GDPR & International Privacy Rights

01Purpose and Scope

This GDPR & International Privacy Rights Policy (“Policy”) supplements the Famepify Privacy Policy and explains the additional privacy rights, protections and legal requirements that may apply where Famepify processes personal data subject to the European Union General Data Protection Regulation (“EU GDPR”), the United Kingdom General Data Protection Regulation (“UK GDPR”) or another applicable international data-protection framework.

Famepify is operated under Famepify Media, a Nigerian business.

The principal privacy framework governing Famepify’s Nigerian operations is the Nigeria Data Protection Act 2023 (“NDP Act”), together with applicable regulations, directives and guidance issued by the Nigeria Data Protection Commission (“NDPC”).

The fact that Famepify is established in Nigeria does not necessarily prevent another jurisdiction’s privacy law from applying to particular processing.

Certain international privacy laws apply beyond the country in which the relevant organisation is established where statutory territorial-scope requirements are satisfied.

This Policy does not represent that the EU GDPR, UK GDPR or every other international privacy law applies to every Famepify User or every processing activity.

Applicability shall be determined by reference to:

• the relevant jurisdiction;
• the location of the Data Subject at the relevant time;
• whether Famepify targets persons in that jurisdiction;
• whether goods or services are offered to persons in that jurisdiction;
• whether behaviour is monitored in that jurisdiction;
• the nature of the processing;
• applicable statutory thresholds;
• the establishment of the controller or processor; and
• any other jurisdiction-specific territorial requirement.

Where an international privacy law applies, Famepify shall provide the rights and protections required by that law to the extent applicable to the relevant processing.

This Policy shall be read together with the Privacy Policy, Data Rights & Privacy Requests Policy, Cookie Policy and other policies published through the Famepify Legal Centre.

02Data Controller

Famepify and Famepify Media

Famepify is operated under Famepify Media.

Where Famepify Media determines the purposes and means of processing personal data through Famepify, it acts as the relevant data controller.

Applicable controller contact information is:

Where another organisation independently determines the purposes and means of particular processing, that organisation may act as a separate controller.

Where Famepify processes personal data solely on documented instructions from another controller, Famepify may act as a processor in relation to that specific processing.

The legal role applicable to any processing activity shall be determined by the actual relationship and processing activity rather than by terminology alone.

03Relationship With Nigerian Privacy Law

The NDP Act Remains Applicable to Nigerian Operations

This Policy does not replace Famepify’s obligations under Nigerian data-protection law.

Where both Nigerian law and an applicable international privacy law govern the same processing, Famepify shall seek to comply with each applicable regime.

Where different laws impose different standards, the applicable requirements shall be assessed according to:

• territorial scope;
• subject matter;
• legal role;
• processing activity;
• mandatory statutory requirements; and
• the rights of the affected Data Subject.

An international privacy regime shall not be treated as displacing the NDP Act merely because an international Data Subject is involved.

04When the EU GDPR May Apply

EU and EEA Territorial Scope

The EU GDPR applies throughout the European Economic Area (“EEA”), which includes the Member States of the European Union together with Iceland, Liechtenstein and Norway.

The EU GDPR may apply to organisations established outside the EEA in circumstances specified by Article 3 of the GDPR.

Where Famepify has no relevant establishment in the EEA, the EU GDPR may nevertheless apply to processing relating to:

• the offering of goods or services to Data Subjects who are in the European Union or EEA; or
• the monitoring of the behaviour of Data Subjects where that behaviour takes place within the European Union or EEA.

The processing concerned must relate to the qualifying targeting or monitoring activity.

Offering Goods or Services to People in the EEA

The availability of a website on the internet does not, by itself, necessarily establish that an organisation intends to offer goods or services to Data Subjects in every country from which the website can technically be accessed.

Whether Famepify offers Services to Data Subjects in an EEA jurisdiction shall be determined from the circumstances.

Relevant indicators may include:

• expressly marketing Services to persons in an EEA country;
• accepting or specifically supporting transactions from that jurisdiction;
• referring expressly to customers or markets within the EEA;
• using advertising directed toward persons in the EEA;
• providing jurisdiction-specific commercial functionality;
• deliberately serving Users in EEA markets; or
• other conduct demonstrating an intention to offer Services to Data Subjects in the EEA.

No single factor shall necessarily determine territorial scope.

Monitoring Behaviour in the EEA

The EU GDPR may also apply where Famepify monitors the behaviour of Data Subjects in the EEA.

Monitoring may include certain forms of systematic online tracking or profiling where individuals are tracked for purposes such as:

• behavioural analysis;
• prediction of preferences;
• targeted advertising;
• profiling;
• systematic observation;
• location tracking; or
• comparable monitoring activity.

Ordinary technical processing shall not automatically constitute behavioural monitoring merely because a website generates server logs or performs essential security functions.

The nature, purpose and systematic character of the processing shall be considered.

Mere Website Accessibility

The mere fact that an individual in an EEA country can open a Famepify webpage shall not, by itself, establish that every Famepify processing activity is subject to the EU GDPR.

Territorial scope shall be determined according to the statutory criteria and the actual processing concerned.

Citizenship Is Not the Sole Test

GDPR territorial scope does not depend solely upon whether an individual holds citizenship of an EU Member State.

A Nigerian citizen who is in an EU Member State may fall within the territorial provisions applicable to a qualifying processing activity.

Conversely, the mere fact that an EU citizen is outside the EEA does not automatically mean every processing activity involving that person falls within Article 3(2).

