Privacy Statement

IMPORTANT – PLEASE READ CAREFULLY

Privacy policy

Introduction

This policy was last reviewed and updated in March 2026 to ensure compliance with current EU and US data protection regulations, including general data protection regulation (GDPR), California Privacy Rights Act (CPRA), and applicable state privacy laws.Previous versions are available upon request.Cleeng B.V. (a private limited company organized under the laws of the Netherlands, with registered office at Reimersbeek 14, 1082 AG Amsterdam, Netherlands) (“Cleeng”, “we”, “us”, “our”) provides subscription retention management services and merchant services, including operating as a Merchant of Record for certain Transactions.This Privacy Policy explains what personal data Cleeng collects, uses, shares, and otherwise processes about the following data subject categories:

• Visitors: Individuals who visit our website (cleeng.com) and related online properties.
• Users: Individuals who are registered and opened an account for the purpose of using our products and services, including our Merchant Module and related subscription management platforms.
• Merchants/Customers: Representatives of merchant customers who interface with our services.
• Applicants: Individuals applying for employment, internship, or other work opportunities with Cleeng.
• Managed Users: Individuals who are customers of our merchant Customers and whose data we process on behalf of those Merchants.

Scope and Roles
‍This Privacy Policy applies to Personal Data processing by Cleeng in our capacity as a data controller (when we determine purposes and means of processing) and, when we process Personal Data on behalf of Merchants, in our capacity as a data processor.

This Policy is intended to be transparent, accessible, and fair. We are committed to being clear about how we collect, use, protect, and share your Personal Data.

‍Definition of Personal Data and other definitions
‍
‍“Personal Data” means any information relating to an identified or identifiable natural person. This includes both directly identifying information (such as name, email address, or payment card details) and indirectly identifying information (such as transaction histories, device identifiers, or usage patterns) that, alone or in combination with other information, could identify an individual.

Terms not defined in this Privacy Policy shall have a meaning as specified in the Master Subscription Agreement and Merchant Schedule.

‍2. Personal Data We Collect

2(a). Categories of Personal Data by data subject type
‍We collect different categories of Personal Data depending on how you interact with Cleeng.
‍
A. Visitors (Website and Online Properties) 🌐

B. Merchants and Merchant Representatives 🤝

C. Managed Users of Merchants (Merchant of Record Model) 🛒When you purchase or subscribe through a merchant using Cleeng as Merchant of Record, we act as an independent data controller for payment, tax, compliance, and fraud purposes, and as a data processor for other services strictly on the Merchant's instructions.

D. Job Applicants and Candidates 📃

2(b). Personal Data from third-party sources
‍We may receive Personal Data about you from service providers (e.g., payment processors, analytics providers), law enforcement, regulatory authorities, business partners, public records, data aggregators (for underwriting/KYC/AML), and customer feedback platforms. We only process this data where we have a lawful basis and the data was lawfully obtained.
‍
‍2(c). Data we do not intentionally collect
‍We do not deliberately collect or process, unless strictly necessary and permitted by law: Special category data (race, health, sex life, etc.), children’s data under 18 years of age, precise real-time location data, protected health information governed by HIPAA, or social media data (unless voluntarily linked).

‍2(d). Data minimization principle
‍We adhere to the principle of data minimization and only collect Personal Data that is adequate, relevant, and limited to what is necessary for the purposes identified. If you believe we are collecting unnecessary data, please contact us at privacy@cleeng.com.

‍3. Purposes and Legal Basis for Processing Personal Data
‍Under GDPR and equivalent laws, we process Personal Data only where at least one legal basis applies.

3(a). General Legal Bases ⚖️

• Contract: Processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.
• Legal obligation: Processing is required to comply with applicable laws, regulations, or court orders.
• Legitimate interests: Processing is necessary for our legitimate business interests, provided these do not override your fundamental rights and freedoms.
• Consent: Processing is based on your explicit, informed consent where required by law.
• Vital interests: In rare cases, processing may be necessary to protect vital interests of you or another person (for example, serious emergency situations).
• Public task: This basis does not generally apply to Cleeng, which is a private company and does not perform official public tasks.

Processing Activities by Purpose:

3(b). Purpose limitation and compatibility
‍We will not use your Personal Data for purposes that are incompatible with those listed above unless:

• We obtain your explicit consent
• The new purpose is compatible with the original purpose under applicable law
• We provide clear notice of the new purpose where required

3(c). Withdrawal of Consent
‍Where we rely on consent, you may withdraw it at any time by emailing privacy@cleeng.com with “Withdraw Consent” in the subject line and specifying which processing you want to stop. Withdrawal does not affect the lawfulness of processing that took place before the withdrawal.

‍4. Sharing of Personal Data with Third Parties
‍We share Personal Data only when necessary, with appropriate safeguards, and subject to the purposes outlined in Section 3.

