, your continued use of the Website after we make changes is deemed to be acceptance of the updated rules.