Privacy Policy

Identification

This privacy notice is issued jointly by two companies of the COMO group, each acting as a separate and independent controller for its own processing: COMO Digital Life S.à r.l., R.C.S. Luxembourg B 189 542, registered office 1-5 Rue de l'Innovation, L-1896 Kockelscheuer, Luxembourg, and COMO DL S.A., R.C.S. Luxembourg B 208 603, with the same registered office, a payment institution authorized and supervised by the Commission de Surveillance du Secteur Financier (CSSF) under license number Z00000013.

COMO Digital Life S.à r.l. is the controller for the personal data collected through this Website and through the operation of the COMO Platform.

COMO DL S.A. is the controller for the personal data it processes in connection with the regulated payment services of COMO Pay.

Where you apply for or use the regulated payment services of COMO Pay, COMO DL S.A. collects and processes your personal data directly, as an independent controller, for onboarding, client due diligence, transaction monitoring, AML/CTF and Sanctions screening, fraud prevention, the execution of payment transactions, the safeguarding of funds, security, and compliance with its legal obligations as a payment institution.

The legal bases for that processing are compliance with legal obligations, the performance of a contract, and the legitimate interests of COMO DL S.A. in preventing financial crime. Screening and transaction monitoring involve automated processing, and a decision that produces legal effects for you is subject to human review. COMO Digital Life S.à r.l. and COMO DL S.A. are not joint controllers within the meaning of Article 26 of the GDPR. Each controller determines the purposes and means of its own processing separately and is solely responsible for it, and the two controllers disclose personal data to each other only where necessary and in accordance with the GDPR and Luxembourg professional secrecy rules.

For a request concerning the processing by COMO Digital Life S.à r.l., contact privacy@como-dl.com.

For a request concerning the processing by COMO DL S.A., contact its data protection officer at dpo@como-dl.com.

This privacy notice applies to the information collected through this Website and the COMO Platform, and to related sales, marketing and events.

Please read this privacy notice carefully as it will help you understand what we do with our collected information.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?

2. HOW DO WE USE YOUR INFORMATION?

3. WILL YOUR INFORMATION BE SHARED WITH ANYONE?

4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

5. DO WE USE GOOGLE MAPS?

6. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

7. HOW LONG DO WE KEEP YOUR INFORMATION?

8. HOW DO WE KEEP YOUR INFORMATION SAFE?

9. DO WE COLLECT INFORMATION FROM MINORS?

10. WHAT ARE YOUR PRIVACY RIGHTS?

11. CONTROLS FOR DO-NOT-TRACK FEATURES

12. DO WE MAKE UPDATES TO THIS NOTICE?

13. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

14. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Information is automatically collected.

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Website.

We automatically collect certain information when you visit, use or navigate the Website. This information does not reveal your specific identity (like your name or contact information) but includes device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Website and other technical information. This information is primarily needed to maintain the security and operation of our website, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies.

The information we collect includes:

Log and Usage Data. Log and usage data are service-related, diagnostic usage and performance information our servers automatically collect when you access or use our website and which we record in log files. Depending on how you interact with us, this log data include your IP address, device information, browser type and settings and information about your activity on the Website (such as the date/time stamps associated with your usage, pages and files viewed, searches and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called 'crash dumps') and hardware settings).

Device Data. We collect device data such as information about your computer, phone, tablet or other devices you use to access the Website. Depending on the device used, this device data include information such as your IP address (or proxy server), device application identification numbers, location, browser type, hardware model Internet service provider and/or mobile carrier, operating system configuration information.

Location Data. We collect information data such as information about your device's location, which can be either precise or imprecise. How much information we collect depends on the type of settings of the device you use to access the Website. For example, we use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt-out of allowing us to collect this information either by refusing access to the information or by disabling your Locations settings on your device. Note, however, if you choose to opt-out, you are not able to use certain aspects of the Services.

2. HOW DO WE USE YOUR INFORMATION?

In Short: We process your information for purposes based on legitimate business interests, the fulfillment of our contract with you, compliance with our legal obligations, and/or your consent.

We use personal information collected via our Website for a variety of business purposes described below. We process your personal information for these purposes in reliance on our legitimate business interests, in order to enter into or perform a contract with you, with your consent, and/or for compliance with our legal obligations. We indicate the specific processing grounds we rely on next to each purpose listed below.

We use the information we collect or receive:

Fulfill and manage your orders. We use your information to fulfill and manage your orders, payments, returns, and exchanges made through the Website

Administer prize draws and competitions. We use your information to administer prize draws and competitions when you elect to participate in our competitions

To deliver and facilitate the delivery of services to the user. We use your information to provide you with the requested service.

To respond to user inquiries/offer support to users. We use your information to respond to your inquiries and solve any potential issues you might have with the use of our Services.

