GDPR Compliance.

1. Overview

The General Data Protection Regulation ("GDPR") gives individuals in the European Economic Area ("EEA") and the United Kingdom specific rights over their personal data. This page explains how Clipply LLC ("Clipply," "we," "us," or "our") complies with the GDPR. It supplements, and should be read alongside, our Privacy Policy.

2. Clipply's Role

Under the GDPR, an organization is either a data controller (decides why and how personal data is processed) or a data processor (processes data on a controller's behalf). Clipply is:

• A controller for account, billing, and workspace-administration data belonging to our customers; and
• A processor for link-click and visitor analytics data our customers collect through links they create, acting on our customer's instructions.

If your organization uses Clipply and needs a Data Processing Addendum for your own GDPR documentation, contact privacy@clipply.com.

3. Legal Basis for Processing

We process personal data under the following legal bases:

• Contract: processing needed to create your account and provide the Service you signed up for;
• Legitimate interests: fraud prevention, service security, and improving the Service, balanced against your rights;
• Consent: for optional communications and non-essential cookies, which you can withdraw at any time; and
• Legal obligation: where processing is required to comply with tax, accounting, or other applicable law.

4. Your Rights

If the GDPR applies to you, you have the right to:

• Access: obtain a copy of the personal data we hold about you;
• Rectification: correct inaccurate or incomplete personal data;
• Erasure: request deletion of your personal data, subject to legal exceptions (e.g. billing records we must retain);
• Restriction: limit how we process your data while a dispute is resolved;
• Portability: receive your data in a structured, commonly used, machine-readable format;
• Objection: object to processing based on legitimate interests, including profiling; and
• Withdraw consent: at any time, for processing that relies on consent, without affecting processing carried out before the withdrawal.

5. How to Exercise Your Rights

Send your request to privacy@clipply.com. To protect your data, we may ask you to verify your identity before processing a request. We respond to all verified requests within one month, as required by the GDPR; if a request is complex, we may extend this by a further two months and will explain why.

6. Sub-Processors

We use the following categories of sub-processor to provide the Service:

• Tap Payments — payment processing (PCI-DSS compliant; never receives your account password);
• Hosting & infrastructure providers — to run and store the Service and its data;
• Analytics providers — aggregated product and site-usage analytics.

Each sub-processor is bound by a data processing agreement consistent with GDPR requirements.

7. International Transfers

Where personal data is transferred outside the EEA or UK, we rely on appropriate safeguards recognized under the GDPR, such as the European Commission's Standard Contractual Clauses or an adequacy decision covering the destination country, so your data remains protected wherever it is processed.

8. Data Breach Notification

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and will notify affected individuals directly where the breach is likely to result in a high risk to them, in line with GDPR Articles 33 and 34.

9. Data Protection Officer

Questions about this page or our data protection practices can be directed to our Data Protection team at privacy@clipply.com.

10. Supervisory Authority

If you believe we have not resolved your concern, you have the right to lodge a complaint with the data protection supervisory authority in your country of residence, place of work, or the place where the issue occurred.

11. Changes to This Page

We may update this page from time to time to reflect changes in our practices or applicable law. The "Last updated" date at the top reflects the most recent revision.

12. Contact