This Privacy Policy describes Design Plus Motion's practices for collecting, using, maintaining, protecting and disclosing information in relation to both visitors and customers. This Policy has been drafted in line with Article 12 of the General Data Protection Regulation which states that the controller shall take appropriate measures to provide information where personal data is to be collected^[1] and where personal data have been obtained but not from the data subject[2].

Who we are?

Stephan Zammit, with an official address of Il-Gardina, Trejqet in-Nigret, Zurrieq (hereinafter referred to as “We” or “Us”) operate a website currently available on the web, which offers graphic design and motion design content. We currently operate from Il-Gardina, Trejqet in-Nigret, Zurrieq, Malta, Europe. Persons having interest in obtaining more information on our practices or otherwise can send an email on stephanzammit@designplusmotion.com. We respect the privacy of individuals and we are committed to protect information of visitors and customers.

What data do We collect?

This Policy applies mutatis mutandis to data collected from Our website https://designplusmotion.com (hereinafter referred to as the “DesignPlusMotion Website”) and from communication with us through your design board when you subscribe to a design service (hereinafter referred to as the “DesignPlusMotion Services”).  Visitors to the DesignPlusMotion Website and users of the DesignPlusMotion Services hereinafter shall be referred to as “You”. In accordance to the General Data Protection Regulation (hereinafter referred to as “GDPR”), personal data is any information which is related to an identified or identifiable natural person, whether directly or indirectly, in particular by reference to an identifier such as a name, identification number, an online identifier such as a name, and any location information (hereinafter referred to as “Personal Data”).

We collect the following data:

Personal Data that You might provide to Us:

• when You register an account via the DesignPlusMotion Services
• when You register your interest via the DesignPlusMotion Website
• when You complete your profile information
• when You upload personal images, audio, video or other design material to the DesignPlusMotion Services
• when You contact Us to make a complaint, ask a question, inquire or leave any feedback
• in order to submit your preferred payment method in order to subscribe to DesignPlusMotion Services
• in order to enroll in Our newsletter system

Personal Data we collect automatically:

• when making use of the DesignPlusMotion Website
  
  As you navigate through our website we may use cookies, which are small files placed on the hard drive of Your computer or mobile device, and web beacons, to collect information about your equipment, browsing patterns and actions). Data collected from cookies and web beacons might include information on a web browser, details of your visits to the DesignPlusMotion Website, including inter alia, traffic data and logs, page views and IP address.
  

Personal Data collected from third-party sources:

In order to provide the optimum service to You, We have contracted with third-party suppliers and service providers. We may obtain Personal Data about You from third parties, including but not limited to:

• Google Analytics
  This is a third-party tool by Google Inc that helps gather data. Google Analytics offers an opt-out option (add-on required).
  
• Stripe
  Stripe is used to make payments, subscribe and manage your subscription.
  
• Calendly
  Calendly is used to book a call with us or schedule a meeting.
  
• Trello
  Trello is used to collect information and details about the tasks you assign to us.
  
• Facebook Inc
  Facebook is an American technology conglomerate heading a popular global social networking service.
  

We require that any third parties providing information has obtained such information lawfully and that the third party has obtained the appropriate consent to share the information. We work hard to ensure that data collected from third parties is lawfully obtained, however we are not in a position to ascertain this fully, and we shall not be deemed responsible for any breach carried out by our third parties.

How We use Your data?

In line with the principle of data minimization and data economy, we only collect personal data and processes it on the following legal basis:

• To service You via the DesignPlusMotion Website.
• To service You via DesignPlusMotion Services.
• To provide You with a user account and to identify You from other users, to contact You, to respond to your queries, complaints or questions, to troubleshoot and diagnose problems, complaints or questions, to provide you with the products and services which you have enrolled for and to process payment.
• To gather anonymous analytics about how users use the DesignPlusMotion Website and Services, to understand how We can improve our service offering.
• To operate the DesignPlusMotion Website, ensuring security and integrity, to enforce our agreements and policies.
• For legitimate interest, primarily to protect us from legal action or claims from third parties, including you and/or to protect our legal rights and/or those of our employees.

We endeavor not to collect additional Personal Data or use the Personal Data we have collected for materially different, unrelated or incompatible purposes without asking for Your consent.