The circumstances of the Data Subject and processing activity shall determine applicability.

05EU Representative

Article 27 Representation

Where Article 3(2) of the EU GDPR applies to Famepify and Article 27 requires appointment of a representative, Famepify shall designate an appropriate representative in the European Union in writing.

The representative shall be established in a Member State in which relevant Data Subjects are located.

Where appointed, the representative may be authorised to receive communications concerning applicable GDPR matters from:

• Data Subjects;
• supervisory authorities; and
• other competent bodies.

The appointment of a representative shall not remove Famepify’s own responsibilities under applicable data-protection law.

Article 27 Exceptions

An EU representative may not be required where the applicable statutory exception is satisfied.

The exception may apply where the processing:

• is only occasional;
• does not include large-scale processing of special categories of personal data;
• does not include large-scale processing of personal data relating to criminal convictions and offences; and
• is unlikely to result in a risk to the rights and freedoms of natural persons, having regard to the nature, context, scope and purposes of processing.

The exception shall not be presumed merely because Famepify is a non-EU business.

Where Article 27 requires appointment of a representative, the required appointment shall be made and applicable contact details shall be published.

06When the UK GDPR May Apply

United Kingdom Territorial Scope

The UK GDPR is a separate legal regime from the EU GDPR.

It may apply to processing by an organisation established outside the United Kingdom where the relevant processing relates to:

• offering goods or services to individuals in the United Kingdom; or
• monitoring the behaviour of individuals in the United Kingdom.

The mere technical accessibility of Famepify within the United Kingdom shall not necessarily establish UK GDPR applicability.

The targeting and processing circumstances shall be considered.

UK Representative

Where Famepify is subject to the extra-territorial provisions of the UK GDPR and applicable law requires a United Kingdom representative, Famepify shall designate such representative in accordance with the applicable legal requirements.

An applicable statutory exception may apply where the relevant processing is occasional, low risk and does not involve qualifying large-scale special-category or criminal-offence data.

Where a representative is appointed, relevant contact information shall be made available as required.

07Other International Privacy Laws

Jurisdiction-Specific Application

Privacy and data-protection legislation exists in numerous jurisdictions outside Nigeria, the EEA and the United Kingdom.

Famepify does not represent that every privacy law in every country automatically applies merely because the Platform can be accessed from that country.

Where another privacy law applies to Famepify, applicable rights shall be determined according to that law’s:

• territorial scope;
• business thresholds;
• processing thresholds;
• exemptions;
• definitions;
• consumer or Data Subject eligibility requirements; and
• other statutory criteria.

No Voluntary Adoption of Every Foreign Law

Nothing in this Policy shall be construed as a contractual undertaking by Famepify to subject all processing worldwide to every privacy law described or referred to in this Policy.

Where an international law does not legally apply to the relevant processing, Famepify may nevertheless elect to provide a comparable privacy control as a matter of policy or operational convenience.

Such voluntary accommodation shall not, by itself, constitute an admission that the foreign law applies.

08Data-Protection Principles

GDPR Processing Principles

Where the EU GDPR or UK GDPR applies, personal data shall be processed consistently with applicable data-protection principles.

These include:

• lawfulness, fairness and transparency;
• purpose limitation;
• data minimisation;
• accuracy;
• storage limitation;
• integrity and confidentiality; and
• accountability.

Famepify shall be responsible for demonstrating compliance where the applicable law places that accountability obligation upon it.

Purpose Limitation

Personal data collected for a specified purpose shall not be used for a materially incompatible new purpose without an appropriate lawful basis and any additional transparency or consent required by law.

Data Minimisation

Only personal data that is adequate, relevant and reasonably necessary for the applicable processing purpose should be collected or otherwise processed.

Accuracy

Reasonable steps shall be taken to ensure that personal data requiring accuracy is kept accurate and corrected or removed where materially inaccurate.

Storage Limitation

Personal data shall not be retained in identifiable form longer than reasonably necessary for the applicable lawful purpose, subject to lawful retention requirements.

Security and Confidentiality

Personal data shall be protected using appropriate technical and organisational measures having regard to relevant processing risks.

09Categories of Personal Data

Personal Data Processed by Famepify

The categories of personal data processed by Famepify are described principally in the Privacy Policy.

Depending upon the interaction concerned, personal data may include categories such as:

• Account and registration information;
• contact information;
• Order information;
• social media usernames and destination links;
• Wallet and transaction information;
• Payment Provider information;
• support correspondence;
• complaint and refund records;
• API and reseller information;
• technical and device information;
• Cookie and consent information;
• marketing preferences;
• security information; and
• other information voluntarily provided or lawfully obtained.

The presence of a category in this Policy does not mean that every category is collected from every Data Subject.

10Sources of Personal Data

Data Collected Directly

Personal data may be obtained directly from a Data Subject when the person:

• creates an Account;
• places an Order;
• makes a Payment;
• contacts Famepify;
• submits a support request;
• submits a refund request;
• submits a privacy request;
• subscribes to marketing;
• uses Platform functionality; or
• otherwise provides information directly.

Data Obtained From Other Sources

Personal data may also be obtained from lawful external sources.

Such sources may include:

• Payment Providers;
• banks and financial institutions;
• service suppliers;
• security providers;
• referral systems;
• authorised representatives;
• publicly available social media pages;
• business partners; or
• competent public authorities.

Where Articles 14 or comparable transparency requirements apply to indirectly obtained data, the required information shall be provided subject to lawful exceptions.

