1. Who we are
1.1 SignalBridge Tech Ltd, registration number HE 487847, registered office 23 Stasinou Street, 1st Floor, 2404 Engomi, Nicosia, Cyprus, Republic of Cyprus ("SignalBridge", "we") is the controller of the personal data described in this policy. Where we act as a controller together with, or independently of, another party, that is explained in the relevant section below.
1.2 Our data protection contact point is [email protected]. Where we are required to appoint a Data Protection Officer, the Data Protection Officer can be contacted at the same address. Our lead supervisory authority is the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus.
2. Who this policy applies to
2.1 This policy applies to individuals acting in a business capacity: representatives of advertisers, agencies, publishers and supply partners; individuals who register for or administer an account; individuals whose details we process as part of onboarding or beneficial-ownership checks; and visitors to our website.
2.2 It does not apply to individuals who see or interact with advertising delivered through our platform. Those individuals are covered by our End-User Privacy Notice. Our use of cookies and similar technologies on our own website is described in clause 9.
3. What we process and why
| Category | Purpose | Legal basis (GDPR) |
|---|---|---|
| Identity and contact details (name, role, business email, telephone) | Managing the relationship and providing the Services | Art 6(1)(b) contract; Art 6(1)(f) legitimate interests where you act for a corporate counterparty |
| Account credentials, access logs, IP address, device and browser data | Account security, access control, fraud and abuse prevention | Art 6(1)(f) legitimate interests in securing the platform |
| Identity documents, corporate registration documents, beneficial ownership and director information | Counterparty due diligence and verification (KYB/KYC) | Art 6(1)(f) legitimate interests; Art 6(1)(c) where a legal obligation applies |
| Screening results against sanctions and politically exposed persons lists | Compliance with restrictive measures | Art 6(1)(c) legal obligation; Art 6(1)(f) legitimate interests |
| Bank account and payment reference data | Invoicing, settlement and payer-consistency verification | Art 6(1)(b) contract; Art 6(1)(c) legal obligation |
| Correspondence, support tickets, complaint and appeal records | Handling requests, notices and complaints; evidencing our decisions | Art 6(1)(b) contract; Art 6(1)(c) where retained to evidence compliance |
| Website analytics and cookie data | Operating and improving the website | Consent where required; Art 6(1)(f) for strictly necessary purposes |
3.1 Where we rely on legitimate interests we carry out and record a balancing assessment. You may ask us for further information about that assessment using the contact details in clause 10, and we will provide such information as is appropriate in the circumstances.
3.2 We do not take decisions producing legal or similarly significant effects concerning you based solely on automated processing, except that we apply automated screening against sanctions and politically exposed persons lists and automated fraud and risk controls, which may result in an account being refused, restricted or suspended. That processing is carried out in order to comply with restrictive measures and other legal obligations to which we are subject. Where a decision of that kind is taken we will tell you, unless the law prevents us from doing so; a member of our staff will review the decision on request; and you may contest it and provide further information using the contact details in clause 10. If we introduce any other decision of this kind based solely on automated processing, we will tell you and explain the logic involved and your rights.
3.3 We do not knowingly collect personal data relating to children through the platform or the website. This policy is addressed to individuals acting in a business capacity.
4. Where the data comes from
4.1 Most data comes from you or your organisation directly. We also obtain corporate registry data, sanctions and PEP screening results and company verification data from third-party providers, and technical data automatically when you use the platform or the website.
5. Who we share it with
- Service providers acting on our instructions, including hosting, screening, verification, fraud detection and support providers, under written data processing terms.
- Professional advisers, auditors and insurers, where necessary and under a duty of confidentiality.
- Banks and payment service providers, where necessary to effect settlement.
- Competent authorities, where required by law or where necessary to establish, exercise or defend legal claims.
5.1 We also disclose personal data to our group companies for the purposes described in this policy, and to an actual or prospective purchaser, investor or funder in connection with a corporate transaction, subject to appropriate confidentiality protections. We disclose personal data to third parties only for the purposes described in this Privacy Policy and in accordance with applicable law. We do not sell personal data, and we do not permit third parties to use personal data for their own independent marketing purposes except where expressly disclosed to you.
6. International transfers
6.1 Personal data is generally stored and processed on secure servers located in or near the region in which our services are provided. Personal data may also be processed or accessed from other countries, including countries which do not provide an equivalent level of protection. Where we transfer personal data outside the EEA, the UK or Switzerland, we implement appropriate safeguards as required by applicable data protection laws, including reliance on adequacy decisions, the European Commission’s Standard Contractual Clauses (as amended by the UK International Data Transfer Addendum or adapted for Switzerland where relevant), or other legally recognised transfer mechanisms. You may request further information about those safeguards, and a copy of the relevant mechanism, using the contact details in clause 10. The categories of recipient to which personal data may be transferred are those listed in clause 5. We maintain, in our record of processing activities, a current list of the countries to which personal data is transferred and of the transfer mechanism relied on for each, and we will provide that list on request.