To send you marketing and promotional communications. We and/or our third-party marketing partners use the personal information you send to us for our marketing purposes if this is in accordance with your marketing preferences. For example, when expressing an interest in obtaining information about us or our Website, subscribing to marketing or otherwise contacting us, we will collect personal information from you. You can opt out of our marketing emails at any time (see the "WHAT ARE YOUR PRIVACY RIGHTS" below.

Deliver targeted advertising to you. We use your information to develop and display personalized content and advertising (and work with third parties who do so) tailored to your interests and/or location and to measure its effectiveness.

3. WILL YOUR INFORMATION BE SHARED WITH ANYONE?

In Short: We only share information with your consent, to comply with laws, to provide you with services, to protect your rights, or to fulfill business obligations.

We process or share your data that we hold based on the following legal basis:

Consent: We process your data if you have given us specific consent to use your personal information in a specific purpose.

Legitimate Interests: We process your data when it is reasonably necessary to achieve our legitimate business interests.

Performance of a Contract: Where we have entered into a contract with you, we process your personal information to fulfill the terms of our contract.

Legal Obligations: We disclose your information where we are legally required to do so in order to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process, such as in response to a court order or a subpoena (including in response to public authorities to meet national security or law enforcement requirements).

Protection of Rights: We disclose your information where it is necessary to investigate, prevent, or take action regarding potential violations of our policies, suspected fraud, situations involving potential threats to the safety of any person and illegal activities, or as evidence in litigation in which we are involved, based on our legitimate interests or a legal obligation.

More specifically, we need to process your data or share your personal information in the following situations:

Business Transfers. We share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Affiliates. We share your information with our affiliates, in which case we will require those affiliates to honor this privacy notice. Affiliates include our parent company and any subsidiaries, joint venture partners or other companies that we control or that are under common control with us.

Personal data is exchanged between COMO Digital Life S.à r.l. and COMO DL S.A. only where applicable law permits and as described in the Identification section, and the COMO Platform is hosted and maintained by a company of our group, subject to confidentiality obligations at least equivalent to this notice.

Business Partners. We share your information with our business partners to offer you certain products, services or promotions.

4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We use cookies and other tracking technologies to collect and store your information.

We use cookies and similar tracking technologies (like web beacons and pixels) to access or store information. Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice.

5. DO WE USE GOOGLE MAPS?

In Short: Yes, we use Google Maps for the purpose of providing better service.

This Website uses Google Maps APIs which are subject to Google's Terms of Service. You find the Google Maps APIs Terms of Service here. To find out more about Google's Privacy Policy, please refer to this link.

6. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: We transfer, store, and process your information in countries other than your own.

We store and process your personal information on secure servers located in the European Union. Where personal data is transferred to a country outside the European Economic Area, the transfer takes place in accordance with Chapter V of the GDPR, on the basis of an adequacy decision of the European Commission or of appropriate safeguards such as the standard contractual clauses approved by the European Commission, and information on the transfer mechanism is available upon request through the contact details in Section 13.

7. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this privacy notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy notice unless a longer retention period is required or permitted by law (such as tax, accounting or other legal requirements).

For data collected through the Website, we keep your personal information only for as long as necessary for the purposes described in this notice. Where the law requires a longer retention, such as the record-keeping obligations under the Luxembourg law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, or the retention of accounting records under Luxembourg commercial law, the statutory period applies.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

8. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security, and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, the transmission of personal information to and from our website is at your own risk. You should only access the Website within a secure environment.

9. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

10. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: You have the rights granted by the GDPR, including access, rectification, erasure, and objection. Under the GDPR, you have the right to request access to your personal data and to receive a copy of it, to have inaccurate data rectified, to have your data erased, to restrict or object to its processing, and to receive the data you provided to us in a structured, commonly used, and machine-readable format. Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of the processing carried out before the withdrawal. You may exercise your rights against the controller responsible for the processing concerned, as described in the Identification section, using the contact details in Section 13. You also have the right to lodge a complaint with the Luxembourg supervisory authority, the Commission nationale pour la protection des données (CNPD, www.cnpd.lu), or with the supervisory authority of your place of residence.

11. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy notice.

12. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We update this privacy notice from time to time. The updated version will be indicated by an updated "Revised" date and the updated version will be effective as soon as it is accessible.

If we make material changes to this privacy notice, we notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy notice frequently to be informed of how we are protecting your information.

13. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

For COMO Digital Life S.à r.l.: 1-5, Rue De l'Innovation, L-1896 Kockelscheuer, Luxembourg, privacy@como-dl.com.

For COMO DL S.A.: its data protection officer, dpo@como-dl.com, 1-5, Rue De l'Innovation, L-1896 Kockelscheuer, Luxembourg.

14. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country, you have the right to request access to the personal information we collect from you, change that information, or delete it in some circumstances. To request to review, update, or delete your personal information, please submit a request to the contact point of the relevant controller stated in Section 13. We will respond to your request within one month, in accordance with Article 12(3) of the GDPR.