11Lawful Bases for Processing

Lawfulness Requirement

Where the EU GDPR or UK GDPR applies, personal data shall be processed only where an applicable lawful basis exists.

Depending upon the processing concerned, a lawful basis may include:

• consent;
• performance of a contract;
• steps taken at the request of a Data Subject before entering into a contract;
• compliance with a legal obligation;
• protection of vital interests;
• performance of a qualifying public-interest task where applicable; or
• legitimate interests, subject to the required balancing assessment.

No lawful basis shall be selected merely for convenience where its legal conditions are not satisfied.

Contractual Processing

Processing may be necessary for performance of a contract where the personal data is objectively necessary to provide a Service requested by the Data Subject.

Such processing may include information necessary to:

• create or administer an Account;
• process an Order;
• maintain a Wallet;
• verify a Payment;
• deliver a purchased Service; or
• provide contractually requested support.

Contractual necessity shall not be interpreted as permission to process unrelated information merely because a User has accepted the Terms of Service.

Legal Obligations

Personal data may be processed where necessary to comply with a legal obligation applicable to Famepify.

Depending upon the circumstances, such obligations may concern:

• accounting;
• taxation;
• fraud prevention;
• regulatory compliance;
• court orders;
• lawful government requests; or
• another applicable statutory obligation.

Legitimate Interests

Where legitimate interests are relied upon, Famepify shall identify the legitimate interest concerned and assess whether the Data Subject’s interests, fundamental rights and freedoms override that interest.

Legitimate interests may, where appropriate, include:

• Platform security;
• fraud prevention;
• network protection;
• improvement of Services;
• administration of customer relationships;
• defence of legal claims; and
• other reasonable business interests compatible with the rights of Data Subjects.

Consent

Where consent is the applicable lawful basis, consent shall satisfy the legal standard required by the applicable privacy law.

Under the GDPR, valid consent must be freely given, specific, informed and unambiguous and must be indicated through an affirmative act.

Consent shall not be inferred merely from:

• silence;
• inactivity;
• pre-selected acceptance;
• general acceptance of unrelated contractual terms; or
• another mechanism that does not establish a genuine choice.

Where explicit consent is required, the higher applicable standard shall be used.

12Withdrawal of Consent

Right to Withdraw

Where processing relies on consent, the Data Subject may withdraw that consent at any time.

Withdrawal shall be as accessible as reasonably required by applicable law.

Withdrawal shall not affect the lawfulness of processing carried out before the withdrawal became effective.

Continued Processing Under Another Lawful Basis

Withdrawal of consent does not necessarily require Famepify to erase or cease every processing activity involving the relevant information.

Processing may continue where another lawful basis independently applies.

For example, withdrawal of marketing consent shall not require deletion of transaction records that must lawfully be retained for tax, accounting, fraud-prevention or legal purposes.

13Special Categories of Personal Data

Enhanced Protection

The EU GDPR and UK GDPR provide enhanced protection for certain categories of sensitive personal data.

Depending upon applicable law, such categories may include data revealing or concerning:

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade union membership;
• genetic data;
• biometric data used for unique identification;
• health;
• sex life; or
• sexual orientation.

Famepify does not ordinarily require these categories of personal data for normal social media growth Orders.

Lawful Processing of Special Category Data

Where special-category data is processed, both an Article 6 lawful basis and an applicable Article 9 condition or equivalent legal authorisation shall be identified where required.

The mere existence of an ordinary contractual relationship shall not automatically authorise special-category processing.

14Criminal Conviction and Offence Data

Special Legal Treatment

Where information concerning criminal convictions or offences is processed under a GDPR regime, such processing shall be undertaken only where the applicable legal conditions and safeguards are satisfied.

Famepify shall not treat ordinary suspicion of fraud as permission to create or process unnecessary criminal-record information.

15Privacy Information and Transparency

Information Provided at Collection

Where personal data is collected directly and Article 13 or an equivalent transparency provision applies, the Data Subject shall receive applicable information concerning matters such as:

• the identity and contact details of the controller;
• representative details where applicable;
• Data Protection Officer contact details where applicable;
• processing purposes;
• lawful bases;
• legitimate interests where relied upon;
• recipients or categories of recipients;
• international transfers;
• retention periods or criteria;
• applicable rights;
• consent withdrawal;
• complaint rights;
• contractual or statutory requirements to provide data; and
• applicable automated decision-making.

The Privacy Policy provides the principal Famepify privacy notice.

Information Where Data Is Obtained Indirectly

Where personal data has not been obtained directly from the Data Subject, additional transparency requirements may apply.

Subject to applicable exceptions, the required information may include:

• categories of personal data;
• source of the personal data; and
• whether the source was publicly accessible.

Applicable information shall be provided within the statutory period required by the relevant law.

16Right of Access

Access to Personal Data

Where the GDPR applies, a Data Subject may request confirmation as to whether personal data concerning that person is being processed.

Where processing occurs, the Data Subject may have the right to:

• access the personal data;
• receive a copy of qualifying personal data; and
• obtain supplementary information concerning the processing.

The supplementary information may include:

• purposes of processing;
• categories of personal data;
• recipients or categories of recipients;
• applicable retention;
• rights of rectification, erasure, restriction and objection;
• complaint rights;
• available information concerning data sources; and
• information concerning qualifying automated decision-making.

Access shall remain subject to applicable rights of others, legal privilege, confidentiality, security and other lawful limitations.

17Right to Rectification

Correction of Inaccurate Data

A Data Subject may request correction of inaccurate personal data and completion of incomplete personal data where the applicable law provides that right.

