Privacy Notice

This policy describes Socialdatabase's use of your data. Mysocialdatabase.com BV & Socialdatabase, Inc, collectively referred herein as Socialdatabase, we or us.

We are a company that specializes in creating customized audiences, consisting of X users, in order for other companies to send you targeted advertisements on X (FKA Twitter). In order to create such customized audiences, we collect personal data from the X (FKA Twitter) public database in our own secure database, located in The Netherlands. This means that if you have a public X (FKA Twitter) profile, we may collect and process your personal data.

The privacy and protection of the personal data we collect about you are important to us and we process your data in accordance with applicable data protection laws. In this Privacy Notice, we would like to explain to you in more detail which personal data we collect and process from X (FKA Twitter) in connection with our customized audiences advertising services and how we use the personal data we collect.

01. Who we are

Socialdatabase is a company that specializes in creating customized audiences of X users so that other companies can deliver targeted advertisements on X (FKA Twitter). Our secure database is located in The Netherlands.

02. What data do we collect?

We do not collect any personal data directly from you. We collect your personal data indirectly, through a publicly accessible source — namely via X (FKA Twitter), using application programming interface (or "API") technology. Such personal data include:

• your X account username;
• your X @handle;
• your X ID number;
• your list of followers;
• your list of following;
• your profile information;
• information about your posts (such as date and time created, content, and the application and version of X posted from);
• the lists you created on your X account;
• reposts; and
• (if provided) language and location information.

As mentioned, we only collect personal data that is publicly available and accessible on X. If you have enabled "Protect your Posts" on X, we do not process your personal data.

In addition, we exclude, and therefore do not process, any personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation, and personal data relating to criminal convictions and offences.

03. For what purposes do we use your data?

We process your personal data as required by us to enable our business and pursue our legitimate interests. In particular, we use your data for the following purposes:

• Database enrichment: we process your personal data to enrich our secure database with an up-to-date and real-time copy of the public X database.
• Marketing: we process your personal data for marketing purposes — to (i) identify X users who are likely to be interested in the products and services of our (potential) customers, and (ii) enable our customers to provide you with personalized and relevant advertisements on your feed on X.

Our aim with such targeted advertising by means of customized audiences is to ensure that you receive promotional messages which are actually relevant to you, instead of (only) messages with little to no relevance.

If you do not, or no longer, wish to receive any personalized (targeted) advertisements on your X account from our customers (or other advertisers), X provides you the means to object to such processing via your "privacy and safety settings" in your account on X.

04. What is the legal basis for our processing of your data?

The processing by us of your personal data as described above for the purpose of personalized and targeted advertising is based on our legitimate interests.

The processing is aimed at composing a customized audience on X in order to enable our customers to use their marketing efforts as focused and as effective as possible.

In the performance of processing your personal data for our legitimate business interests, we have, to the greatest extent possible, taken all measures to minimize the impact such processing has and will have on you and your rights and interests involved.

05. Who will we share this data with?

We do not share personal data with any external service providers. All services necessary to perform the processing operations are performed by us only.

Any personal data collected and processed by us are also not shared with any of our customers.

We share (some of) your personal data with X, namely X ID numbers. We will only share this data with X in a secure manner. X is regarded as a separate controller, who provides its own separate service to our customer. X re-creates the customized audience on the X platform as a "tailored audience" for the benefit of the customer and enables the customer to send its advertising campaigns to the customized audience, in accordance with the X terms and conditions.

Personal data may be shared with government authorities and/or law enforcement officials if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws — including, but not limited to, use in connection with legal claims, compliance, regulatory, or investigative purposes (including disclosure of such information in connection with legal process or litigation).

06. Where will we send your data?

As indicated above, we share X ID numbers with X. This sharing may involve a data transfer to a third country outside the EU without an appropriate level of data protection. As far as this is relevant — X processes personal data in the United States, Ireland and any other countries where it operates — X has put appropriate protection measures in place, e.g. a Privacy Shield certification or European Commission approved standard contractual clauses (see X's privacy policy).

07. Which company entity is my data controller?

The data controller for your data is Socialdatabase. Please find the relevant contact details below:

Socialdatabase
Slego 1A
1046 BM Amsterdam
The Netherlands

08. How long will you retain my data?

We keep your personal data no longer than necessary to create a customized audience. As such, your personal data are deleted as soon as the customized audiences are available to our customers via X. The personal data in our database are a real-time copy of the public X database and are continuously updated. As such, the retention terms X applies are equally applicable here. For more information please revert to X's privacy policy.

09. How do you protect my data?

We strive to maintain the highest standards of security and we have put in place robust technical and organizational measures for the protection of your data in accordance with the current, general state-of-the-art technologies, especially to protect the data against loss, falsification or access by unauthorized third persons.

