Outline

Click here for Intellum's Privacy Notice

Privacy Notice

We are designing Antavo Academy as an educational program (“Educational Program”) to share loyalty knowledge and to develop the next generation of loyalty professionals and business leaders. Topics we will be looking to cover as part of the study programme will include best practices, case studies, theories, planning and trends in the loyalty industry.

This Privacy Notice explains how we process your personal data within Antavo Academy.

1. Contact details of the Data Controller

company name: Antavo LIMITED

registered seat: 9th, Floor, 107 Cheapside, London, United Kingdom, EC2V 6DN

registration nr.: 08046168

email: giulia.filoso@antavo.com

Contact details of the Data Protection Officer

Annamária Nádai, Data Protection Officer

Email: dpo@antavo.com

2. Purpose of data processing

The purpose of data processing is

1. Handling registration for Antavo Academy Educational Programmes

2. Carrying out Antavo Academy Educational Programs

3. Issuance of certifications in case of successful completion of the Educational Programs.

4. Publishing your participation in the Education Programs on our website (www.antavo.com), and our Linkedin profile

5. Publishing your result (certification) of the Education Programs on our website (www.antavo.com), and our Linkedin profile

3. Legal basis for processing the personal data for the purposes set out in section 2.

The legal basis for data processing is the consent of you, as the data subject under

GDPR Article 6(1)(a)
UK GDPR Article 6(1)(a)

By participating in the Antavo Academy Educational Programs, you give consent to process the personal data defined in Section 4 below.

4. What kind of personal data do we collect?

For the purpose of data processing specified in point 2 of this Privacy Notice, we process the following personal data:

full name
image (photo)
email
company you work at
your position
your result of the Educational Program exams
your certificates

5. Persons having access to personal data

Employees of Antavo participating in the organization of Antavo Academy will have access to all personal data listed in Section 4.

6. Whom do we share the personal data with?

We use the Intellum platform for conducting Educational Programs. For details of how your personal data are processed, please refer to the Intellum Privacy Policy: https://www.intellum.com/privacy-policy

Participation and certifications will be published on LinkedIn. For details of how your personal data are processed, please refer to the LinkedIn privacy policy: https://www.linkedin.com/legal/privacy-policy.

We use Google services. For further details please refer to the Google privacy policy: https://policies.google.com/privacy.

7. How long will the personal data be held for the purposes set out in section 2?

The personal data listed in Section 4. will be kept for 3 (three) years.

Registered users’ accounts which have been inactive for 12 (twelve) months will be deleted.

Registered users that have never logged in will be deleted 3 (three) months after the registration.

8. Automated decision-making

We do not use automatic decision-making or profiling.

9. What are your rights in relation to processing of personal data?

9.1. Right to information

The right to information allows you to know what personal data is collected about you, why, who is collecting data, how long it will be kept, how you can file a complaint, and with whom your data will be shared.

Antavo is obligated to provide information about:

controller’s information and contact details
purpose of data processing
legal basis for personal data processing
recipients of the personal data
data transferring
data retention period
rights granted to the data subject under the data protection law,
the right to file a complaint
whether the provision of personal data is a statutory or contractual requirement,
the existence of automated decision making, including profiling

9.2. Right of access

You have a right to submit subject access requests and obtain information from Antavo about whether your personal information is being processed. Antavo is then obligated to provide a copy of personal data it has about you and additional information, including:

the purpose of the processing
the categories of personal data are they processing
with whom the data is shared (third countries or international organizations)
how long will the organization keep the data (data retention period)
information about their GDPR rights (right to rectification, right to erasure, restriction of processing, etc.)
the existence of automated decision-making, including profiling
what is the source of collected data (if the data is not collected from the individual)
the right to lodge a complaint with a Supervisory Authority

9.3. Right to rectification

The right to rectification allows you to ask Antavo to update any inaccurate or incomplete data it has on you.

9.4. Right to be forgotten

The right to be forgotten is also known as the right to erasure. This right allows you to ask for your personal data to be deleted if:

personal data is no longer necessary
you withdraw consent
the personal data have been unlawfully processed
you object to the processing, and Antavo has no reason to continue processing
data erasure is necessary for compliance with a legal obligation (EU law or national law)

Although there are situations where Antavo can decline the request. For instance, for reasons in the public interest or compliance with legal obligations.

If you exercise their right to erasure, Antavo has to notify any third parties with whom the data was shared and request the erasure of data.

