FAMA PRIVACY NOTICE

1. Introduction
This is a description of how your personal data is collected, used and deleted while you visit our website /www. / or use our app “Fama”, register your account for subscription and using our products or services. The Controller of your personal data is legal entity Fama Technologies OÜ, registry code  16459143, address Harju maakond, Tallinn, Kesklinna linnaosa, Narva mnt 5, 10117 (“we”, “us”).

2. How we get the personal information?
The personal information we process is provided to us directly by you in order to register yourself as our platform user (Fan). You need to create an account to use the platform. You may also use our platform as content creator (Creator). This means that any content you create (photos, videos, texts etc.) is provided to us by you and you also decide how much personal data it consists. We will screen the content in order to make sure that uploaded content to our platform is in accordance with our platform terms. We also have the right to delete the content that we consider not to be in line with our platform Terms and Conditions. In addition, we may also collect your personal data indirectly. When visiting our website as Fan, Creator or visitor, we and our service providers, may collect certain data using tracking technologies like cookies, web beacons and similar technologies. Use of web cookies are described on our website in cookie banner. Indirectly collected data may fall under the terms of third-party privacy policies while they act as an independent data controllers. Please read those separately.

3. What kind of data is processed and why?

Processing activity Data categories Purpose Legal basis
Fan Billing Information
Name, Picture, Email, Date of birth, wallet address, Google ID or Apple ID for log-in
Fan account creation
Contract
Creator Billing Information
Name, Picture, Email, Date of birth, wallet address, Google ID or Apple ID for log-in, Instagram Account information
Creator account creation
Contract
Fan and Creator wallet information for accounting
Transaction data
Fulfilling the accounting law requirements
Legal obligation
Status of funds on the wallets of Fans and Creators
Amounts of cryptographic tokens held on the Wallets
Ensuring operation of the transactions on the Platform
Contract
Profile creation by Fan and Creator
Profile information as seen on the profile form and provided by Fan or Creator
Creating profile
Legitimate interest
Payments by Fan
Crypto currency, wallet information is processed
Payment collection and division to platform and Creator
Legal obligation and Contract
Website and related product maintenance and quality assurance
IP address of the device, Device screen size, Device type (unique device identifiers), operating system, language of the operating system, Browser information, Geographic location (country only)
Providing the web platform technical availability
Contract
Web analytics
Online identifiers (including cookie identifiers and IP addresses)
Platform usage statistics for business decisions and better user experience
Consent
Newsletters and offers
Name, E-mail address, Phone number
Marketing
Consent
Fan or Creator request resolving
Name, E-mail, request and communication
Customer support
Contract
Chat
Chats between Fan and Creator
Providing the platform functionality
Contract

4. Sharing your personal data

Any data you provide will not be publicly displayed or shared to otherrs. Our employees and business partners have access to personal data to the extent necessary for the performance of their work duties. We are also bound by legal obligation to reply any authorities’ requests for access. In such request we make
sure that it is legally binding and follows the process according to applicable law. We use third party processors to help provide our service. Those service providers only get access to personal data if it is absolutely necessary for the service provided. Such access and data transfer is always kept to minimum. We only use the service providers that provide high level information security and privacy protection safeguards.

Why and with whom we share your personal data?

Categories of Recipients Reason for sharing
Service providers
We work with service providers that work on our behalf which may need access to certain personal data to provide their services to us. These companies include those we have hired to operate the technical infrastructure that we need to provide service and assist in protecting and securing our systems and services. For instance, we use Mixpanel for data analytics, and Elastic Search for our search feature.
Payment providers
For paid services you interact directly to payment service providers available on our platform, who process your data as data controllers and thus their privacy notice will apply.

International transfers

Some of our processing is cloud based so your personal information might be sent outside the European Economic Area. In such instances we will ensure that the transfer of your personal data is carried out in accordance with applicable privacy laws and, in particular, that appropriate contractual, technical, and organisational measures are in place. For more detailed information about such data transfers, please contact us by web form.

5. Ensuring the security of personal data
We have taken necessary technical and organizational security measures to protect your personal data against accidental or unlawful destruction, loss or alteration and against the unauthorized disclosure, abuse or other processing in violation of applicable law. This includes: Identity and access management; Preventing unauthorized viewing of personal data; Deliberately set password requirements and other relevant continuously updated security measures.

6. Retention and deletion of personal data
The storage period of personal data depends on whether we have legal obligations to store data (i.e
accounting regulations), contractual obligations, legitimate interest to provide best services or your explicit
consent.

