About us and this policy

Brenlita UAB is dedicated to safeguarding your privacy. Managing all personal data properly, including ensuring its security and confidentiality, is central to our business and supports our policies and procedures. We collect, use, and are responsible for certain personal data about you. When we do so, we comply with relevant data protection laws and act as the 'controller' of that personal data for the purposes of these laws.

This Privacy Policy (the "Policy") explains how we handle your personal data when you interact with us through our website www.trendnotifier.com (the "Website"), communicate with us, or use our services. It also outlines your rights regarding your personal data and provides our contact details should you have any questions or complaints.

Your personal data is collected by Brenlita UAB ("we", "us", "our"), a legal entity registered in Lithuania with legal entity code 305278622, registered office at Žalgirio g. 92-100, LT-09300 Vilnius, Lithuania.

Our contact details

If you have any questions regarding the processing of your personal data, please contact us at: info@trendnotifier.com

Brenlita UAB
Registration code: 305278622
VAT number: LT100017211519
Address: Žalgirio g. 92-100, LT-09300 Vilnius, Lithuania
Phone: +370 525 08317
Email: info@trendnotifier.com

To whose personal data does this Policy apply?

This Policy outlines our practices regarding the use of personal data of:

• Individuals and/or representatives of legal entities who register to use our products and/or services ("Users"); and
• Individuals who visit our Website or otherwise interact with our products and/or services.

Legal requirements

In certain circumstances, if you do not provide the personal data required, we will not be able to perform our obligations under the contract with you or may not be able to provide you with our products and/or services. We will make it clear if and when this situation arises and what the consequences of not providing the information will be for you.

Your personal data may also be processed if it is necessary on a reasonable request by a law enforcement or regulatory authority, body or agency or in the defence of a legal claim.

We will not delete personal data if it is relevant to an investigation or a dispute. It will continue to be stored until those issues are fully resolved.

Keeping your personal data protected and secure

Your personal data is processed in accordance with the General Data Protection Regulation (EU) 2016/679 (the "General Data Protection Regulation" or "GDPR") and other legal acts regulating the legal protection of personal data.

We have appropriate security measures in place to prevent personal data from being accidentally lost, used, or accessed unlawfully. We also have procedures in place to deal with any data breach.

What personal data do we collect?

We collect all personal data only directly from our Users and individuals who are not Users but visit our Website.

The categories of personal data we collect may include (the actual scope of personal data that we collect always depends on the situation):

• Identification data: first name, surname.
• Contact data: email address.
• Service provision-related data: service agreement (terms and conditions), information received by the Users while receiving our services.
• Communication data: messages received from and sent to the Users or individuals who are not Users but visit our Website.
• Data related to the Website usage: login name (email address), password, cookies.
• Other data: as indicated in the Policy.

If necessary, we can process other personal data.

We do not process special categories of personal data, such as biometric data, health data, etc.

We do not process your personal data for marketing purposes. We do not engage in direct marketing communications and do not use your personal data to send commercial messages. However, in order to measure and evaluate the effectiveness of our advertising campaigns, we use third-party advertising measurement tools (Meta Ads, Reddit Ads), which may process online identifiers (cookie identifiers, device identifiers, IP addresses and behavioural data on an aggregated basis). Such processing takes place only where you have given your prior consent through our cookie consent banner.

When you visit our Website, certain analytics and advertising-related tools may, subject to your consent, collect online identifiers (cookie identifiers, device identifiers, IP address (in truncated/anonymised form where applicable)), technical data (browser type, operating system, screen resolution, language, time zone, referring URL), behavioural data (pages viewed, time spent, clicks, scrolls, navigation paths) and, in the case of session-replay tools, recordings of cursor movement and page interaction. Such data is processed for statistical, analytical and advertising-effectiveness purposes only and is not used by us to identify individual visitors.

Our Website is not aimed at children under the age of 18. If you are under 18 years old, you should not submit any personal data to us via our Website without checking with your parent or guardian.

Purposes for which we use the personal data

We use personal data to create accounts on the Website for the Users. For this purpose, we process the following categories of personal data: Identification data; Contact data; Data related to the Website usage.