Famepify may request proportionate supporting information where reasonably necessary to determine the accurate record.

18Right to Erasure

Right to Be Forgotten

Where the applicable GDPR conditions are satisfied, a Data Subject may request erasure of personal data.

Erasure may be required where, among other circumstances:

• the personal data is no longer necessary for the original purpose;
• consent has been withdrawn and no other lawful basis remains;
• a valid objection applies and there is no overriding ground for continuation;
• the personal data has been unlawfully processed; or
• erasure is required by applicable law.

Exceptions to Erasure

The right to erasure is not absolute.

Personal data may continue to be retained where processing remains necessary for an applicable lawful purpose, including:

• compliance with a legal obligation;
• exercise or defence of legal claims;
• freedom of expression and information where applicable;
• qualifying public-interest purposes; or
• another lawful exception.

Famepify may therefore retain transaction, Payment, security, dispute, fraud-prevention, tax or accounting records where a lawful retention basis exists.

19Right to Restriction

Restriction of Processing

A Data Subject may request restriction of processing in circumstances recognised by the applicable GDPR regime.

Restriction may apply, for example, where:

• accuracy is contested while verification is undertaken;
• processing is unlawful but deletion is opposed;
• Famepify no longer requires the data but the Data Subject requires it for legal claims; or
• an objection is being considered.

During restriction, ordinary processing may be limited while storage continues.

20Right to Data Portability

Portable Personal Data

Where the statutory conditions are satisfied, a Data Subject may receive personal data provided to Famepify in a structured, commonly used and machine-readable format.

The right generally applies where:

• processing is based upon consent or contract; and
• processing is carried out by automated means.

Direct Transmission

Where technically feasible and legally required, the Data Subject may request transmission of qualifying personal data directly to another controller.

Portability shall not require Famepify to create incompatible systems, disclose another person’s personal data or disclose information outside the legal scope of the portability right.

21Right to Object

Objection Based on Particular Circumstances

Where processing is based on legitimate interests or another lawful basis to which the statutory objection right applies, a Data Subject may object on grounds relating to that person’s particular situation.

Famepify shall cease the relevant processing unless an applicable lawful ground permits continuation.

Direct Marketing

A Data Subject has the right to object at any time to processing of personal data for direct marketing.

Where such an objection is made, personal data shall no longer be used for the relevant direct-marketing purpose.

This applies to related profiling to the extent the profiling concerns that direct marketing.

Famepify may retain limited suppression information necessary to ensure that the objection remains effective.

22Rights Concerning Automated Decision-Making

Solely Automated Significant Decisions

Where Article 22 or a comparable provision applies, a Data Subject has protections against certain decisions based solely on automated processing, including profiling, where the decision produces legal effects or similarly significant effects.

Routine automation shall not automatically fall within this restriction.

Examples of routine automated processes may include:

• Order routing;
• status updates;
• technical monitoring;
• routine security controls;
• transaction reconciliation; and
• service automation.

The applicable analysis shall depend upon whether the decision is solely automated and whether it produces the required level of effect.

Permitted Exceptions

A qualifying automated decision may be permitted where the applicable law allows it, including where the decision is:

• necessary for entering into or performing a contract;
• authorised by applicable law containing appropriate safeguards; or
• based on explicit consent.

Safeguards

Where required, Famepify shall implement safeguards such as:

• the right to obtain human intervention;
• the right to express a point of view; and
• the right to contest the decision.

Special-category personal data shall not be used for qualifying automated decisions except where the stricter applicable requirements are satisfied.

23Right to Complain to a Supervisory Authority

EU Supervisory Authorities

Where the EU GDPR applies, a Data Subject may have the right to lodge a complaint with an applicable data-protection supervisory authority.

Depending upon the circumstances, this may include the supervisory authority associated with:

• the Data Subject’s habitual residence;
• place of work; or
• place of the alleged infringement.

Use of the Famepify internal privacy procedure shall not constitute a waiver of a statutory right to lodge a regulatory complaint.

United Kingdom Information Commissioner’s Office

Where the UK GDPR applies, a Data Subject may have the right to complain to the United Kingdom Information Commissioner’s Office (“ICO”).

Famepify may encourage the Data Subject to permit internal investigation first, but use of an internal complaint procedure shall not remove applicable regulatory rights.

Nigeria Data Protection Commission

Where Nigerian law applies, rights to complain to the NDPC remain unaffected by this Policy.

The applicability of GDPR rights shall not displace rights independently available under the NDP Act.

24Right to Judicial Remedy

Court and Tribunal Rights

Where applicable law provides a right to seek judicial or other legal redress for an alleged data-protection violation, nothing in this Policy shall operate as a waiver of that right.

Internal complaints, Data Rights Requests and regulatory complaints shall not exclude judicial remedies that cannot lawfully be restricted.

25Submitting an International Privacy Request

Request Channels

Requests under the EU GDPR, UK GDPR or another applicable privacy regime may be submitted through the Famepify Data Rights process or by email.

Failure to use the suggested subject line shall not invalidate an otherwise clear privacy request.

Information Required

The request should contain sufficient information to identify the Data Subject, determine the applicable right and locate responsive data.

Relevant information may include:

• full name;
• registered Famepify email address;
• Account identifier;
• country or jurisdiction relevant to the request;
• right being exercised;
• description of the requested personal data or processing;
• relevant Order, Payment, ticket or transaction reference;
• representative authority where applicable; and
• other information reasonably necessary to process the request.