Antavo has to comply unless it can prove that the request would require a disproportionate effort or if it is impossible to comply.

9.5. Right to restrict processing

You can request that Antavo limits the way it uses your personal data. Antavo is not automatically obligated to delete the data. However, it has to refrain from processing it in certain situations:

if the data is inaccurate (during the verification process)
if the processing is unlawful, but you do not want the data to be erased and request restriction (which is different from the right to be erased)
Antavo no longer needs data, but you want the data to be preserved so the legal claim can be exercised
Antavo is taking measures to verify the data erasure request

Once the data is restricted, Antavo is not allowed to process it unless it has your consent, it needs it for legal claims or to protect the rights of other individuals.

9.6. Right to data portability

Data portability allows you to obtain personal data you have previously provided to Antavo in a structured, commonly used, and machine-readable format.

You can also request for your data to be transferred directly to another organization. However, it can only be applied to the data if processing is carried out by automated means, no papers.

9.7. Right to object to processing

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on the following legal grounds:

necessary to perform a task in the public interest ; or
necessary for Antavo’s or a third party's legitimate interests.

Antavo shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of you or for the establishment, exercise or defense of legal claims.

9.8. Right to withdraw consent

You have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

9.9. Exercising the rights

If you wish to exercise any of these rights, please contact us at dpo@antavo.com.

Information is provided to you at the earliest convenience, but at a maximum of 30 days from the date the request was received.

Where the retrieval or provision of information is particularly complex or is subject to a valid delay, the period may be extended by two further months where necessary. However, this is only done in exceptional circumstances and you will be kept informed in wiring throughout the retrieval process of any delays or reasons for delay.

If for any reason, Antavo is unable to act in response to a request a written explanation to you will always be provided and you will be informed of your right to complain to the Supervisory Authority and to a judicial remedy.

Information provided, and any communication and any actions taken under shall be provided free of charge.

Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, Antavo may either:

(a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

(b) refuse to act on the request.

Where Antavo has reasonable doubts concerning the identity of the natural person making the request, it may request the provision of additional information necessary to confirm the identity of the data subject.

If Antavo does not comply with a request, it shall inform you without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

For UK only

Generally, a request from a data subject should be responded to at the latest within one month of receipt of the request.

The one-month time limit can be paused:

(i) if there is anything in the request that Antavo requires clarification from the requester on,

(ii) if the requester's identification has to be verified; or

(iii) prior to receipt of a fee (in the limited circumstances where it is permissible to ask for one).

10. Remedies

10.1. For EEA countries

Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes GDPR.

The list of the European supervisory authorities can be found here.

Right to an effective judicial remedy against a supervisory authority

Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to an effective judicial remedy where the supervisory authority which is competent does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged to it.

Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

Right to an effective judicial remedy against a controller or processor

Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority, you have the right to an effective judicial remedy where you consider that your rights under GDPR have been infringed as a result of the processing of your personal data in non-compliance with GDPR.

Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where you have your habitual residence.

10.2. For UK

You have the right to complain to an organization if you think it has not handled personal information in compliance with the UK GDPR.

You should give the organization you’re unhappy with a chance to sort things out before bringing your complaint to the supervisory authority.

Give the organization one month to respond to your complaint or request. Ask the organization involved for clarification if you don’t understand or you’re unhappy with their response. Organizations have an obligation to clearly explain why they are using your information in the way they are doing or why they have refused a request.

If you have followed these steps or the organization is refusing to respond to you, you can complain to the supervisory authority.

The name and contact details of the supervisory authority

Information Commissioner's Office (ICO)

seat: Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

telephone: 0303 123 1113

fax: 01625 524510

website: www.ico.org.uk

You have the right to an effective judicial remedy against a legally binding decision of the ICO. You can apply to the High Court, or the Court of Session in Scotland, for a judicial review where the complaints process has been exhausted. You may also proceed to take the controller or processor to court for the matter, and the court may take a differing view from any ICO decision.

You have the right to an effective judicial remedy if the ICO does not handle the complaint or provide you with a progress update within three months.

You may apply to the First Tier Tribunal to make an order against the Commissioner.

You have a right to seek a judicial remedy against a controller or processor. The DPA 2018 empowers courts to make an order for compliance, requiring controllers to take or refrain from taking specific steps where a data subject’s rights, under data protection legislation, have been infringed.

Note: if you are a resident of the State of California, USA, please also refer to this supplemental Privacy Notice.

