Privacy Policy

In this Privacy Policy, we describe how OptiQueue Nordics AB, organization number 559286–3251 with address Drottninggatan 78, 111 36 Stockholm, Sweden, hereinafter referred to as ("OptiQueue", "we" or "us") processes personal data when you use our service ("Service”) which is available on mywaitlists.com and when you create a business account with us. OptiQueue is the personal data controller for all personal data we collect unless otherwise is stated in this Privacy Policy. Your privacy is important to us. According to the General Data Protection Regulation 2016/679 ("GDPR"), we as the data controller are responsible for the processing of your personal data when we determine the purposes and means of the processing of personal data.

By "personal data" we mean all information relating, directly or indirectly, to an identifiable natural person who is alive. In some cases, we are not responsible for the personal data. This is the case when we share your personal data with companies that independently determine the purposes and means for how your personal data is processed. In these cases, it is important that you read through the personal data controller's applicable privacy policy to know how your personal data is processed and what rights you have vis-à-vis the data controller. We are not responsible for personal data that the customer (a company) adds to Service on its own. This user generated content is controlled by the customer and can be changed and deleted whenever. This document contains information about our collection, use and processing of personal data. It also includes information about which parties we may share personal data with and your rights in relation to your personal data. When you use our Service, we will process personal data for several purposes, as stated below.

1. PERSONAL DATA PROCESSED

We collect and process the following categories of personal data, in the case that a living natural person can be identified through them, to provide the Service and for the purposes set out below: *Full name* *Email* *Phone* *Password* *Organizational name* *Country* *Industry* *Website URL* And

*Waitlist name* *product category* *Image(s)* *Waitlist description* *Country* *Region* *City* *Address* *Other personal data you as a Customer provide (user generated content)*

Please note that we cannot provide the Service without at least some of this personal data. When you use the Service, certain information will also be collected automatically by us, including: (a)information about your use of the Service; (b) technical data, which may include the URL you were at when you navigated to the Website, your IP address, unique device ID, network and computer performance information, browser type, language, and identification and operating system information.

2. PURPOSES AND LEGAL BASIS

We will process the categories of personal data above for the following purposes: (a) Full name, email address, telephone number, password, organizational name, country, industry and website URL to provide and administer your business account in accordance with our terms and conditions. The processing of personal data for this purpose is based on the fulfillment of an agreement with you; (b) Name, email address and phone number to send you notifications and messages via email and SMS about updates to the Service and changes to our terms and conditions and our Privacy Policy. The processing of personal data for this purpose is based on our legitimate interest or in some cases to fulfill a legal obligation. We have a legitimate interest to keep you updated regarding news and developments regarding the Service. (c) Information about your use of the Service and information provided when contacting our customer service. We process this information to improve your experience of the Service, based on our legitimate interest in providing you with a customized experience that is tailored to your preferences. (d) Information about your use of the Service and other technical data to ensure the technical functionality of the Service (in order to be able to fulfill our agreement with you) and to prevent use of the Service in violation of our terms and conditions, based on our legitimate interest to ensure that our Service is not misused and to protect ourselves and other customers as well as to be able to establish or assert a legal claim; (e) Information about your use of the Services to enforce our terms and conditions, including protecting our Service and our rights, and, if necessary, the rights of third parties based on our legitimate interest in protecting our business, customers using the service and third parties ; and

(f) to comply with legal obligations, based on our obligation to comply with applicable laws and regulations. When we process personal data based on our legitimate interest, we always make a balancing between our interest in processing the personal data and the implications and privacy risks the processing of personal data can mean for you as a data subject. If we process personal data based on our legitimate interest we have concluded that our legitimate interest can be exercised without violating your right to privacy.

3. STORAGE OF PERSONAL DATA

We never store personal data longer than what is necessary in relation to the purpose for which we process the personal data. We never process personal data for longer than 180 days from the date when you deleted your business account, as long as there are no legal obligations that oblige us to save the personal data, or if we need to keep the personal data in order for us to be able to defend or enforce legal claims. Contact details that are used to send out information about updates regarding the Service or to inform about changes in terms and conditions or in this Privacy Policy are sent out as long as customer has an ongoing subscription. Personal data that is used to improve the Service and to develop new services is anonymized as soon as possible, but no longer than six months from the time it was created or obtained. Personal data that, where applicable, is used to enforce the terms and conditions and/or to protect our rights is stored for as long as we need to keep the personal data to defend ourselves from a legal claim in accordance with the applicable statute of limitations (three years in consumer relations and ten years in other cases). Personal data that is processed in accordance with a legal obligation is stored as long as the legal obligation states that the personal data must be stored. This includes when personal data is stored for accounting purposes. Information regarding accounting is stored up to and including the seventh year after the end of the calendar year in which the accounting year ended.

