1. Introduction & Data Controller

ElectPolling ("we," "us," "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your information when you use our Platform.

ElectPolling acts as the data controller for personal data processed through the Platform. For data processed in the context of specific campaigns, the relevant campaign operator may act as a co-controller or data processor, as appropriate.

2. Information We Collect

2.1 Information You Provide:

• Account registration data (name, email address, username, password)
• Profile information (bio, avatar, location, interests, social links)
• User-generated content (posts, comments, videos, messages, poll responses)
• Campaign information (for campaign operators)
• Communications with our support team
• Payment information (processed by third-party processors; we do not store card numbers)

2.2 Information Collected Automatically:

• Device information (device type, operating system, browser type and version)
• IP address and approximate geographic location derived from it
• Log data (pages visited, features used, timestamps, referrer URLs)
• Cookies and similar tracking technologies (see Section 7)
• Usage patterns and engagement analytics

2.3 Sensitive Information:

We recognize that political opinions, voting intent, and campaign affiliations may constitute sensitive personal data in certain jurisdictions (including "special category" data under GDPR). We process such data only where you have freely given explicit consent or where another lawful basis applies. You may withdraw consent at any time.

3. Legal Bases for Processing (GDPR & Equivalent Laws)

We process your personal data on the following legal bases:

• Contract Performance: Processing necessary to provide our Platform services to you
• Legitimate Interests: Preventing fraud, improving Platform security and functionality, analytics (subject to your rights to object)
• Legal Obligation: Complying with applicable laws, court orders, and regulatory requirements
• Consent: Where we explicitly ask for your consent, including for marketing communications, sensitive data processing, and non-essential cookies
• Vital Interests: In emergency situations where processing is necessary to protect life

4. How We Use Your Information

• Providing, operating, maintaining, and improving the Platform
• Creating and managing your account
• Enabling communication between users and campaigns
• Processing transactions and managing subscriptions
• Sending service notifications, security alerts, and support communications
• Sending marketing communications (only with your consent; you may opt out at any time)
• Generating aggregated, anonymized analytics and insights
• Detecting, preventing, and addressing fraud, abuse, and security threats
• Enforcing our Terms of Service and Community Guidelines
• Complying with legal obligations and responding to lawful requests from authorities
• Protecting the rights, safety, and property of ElectPolling, our users, and the public

We do not sell your personal data to third parties for their independent use. We do not use your personal data to make automated decisions that produce legal or similarly significant effects without human review, except where required for security and fraud prevention.

5. Information Sharing & Disclosure

We do not sell, rent, or trade your personal information. We may share information in the following limited circumstances:

• With Your Consent: Where you have given explicit permission
• Public Profile: Information you choose to make public is visible to other users and may be indexed by search engines
• Campaign Operators: Your interactions with a campaign may be visible to that campaign's authorized operators
• Service Providers: Trusted third-party vendors who assist us in operating the Platform (e.g., cloud hosting, analytics, payment processing, email delivery), bound by data processing agreements and prohibited from using your data for their own purposes
• Business Transfers: In connection with a merger, acquisition, or sale of assets, subject to the acquirer agreeing to honor this Privacy Policy or providing you notice and choice
• Legal Requirements: Where required by applicable law, valid court order, subpoena, or governmental request; we will notify you where legally permitted
• Safety & Security: To prevent imminent harm, fraud, or security threats, or to protect the rights and safety of our users or the public
• Aggregated/Anonymized Data: We may share anonymized, aggregated statistical data that cannot reasonably identify you

6. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence, including countries that may not offer the same level of data protection as your home country.

When transferring data from the EEA, UK, or Switzerland, we rely on appropriate safeguards including: Standard Contractual Clauses (SCCs) approved by the European Commission; UK International Data Transfer Agreements (IDTAs); adequacy decisions; or other legally recognized mechanisms.

For transfers from Nigeria, Canada, Australia, or other jurisdictions with cross-border transfer restrictions, we implement equivalent contractual and technical safeguards as required by local law.

