Last Updated: 14 October 2022

Data Controller

1. The operator of the www.exoflow.org website (the "Website") and hence data controller is Grows Technologies OÜ, a company registered in the commercial register of Estonia with the registered address Soo tn 28-18, Põhja-Tallinna linnaosa, Tallinn, Harju maakond, 10414 (hereinafter referred to as "Operator", "we", "us"). Data protection is important to us and we adhere to applicable data protection laws and regulations. This includes both Swiss data protection and privacy requirements and where applicable to individuals in the European Union and the member states of EFTA, the General Data Protection Regulation (hereinafter "GDPR") and the applicable national laws.
2. This Privacy Policy explains the processing of personal data by Operator and explains in particular which personal data of the Website’s visitor (hereinafter referred to as "User") is controlled or processed by the Operator, and/or other third parties, and for which purposes this data is processed and the legal basis therefore. It also describes how collected personal data can be checked, corrected or deleted.
3. This Privacy Policy does not extend to any external links that lead to services or websites of third parties, including those outlined in Section Use of Personal Data (4) below, or any social media websites (such as Discord, Twitter, Github etc. which may be linked to from the Website). These third-party websites and services are subject to the terms and conditions and the privacy policy of the respective provider.

Acceptance of the Privacy Policy

1. In relation to any personal data provided by the User, by clicking on the "I agree to the Privacy Policy”, or similar wording with the same purpose and effect, field(s) or checkboxes, the User agrees to this Privacy Policy.
2. This policy may change from time to time. The continued engagement of Users with the Website after any such revisions indicates that you accept and consent to them, so please check this Privacy policy periodically for updates.

Personal Data

1. Operator respects the privacy of the User and will not collect any personal data (such as name, address, phone number, e-mail address, IP address, device type etc.) unless they are:
   1. provided voluntarily by the User, for example through contact forms on the Website, by phone, by e-mail or by third party service as summarized in Section Use of Personal Data (4) below; or
   2. gathered as a result of checks performed by third parties included in Section Use of Personal Data (4) below based on the personal data provided by the Use.

Use of Personal Data

1. Data transmitted by the User to Operator may be used as follows:
   1. to respond to your inquiries;
   2. to to assess User's personal abilities, knowledge and skills prior to entering into the collaboration contract or another contract with Operator, it's affiliates, consultants, or any other third-party who is also a User;
   3. to create a collaboration offer and negotiate such an offer, which was requested by you;
   4. to fulfill contractual obligations, for example in relation to Operator’s products, services or events;
   5. for marketing purposes, in particular to better understand the needs of Users and to provide Users with information relating to Operator’ products, services or events.
2. Operator is able to collect, use and process personal data in this way because one or more of the following legal bases exists:
   1. User has entered into a contractual relationship with Operator through acceptance of the Member Collaboration Agreement; and/or
   2. Operator has a legal basis or requirement to process your personal data;
   3. Operator has a legitimate reason to do so, for example through contract or other relationship; and/or
   4. User has given consent to Operator to do so.
3. Access to personal data is limited to those employees and third parties who need to know this data. The persons and companies concerned are obliged to maintain confidentiality and comply with applicable data protection laws, including where relevant a data processing agreement. Operator will not sell or otherwise market personal data to third parties.
4. Your personal data will not be shared with third parties for purposes other than those listed below. We will only pass on your personal data to third parties if:
   1. you have given your express consent,
   2. the disclosure is necessary to assert, exercise or defend legal claims and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data,
   3. in the event that a legal obligation exists for the transfer; or
   4. this is legally permissible and necessary for obtaining or the execution of contractual relationships with you.
5. In particular, we may share personal data with some or all the following organizations where it is required to do so to deliver the uses described in Section Use of Personal Data (1), and appropriate contractual confidentiality and other privacy and data protection requirements are in place:

| Google | Operator uses Google’s G-Suite and applications related to it for e-mail and productivity on basis of on Art. 6(1)(f) GDPR. The provider of this service is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. Users’ personal data, such as name and e-mail address, may therefore be shared with Google.

Their privacy policy can be found here. | | | --- | --- | --- | | Typeform | Operator uses Typeform to create online forms and integrate them into the Website on basis of on Art. 6(1) (f) GDPR. If the corresponding consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR; the consent can be revoked at any time. The provider pf this service is TYPEFORM S.L., Carrer Bac de Roda, 163, 08018 Barcelona, Spain (“Typeform”). Users' personal data, such as name, surname, email, Ethereum address, Twitter username, Discord username, DAO membership, current employer, previous employers; Data on personal knowledge and skills, characteristics, such as education, hard/soft skills, language skills, interests; and other relevant personal data provided by you.