We ensure the maximum level of safety and adopt high security measures to prevent unauthorized access, disclosure, modification or unauthorized distribution of data. The data processing is carried out using computers and/or IT enabled tools, following organisational procedures and modes strictly related to the purposes indicated. In some cases, the data may be accessible to certain types of persons in charge, involved with the operation of this DesignPlusMotion Service and Website (such as, but not limited to, administration, sales, marketing, legal and system administration) or external parties (such as third-party technical service providers, mail carriers, hosting providers, IT companies, communications agencies) appointed, if necessary, as data processors by Us.

Legal Basis

When processing Your Personal Data, we rely solely on the following legal basis:

Consent – As per Article 6(1) (a) of the GDPR, processing of data is lawful when the data subject gives consent to the processing for a specific purpose. We will process your personal data when you consent. By ticking or choosing the ‘I accept’ or ‘I agree’ options when faced with the choice, You consent for us to process your Personal Data. Such consent can be easily withdrawn at any time.

Contract – As per Article 6(1)(b) of the GDPR, processing is allowed when it is necessary for the performance of a contract to which You are a party.

Legitimate Interest – As per Article 6(1)(f) of the GDPR, We process certain data in order to improve the Pinreel App and to troubleshoot and eliminate certain technical problems and to develop new features.

Who has access to Your data?

We do not share your Personal Data with third parties for their marketing purposes. However, we might share anonymous or hashed data with third parties for our own marketing purposes. In line with the consent which you have provided we might share data in the following ways:

Our service providers – We may share Your Personal Data with our service providers, such as inter alia, our payment processor, data storage company, app distributors, support providers and other third parties who might be from time to time engaged to perform specific tasks for Us.

Advertising partners – We may share untraceable and anonymous data in order to market our services.

DesignPlusMotion Group – Employees and owners of the DesignPlusMotion Website and DesignPlusMotion Services may have access to Your data should this be required. Moreover, owners might share Your data during business enlargement, consolidation or bankruptcy.

Legal Requirements – We might be asked by law enforcement agencies to disclose Your Personal Data for the establishing of any legal or litigious right by the competent authorities, in cases of evident prima facie mala fides from Your end.

Your Request – As per the GDPR, in the event that You decide to access Your right to data portability as per below, we have no option but to transfer the data accordingly.

How We store Your data

We maintain sophisticated and top of the line data protection practices when it comes to securing Your data, in order to protect it. We use commercially available physical and technical safeguards which have been designed to secure Your Personal Data from loss, or unauthorized access or use. All information You provide to Us is encrypted using a secure HTTPS connection. Additionally, we do not share Personal Data which We collect unless in line with this Policy. We have adopted a ‘need-to-know’ policy, and therefore Personal Data is only disclosed to only employees who strictly need to know Your Personal Data in order to provide You services.

This notwithstanding, We are aware that despite we take all the measures which are feasibly available to Us, there might be rare instances of data loss or damage due to accidents which are beyond our control. No method of transmitting data over the internet can be classified as without risk. We rely on Your responsibility to maintain a confidential and complex password.

Any transmission of Personal Data is done at Your own risk and We cannot guarantee that such Personal Data may not be accessed, disclosed or altered by unauthorised persons.

Marketing

We may make use of services which assist in ad retargeting. We may share data with our marketing partners who engage in ad retargeting. You may opt-out of ad retargeting by using the opt-out option on the channel used to display these ads to You.

Data Retention

In light with the GDPR provisions[3], We keep Personal Data as long as necessary in order to keep up with our legal and contractual obligations. Therefore, unless you explicitly request to have Your Personal Data deleted as per the below, We will retain your Personal Data in our secure database for as long as you hold an active DesignPlusMotion account or subscription with Us. Once an account is deemed inactive by Us, we securely delete Your data. To access, edit, or delete personal data about you or your account, please use the "Manage your Subscription" section in your Trello board.

Notwithstanding the previous provision, Personal Data collected might be kept for an additional period as is permitted or required under Maltese legislation[4], for legal, tax or regulatory reasons or for legitimate and lawful business purposes.

Your Rights

We would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

‍The Right to Access Your Persona Data[5] - You have the right to request for copies of Personal Data which has been collected concerning Yourself. You can access this right at reasonable intervals. When possible, We will endeavor to provide remote access to a secure system which would provide You direct access to Your data. This right should not adversely affect the rights or freedoms or others, including intellectual property rights, trade secrets or software copyright held by Us.

