GDPR

Blutui collects and processes personal data to deliver our services effectively. The types of personal data we collect may include:

• Personal identification information (such as name, email address, phone number)

• Technical data (such as IP address, browser type, device type, and usage data)

• Account-related information (such as account preferences, project details, and billing information)

• Communication data (including customer service inquiries and feedback)

We collect this data directly from you when you interact with our platform, through cookies, or when you communicate with us.

Blutui handles personal data in two different roles. Your rights, and our obligations, depend on which role applies.

• As a controller: For personal data about our own customers and users, such as agency staff with a Blutui account, people who contact us and visitors to blutui.com, Blutui decides how and why the data is used. This statement describes how we handle that data.

• As a processor: For personal data collected through websites our customers build and host on the Blutui Platform, such as an enquiry submitted through a contact form on an agency client's site, our customer or their client is the controller and decides how that data is used. We process that data only on their documented instructions and to provide the Services, as set out in Section 13 of our Terms and Conditions.

If you are a visitor to a website hosted on Blutui and want to exercise your rights over data collected through that site, please contact the owner of that website. We will help our customers respond to these requests. Customers who need a data processing agreement, including for the purposes of the GDPR or UK GDPR, can request one at GDPR@blutui.com.

Where the GDPR or UK GDPR applies, Blutui relies on the following legal bases when it processes personal data as a controller:

• Consent: Where you have given clear, specific consent for a particular purpose, such as receiving marketing emails or allowing non-essential cookies. We only rely on consent where we have asked for it.

• Legal obligation: Where we need to process personal data to comply with a law that applies to us, such as tax and accounting record-keeping requirements.

• Contractual necessity: Where processing is necessary to perform our contract with you, or to take steps at your request before entering into one, including providing the Blutui Platform, managing your account and processing payments.

• Legitimate interests: Where processing is necessary for our legitimate interests, such as securing and improving the Blutui Platform, preventing fraud and telling customers about our services, and those interests are not overridden by your rights and interests.

Where we rely on consent, you can withdraw it at any time by contacting us or by using the unsubscribe link in our emails. Withdrawing consent does not affect processing that took place before you withdrew it.

Depending on where you are located and which law applies, you have some or all of the following rights regarding your personal data:

• Right to Access: You have the right to request a copy of your personal data we hold.

• Right to Rectification: You can request that we correct any inaccurate or incomplete personal data.

• Right to Erasure (Right to be Forgotten): You can request the deletion of your personal data under certain circumstances.

• Right to Restrict Processing: You can request that we restrict the processing of your data.

• Right to Data Portability: You can request a copy of your data in a structured, commonly used format to transfer to another service provider.

• Right to Object: You can object to our processing of your personal data under certain conditions, especially where our processing is based on legitimate interests.

To exercise these rights, please contact us using the details in the Contact Information section. We will respond within the time required by the applicable law. You also have the right to complain to a data protection authority, such as the Office of the Privacy Commissioner in New Zealand, the Information Commissioner's Office in the UK, or the supervisory authority in your EU country.

Blutui retains personal data for as long as necessary to fulfil the purposes for which it was collected, including to comply with legal, accounting or reporting requirements. Once personal data is no longer needed, it is securely deleted or anonymised.

Blutui may share your personal data with third parties in the following circumstances:

• Service Providers: We share data with trusted third-party service providers that help us deliver the Blutui Platform, such as cloud hosting, payment processing, customer support and email providers. They may use the data only to provide services to us.

• Legal Requirements: We may disclose personal data if required to do so by law, in response to legal processes, or to protect our rights, privacy, safety, or property.

• Business Transfers: If Blutui undergoes a merger, acquisition, or asset sale, your personal data may be transferred as part of the transaction.

Every service provider that processes personal data on our behalf is bound by a written agreement that meets the requirements of applicable data protection law. A current list of our subprocessors is published at blutui.com/legal/subprocessors. Blutui does not sell personal data.

Blutui uses appropriate technical and organisational measures to protect personal data, including encryption, secure servers and access controls, to guard against unauthorised access, alteration, loss or disclosure. If we become aware of a personal data breach, we will notify affected customers without undue delay, and in any event within 48 hours, and will notify the relevant regulator and affected individuals where the law requires. No method of electronic transmission or storage is completely secure, so we cannot guarantee absolute security, but we review our measures regularly.

Blutui is based in New Zealand and works with service providers in other countries, so personal data may be transferred to and processed in countries other than the one where it was collected. The European Commission and the United Kingdom both recognise New Zealand as providing an adequate level of data protection. Where we transfer personal data to a country without that recognition, we put appropriate safeguards in place, such as the EU Standard Contractual Clauses or the UK International Data Transfer Addendum. Where we send personal information outside New Zealand, we take reasonable steps to ensure it is protected in a way comparable to the New Zealand Privacy Act 2020.

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have specific rights regarding their personal data:

• Right to Know: You have the right to request information about the personal data we have collected, used, shared, and sold.

• Right to Delete: You have the right to request the deletion of your personal data.

• Right to Opt-Out: You can request to opt-out of the sale of your personal data. Blutui does not sell personal data.

• Right to Non-Discrimination: You have the right to exercise your rights without facing discrimination from Blutui.

To submit a CCPA/CPRA request, please contact us through the details provided in the Contact Information section.

Blutui uses cookies and similar tracking technologies to enhance your user experience, analyse usage patterns, and personalise content. You can manage your cookie preferences through your browser settings or by using our cookie management tools. For more detailed information on how we use cookies, please refer to our Cookie Policy.

We may update this Platform Policy Statement from time to time to reflect changes in privacy laws, our practices or our services. We will post any changes on this page and update the effective date. Where a change materially affects how we handle personal data, we will also notify our customers directly.

If you have any questions or concerns regarding this Platform Policy Statement, your rights under GDPR, CCPA, or CPRA, or wish to exercise any of your data protection rights, please contact us at:

Email: GDPR@blutui.com

Address: Blutui, 95a Collingwood Street, Hamilton, NZ.

Phone Number: +64 21 728092

This policy is designed to inform and protect you while using the Blutui platform, and we are committed to maintaining the highest standards of privacy and data security.