We use personal data to provide services to the Users. For this purpose, we process the following categories of personal data: Identification data; Contact data; Service provision-related data; Data related to the Website usage.

We use personal data to communicate with the Users. For this purpose, we process the following categories of personal data: Identification data; Communication data.

We use personal data to analyse the use of our Website and to improve its functionality and content. For this purpose, and only subject to your prior consent given through our cookie consent banner, we process online identifiers, technical data and behavioural data collected via our analytics tools (Google Analytics, Microsoft Clarity, Google Tag Manager).

We use personal data to measure the effectiveness of our advertising campaigns. For this purpose, and only subject to your prior consent given through our cookie consent banner, we process online identifiers and behavioural data via Meta Ads and Reddit Ads measurement tools. We do not use this data to send you marketing communications.

We monitor the visibility of our Website in search engines. For this purpose, we use Google Search Console, which provides us with aggregated statistical information on the performance of our Website in Google search results. This tool does not place cookies on visitors' devices and does not process personal data of our Website visitors.

What are the legal grounds for processing personal data?

Contract execution. We provide services to our Users. For this purpose, we have to create accounts for our Users on the Website, enter into agreements (terms and conditions) with them and use their personal data to provide the services.

Consent. As a rule, we do not rely on consent as a legal basis for processing your personal data, except in relation to the use of unnecessary cookies (for more, see Clause 8.3 and 16 of the Policy).

Consent for cookies and similar technologies. Where we use analytics or advertising-related cookies and similar technologies (including Google Analytics, Microsoft Clarity, Google Tag Manager, Meta Ads and Reddit Ads), we rely on your prior, freely given, specific, informed and unambiguous consent obtained via the cookie consent banner displayed on our Website. You may withdraw your consent at any time, with effect for the future, by adjusting your cookie preferences on the Website.

How we obtain your personal data

We obtain your personal data from the following sources:

Directly from you: while applying for products and services; while addressing us by email or other communication channels; when you use our products and services; while using our Website.

From third parties: data generated by cookies might be received from entities managing those cookies (for more, see Clause 16 of the Policy).

From your device, through cookies and similar technologies: where you have given your prior consent through our cookie consent banner, online identifiers (cookie identifiers, device identifiers, IP address), technical data and behavioural data are collected from your device by us and, as the case may be, by the third-party providers (Google Analytics, Microsoft Clarity, Google Tag Manager, Meta Pixel and Reddit Pixel). Further details on the cookies used, their providers, purposes and storage durations are set out in our Cookie Policy.

From joint controllers: in respect of advertising-effectiveness measurement, Meta Platforms Ireland Limited and Reddit Ireland Limited may make available to us aggregated information on the performance of our advertising campaigns (in particular, conversion and reach metrics). The essence of the joint controllership arrangements concluded with these providers pursuant to Article 26 of the GDPR may be obtained at the contact details specified in Clause 2 of this Policy.

From publicly available sources or competent authorities: where strictly necessary for compliance with our legal obligations or for the establishment, exercise or defence of legal claims, we may also obtain personal data from publicly accessible registers, professional databases or public competent authorities.

Do we use profiling?

We do not use any automated person-related decision-making in order to provide our services to you.

Recipients of the User's personal data

In the ordinary course of our business, we do not disclose or otherwise make your personal data available to third parties, unless such disclosure is required by law or is strictly necessary for the provision of our services and carried out in accordance with applicable data protection requirements.

Where applicable and only subject to your prior consent obtained through the cookie consent banner, your personal data may be made available to the following categories of third-party recipients:

• Providers of analytics services who process online identifiers, technical and behavioural data on our behalf, as data processors.
• Providers of advertising and advertising-measurement services with whom, in respect of advertising-effectiveness data, we act as joint controllers within the meaning of Article 26 of the GDPR.

Who assists us in processing your personal data?