7. Cookies & Tracking Technologies

We use cookies, web beacons, pixels, and similar technologies to:

• Essential Cookies: Required for basic Platform functionality and security (no consent required)
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how users interact with the Platform (require consent in applicable jurisdictions)
• Advertising Cookies: Enable relevant advertising (require consent; you may opt out)

You can control cookies through your browser settings, our cookie consent banner, or by using opt-out mechanisms for analytics and advertising. Note that disabling certain cookies may limit Platform functionality.

8. Data Retention

We retain personal data only as long as necessary for the purposes set out in this Policy, to comply with legal obligations, resolve disputes, and enforce agreements. Specific retention periods:

• Active account data: Duration of account plus applicable legal retention period
• Deleted account data: Removed from active systems within 30 days; may be retained in encrypted backups for up to 90 days
• Legal hold data: Retained as required by applicable law or ongoing legal proceedings
• Transaction and financial records: As required by tax and financial regulations (typically 7 years)
• Security and fraud logs: Up to 12 months or as required by law

9. Data Security

We implement industry-standard technical and organizational security measures to protect your data, including:

• Encryption of data in transit (TLS) and at rest (AES-256 or equivalent)
• Access controls and principle of least privilege
• Regular security assessments and penetration testing
• Incident response procedures
• Employee data protection training

Despite our efforts, no security system is impenetrable. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant authorities as required by applicable law (within 72 hours under GDPR; as required under NDPA, CCPA, and other laws).

10. Your Rights

Depending on your jurisdiction, you have some or all of the following rights:

• Right to Access: Request a copy of your personal data we hold
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data (subject to legal retention obligations)
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Restrict Processing: Limit how we use your data in certain circumstances
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time
• Right Not to be Subject to Automated Decision-Making
• CCPA/CPRA Rights (California): Right to know, right to delete, right to opt-out of sale/sharing, right to non-discrimination, right to correct, right to limit use of sensitive PI
• NDPA Rights (Nigeria): Right to access, rectification, deletion, objection, and portability under the Nigeria Data Protection Act 2023

To exercise any of these rights, contact us through our support channels. We will respond within the timeframe required by applicable law (30 days under GDPR; 45 days under CCPA). We may require identity verification before processing certain requests. We will not discriminate against you for exercising your privacy rights.

11. Children's Privacy

Our Platform is not directed to persons under 18 years of age (or the age of majority in your jurisdiction, if higher). We do not knowingly collect personal data from anyone under 13 years of age, in compliance with COPPA (USA), GDPR Article 8 (EU minimum age 16, or as permitted by Member State law), UK Children's Code, and equivalent laws worldwide.

If we discover that we have collected personal data from a child under the applicable minimum age without verified parental consent, we will delete that data immediately. If you believe we have inadvertently collected data from a minor, please contact us immediately.

12. Do Not Track

Our Platform currently responds to "Do Not Track" browser signals by limiting non-essential tracking for users in jurisdictions where this is required. We will update this section as standards evolve.

13. Supervisory Authority Complaints

If you believe our data processing violates applicable data protection law, you have the right to lodge a complaint with your local data protection supervisory authority, including but not limited to:

• EU: Your national Data Protection Authority (DPA)
• UK: The Information Commissioner's Office (ICO)
• USA (California): California Privacy Protection Agency (CPPA)
• Nigeria: Nigeria Data Protection Commission (NDPC)
• Canada: Office of the Privacy Commissioner of Canada (OPC)
• Australia: Office of the Australian Information Commissioner (OAIC)

We encourage you to contact us first so we can address your concern directly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the Platform and/or by email at least 30 days before changes take effect where required by law. Your continued use of the Platform after the effective date constitutes acceptance of the updated Policy. For material changes to how we process sensitive data, we will obtain fresh consent where required.

15. Contact Us

For privacy inquiries, data subject rights requests, DMCA notices, or to contact our Data Protection Officer (DPO), please use the official support and contact channels within the Platform. We take all privacy concerns seriously and will respond promptly.