The data User enters in our Typeform forms is stored on Typeform’s servers until User asks us to delete it, revoke any consent User has given to store it, or the purpose for storing the data no longer applies (e.g., after we have finished processing your request). Mandatory legal provisions – in particular, retention periods – remain unaffected by this.

Their privacy policy can be found here. | | | Event locations, travel providers and catering companies | Where relevant, in relation to events Operator may share personal data with third party providers of catering, event and travel services that are needed for the delivery of the relevant event on basis of Art. 6(1)(b) GDPR, once the User enters into explicit contractual agreement related to such relevant event with Operator until the termination event of such agreement . In such cases personal data is likely to include, name, email address and phone number.

Their respective privacy policies will be placed in relevant contractual agreements related to the relevant events. | |

1. We reserve the right to transfer, store, use and process your data, including any personal information, to countries outside of the European Economic Area (“EEA”) including the United States and possibly other countries. By using the Website, you consent to us transferring your data to these countries. You should note that laws vary from jurisdiction to jurisdiction, and so laws and regulations relating to privacy and data disclosure, applicable to the places where your information is transferred to or stored, used or processed in, may be different from the laws and regulations applicable to your place of residency. We take the legally required safeguards and contractual measures to ensure that any parties we transfer personal data to do so in keeping with the level of data protection and security prescribed by the applicable data protection regulation.
2. Within the scope of the GDPR, and where GDPR is applicable, the data processing described in this clause 4, excluding where explicitly stated otherwise in this clause 4, is justified in order to assess User's personal abilities, knowledge and skills prior to entering into the collaboration contract or another contract with Operator, it's affiliates, consultants, or any other third-party who is also a User; and to create a collaboration offer and negotiate such an offer, which was requested by you pursuant to Art. 6(1)(a) GDPR and to comply with legal obligations to which we are subject pursuant to Art. 6(1)(c) GDPR.

Retention of Data

Operator will retain personal data for as long as it is required to deliver the use described in Section Use of Personal Data (1), or as is required by the applicable law, whichever is the longer.

Security Measures

1. We take commercially reasonable technical and organizational precautions to prevent the loss, misuse or alteration of your personal information. Accordingly, we store all the personal information you provide on secure (password- and firewall-protected) servers.
2. You also acknowledge that no technical and organizational measures can fully eliminate security risks connected with the transmission of information over the Internet. We therefore cannot guarantee the security of data sent over the Internet.
3. We also use suitable technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.
4. The User is aware that transmissions on the Internet are not secure by their nature. Once Operator has received the transmitted information, it shall adequately secure it in its systems.

Children’s Privacy

The Website does not address anyone under the age of 18. Operator does not knowingly collect personal identifiable information from children under 18. In the case Operator discovers that a child under 18 has provided it with personal information, Operator immediately deletes this from its servers and/or third-party server hosting, whichever applicable. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us so that we will be able to do necessary actions.

Specific Territory Rights of the User

1. In some regions, such as the European Economic Area, Users have rights that allow them greater access to and control over your personal information.These may include the rights:
   1. to request information about your personal data processed by us. In particular, you may request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, the existence of a right to rectification, deletion, restriction of processing or objection, the existence of a right of appeal, the origin of your data, if these have not been collected by us, and the existence of automated decision-making including profiling and, if applicable, meaningful information on their details;
   2. request the correction of incorrect or complete personal data stored by us;
   3. to demand the deletion of your personal data stored by us, unless the processing is justified by our legitimate interests, necessary to fulfill a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims;
   4. to demand the restriction of the processing of your personal data if you dispute the accuracy of the data;
   5. if our data processing is based on your consent, you have the right to revoke your consent to us at any time. As a result, we are no longer allowed to continue processing data based on this consent in the future;
2. Where possible and Operator will fulfill such requests of the User within a reasonable timeframe, unless retention of the relevant data is required by law, is required for another valid purpose, for example to enable the fulfillment of contractual obligations, or is covered by a valid limitation or exemption under relevant privacy and data protection regulations.
3. If you are resident in the European Economic Area and you believe we are unlawfully processing your personal information, you also have the right to complain to your local data protection supervisory authority. You can find their contact details here: http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.html
4. If you are a resident of California, you are granted specific rights regarding access to your personal information California Civil Code permits users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we share personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided below.
5. If you are under 18 years of age, reside in California, and have a registered account with the Website, you have the right to request removal of unwanted data that you publicly post on the Website. To request removal of such data, please contact us using the contact information provided below, and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on the Website, but please be aware that the data may not be completely or comprehensively removed from our systems.

Contact Us

If you have any queries on this privacy policy or any other queries in relation to how we may manage, protect and/or process your personal data, please do not hesitate to contact us at [email protected]