Before using FAIRO application (the Application) or signing up on its website https://www.fairo.com.ua/ (the Website), you are required to familiarize yourself with and accept this Privacy Policy (the Policy) regulating the collection, processing, use and transfer of your personal data. The Policy applies if you are an individual user of the Application. The expression "individual user" also includes individual entrepreneurs. We may need to update this Policy from time to time (the process of changes of this Policy is the same as the process of changes to Terms and Conditions (hereinafter - Terms and Conditions), which are available on site https://www.fairo.com.ua/en/terms-conditions).

Acceptance of the Policy and Controllers

By switching respective tick box/ex to the right position in a confirmation dialog box appearing in the Application during the sign-up process or signing up on the Website you accept this Policy and therefore the fact that FAIRO LLC, legal entity incorporated under the laws of Ukraine, identification number 43659053, registered address: Ukraine, 04073, Kyiv, 9 Stepana Bandery Avenue, building 5 A, 2d floor (the Provider), as a data controller, processes your personal data in a scope and for the purposes described herein, in connection with your entering into agreement with the Provider (the Agreement) in respect your use of the Application, consent, or on other legal bases as described below. You also accept the fact that regarding banking services the Provider and Raiffeisen Bank Joint Stock Company, a bank registered under the laws of Ukraine, identification number 14305909, registered address: Ukraine, 01011, Kyiv, 9 Lieskova Street (RB) will be the joint controllers (together Controllers) as follows:

• RB is responsible for the data processing due to the contract with you on the banking services;
  
• The Provider is responsible for the data processing due to your use of the Application.
  

RB will process data as a joint controller based on agreement with you for banking services, consent, or on other legal grounds as described below and according to the RB’s Privacy Policy, published on the website https://www.aval.ua/data-protection. Please note that the Provider may also process some data in connection with banking services on behalf of RB under its instructions and/or agreement between the Controllers.

In the Application you may have access to services of the third parties other than the Provider. Your transfer of personal data to such third party providers is not subject to this Policy. In advance to provision of those services you may be required to accept the privacy policy of the respective third parties.

Scope of Personal Data

The scope of your personal data that the Controllers may process depends on the Application features and Services you want to use. Minimum scope of your personal data required for entering into Agreement with the Provider and RB, setting up and keeping your Application account include your full name, contact information including but not limited to e-mail address, phone number, social networks’ and instant messengers’ contacts, tax identification number, registered address, login credentials, language, currency and subscription details. To enable you use of various features and Services of the Application on top of the above we also need to get your bank account details (such as bank details and account number) and taxpayer information. As long as you will use the payment account synchronization features of the Application the Provider will process also credentials to access the payment account, transaction details (such as amount, description, date and currency) and the payment account details (such as bank details, account number, account name, balance, currency, and type of account) which we receive through our subcontractor Salt Edge Inc. Within the Services we may also receive information about your business, finances, expenses, invoices, financial statements, details of your financial transactions, payroll details, payment details, tax return details, details about your customers or vendors or employees, income and wage information, and/or investment information. Certain features of the Application may also have access to your device gallery, camera and contacts if you grant permission in your device settings. On the Website we only collect your e-mail address. Where any your personal data is publicly available in the state registers due to your registration as an individual entrepreneur, we may receive it from our subcontractor You-Control LLC.

Purpose of Your Personal Data Processing

Your personal data are processed to operate our business related to the Application, namely, to:

• set up and keep your Application account to enable your use of the Application and its features and associated Services;
  
• sending you notifications on non-availability of Application’s functions as a result of non-entering into Agreement with the Bank, defined in Terms and Conditions;
  
• improve the Application's features and Services;
  
• inform the Application users that you are the user of the Application;
  
• run and manage our business related to the Application, including resolving billing and financial disputes;
  
• evaluate your eligibility for our offers, products, and services;
  
• connect you with other users;
  
• communicate with you;
  
• advertise and market our services and experiences (if there is respective consent from you);
  
• personalize your experience, including through the development of insights about you and your needs (if there is respective consent from you);
  
• provide you with support and resolve disputes;
  
• conduct researches, including based on anonymized data;
  
• comply with our legal and regulatory requirements;
  
• execute, perform, enforce, remedy, or otherwise apply the Agreement.
  