No Data Subject shall be required to provide information unrelated to reasonable identification or processing of the request.

26Identity Verification

Reasonable Verification

Famepify may request additional information where reasonable doubt exists concerning the identity of a requester.

Verification shall be proportionate to:

• the sensitivity of the information;
• risk of unauthorised disclosure;
• available Account authentication;
• information already held; and
• the consequences of acting upon an unauthorised request.

No Routine Over-Collection

Government-issued identification shall not be required automatically where identity can adequately be confirmed through less intrusive means.

Famepify shall not request:

• banking PINs;
• card PINs;
• OTPs;
• online-banking passwords;
• cryptocurrency private keys;
• seed phrases; or
• unrelated authentication secrets

for the purpose of verifying a privacy request.

27GDPR Request Response Period

One-Month Response Period

Where the EU GDPR applies, Famepify shall respond to applicable Data Subject rights requests without undue delay and ordinarily within one month of receipt of the valid request.

A comparable one-month standard generally applies under the UK GDPR.

The exact calculation of the applicable period shall be determined according to the governing law.

Extension for Complex or Multiple Requests

Where the GDPR permits an extension because a request is complex or because numerous requests have been received from the same individual, the applicable response period may be extended by up to an additional two months.

Where an extension is relied upon, Famepify shall notify the Data Subject within the initial one-month period and provide the reason for the delay where required.

Identity Verification and Timing

Where additional information is reasonably required to confirm identity, the timing of the request shall be administered in accordance with the applicable law.

Verification shall not be used merely to delay an otherwise valid request.

28Fees for Privacy Requests

Ordinary Requests Are Generally Free

Qualifying GDPR rights requests shall ordinarily be processed without charge.

Manifestly Unfounded or Excessive Requests

Where permitted by the applicable GDPR regime, Famepify may charge a reasonable fee reflecting administrative costs or refuse to act on a request that is manifestly unfounded or excessive.

Relevant circumstances may include the repetitive character of the request.

The burden of demonstrating that a request is manifestly unfounded or excessive shall rest with Famepify where the applicable law so provides.

A request shall not be classified as excessive merely because compliance requires reasonable administrative work.

29Refusal of a GDPR Request

Notice of Refusal

Where Famepify does not act on a GDPR rights request, the Data Subject shall be informed of the applicable reasons where required.

The response shall also identify applicable rights to:

• lodge a complaint with a supervisory authority; and
• seek a judicial remedy.

A refusal shall be based upon a recognised legal reason rather than business inconvenience.

30Representatives Acting for Data Subjects

Authorised Agents

A Data Subject may act through an authorised representative where permitted by applicable law.

Famepify may require reasonable evidence confirming:

• the Data Subject’s identity;
• the representative’s identity;
• authority to act; and
• scope of the representative’s mandate.

Direct verification with the Data Subject may be undertaken where reasonably necessary to prevent fraud or unauthorised disclosure.

31Data Concerning Children

Enhanced Protection of Children

Children receive enhanced protection under GDPR principles.

Where consent is relied upon in relation to the direct offering of an information-society service to a child, the applicable age threshold shall be determined under the law governing the relevant Data Subject.

Under EU GDPR rules, Member States may set the applicable parental-consent threshold between 13 and 16 years.

Famepify’s general contractual eligibility requirements are separately governed by the Terms of Service.

No Assumption That Children Are Targeted

Nothing in this section shall be interpreted as representing that Famepify intentionally directs its Services toward children.

Where child-related processing nevertheless occurs, the applicable legal safeguards shall be observed.

Child-Focused Transparency

Where information is specifically directed to a child and applicable law requires child-appropriate transparency, the information shall be presented in language suitable to the intended audience.

32Cookies, Tracking and ePrivacy

GDPR and Cookie Processing

Where Cookie or Tracking Technology data constitutes personal data and the GDPR applies, the resulting personal-data processing shall comply with the GDPR in addition to any separate electronic-communications or Cookie-consent rules.

The Cookie Policy governs Famepify’s Cookie framework in greater detail.

Consent for Non-Essential Tracking

Where valid consent is required for Non-Essential Cookies, analytics, marketing or comparable tracking, such technologies shall not be activated before the required consent is obtained.

A User’s acceptance of the Terms of Service shall not, by itself, constitute GDPR-compliant consent to unrelated tracking.

Withdrawal of Cookie Consent

Where optional Cookie processing is based upon consent, applicable consent may be withdrawn through the available Cookie Preference Centre or comparable control.

Withdrawal shall operate prospectively.

33Direct Marketing

Email and Other Marketing

Processing personal data for direct marketing may be subject to the GDPR and additional electronic-communications legislation.

Where applicable, Famepify shall obtain any consent required for the relevant marketing channel.

The use of legitimate interests under data-protection law does not eliminate a separate requirement for consent that may apply under electronic-communications legislation.

Absolute Marketing Objection

Where Article 21 GDPR or an equivalent provision applies, an objection to direct marketing shall be honoured for the affected marketing processing.

A limited suppression record may be retained to prevent accidental re-enrolment.

34Data Protection by Design and by Default

Privacy in System Design

Where Article 25 or an equivalent obligation applies, Famepify shall implement appropriate technical and organisational measures designed to integrate data-protection principles into relevant processing.

Measures may include, where appropriate:

• data minimisation;
• restricted access;
• privacy-sensitive defaults;
• retention controls;
• pseudonymisation;
• security controls; and
• limitation of unnecessary data exposure.

