At Rankcastle OÜ (“we”, “us”, “our”), we are committed to protecting your privacy and personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our platform.
1. Data Controller
Rankcastle OÜ, registered in Estonia, is the data controller responsible for your personal data. You can contact us at:
- Email: [email protected]
- Address: Lootsa 5, 11415 Tallinn, Estonia
- Registry Code: EE102105036
2. Personal Data We Collect
We collect and process the following categories of personal data:
2.1 Account Information
- Full name
- Email address
- Account role (advertiser, publisher, admin)
- Account creation date and activity timestamps
- Authentication data (encrypted passwords, login tokens)
2.2 Profile Information
- Company name and business details
- Contact information (phone number, business address)
- Website URLs and social media profiles
- Profile pictures and avatar images
- Business categories and specialties
2.3 Financial Information
- VAT registration numbers
- Tax identification numbers
- Payment method details (processed securely through Stripe)
- Payout preferences and banking information
- Transaction history and invoice records
- Payment status and financial reports
2.4 Platform Usage Data
- Campaigns created and managed
- Orders placed and fulfilled
- Platform listings and content offerings
- Messages and communications between users
- Content URLs and published work
- File attachments and reference materials
2.5 Technical Data
- IP addresses and device information
- Browser type and version
- Operating system
- Page views and navigation paths
- Session duration and timestamps
- Cookies and similar tracking technologies
3. Legal Basis for Processing
We process your personal data based on the following legal grounds under GDPR:
- Contract Performance (Article 6(1)(b)): Processing necessary to provide our platform services, facilitate transactions between advertisers and publishers, process payments, and fulfill orders.
- Consent (Article 6(1)(a)): Where you have given explicit consent for specific processing activities, such as marketing communications or optional features.
- Legal Obligation (Article 6(1)(c)): Compliance with tax laws, financial regulations, and other legal requirements including VAT reporting and invoice generation.
- Legitimate Interests (Article 6(1)(f)): Fraud prevention, security monitoring, platform improvement, and customer support, provided these interests do not override your fundamental rights.
4. How We Use Your Personal Data
We use your personal data for the following purposes:
- Creating and managing user accounts
- Facilitating connections between advertisers and publishers
- Processing payments and generating invoices
- Issuing self-billing invoices for publisher payments
- Managing campaigns, orders, and content delivery
- Providing customer support and responding to inquiries
- Sending transactional emails and notifications
- Preventing fraud and ensuring platform security
- Complying with legal and regulatory obligations
- Analyzing platform usage to improve our services
- Generating performance reports and analytics
5. Data Sharing and Third-Party Services
We share your personal data with third parties only in the following circumstances:
5.1 Service Providers
- Stripe: Payment processing and financial transactions
- Resend: Transactional email delivery
- Base44: Application infrastructure and database hosting
- Supabase: Data storage and authentication services
5.2 Business Partners
When you place an order or accept work through our platform, we share relevant information (name, email, order details) with the other party to facilitate the transaction.
5.3 Legal Requirements
We may disclose your data to comply with legal obligations, respond to lawful requests from authorities, protect our rights and property, or ensure user safety.
6. Data Retention
We retain your personal data for as long as necessary to fulfill the purposes outlined in this policy:
- Active accounts: Data retained while your account is active
- Financial records: Retained for 7 years in accordance with Estonian tax law
- Invoices and transactions: Retained for 7 years for legal and accounting purposes
- Closed accounts: Data deleted within 30 days of account closure, except where legal retention is required
- Marketing data: Retained until consent is withdrawn
7. Your Rights Under GDPR
As a data subject, you have the following rights:
- Right to Access (Article 15): Request a copy of the personal data we hold about you
- Right to Rectification (Article 16): Request correction of inaccurate or incomplete data
- Right to Erasure (Article 17): Request deletion of your personal data (“right to be forgotten”)
- Right to Restriction (Article 18): Request limitation of processing in certain circumstances
- Right to Data Portability (Article 20): Receive your data in a structured, machine-readable format
- Right to Object (Article 21): Object to processing based on legitimate interests or direct marketing
- Right to Withdraw Consent (Article 7): Withdraw consent at any time where processing is based on consent
- Right to Lodge a Complaint: File a complaint with the Estonian Data Protection Inspectorate or your local supervisory authority
To exercise these rights, please contact us at [email protected]. We will respond within 30 days.
8. Data Security
We implement appropriate technical and organizational measures to protect your personal data:
- Encryption of data in transit (TLS/SSL) and at rest
- Secure authentication and access controls
- Regular security audits and vulnerability assessments
- Employee training on data protection practices
- Incident response procedures for data breaches
- Restricted access to personal data on a need-to-know basis
9. International Data Transfers
Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA). When we transfer data internationally, we ensure adequate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions recognizing equivalent data protection standards
- Service providers certified under recognized data protection frameworks
10. Cookies and Tracking Technologies
We use cookies and similar technologies to enhance your experience, analyze usage, and provide personalized content. You can manage cookie preferences through your browser settings. Essential cookies required for platform functionality cannot be disabled.
11. Children’s Privacy
Our platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly.
12. Automated Decision-Making
We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you without human intervention.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice on our platform at least 30 days before changes take effect. Your continued use of the platform after changes constitute acceptance of the updated policy.
14. Data Protection Officer
For questions about this Privacy Policy or our data practices, or to exercise your rights, please contact us at:
- Email: [email protected]
- Subject line: “Data Protection Inquiry”
15. Supervisory Authority
If you have concerns about our data processing practices, you have the right to lodge a complaint with:
Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
Address: Tatari 39, 10134 Tallinn, Estonia
Email: [email protected]
Website: www.aki.ee
Contact Us
If you have any questions about this Privacy Policy or our data protection practices, please contact us at [email protected].