Your personal data collected on the Website are processed to:

• facilitate your access to the Application (by sending you the link to the Application etc.);
  
• advertise and market our services and experiences.
  

Transfers to Third Party Recipients

The Controllers may transfer your data to processors and third parties to perform some of the personal data processing operations, however, only for the purposes specified in this Policy, on a basis of written agreement and in accordance with applicable law. Otherwise the Controllers does not transfer or disclose your personal data to any third parties, unless you have consented otherwise under this Policy or initiated the disclosure or except as required by the applicable laws. Other users of the Application may be informed that you are using the Application. Sharing your personal data with other users of the Application is completely under your control. Data processors and third parties to which the Provider may transfer your data (and where they are located outside European Economic Area you explicitly consent to transfer of your personal data to such data processor or third party):

• Creative Dock AT GmbH, Landstraßer Hauptstraße 14-16 1090 Vienna
  
• CreativeDock s.r.o., Zubatého 295/5, Smíchov, 150 00 Praha 5, Czech Republic
  
• Creative OpCo s.r.o., Zubatého 295/5, Smíchov, 150 00 Praha, Czech Republic
  
• Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland
  
• Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
  
• Facebook Inc., 1601 Willow Road, Menlo Park, CA 90425, USA
  
• You-Control LLC, 1A Shumskogo Str., office 117, Kyiv, 02098, Ukraine
  
• Liga Zakon LLC, 23 Parkovo-Syretska Str., Kyiv, 04112, Ukraine
  
• Salt Edge Inc., 35 Jack Aaron Drive, Ottawa, Ontario, K2G 6L2, Canada
  
• Zendesk, Inc., 1019 Market Street, San Francisco, CA 94103, USA
  
• The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA
  
• Universal Trading Solution, LLC, identification code: 40658806
  
• Private entrepreneur Harbusov Mykhailo Serhiyovytsch, 54046, Mykolayivs'ka oblast, Mykolayiv, Architect Starov street, building 4d, apartment 14
  
• Global Bilgi, LLC, identification code: 36215539, and other companies/persons, which provide services in sphere of contacting with clients
  

Also, the Provider may transfer your data in connection with banking services to:

Raiffeisen Bank Joint Stock Company, a bank registered under the laws of Ukraine, identification number 14305909, registered address: Ukraine, 01011, Kyiv, 9 Lieskova Street, Raiffeisen Bank International AG Am Stadtpark 9, 1030 Vienna, Company Register Number: FN 122119m at the Commercial Court of Vienna

Please note that RB as the joint controller in connection with banking services may transfer the data to processors or third parties which are not stated herein and may be located outside Ukraine and European Economic Area. The details and the list of such processors and third parties are specified in the Banking rules, published on RB’s website:https://www.aval.ua/documents/biznesu/publichna-propozitsiya-pro-nadannya-bankivskikh-poslug, and Privacy Policy: https://www.aval.ua/data-protection.

Your Rights

Pursuant to the Law of Ukraine "On personal data protection" you have the right to:

• know about the sources of collection, location of your personal data, purpose of their processing, location and/or place of residence (temporary residence) of the controller or processor of personal data, or to issue a respective request on obtaining such information to the authorized persons, except for cases established by the law;
  
• receive information on conditions of access to personal data, in particular information about third parties your personal data are transferred to;
  
• access to your personal data;
  
• receive a response with regard to whether your personal data are processed as well as to receive information on the content of your personal data within the period that is no longer than 30 days since the moment the relevant request was received, unless otherwise prescribed by law;
  
• submit a motivated request to controller of personal data with objection against processing of your personal data;
  
• submit a motivated request to change or delete your personal data by any controller and processor of personal data, if such data are processed illegally or are inaccurate;
  
• protect your personal data from illegal processing and accidental loss, destruction, damage due to a deliberate concealing, failure to provide them or provision of such data with delay, as well as to protection from provision of data which are inaccurate or disgraceful for the honor, dignity and business reputation of an individual;
  
• submit complaints on your personal data processing to the Ukrainian Parliament Commissioner for Human Rights or courts;
  
• use legal remedies in case of violation of legislation on protection of personal data;
  
• make reservations to restrict the right to process your personal data while providing your consent;
  
• withdraw consent to the processing of your personal data;
  
• know the automatic mechanism of processing of personal data; and
  
• be protected from automated decision that has legal consequences for you.
  