Default Processing

By default, personal data should not be made available to an indefinite number of persons or processed more extensively than is necessary for the relevant purpose where Article 25 applies.

35Data Protection Impact Assessments

High-Risk Processing

Where processing is likely to result in a high risk to the rights and freedoms of natural persons and Article 35 or equivalent requirements apply, Famepify shall assess whether a Data Protection Impact Assessment (“DPIA”) is required.

Relevant processing may include, depending upon scope and circumstances:

• systematic and extensive profiling;
• certain large-scale special-category processing;
• large-scale systematic monitoring of publicly accessible areas; or
• other processing designated as high risk by an applicable supervisory authority.

DPIA Content

Where required, an appropriate DPIA may address:

• the contemplated processing;
• purposes of processing;
• necessity and proportionality;
• risks to Data Subjects; and
• safeguards intended to address those risks.

36Data Protection Officer

Appointment Where Required

Where Article 37 GDPR, the UK GDPR or another applicable law requires designation of a Data Protection Officer (“DPO”), Famepify shall make the required designation.

GDPR circumstances requiring a DPO may include where core activities consist of:

• regular and systematic monitoring of Data Subjects on a large scale; or
• large-scale processing of special categories of personal data or criminal-offence data.

The applicability of those criteria shall be assessed according to Famepify’s actual processing.

DPO Contact Details

Where a DPO is formally designated under an applicable regime, Famepify shall publish the appropriate DPO contact details and make required regulatory notifications.

The absence of separately published DPO details in this Policy shall not be interpreted as identification of an unnamed employee or officer as a statutory DPO.

37Processors and Service Providers

Use of Processors

Where Famepify appoints a processor in relation to processing governed by the GDPR, the processor shall be selected on the basis of sufficient guarantees to implement appropriate technical and organisational measures.

Processor Agreements

Where Article 28 applies, processor relationships shall be governed by an appropriate written contract or other binding legal act.

Such arrangements shall address applicable requirements including:

• processing instructions;
• confidentiality;
• security;
• subprocessors;
• Data Subject rights assistance;
• breach assistance;
• deletion or return of data;
• compliance information; and
• audit rights where required.

Subprocessors

Where a processor engages another processor and GDPR requirements apply, appropriate authorisation and contractual protections shall be maintained.

Subprocessor involvement shall not remove the original processor’s applicable obligations.

38Joint Controllers

Joint Determination of Processing

Where Famepify and another organisation jointly determine the purposes and means of particular processing, the parties may constitute joint controllers.

Where Article 26 applies, the respective responsibilities shall be allocated through an appropriate arrangement.

The essence of the arrangement shall be made available to Data Subjects where required.

A joint-controller arrangement shall not remove the Data Subject’s right to exercise applicable rights against a controller where the GDPR permits such exercise.

39Security of Processing

Appropriate Security Measures

Where Article 32 or an equivalent requirement applies, Famepify shall implement technical and organisational measures appropriate to the risk.

Relevant measures may include, as appropriate:

• encryption;
• pseudonymisation;
• access controls;
• authentication;
• availability protections;
• backup controls;
• incident response;
• vulnerability management;
• logging;
• recovery capabilities;
• periodic security review; and
• personnel controls.

No provision of this Policy constitutes a representation that any technical system can be made completely immune from security incidents.

40Personal Data Breaches

Breach Assessment

Where a personal data breach occurs, Famepify shall assess:

• the nature of the breach;
• categories and approximate number of Data Subjects affected;
• categories and approximate amount of data involved;
• likely consequences;
• risk to Data Subjects; and
• measures taken or proposed to address the incident.

EU Supervisory Authority Notification

Where Article 33 GDPR applies and a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, Famepify shall notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach.

Where notification occurs after the applicable period, reasons for the delay shall be provided where required.

A breach that is unlikely to result in the relevant risk may fall within the applicable notification exception.

Notification to Affected Data Subjects

Where Article 34 applies and a breach is likely to result in a high risk to the rights and freedoms of natural persons, affected Data Subjects shall be notified without undue delay unless an applicable exception applies.

The communication shall use clear and plain language and provide legally required information concerning the incident.

UK Breach Requirements

Where the UK GDPR applies, applicable breach-notification obligations to the ICO and affected individuals shall be handled according to UK law.

Nigerian Breach Obligations

Applicable Nigerian breach-notification requirements shall continue to apply independently where the NDP Act governs the processing.

41International Data Transfers

Transfers Outside the EEA

Where personal data subject to the EU GDPR is transferred from the EEA to a recipient in a third country or international organisation, the transfer shall comply with Chapter V of the GDPR.

The purpose of the transfer rules is to ensure that GDPR protection is not undermined merely because personal data leaves the EEA.

Adequacy Decisions

Where the European Commission has adopted an applicable adequacy decision under Article 45 GDPR, personal data may be transferred within the scope of that decision without an additional Article 46 transfer safeguard.

Adequacy status may be limited by:

• jurisdiction;
• sector;
• recipient category;
• certification status; or
• another condition contained in the relevant decision.

Applicable adequacy status shall therefore be checked at the time of transfer.

Transfers to Nigeria

As of the Last Updated date of this Policy, Nigeria is not listed among the jurisdictions for which the European Commission has adopted an Article 45 adequacy decision.

Accordingly, where an EEA-to-Nigeria transfer falls within Chapter V of the GDPR and no other applicable arrangement alters the analysis, an appropriate transfer mechanism shall be required unless a lawful derogation applies.