4. TRANSFER OF PERSONAL DATA

OptiQueue may in some cases share personal data with third parties. These third parties act as a data processor to us, which means that they process personal data in accordance with the purposes that we have determined and according to our instructions. We ensure that everyone who acts as a data processor has received detailed instructions on how the personal data shall be processed and that the data processor has taken appropriate technical and organizational measures to protect your personal data. The categories of recipients that constitutes our data processors are companies that provide the following services to us:

Cloud-storage of personal data Sending automatic e-mails Analysis of data Other In some cases, personal data may be shared with third parties who are responsible for your personal data, such as a data controller. This means that they independently determine the purposes for the processing of personal data in accordance with their privacy policy. The categories that process personal data on their own behalf, as a data controller, are: Payment provider Other In some cases, your personal data may be shared with an authority if it is necessary due to a legal obligation or if it is necessary for us to be able to defend or assert a legal claim.

5. WHERE YOUR PERSONAL DATA IS PROCESSED

We mainly process your personal data within the EU/EEA. This means that your personal data is mainly processed in countries where the GDPR applies and where the level of protection for your personal data maintains an adequate level of protection. If we process your personal data in a country outside the EU/EEA, a third country, we guarantee that such processing will only take place if the level of protection is at least the same as if the personal data were processed within the EU/EEA. We ensure this by only processing personal data in countries that the European Commission has announced have an adequate level of protection, alternatively we have been guaranteed in an agreement with a data processor in a third country that the level of protection is at least equivalent to what applies within the EU/EEA.

6. PROTECTION OF PERSONAL DATA

Keeping your personal data protected is of utmost importance to OptiQueue. To protect your personal data from unauthorized use and unauthorized access, we have implemented appropriate technical and organizational measures. Everyone working at OptiQueue have received clear instructions on how your personal data is to be processed and how it is protected.

7. OTHER THINGS YOU NEED TO KNOW

Links to other websites You should be aware that when you visit our website, you may be directed to other websites operated by third parties where their collection of personal data is beyond our control. The privacy policy on their respective websites will govern their use of personal data collected from you. Change in ownership

If the ownership of our business changes, we may transfer your information to the new owners so they can continue to provide the Service. The new owners must continue to observe the commitments we stated in this Privacy Policy.

8. YOUR RIGHTS UNDER GDPR

You have certain rights that you can exercise at any time in accordance with the GDPR. In order for us to be able to fulfill a request to exercise any of your rights, we may require you to identify yourself in an appropriate way so that we can ensure that we do not disclose information about your personal data to anyone else. At the bottom of our Privacy Policy, you will find our contact details and information on how to exercise your rights under the GDPR or if you have other questions regarding our processing of personal data.

Access to personal data You have the right to receive a copy of the personal data that we process regarding you. You have the right to receive the copy within thirty (30) days from the time we received your request, as long as there is no applicable exception. Right to rectification and right to erasure You have the right to request that your personal data shall be rectified if we have inaccurate personal data regarding you. You also have the right to have incomplete data completed.

You have the right to request that we delete your personal data. In the event of such a request, we will check whether your personal data can be deleted. We may deny you the deletion of certain categories of personal data if this is necessary for us to be able to fulfill legal obligations. Also keep in mind that we cannot provide the Service if we cannot process necessary personal data.

Data portability You have the right to obtain the personal data we process about you in a structured, commonly used and machine-readable format in order to transfer this personal data to another data controller. This right refers to such personal data that you yourself have provided to us and in cases where the processing is based on your consent or if we process the personal data to be able to fulfill an agreement with you. Right to restriction

You can, if certain conditions are met, request that we restrict the processing of your personal data. Keep in mind that restricting our processing of your personal data may mean that we cannot provide the Service. Right to lodge a complaint to a supervisory authority If you think that we have processed your personal data in violation of this Privacy Policy or the GDPR, you have the right to lodge a complaint with a supervisory authority. At the respective EU/EEA country's supervisory authority for data protection, more information is available on how to lodge a complaint.

To exercise any of the rights stated above or if you have other questions regarding our processing of personal data, please contact us at the following address: hello@mywaitlists.com or OptiQueue Nordics AB, Drottninggatan 78, 11 136, Stockholm. Please note that you may need to verify your identity before your request can be processed.

CHANGES TO THE PRIVACY POLICY

We may from time to time make changes to this Privacy Policy. If the changes are essential, we will always notify you of the changes by sending you information via the contact details you have provided. You will always be able to find the last updated Privacy Policy on our website.