The transmission of your personal data from and to X takes place through so-called application programming interfaces. Additionally, the transfer of X ID numbers from us to X is secured by means of hashing (using the cryptographic hash function SHA-2).

Once we have received your personal data we will use strict procedures and security features to prevent unauthorized access, undesired modification and/or disappearance of your personal data.

10. What rights do you have in relation to your data?

In principle, you are entitled to a number of rights in relation to the personal data we process from you. You can exercise these rights (most) easily and effectively via your X account.

Via X, you can ask for a copy of your information, to correct it, erase or restrict its processing, or ask X to transfer (some of) this information to other organizations. To exercise these rights please check your X account settings. X also enables you with the right to object to certain processing activities, such as profiling performed by X (or its third party business partners such as us) for the purposes of direct marketing. To exercise these rights please check your X account privacy and safety settings.

Any rights exercised by you through X are directly communicated with us through X APIs. This means that whenever you change your "privacy and safety settings" or other X account setting, such changes are automatically updated and implemented in our own secure database.

11. California Notice of Collection (CCPA)

Residents of California may have the following rights:

a. You have the right to know and access your personal information

You have the following rights to know under CCPA:

• The personal information categories we collect and the categories of sources from where we get this information.
• The third-party categories and any other entities where we share personal information with.
• How to access the specific pieces of personal information that has been collected about you.

If you need to contact us to get this information, please use our contact form and include your name, email address, postal address and your X handle. You can also email us at privacy@socialdatabase.com with the subject heading "CCPA request".

You can also exercise your rights by sending a letter addressed to Socialdatabase, Inc., Attention: Privacy Policy Inquiry, 228 East 45th ST, Suite 9E, 10017, New York, NY. In your request, please attest to the fact that you are a California resident and provide a current California address for our response. Please be aware that not all information sharing is covered by the California privacy rights requirements and only information on covered sharing will be included in our response. We reserve our right not to respond to requests submitted to addresses other than the addresses specified in this paragraph.

b. Right to deletion

In some cases, you may ask us to delete your personal information. If so, please fill in our contact form and include your name, email address, postal address and X handle. You can also email us at privacy@socialdatabase.com with the subject heading "CCPA deletion request".

c. Right to opt-out of sales

If we share your personal information with third parties in a manner that is seen as a sale under CCPA, you can request that we do not sell your personal information on a going-forward basis. Please fill in our contact form and include your name, email address, postal address and X handle. You can also email us at privacy@socialdatabase.com with the subject heading "CCPA opt-out request".

d. Right to non-discrimination

You may exercise any of the rights above without fear of being discriminated against just because you exercise your rights under the CCPA.

If you have any questions, you can email us at privacy@socialdatabase.com with the subject heading "CCPA question".

12. CPRA Addendum to CCPA Notice

Effective Date: 10 November 2023

Socialdatabase values the privacy of our California consumers and recognizes the new rights granted by the California Privacy Rights Act (CPRA), which further amends and strengthens the California Consumer Privacy Act (CCPA). In compliance with these laws, we are providing the following additional information and rights to our users:

• a. Right to Correction: If you believe that any personal information we hold about you is inaccurate, you may request that we correct such information.
• b. Sensitive Personal Information: We will handle sensitive personal information in accordance with the heightened requirements under the CPRA. You have the right to direct us to limit the use of your sensitive personal information to only those purposes necessary to provide our services or as otherwise permitted by law.
• c. Data Minimization and Retention: We are committed to collecting only the personal information necessary for the purposes for which it is processed and will retain this information only for as long as is reasonably necessary to fulfill these purposes.
• d. Risk Assessments and Cybersecurity Audits: We regularly perform risk assessments and cybersecurity audits on the personal information that presents significant risks to your privacy or security.
• e. Automated Decision-Making: If we use automated decision-making technology, including profiling, we will provide you with information about the logic involved and the significance and expected consequences of the processing, and you may have the right to opt out.
• f. No Retaliation: We will not discriminate against any employee, applicant, or independent contractor for exercising their rights under the CPRA.
• g. Protection of Minors: We adhere to increased protections and consent requirements for minors under 16 years of age in the collection and processing of personal information.

If you have any questions about your rights under the CPRA or our privacy practices, please contact our Privacy Officer at DPO@socialdatabase.com.

13. If you have questions

We hope this Privacy Notice satisfies any queries you have about the way we process your data. If you have any further concerns about how we process your data, you can get in touch with us at office@socialdatabase.com or with our data protection officer at dpo@socialdatabase.com.

Please note that in the event you have unresolved concerns, you also have the right to complain to a data protection authority. The relevant data protection authority will be the Dutch data protection authority, or Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).