You may exercise your rights contacting the Provider or RB as the joint controllers. Please see the contact information below.

Payment Information and Online Banking Credentials

In case you use the payment account synchronization feature and Services of the Application, your online banking credentials are by default used only upon your manual entry, securely encrypted and stored by Salt Edge Inc. as a data processor.

Location

Some of the Application's features and Services may access and collect your current location data, including GPS coordinates or other similar information regarding the location of your device. Some features of the Application may not function properly if use of location data is blocked or disabled.

Technical Data

You acknowledge that Provider may collect and use technical data, including but not limited to information about your mobile device and system, Internet connection or your use of the Application. The purpose of the collection of technical data is to make the Services available, ensure quality, increase your comfort, and further analyze and develop the Application and related services. We process them based on our agreement. Technical data is anonymous and stored separately from the personal data, therefore it cannot be linked back to you in any way to identify you.

Cookies

Cookies are small pieces of data that are stored on your device to help the Application and the Website to remember certain information. Cookies may contain personal data. We use cookies in order to keep your settings, for security reasons, to analyze your use of the Application and the Website and for targeting advertisement and marketing as described above. You can always block use of cookies or delete existing cookies by changing the settings of your browser or device, however it can affect the functionality of the Application.

Data Security

Your personal data is stored and processed automatically in electronic form on secure servers using the cloud technology provided by Amazon Web Service, Inc.. The respective database servers are located in European Economic Area region. Controllers and their subcontractors have to always comply with their high data protection standards. You acknowledge, that even Controllers, Salt Edge Inc. and other data processors use all standard security measures, the security of your personal data and other information can't be fully guaranteed. Please be careful with your personal data.

Removal of Your Personal Data

Your personal data will be processed by the Controllers for the term necessary for the performance of the purposes described in this Policy as per applicable legal basis: your consent, agreement, legitimate interest, or compliance with legal obligations. In either case your personal data will be removed by the Provider from its databases within one (1) month following fulfilling of the purposes, described in this Policy, or termination of the existence of grounds for such processing. Additionally, by giving consent with this Policy you certify that you agree and understand the following:

• withdrawal of consent means marking of data stored by Provider and processed solely on the ground of such consent, as data processing of which will be stopped in future, at the same time Provider may continue storing such data during the terms described in the legislation of Ukraine if it is necessary for fulfillment by Provider of obligations, set by legislation of Ukraine;
• in case if you initiated usage of Banking module according to Terms and Conditions and after that terminated the agreement on usage of Banking module and withdrew your consent for data processing, Provider will store all the information regarding correspondence with you during the terms, set by order by Ministry of Justice of Ukraine dated 12 April 2021 # 578/5, but not less, than during 5 years after the withdrawal of consent.  
• in case of termination of Agreement on Application usage as defined in Terms and Conditions, Provider shall store and use your personal data during 5 years for communicating with you on the terms and conditions, defined in Marketing consent, which is available on site https://www.fairo.com.ua/en/marketing-consent (applicable if you granted such consent).

As long as your personal data are depersonalized and cannot be attributed to you such data can be stored and processed by the Provider for unlimited period of time. Order of storage and deletion of your data by RB is described in its Privacy Policy at: https://www.aval.ua/data-protection.

Contact Information

If you have any queries relating to the protection and security of your data in connection with the Application or non-banking services, please contact Provider at support@fairo.com.ua or at the following postal address: 9 Stepana Bandery Avenue, building 5 A, 2d floor, Kyiv, 04073,Ukraine.

If you have any queries relating to the protection and security of your data in connection with banking services, please contact Raiffeisen Bank JSC at the following postal address: 9, Leskova Str., Kyiv, 01011, Ukraine.