7. Retention Period
7.1 We retain personal data only for the period necessary to fulfil the purposes outlined in this Privacy Policy, or as required by applicable legal, regulatory, tax, or accounting obligations, or for as long as necessary to establish, exercise or defend legal claims. The criteria we use to determine that period are the duration of our relationship with you or with the organisation you represent, the limitation period applicable to claims arising out of that relationship, and the minimum periods prescribed by the tax, accounting, company law and anti-money-laundering rules that apply to us; where more than one of those criteria applies, we retain the data for the longest period so determined. Once the retention period expires, or upon a valid deletion request, personal data will be securely deleted or permanently anonymised. Where immediate deletion is not possible, for example because the data is held in backup archives, we will securely store the data and isolate it from further processing until deletion is possible.
7.2 Security. We maintain technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures are described at a general level in the technical and organisational measures annexed to our Data Protection Terms, and are kept under review.
8. Your rights
8.1 Subject to the conditions in applicable law, you have the right to request access to your personal data, rectification, erasure, restriction of processing, portability, and to object to processing based on legitimate interests. Where processing is based on consent you may withdraw it at any time without affecting the lawfulness of prior processing.
8.2 We may need to verify your identity before acting on a request, and we may decline or charge for requests that are manifestly unfounded or excessive. Exercising your rights will not result in any detriment to you. You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus or with the supervisory authority of your habitual residence or place of work.
8.3 Additional rights in certain jurisdictions. Depending on where you are located, you may have additional or different rights under local law, including rights to opt out of the sale or sharing of personal information or of targeted advertising, rights relating to sensitive personal information, and rights of appeal against our decision on a request. Where the law of your jurisdiction gives you such a right, we will give effect to it in accordance with that law, and you may exercise it using the contact details in clause 10. Where that law requires us to provide information in addition to the information set out in this policy, or requires any matter described in this policy to be dealt with differently, that law prevails to the extent of the difference and we will comply with it.
9. Cookies and similar technologies
9.1 We use cookies and similar technologies, such as local storage and pixels, on our website. In this clause we refer to all of them as "cookies". This clause applies to our website only. It does not apply to cookies, software development kits or similar technologies used in the apps and websites of our publishing partners in connection with advertising delivered through our platform; those are described in our End-User Privacy Notice, and any consent required for them is obtained by the operator of the app or website concerned.
9.2 We group the cookies we use into four categories. Strictly necessary cookies are required to operate the website and to keep your session secure, and include the cookie that records the choices you make in our cookie banner; they are set automatically and do not require your consent. Preference cookies remember settings such as language or region. Analytics cookies allow us to recognise and count visitors and to see how visitors move around the website, which helps us improve the way it works. Marketing cookies measure the effectiveness of our own marketing and, where applicable, allow us to show you our advertising elsewhere. Preference, analytics and marketing cookies require your consent.
9.3 Cookies in the preference, analytics and marketing categories are set only after you have given your consent through the banner shown on your first visit. Until you give consent, only strictly necessary cookies are set. You may consent to some categories and not others. A current list of the cookies used on the website, showing who sets each one, what it does and how long it remains on your device, is available in the preference centre reached from that banner and from the cookie settings link in the footer of every page.
9.4 You can change or withdraw your consent at any time through the cookie settings link in the footer of every page. Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out before withdrawal.
9.5 You may also be able to refuse or disable cookies by adjusting your browser settings. Because each browser is different, please consult the instructions provided by your browser. Browser settings are not a substitute for the choice you make in our banner, and your selection is specific to the browser or device you are using when you make it, so you may need to make it separately on each browser or device. If you refuse, disable or delete cookies, some functionality of the website may no longer be available to you. Where required by applicable law, we also recognise and act on opt-out preference signals sent from your browser, such as Global Privacy Control.
9.6 Where a third party sets a cookie on our website, that party processes the information it collects for its own purposes and under its own privacy policy. Clause 6 applies to any transfer of personal data collected through cookies outside the European Economic Area, the United Kingdom or Switzerland.
10. Contact
10.1 Legal enquiries: [email protected]. Postal address: 23 Stasinou Street, 1st Floor, 2404 Engomi, Nicosia, Cyprus, Republic of Cyprus.
11. Changes
11.1 We will update this policy when our processing changes. The date at the top shows when it was last updated. Where a change is material, we will bring it to your attention by an appropriate means, such as email or a notice in the platform, before it takes effect.