Privacy Policy

INTRODUCTION Circl is built with privacy as a fundamental part of the service. This Privacy Policy explains what personal data we process, why we process it, how it is protected and what rights you have. The controller responsible for Circl is: Epik AB Company registration number: 556151-1667 Skolan 642 93 Flen Sweden Email for privacy and personal data enquiries: privacy@mycircl.se Circl: https://www.mycircl.se PERSONAL DATA WE PROCESS Depending on how you use Circl, we may process: • Account information, such as your name, email address, telephone number and information required to create and administer your account. • Profile information that you choose to provide, such as profile photo, birth information, area, biography and optional profile information. • Content that you create or upload, such as text, images and videos. • Information about relationships and interactions within Circl, such as friends, messages, comments, Pins, Openings and Memories. • Location information when you use features that require your location. • Contacts from your device if you expressly allow Circl to access them for features that help you find people you already know. • Technical information required for security, operation, troubleshooting and delivery of the service. • Push tokens and similar technical identifiers required to deliver notifications. LOCATION INFORMATION Circl uses location information for features based on proximity, places and social contexts. Your precise location is not displayed to other users. When Circl shows people or activity nearby, location information is used to provide an approximate and privacy-protective experience. Circl does not display other users' precise location, direction or movement patterns. You can control Circl's access to location information through your operating system's permission settings. Some location-based features will not function without location permission. CONTACTS If you give Circl access to your contacts, the information may be used for features that help you discover people you already know. Your contacts are not published in Circl and are not displayed to other users as a contact list. Circl uses contact information for the features and purposes described here and does not sell contact information to third parties. CAMERA, IMAGES AND VIDEO Circl may request access to your camera, images or video when you use features where you choose to create or upload such content. The content is processed in order to provide the feature you have chosen to use. PUSH NOTIFICATIONS If you allow notifications, Circl may use a technical push token to send relevant messages and updates to your device. You can change notification permission at any time in your device settings. WHY WE PROCESS PERSONAL DATA We process personal data to: • create and administer your account • provide Circl's features • help people discover relevant people, activities, places and social contexts • enable communication and relationships between users • provide relevant local information without exposing precise location • deliver notifications that you have permitted • prevent abuse, fraud and security problems • troubleshoot and maintain the security and operation of the service • comply with legal obligations LEGAL BASIS Depending on the processing, we rely on: • performance of a contract where processing is necessary to provide Circl • consent where processing requires your voluntary approval • legitimate interests where processing is necessary, for example, for security, prevention of abuse or reasonable operation of the service and those interests are not overridden by your rights • legal obligation where the law requires certain information to be processed or retained Where processing is based on consent, you may withdraw your consent. SHARING PERSONAL DATA We do not sell your personal data. Personal data may be processed by service providers required to operate Circl, such as providers of hosting, databases, authentication, email, push notifications, payments or other technical infrastructure. Such providers may only process information for agreed purposes and subject to applicable data protection and security requirements. Information may also be disclosed where we are required to do so by law or a binding order from a competent authority. TRANSFERS OUTSIDE THE EU/EEA Some technical service providers may process personal data outside the EU/EEA. Where this occurs, the transfer must use a lawful transfer mechanism under the GDPR and, where required, supplementary safeguards. RETENTION AND DELETION We retain personal data only for as long as necessary for the purposes for which it was collected or for as long as we have a legal obligation to retain it. When you delete your Circl account, personal data associated with the account is deleted or anonymised, except for information that must be retained for a period of time due to law, security, fraud prevention, legal claims or other legitimate obligations. Such information will not be used for other purposes during the retention period. SECURITY We use technical and organisational security measures to protect personal data against unauthorised access, loss, alteration or disclosure. No internet-based service can guarantee absolute security, but data protection and security are considered throughout the development and operation of Circl. YOUR RIGHTS Under the GDPR, depending on the circumstances, you may have the right to: • receive information about how your personal data is processed • request access to your personal data • request correction of inaccurate information • request deletion • request restriction of processing • object to certain processing • receive certain data in a structured, machine-readable format • withdraw consent You can contact us at: privacy@mycircl.se You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or another competent data protection authority in the EU/EEA. ACCOUNT DELETION You can delete your account yourself in Circl's account settings. Deletion happens in two steps: you confirm your choice, the account is closed immediately and you are signed out on all devices. For 24 hours you can sign in again and restore the account. After that the account is permanently deleted. On permanent deletion we delete your personal data, contact details, address and home area, location data and presence, contacts, settings, notification preferences, registered devices and profile photos. Content you shared with others – memories, openings, invitations, channels, channel posts, threads, comments and messages – remains without your name and without your profile. If Circl removes an account, for example after serious or repeated breaches of the terms, the same permanent deletion of personal data applies. You can also find instructions at: https://www.mycircl.se/delete-account Deleting an account does not merely deactivate it. Personal data associated with the account is deleted or anonymised as described above. CHILDREN Circl is not designed as a service for children. Applicable age limits and requirements for use of the service must be followed. CHANGES We may update this Privacy Policy as Circl develops, our processing of personal data changes or legal requirements change. The current version will always be available on this page. CONTACT Privacy and personal data enquiries: privacy@mycircl.se