Standard Contractual Clauses

Where appropriate, Famepify may rely upon Standard Contractual Clauses (“SCCs”) adopted by the European Commission as an Article 46 safeguard.

Applicable SCCs shall be selected according to the relationship between the parties, including where the transfer is:

• controller to controller;
• controller to processor;
• processor to processor; or
• processor to controller.

The use of SCCs shall not eliminate any obligation to assess whether the protections contained in the clauses can operate effectively in the circumstances of the transfer.

Supplementary Measures and Transfer Assessments

Where required, Famepify or the relevant transfer party shall assess the laws and practices applicable to the transfer and determine whether supplementary safeguards are necessary.

Depending upon the circumstances, supplementary measures may include:

• contractual safeguards;
• encryption;
• pseudonymisation;
• access restrictions;
• technical separation;
• organisational controls; or
• other measures appropriate to the identified risk.

Other EU Transfer Mechanisms

Where legally applicable, other international-transfer mechanisms may include:

• Binding Corporate Rules;
• approved codes of conduct;
• approved certification mechanisms;
• legally binding instruments between public authorities; or
• another safeguard recognised under Article 46.

Famepify shall not claim reliance upon a mechanism that has not actually been implemented for the relevant transfer.

42Article 49 Derogations

In limited circumstances, a transfer may be permitted under an applicable Article 49 derogation.

Such derogations shall be interpreted according to their legal conditions and shall not ordinarily be used as a substitute for appropriate safeguards where transfers are regular, systematic and capable of being covered by an Article 46 mechanism.

43UK International Transfers

Restricted Transfers

Where Famepify makes or participates in a transfer governed by the UK GDPR’s international-transfer rules, the transfer shall be assessed according to the UK regime.

A restricted transfer may require:

• UK adequacy regulations;
• an appropriate safeguard; or
• an applicable statutory exception.

UK Transfer Safeguards

Where appropriate, UK transfer safeguards may include mechanisms recognised under UK law, including applicable versions of:

• the UK International Data Transfer Agreement;
• the UK Addendum to qualifying EU Standard Contractual Clauses;
• Binding Corporate Rules; or
• another legally recognised safeguard.

Where a transfer-risk or data-protection assessment is required, the applicable assessment shall be undertaken.

44Onward Transfers

Further Transfers to Other Recipients

Where personal data received under an international-transfer safeguard is subsequently transferred to another recipient, the onward transfer shall remain subject to applicable transfer and data-protection obligations.

An initial lawful transfer shall not automatically authorise unrestricted further disclosure.

45International Hosting and Cloud Services

Remote Access May Constitute a Transfer

International data transfers may occur not only when files are physically moved from one country to another but also where personal data is made accessible to a legally separate recipient in another jurisdiction in circumstances constituting a regulated transfer.

Use of:

• cloud hosting;
• remote support;
• database administration;
• communications infrastructure;
• external service providers; or
• other international systems

shall therefore be assessed according to the applicable transfer rules.

46Storage Location

No Guarantee of Exclusive Nigerian Storage

Famepify shall not represent that personal data is stored exclusively in Nigeria unless the actual infrastructure supports that representation.

Hosting, backup, communications, Payment Provider or supplier infrastructure may involve processing in multiple jurisdictions.

Applicable international transfers shall be subject to the safeguards required by the relevant law.

47Data Retention

International Retention Requirements

Where GDPR requirements apply, personal data shall be retained only for so long as reasonably necessary for the lawful purposes for which it is processed, subject to applicable legal retention requirements.

Retention considerations may include:

• active Account status;
• Order fulfilment;
• payment reconciliation;
• tax and accounting obligations;
• fraud prevention;
• security;
• complaint handling;
• chargeback periods;
• limitation periods;
• legal claims;
• regulatory obligations; and
• privacy-request records.

Specific retention periods may vary according to the category of data and purpose.

48Anonymized Information

True Anonymization

Information that has been irreversibly anonymized so that no individual is identified or identifiable by reasonably available means may cease to constitute personal data for GDPR purposes.

Removing a name alone does not necessarily anonymize information.

Where information remains capable of being linked to an individual, it shall continue to be treated according to its actual legal status.

49Pseudonymized Information

Pseudonymization Is Not Anonymization

Pseudonymized data remains personal data where the information can be attributed to a Data Subject through additional information.

Pseudonymization may constitute a useful safeguard but shall not be treated as eliminating GDPR obligations where the data remains identifiable.

50Profiling

Meaning of Profiling

Profiling generally involves automated processing of personal data to evaluate certain personal aspects of an individual.

Depending upon the processing, this may concern matters such as:

• behaviour;
• preferences;
• interests;
• reliability;
• location; or
• movements.

Not every automated classification or technical process constitutes profiling.

Where profiling is undertaken and the GDPR applies, transparency, lawful-basis and applicable objection or automated-decision rights shall be observed.

51Legitimate Interest Assessments

Balancing Requirement

Where Famepify relies upon legitimate interests for processing governed by the GDPR, the assessment shall consider:

• the legitimate interest pursued;
• necessity of the processing;
• reasonable expectations of the Data Subject;
• nature of the personal data;
• effect upon the Data Subject;
• vulnerability of affected persons;
• available safeguards; and
• whether the Data Subject’s rights override the interest.

Where the balance favours the Data Subject, another lawful basis shall be required or the processing shall not proceed.

52Records of Processing

Accountability Records

Where Article 30 or an equivalent provision requires records of processing activities, Famepify shall maintain appropriate records concerning applicable processing.

