NanoBuzz Club privacy policy Version: NANOBUZZ-PRIVACY-2026-09-05-V3. Updated: 5 September 2026. This policy explains, in plain language, how we process personal data on nanobuzz.club and in the NanoBuzz Club app: what we collect, why, on what legal basis, how long we keep it, who helps us process it and what rights you have under the GDPR. Who is the data controller The controller of your personal data is NanoBuzz sp. z o.o., ul. Kościelna 45B/14, 60-537 Poznań, Poland, entered in the National Court Register under KRS 0001131220, NIP 7812077628, REGON 529868223. For any privacy matter, including exercising your rights described below, write to us at kontakt@nanobuzz.agency (given here as plain text) or by post to the registered office address, marking your letter "data protection". What data we process We process the following categories of data, depending on how you use the Club: - Application data: name, contact details, social media handles, niche and audience description you submit in the join form - Account data: login details, profile information and settings in the creator panel or client portal - Campaign collaboration data: briefs accepted, content drafts, publication links, shipping addresses for creator packs, payout and invoicing details - Social media statistics: audience and performance metrics collected with your consent to match you with campaigns and report results - Cookies and analytics data: usage data collected on the website subject to your choices in the consent banner, with Google Consent Mode applied Purposes and legal bases We process your data to review applications and operate your membership, to arrange and run campaign collaborations including shipping and payments (performance of a contract, Article 6(1)(b) GDPR), to comply with accounting and tax obligations (legal obligation, Article 6(1)(c)), to analyse and improve the website and platform and to establish or defend legal claims (legitimate interest, Article 6(1)(f)), and to collect social statistics and use non-essential cookies (consent, Article 6(1)(a)). Consent can be withdrawn at any time without affecting prior processing. How long we keep your data We maintain an ongoing register of applications and collaboration history, including applicants who were not selected. For new applications covered by this notice, we do not automatically delete the whole application or its address merely because 14 days have passed. This does not permit or promise retention forever. Each category is kept only for as long as necessary for its specific purpose and lawful basis. We review retention periodically, respect your rights and delete or anonymise data that is no longer needed. Application details are used while reviewing the application and resolving its outcome. We may then retain a limited history of decisions and contact where necessary for accountability, preventing misuse or legal claims, subject to an assessment of legitimate interests and your rights under Article 6(1)(f) GDPR. This does not automatically justify keeping the entire form, every message or an address for the same period. Future matching within the voluntary community relies on the separate choice described at sign-up and ends when that consent is withdrawn or its purpose ends, apart from any limited evidence lawfully needed for claims. An address supplied before selection is for preparing a possible shipment. Its continued necessity is assessed separately from application history. Once the logistical need ends, we keep it only for another specific purpose with a proper lawful basis; otherwise we delete or anonymise it. We reconfirm the address before every new shipment. A database entry does not authorise shipment. Account data is kept while you use the account and afterwards only as required by law or needed for legal claims. Accounting and tax documents follow the applicable statutory periods, generally five years from the end of the relevant tax year, including any statutory extension, suspension or interruption. Cookie and analytics data follows the periods disclosed in the consent settings. Community participation, future commercial email and future commercial SMS are separate, optional choices. Declining them does not affect a current campaign application. Retaining a record is not marketing consent. You can withdraw the relevant choice through our contact page or an available account function. Data needed under another lawful basis may remain, but withdrawal ends marketing in that channel. This update does not rewrite earlier notices or consents. In particular, it does not automatically extend a previously stated 14-day address period or the 12-month period in the earlier English notice. Earlier records require a separate review of the information originally provided, the purpose, lawful basis and necessary scope. Before a new use, we assess compatibility and provide the required information. Publishing a new notice is not fresh consent. The historic N1165 flow still records V2 acknowledgements; these refer to the archived V2 text and are not V3 acknowledgements. Who we share data with We use carefully selected processors bound by data processing agreements: hosting and infrastructure providers, Supabase (database and authentication for the app), analytics providers operating under Consent Mode, courier companies for creator pack delivery, and accounting services. Brand clients see campaign collaboration data in a client-safe form needed to run their campaign. Some providers may process data outside the European Economic Area; where that happens, we rely on appropriate safeguards such as Standard Contractual Clauses. Your rights Under the GDPR you have the right to access your data and receive a copy, to rectify inaccurate data, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa. To exercise any right, contact us as described above; we respond within the deadlines set by the GDPR.