We are 'data controllers' of your personal data. This means that we determine the purposes and legal bases for which your personal data is collected and used, as well as the methods of its processing. We are responsible for ensuring that all processing activities comply with applicable data protection laws, that your data is handled lawfully, fairly, and transparently, and that appropriate technical and organisational measures are in place to protect it from unauthorised access, alteration, disclosure, or loss.

To deliver our services, we rely on certain external service providers who support us in operating the Website, communicating with you, performing accounting functions, and carrying out other essential activities. These external parties act as our 'data processors'. We engage them strictly in accordance with the requirements of the GDPR, including by entering into written data processing agreements that oblige them to process personal data only on our documented instructions and to implement appropriate technical and organisational measures to ensure its security.

Third-party service providers

• Google Analytics (analytics). Provider: Google Ireland Limited (acting as data processor). Categories of data: online identifiers, IP address (truncated), technical data, behavioural data.
• Microsoft Clarity (session analytics). Provider: Microsoft Ireland Operations Limited (acting as data processor). Categories of data: online identifiers, technical data, behavioural data, session recordings (with sensitive fields masked).
• Google Tag Manager (tag-management container). Provider: Google Ireland Limited. Role: processor. Google Tag Manager does not itself set tracking cookies; it loads and conditionally fires other tags only after the corresponding consent has been obtained.
• Google Search Console (search performance monitoring). Provider: Google Ireland Limited. This tool does not set cookies on visitors' devices and does not process personal data of our Website visitors.
• Meta Ads / Meta Pixel (advertising measurement). Provider: Meta Platforms Ireland Limited. Categories of data: online identifiers, IP address, conversion and behavioural events. Role: joint controller with us in respect of the collection and transmission of data via the Meta Pixel.
• Reddit Ads / Reddit Pixel (advertising measurement). Provider: Reddit Ireland Limited. Categories of data: online identifiers, IP address, conversion and behavioural events. Role: joint controller with us in respect of the collection and transmission of data via the Reddit Pixel.

How long will we retain your personal data?

We will retain your personal data for as long as it is reasonably necessary to fulfil the purposes we collected it for; however, your personal data will be retained for no longer than as set out hereunder:

• Identification data, Service provision-related data, Contact data and Data related to the Website usage: while you keep your account on our Website and continue receiving our services/products.
• Communication data: during the duration of active correspondence with you and for an additional 3 months following the end of such communication.

Data processed via analytics and advertising-related tools:

• Google Analytics: user- and event-level data is retained in accordance with the retention period selected by us in the Google Analytics administrative settings (by default, up to 14 months from the date of collection), after which it is automatically deleted by Google. Aggregated statistical reports are retained for as long as they remain useful for analytical purposes.
• Microsoft Clarity: session recordings and behavioural data are retained for the period set out in the Microsoft Clarity Terms of Service and product documentation (by default, up to 13 months from the date of collection), after which they are automatically deleted by Microsoft.
• Meta Ads and Reddit Ads: advertising-effectiveness data is retained for the period set out in the respective provider's terms (typically up to 180 days for cookie-based identifiers and up to 2 years for aggregated reporting), after which it is automatically deleted or anonymised by the provider.
• Cookie-based identifiers stored on your device are retained for the durations set out in our Cookie Policy.

To determine the appropriate retention period for your personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, as well as the applicable legal and regulatory requirements.

We will also routinely refresh our information to ensure we keep it up-to-date.

When it is no longer necessary to retain your personal data, we will delete or anonymise it.

Where your information will be stored

We ensure that your personal data is stored in the territory of the European Union ("EU") and the European Economic Area ("EEA").

If, for legitimate purposes, we should transfer your personal data outside the EU and the EEA, we will ensure that adequate safeguards are in place, such as the standard contractual clauses approved by the European Commission.