‍The Right to Rectification[6] - You have the right to request that without unjust delay We correct any information You believe is inaccurate about Yourself. You also have the right to request to complete information concerning Yourself that You believe is incomplete, by providing a supplementary statement.

‍The Right to Erasure[7] - You have the right to request the erasure of Your Personal Data without undue delay and We shall erase such Personal Data without as considerably soon as possible when one of the following grounds apply:

• The Personal Data is no longer necessary in relation to the purpose for which it was collected or processed
• You withdraw consent on which processing is based or there is no longer a legal ground for the processing;
• You object to the processing pursuant to Article 21 (1) of the GDPR and there are no overriding legitimate grounds for the processing;
• You object to the processing pursuant to Article 21 (2) of the GDPR; or
• The processing was unlawful.

The above right shall not apply to the extent that processing is necessary for the establishment, exercise or defense of legal claims.

Right to lodge a complaint with the supervisory authority

‍The Right to Restrict Processing[8] - You have the right to request that We restrict the processing of your personal data, under certain conditions.

• The accuracy of the Personal Data is contested by Yourself, for a period, to enable us to verify the accuracy of such Personal Data
• The processing is unlawful and You oppose to the erasure of the Personal Data and restrict use instead
• We no longer need to process Your personal data, but such Personal Data is required by Yourself for the establishment, exercise or defense of legal claims.
• You have objected to the processing in line with Article 21(1), pending verification whether the Our legitimate grounds override those of the data subject.

When Personal Data is restricted in line with the above, such data may only be processed with Your consent.

‍The Right to Data Portability[9] - You have the right to request that We transfer the Personal Data which You have provided to us, in a structured, commonly used and machine-readable format and You have the right to transmit such data to any other data controller. We shall not hinder this process in any way, where:

• The processing is based on consent is pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1) of the GDPR.
• The processing is carried out by automated means.

The right to withdrawal if point (a) of Article 6(1) or point (a) of Article 9(2)

California User’s Rights

In addition to Section 8, pursuant to the California Privacy Rights Act, California users have the right to:

• Delete any personal information We hold.[10]
• Correct any inaccurate Personal Information.[11]
• Know what personal information is being collected by Us, and right to access such information. [12]
• Know what personal information is sold or shared by Us and to whom[13], and the right to opt-out from such sale or data sharing. [14]
• Limit use and disclosure of Sensitive Personal Data. [15]

Exercise of any of the above rights shall not result in any direct or indirect retaliation by Us. [16]

[1] Article 13, General Data Protection Regulation.

[2] Article 14, General Data Protection Regulation.

[3] Article 5 (e), General Data Protection Regulation

[4] As per the Commercial Code, Chapter 13 of the Laws of Malta and the Companies Act, Chapter 386 of the Laws of Malta.

[5] Recital 63 & Article 15, General Data Protection Regulation.

[6] Article 16, General Data Protection Regulation.

[7] Article 17, General Data Protection Regulation.

[8] Article 18, General Data Protection Regulation.

[9] Article 20, General Data Protection Regulation.

[10] Section 1798.105, Amended November 3, 2020, by initiative Proposition 24, Sec. 5. Effective December 16, 2020. Operative January 1, 2023, pursuant to Sec. 31 of Proposition 24.

[11] Section 1798.106, Added November 3, 2020, by initiative Proposition 24, Sec. 6. Effective December 16, 2020. Operative January 1, 2023, pursuant to Sec. 31 of Proposition 24.

[12] Section 1798.110, Amended November 3, 2020, by initiative Proposition 24, Sec. 7. Effective December 16, 2020. Operative January 1, 2023, pursuant to Sec. 31 of Proposition 24.

[13] Section 1798.115, Amended November 3, 2020, by initiative Proposition 24, Sec. 8. Effective December 16, 2020. Operative January 1, 2023, pursuant to Sec. 31 of Proposition 24.

[14] Section 1798.120, Amended November 3, 2020, by initiative Proposition 24, Sec. 9. Effective December 16, 2020. Operative January 1, 2023, pursuant to Sec. 31 of Proposition 24.

[15] Section 1798.121, Added November 3, 2020, by initiative Proposition 24, Sec. 10. Effective December 16, 2020. Operative January 1, 2023, pursuant to Sec. 31 of Proposition 24.

[16] Section 1798.125.