Data Type Purpose Retention Time
Name, Picture, Email, Date of birth, billing information
Fan account management
Until account deletion or 3 years after last action
Name, Picture, Email, Date of birth, billing information
Creator account management
Until account deletion.
Fan and Creator billing information for accounting
Transaction data
7 years+ current fiscal year
Profile information as seen on the registering form and provided by Fan or Creator
Creating Fan or Creator profile
Until account deletion or request for data removal
Crypto currency, crypto wallet information
Payment management
3 years after the deletion of account. 3 years after pay per view payment
Chat content
Platform functionality
Until account deletion or data deletion request
Name, E-mail, request and communication
Fan or Creator request resolving
Until account deletion
Name, Email address,
Newsletter consent
Marketing Until withdrawal of consent
IP address of the device, Device screen size, Device type (unique device identifiers), Browser information, Geographic location (country only),
Providing the website service
A session for 15 days Cookies data for 30 days Device and usage data on the server for 30 days
Online identifiers (including cookie identifiers and IP addresses)
Website statistics
Until withdrawal of consent

7. Your rights and preferences
Under data protection law, you have rights including:
1) Right to be informed and to access. You may get information regarding your personal data processed by us.
2) Right to data portability. You have the right to receive your personal data from us in a structured, commonly used and machine-readable format and to independently transmit those data to a third party.
3) Right to erasure. You have the right to have personal data we process about you erased from our systems if the personal data are no longer necessary for the related purposes.
4) Right to object and restrict. You have the right to object to the processing of your personal data and restrict it in certain cases.
5) Right to rectification. You have the right to make corrections to your personal data.
6) Right to withdraw consent. When you have given us consent to process your personal data, you may withdraw said consent at any time.
To exercise any of the abovementioned rights, please contact via our web form. We will respond to your
requests within 30 days.

8. Other important information
Newsletter and direct marketing campaigns
With your explicit consent, we may send you our newsletter and marketing offers. You may opt out of these messages. Please note that email marketing messages include an opt-out mechanism within the message itself (e.g. an unsubscribe link in the emails we send to you). Clicking on the link in an email will opt you out of further messages. You may also opt-out on your account settings in case this option is available. We may also use social media tools to market our products and services. As social media and web analytics providers act as joint processors, there might be consent or opt-out requirements also on their side (Google Ads, Facebook Ads etc.).
Dispute resolution
If you have questions or concerns about our use of your personal information, please feel free to contact us at contact@joinfama.com. You may lodge a complaint to the supervisory authority, the Estonian Data Protection Inspectorate, info@aki.ee


9. Additional notice for California consumers
Compliance with the California Consumer Privacy Act (CCPA). This section describes specific rights to consumers as California residents in addition to the above described privacy notice. In case this section contradicts to any other section in this privacy policy, this section prevails for California residents.
Your Rights and Choices The CCPA provides consumers (California residents) with specific rights regarding their Personal Information (“PI”). This section describes your CCPA rights and explains how to exercise those rights. Access to Specific Information and Data Portability Rights You have the right to request that we disclose certain information to you about our collection and use of your PI over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

  • The categories of PI we collected about you.
  • The categories of sources for the PI we collected about you.
  • Our business or commercial purpose for collecting or selling that PI.
  • The categories of third parties with whom we share that PI.
  • The specific pieces of PI we collected about you (also called a data portability request).
  • If we disclosed your PI for a business purpose, identifying the PI categories that each category of recipient obtained.


Deletion Request Rights

You have the right to request that we delete any of your PI that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your PI from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us or our service providers to:

  • Complete the transaction for which we collected the PI, provide a service that you requested, take actions reasonably anticipated within the context of our ongoing relationship with you or otherwise perform our contract with you.
  • Detect security incidents; protect against malicious, deceptive, fraudulent or illegal activity; or prosecute those responsible for such activities.
  • Debug products to identify and repair errors that impair existing intended functionality.
  • Exercise free speech, ensure the right of another consumer to exercise their free speech rights or exercise another right provided for by law.
  • Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.).
  • Engage in public or peer-reviewed scientific, historical or statistical research in the public interestthat adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
  • Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
  • Comply with a legal obligation.
  • Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

 

Exercising Access, Data Portability and Deletion Rights
To exercise the access, data portability and deletion rights described in the Access to Specific Information and Data Portability Rights and Deletion Request Rights sections, please submit a verifiable consumer request to us by our web form.

Only you or a person registered with the California Secretary of State that you authorize to act on your 
behalf may make a verifiable consumer request related to your PI. You may also make a verifiable consumer request on behalf of your minor child. Please keep in mind that our service is targeted to consumers 18 years and older.

You may only make a verifiable consumer request for access or data portability twice within a 12-month
period. The verifiable consumer request must:

 

  • Provide sufficient information that allows us to reasonably verify you are the person about whom we collected PI or an authorized representative.
  • Describe your request with sufficient detail that allows us to properly understand, evaluate and respond to it.

We cannot respond to your request or provide you with PI if we cannot verify your identity or authority to make the request and confirm the PI relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use PI provided in a verifiable consumer request to verify
the requestor’s identity or authority to make the request.

Response Timing and Format
We endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your PI that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you services.
• Charge you different prices or rates for services, including through granting discounts or other
benefits, or imposing penalties.
• Provide you a different level or quality of services.
• Suggest that you may receive a different price or rate for services or a different level or quality of services.

Changes to Our Privacy Notice
We reserve the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will notify you on our platform. This Privacy Notice was updated March 2022.