Specifically, where you have given your consent to the use of analytics or advertising-related cookies and similar technologies, certain data may be transferred to the United States of America. The transfers and safeguards relied upon are as follows:

• Google LLC (parent of Google Ireland Limited) – transfers take place on the basis of the adequacy decision of the European Commission of 10 July 2023 on the adequate level of protection of personal data under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795). Google LLC is certified under the EU-US Data Privacy Framework. Where the adequacy decision should cease to apply, transfers shall rely on the Standard Contractual Clauses adopted by the Commission Implementing Decision (EU) 2021/914.
• Microsoft Corporation (parent of Microsoft Ireland Operations Limited) – transfers take place on the basis of the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795); Microsoft Corporation is certified under the EU-US Data Privacy Framework. Standard Contractual Clauses serve as a fallback safeguard where required.
• Meta Platforms, Inc. (parent of Meta Platforms Ireland Limited) – transfers take place on the basis of the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795); Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. Standard Contractual Clauses serve as a fallback safeguard where required.
• Reddit, Inc. – transfers take place on the basis of the EU-US Data Privacy Framework (EU-US Data Privacy Framework) where Reddit, Inc. is certified, or, in the absence of certification, on the basis of the Standard Contractual Clauses adopted by the Commission Implementing Decision (EU) 2021/914.

You may obtain a copy of the relevant safeguards or further information on the transfers by contacting us using the contact details specified in Clause 2 of this Policy.

Your rights

To the extent provided for under applicable law, you have the following rights in relation to your information, which you can exercise free of charge. Some of these rights will only apply in certain circumstances.

• Withdraw Consent: where we have collected your consent, for example, to use cookies when you visit our Website.
• Access: you are entitled to ask us if we are processing your information and, if we are, you can request access to your personal data. This enables you to receive a copy of the personal data we hold about you and certain other information about it.
• Correction: you are entitled to request that any incomplete or inaccurate personal data we hold about you is corrected.
• Erasure: you are entitled to ask us to delete or remove personal data in certain circumstances. There are certain exceptions where we may refuse a request for erasure, for example, where the personal data is required for compliance with law or in connection with legal claims.
• Restriction: you are entitled to ask us to suspend the processing of certain of your personal data about you, for example, if you want us to establish its accuracy or the reason for processing it.
• Transfer: you may request the transfer of certain of your personal data to another party.
• Not to be subject to automated individual decision-making: you may ask not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you.
• Right to object: you also have a right to object to us processing your information in certain circumstances. Where we are processing your personal data based on legitimate interests, you may challenge this. However, we may be entitled to continue processing your information based on our compelling legitimate grounds or where this is relevant to legal claims.
• Right to lodge a complaint: you have the right to lodge a complaint with a competent supervisory authority. In Lithuania, the supervisory authority is the State Data Protection Inspectorate ("Valstybinė duomenų apsaugos inspekcija"), L. Sapiegos g. 17, 10312 Vilnius, ada@ada.lt.

For further information on each of those rights, including the circumstances in which they apply, please contact us or refer to the information issued by the data protection authority of your jurisdiction (https://digital-strategy.ec.europa.eu/en/library/list-personal-data-protection-competent-authorities).

If you want to exercise any of these rights, please contact us in writing, providing us with enough information to identify you and the specifics of the right you want to exercise. We may ask you to confirm your identity. Our contact details are specified in Clause 2 of this Policy.

We will provide a response to your request within 30 calendar days of receipt. In exceptional circumstances requiring additional time, we may, upon notifying you, extend the deadline for the submission of your data request or other requirements specified in your application up to 60 calendar days from the date of your request.

Cookies

A cookie is a small text file that a website saves to your device (computer, smartphone, or tablet) when you visit the website. Cookies help us recognise your device and improve the functionality and ease of use of our Website.

On our Website, we use cookies. For information on how we use cookies, for what purposes, and for how long, please review the Cookie Policy.

Links to third-party websites

Our Website, products, services, and other communications may, from time to time, include links to third-party websites. The personal data you provide through these websites is not covered by this Policy, and we are not responsible for how such websites handle your personal data. If you follow links to these websites, please be aware that they have their own privacy policies, which explain how your information is collected and processed when visiting those sites.

Modifications to the Policy

This Policy may be changed from time to time. The changed Policy will be made available on the Website.

Questions about the Policy

If you have any questions about this Policy, please do not hesitate to contact us. Our contact details are specified in Clause 2 of this Policy.