Privacy Notice for California Residents which provides further information and describes additional rights arising under the California Consumer Privacy Act (“CCPA”)

This supplemental Privacy Notice describes the rights of California residents under the California Consumer Privacy Act of 2018, which was amended by the California Privacy Rights Act of 2020 (together, “CCPA”). The CCPA requires Antavo to provide certain information to California consumers.

Any terms defined in the CCPA and CPRA have the same meaning when used in this CCPA Notice. This CCPA Notice applies to California residents’ Personal Information, which we collect directly or indirectly while using our Services or in order to provide our Services (as defined under the Terms of Service), and business-to-business Personal Information.

Any terms defined in the CCPA have the same meaning when used in this

Notice

Antavo LIMITED (company registration nr: 08046168, registered seat: 9th, Floor, 107 Cheapside, London, United Kingdom, EC2V 6DN) (hereinafter referred to as “Antavo”, “We”, “Our”, “Us”) is designing Antavo Academy as an educational programme (“Educational Programme”) to share loyalty knowledge and to develop the next generation of loyalty professionals and business leaders. As one of our trusted partners, we would like to invite you to join us in its creation. Topics we will be looking to cover as part of the study programme will include best practices, case studies, theories, planning and trends in the loyalty industry.

1. Personal information

We collect Personal Information which is defined under the CCPA.

Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern.

For purposes of this, publicly available means: information that is lawfully made available from federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media; or information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.

Publicly available does not mean biometric information collected by a business about a consumer without the consumer’s knowledge.

Personal information does not include consumer information that is de-identified or aggregate consumer information.

2. Personal Information We Collect

We collected the following categories of personal information:

3. Categories of Sources of Personal Information

We collect personal information directly from you.

We obtain the categories of personal information listed above directly from you when you're completing Educational Programmes.

4. Use of Personal Information

Antavo is working on a series of in-depth guides and articles that will be published. We would like to include the opinion of consultants/loyalty experts, like you, who have profound experience in this field.

The answers provided to the Survey will be published on the website of Antavo (www.antavo.com), and the Linkedin page of Antavo.

The published result of the Survey’s open-ended questions may include your answers given in the form of a quote, together with your image, your name, your position and the company you work at.

Responses given to the multiple choice questions will be published in a fully anonymized form.

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

5. Disclosures of Personal Information for a Business Purpose

We may disclose Personal Information to a third party for a business purpose.

When we disclose Personal Information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that Personal Information confidential and not use it for any purpose except performing the contract. We further restrict the contractor and service provider from selling or sharing your Personal Information.

We disclose the following categories of Personal Information for a business purpose:

6. Sale or Share of Personal Information

We do not collect personal information for the purpose of selling it in exchange for money.

We do not share Personal Information to a third party for cross-context behavioral advertising.

7. Sensitive Personal Information

We do not collect Sensitive Personal Information.

8. Information Retention

We retain personal information for 3 (three) years.

We retain personal information as long as required to fulfill the purpose defined in Section 4.

9. What are your rights under CCPA?

If you wish to exercise any of these rights, please submit a request by emailing us at dpo@antavo.com.

You may exercise these rights free of charge except as otherwise permitted under applicable law. If requests are manifestly unfounded or excessive, in particular because of their repetitive character, Antavo may either charge a reasonable fee, taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request and notify the consumer of the reason for refusing the request.

We may limit our response to your exercise of these privacy rights as permitted under applicable law.

We will respond to a verifiable request within the timeframes set forth under the CCPA, thus, within 45 days of receiving a verifiable consumer request from the consumer. This time period may be extended once by an additional 45 days when reasonably necessary, however, in this case, we will inform you of the extension within the first 45-day period.

We will provide the required information in a readily usable format, if technically feasible, that allows you to transmit this information from one entity to another entity without hindrance. Antavo may require authentication of you that is reasonable in light of the nature of the personal information requested.

The disclosure of the required information will cover the 12-month period preceding the business’ receipt of the verifiable consumer request.

If Antavo does not take action on your request, it shall inform you, without delay and at the latest within the time period permitted of response by this section, of the reasons for not taking action and any rights you may have to appeal the decision to Antavo.

Please note that, only you or your authorized agent may make a verifiable request related to your personal information. Such requests must include sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative as well as sufficient details regarding your request that allows us to properly understand, evaluate, and respond to it.

—------------------------------------------------------------------------

This Privacy Notice may be changed unilaterally by Antavo at any time.

This Privacy Notice enters into force on February 05, 2025.