Depending upon the legal role and circumstances, such records may include:

• processing purposes;
• categories of Data Subjects;
• categories of personal data;
• recipients;
• international transfers;
• retention information; and
• security measures.

Any statutory exemption applicable to smaller organisations shall be assessed according to the conditions of the law rather than assumed solely from business size.

53Regulatory Cooperation

Supervisory Authorities

Where the EU GDPR, UK GDPR or another applicable privacy regime requires cooperation with a competent supervisory authority, Famepify shall respond to lawful regulatory requirements in accordance with the applicable law.

Nothing in this Policy shall require disclosure of information beyond what the authority is lawfully entitled to obtain.

54Data Protection Representatives and Regulatory Contacts

Publication of Required Contacts

Where applicable law requires publication of an EU representative, UK representative, DPO or comparable privacy contact, the appropriate details shall be made available through the Privacy Policy, this Policy or another appropriate legal notice.

No person shall be deemed to hold one of those statutory roles solely because the person’s general contact details appear on the Famepify website.

55Conflicts Between Privacy Regimes

Concurrent Laws

More than one privacy regime may apply to the same processing activity.

Where this occurs, Famepify shall seek to comply with all mandatory applicable requirements.

Where a genuine conflict arises that cannot reasonably be reconciled, the matter shall be assessed according to:

• territorial scope;
• conflict-of-laws principles;
• mandatory statutory requirements;
• applicable regulator guidance;
• contractual safeguards; and
• the circumstances of the processing.

56Relationship With the Data Rights Policy

Operational Request Procedure

This Policy describes international rights and legal protections.

The Data Rights & Privacy Requests Policy establishes the principal Famepify operational procedure for exercising those rights.

A Data Subject does not need to identify the exact statutory article applicable to a request.

Where the substance of a communication clearly constitutes a valid privacy-rights request, Famepify shall assess it according to the applicable law.

57Relationship With the Privacy Policy

Primary Privacy Notice

The Privacy Policy remains the primary Famepify privacy notice.

It describes:

• categories of personal data;
• processing purposes;
• lawful bases;
• sharing;
• international transfers;
• retention;
• security;
• marketing;
• Data Subject rights; and
• privacy contact information.

This Policy supplements that notice where international privacy regimes apply.

58Relationship With the Cookie Policy

Online Tracking

The Cookie Policy governs Famepify’s use of Cookies and equivalent Tracking Technologies.

Where European or United Kingdom electronic-communications and privacy requirements apply, the Cookie Policy shall be interpreted together with those requirements and this Policy.

59Relationship With the Terms of Service

Privacy Rights Are Not Waived by Contract

Acceptance of the Terms of Service shall not waive a privacy right that cannot lawfully be waived.

A contractual term shall not constitute GDPR consent merely because the term appears in a general agreement.

Where consent is required, the applicable consent standard shall be independently satisfied.

60Policy Changes

Changes in International Privacy Law

Famepify may amend this Policy to reflect:

• amendments to privacy legislation;
• regulatory guidance;
• court decisions;
• new adequacy decisions;
• changes to international transfer mechanisms;
• changes to Famepify processing;
• changes to international markets served;
• new representatives or regulatory contacts; or
• other compliance developments.

The Last Updated date shall identify the current published version.

Changes Requiring New Consent

A change to this Policy shall not, by itself, constitute consent to a materially new processing activity where applicable law requires separate consent.

Where fresh consent is required, an appropriate consent process shall be used.

61Mandatory Law and Severability

Mandatory Privacy Protections Prevail

Where a provision of this Policy conflicts with a mandatory requirement of an applicable privacy law, the mandatory legal requirement shall prevail to the extent of that conflict.

Severability

If a provision of this Policy is determined to be unlawful, invalid or unenforceable, the remaining provisions shall continue in force to the extent permitted by law.

The affected provision shall be interpreted or modified only to the minimum extent necessary to preserve its lawful purpose.

62Contact and Privacy Requests

International Privacy Requests

Requests concerning rights under the EU GDPR, UK GDPR or another applicable international privacy law may be submitted through the Famepify privacy-request procedure.

The request should identify the privacy right being exercised and the jurisdiction considered relevant where reasonably known.

Failure to identify the correct legal provision shall not invalidate an otherwise valid request.

General Data Rights Requests

The complete procedure for submitting access, rectification, deletion, objection, portability, restriction and other privacy requests is available through the Data Rights & Privacy Requests Policy.

Legal Centre

The wider Famepify legal framework is available through the Famepify Legal Centre.

Related policies include:

63Preservation of International Privacy Rights

Final Legal Effect

Nothing in this Policy shall be interpreted as:

• requiring a Data Subject to waive an applicable privacy right;
• claiming that GDPR protections apply where the GDPR is legally inapplicable;
• denying GDPR protections where the territorial-scope requirements are satisfied;
• authorising processing without a lawful basis;
• converting general contractual acceptance into privacy consent where separate consent is required;
• preventing withdrawal of consent;
• preventing objection to direct marketing;
• preventing a Data Subject from contacting an applicable supervisory authority;
• removing an applicable right to judicial redress;
• validating an unlawful international transfer;
• permitting circumvention of Data Subject rights through a processor or third party;
• removing protections required by Nigerian data-protection law; or
• excluding another mandatory privacy protection that cannot lawfully be excluded.

The applicable rights of each Data Subject shall be determined by the privacy laws governing the relevant processing activity, together with the actual facts, location, purpose, legal role and circumstances of that processing.