This Privacy Policy describes the privacy practices of Civic Tech Lab (“CTL”, “us”, “our”, and “we”) and how we handle personal information that we collect through our website (the “Site”), as well as through social media, our marketing activities, and other activities described in this Privacy Policy.

‍

CTL may provide additional or supplemental privacy policies to individuals for specific products or services that we offer at the time we collect personal information.

1. Controller.

‍

CTL is the controller of your personal information covered by this Privacy Policy for purposes of General Data Protection Regulation 2016/679 (“GDPR”).

2. Personal information we collect:

· Identity data, such as your first, last name and age;
· Contact data, such as email address, phone number and mailing address;
· Demographic information, such as your city, state, country of residence, postal code;
· Professional or employment information, such as your current

job title and company name;
· Communications that we exchange with you, including when

you contact us with questions or feedback, through the Site, social media, or otherwise;
· Online activity data, such as pages or screens you viewed, how long you spent on a page or screen, the website you visited before browsing to the Site, navigation paths between pages or screens, information about your activity on a page or screen, access times and duration of access, and whether you have opened our marketing emails or clicked links within them;
· Cookies, which are text files that websites store on a visitor's device to uniquely identify the visitor's browser or to store information or settings in the browser for the purpose of helping you navigate between pages efficiently, remembering your preferences, enabling functionality, helping us understand user activity and patterns, and facilitating analytics and online advertising;
· Commercial information, such as products or services you have purchased, obtained, or considered, as well as other information related to your purchasing or consuming history;
· Marketing data, such as your preferences for receiving our marketing communications and details about your engagement with them;
· Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

3. Legal bases for processing your personal information.

We use your personal information only as permitted by law, for

the purposes for which we collected it as listed in para. 4 below.

In respect of each of the purposes for which we use your personal information, the data protection legislation requires us to ensure that we have a “legal basis” for that use. Our legal bases for processing your personal information described in this Privacy Policy are listed below:
· Where we need to perform a contract, we are about to enter

into or have entered into with you (“Contractual Necessity”);
· Where it is necessary for our legitimate interests and your interests and fundamental rights do not override those interests (“Legitimate Interests”);
· Where we need to comply with a legal or regulatory obligation (“Compliance with Law”);
· Where we have your specific consent to carry out the processing for the purpose in question (“Consent”).

4. Purposes for using your personal information.

We use your personal information for the following purposes

and based on the following legal bases:
· Operation of the website and service delivery based on Contractual Necessity and Legitimate Interests;
· Compliance, fraud prevention and safety based on Legitimate Interests and Compliance with Law [we have a legitimate interest

in ensuring the ongoing security and proper operation of our services, website and associated IT services and networks];
· Troubleshooting based on Legitimate Interests [it is in our legitimate interests that we can monitor and ensure the proper operation of our website and associated systems and services];
· Marketing based on Consent.

5. Retention.

We retain personal information for as long as necessary to fulfill

the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes.
To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

When we no longer require the personal information, we have collected about you, we will either delete or anonymize it or, if this is not possible (for example, because your personal information

has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible. If we anonymize your personal information (so that it can no longer be associated with you), we may use this information indefinitely without further notice to you.

6. Your rights.

Data protection laws provide you with certain rights regarding

your personal information. You may ask us to take the following actions in relation to your personal information that we hold:
· Access. Provide you with information about our processing of your personal data and give you access to it;
· Correct. Update or correct inaccuracies in your personal data;
· Transfer. Transfer a copy of your personal data to you or a third party of your choice;
· Restrict. Restrict the processing of your personal data;
· Object. Object to our reliance on our legitimate interests as the basis of our processing of your personal data;
· Delete. Delete your personal data;
· Opt-out. Stop sending you direct marketing communications.

You may continue to receive service-related and other non-marketing emails.
You may submit these requests by email to us. We may request specific information from you to help us confirm your identity

and process your request. Applicable law may require or permit

us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions. If you would like to submit

a complaint about our use of your personal information or our response to your requests regarding your personal information,

you may contact us or submit a complaint to the data protection regulator in your jurisdiction.

7. Changes to this Privacy Policy.

We reserve the right to modify this Privacy Policy at any time without notice to users by updating this Privacy Policy and posting it on the Site. If required by law we will also provide notification

of changes in another way that we believe is reasonably likely

to reach you, such as via email or another manner through the

Site. Any modifications to this Privacy Policy will be effective

upon our posting the modified version (or as otherwise indicated

at the time of posting). In all cases, your use of the Site after the effective date of any modified Privacy Policy indicates your acceptance of the modified Privacy Policy.

8. Contact information.
Email: contact@ctlab.io