‍4(a). Service Providers and Processors
‍We engage third parties to perform services on our behalf (as data processors). These vendors assist with core business functions, including:

• Payment processing and financial services (e.g., anti-fraud, settlement).
• Hosting, cloud infrastructure, and content delivery networks (CDNs).
• Customer support, ticketing, and communication tools.
• KYC/AML, identity verification, tax/VAT services, and underwriting.
• Analytics, marketing, advertising, and Customer Relationship Management (CRM) systems.
• HR, payroll, and related business operations systems.

These providers are bound by Data Processing Agreements (DPAs) requiring them to process Personal Data only on our documented instructions and implement appropriate security measures.

‍4(b). Merchant Customers and Partners

• With Merchants: We share relevant transaction, subscription, and account information with our Merchant customers to enable them to manage their relationships with Managed Users.
• With Partners: We share Personal Data with integration and API partners at your direction, where you authorize such integrations.

4(c). Corporate and Legal Disclosures
‍We may disclose Personal Data to:

• Affiliated Companies: Cleeng B.V. shares Personal Data within the group for service provision, infrastructure, support, and compliance, governed by intra-group agreements.
• Legal & Regulatory Authorities: Courts, regulators, tax authorities, and law enforcement where necessary to protect our rights, safety, property, or comply with a legal obligation (e.g., a court order).
• Business Transfers: Personal Data may be transferred as part of a merger, acquisition, reorganization, or asset sale, subject to applicable law and appropriate safeguards.

4(d). Data Sharing Prohibitions
‍We do not:

• Sell Personal Data to data brokers in the conventional sense.
• Share Personal Data for cross-context behavioral advertising without providing required CCPA/CPRA notices and opt-out mechanisms.

4(e). International Transfers
‍We operate globally and may transfer Personal Data to countries other than the one in which you reside. Where we transfer Personal Data from the EU/EEA or UK to countries without an adequacy decision, we rely on the following legally approved mechanisms:

• The EU–US Data Privacy Framework (where applicable).
• Standard Contractual Clauses adopted by the European Commission or UK equivalents.
• Transfer Impact Assessments and supplementary measures (such as encryption and access controls).
• Article 49 GDPR derogations (e.g., contract performance or explicit consent) only in limited cases.

You may contact privacy@cleeng.com to obtain more details about our international transfer mechanisms.

‍5. Data Retention and Deletion
‍Cleeng manages the retention of your Personal Data by holding it only for the duration required to achieve the objectives detailed in this Policy, to comply with our binding legal obligations, or while a demonstrable legitimate business need exists that adheres to all relevant legal and compliance mandates. In specific circumstances, we must retain Personal Data for longer periods, for example, when necessary to fulfill statutory requirements, resolve disputes, collect outstanding fees, or when an extended period is mandated or expressly permitted by an applicable law, rule, or regulation.

If you have chosen to receive marketing materials from us, we will preserve records of your marketing preferences until you decide to opt out of such communications. This retention is executed in accordance with our documented internal policies.

The precise retention period for your Personal Data is determined by considering a set of factors:

• The overall volume, category, and inherent sensitivity of the Personal Data processed.
• The potential security risk associated with any unauthorized disclosure or use.
• The original purposes for which we utilize the data, and whether those purposes can be feasibly accomplished through alternative, less data-intensive means.
• The stringency of current legal and regulatory requirements that apply to that specific data set.

Following the expiration of the determined retention period, any remaining information is either aggregated or rendered completely depersonalized, ensuring it can no longer be used to identify you individually.

‍5(a). Your right to deletion
‍You can request deletion of your Personal Data under the conditions described in Section 7. We may retain certain data where necessary to comply with legal obligations, prevent fraud, or establish, exercise, or defend legal claims.

‍5(b). Secure destruction
‍When we delete Personal Data, we use appropriate technical and organizational measures to ensure secure destruction or anonymization, and we periodically review and audit retention and deletion practices.

‍6. Security and Protection of Personal Data
‍We implement technical, organizational, and administrative measures designed to protect Personal Data against unauthorized access, loss, misuse, alteration, and destruction.

‍6(a). Technical measures
‍- Encryption of data in transit (TLS 1.2+).  
- Encryption of sensitive data at rest (e.g., AES‑256).  
- Strong authentication and role‑based access control.  
- Firewalls, intrusion detection and prevention, and DDoS protection.  
- Regular vulnerability scanning and penetration testing.  
- PCI DSS Level 1 controls for payment data (including tokenization).

‍6(b). Organizational measures
‍- Appointment of a Data Protection Officer (DPO) contactable at privacy@cleeng.com.  
- Privacy‑by‑design and by‑default practices in product and process design.  
- Data Protection Impact Assessments for high‑risk processing.  
- Cleeng personnel (employees and contractors) training and confidentiality obligations.  
- Third‑party risk management and security due diligence.  
- Data Processing Agreements and audit rights with processors.

‍6(c). Incident response and breach notification
‍- Continuous monitoring for suspicious activity where feasible.  
- Prompt investigation and containment of suspected incidents.  
- Notification to relevant supervisory authorities within statutory timelines (e.g., 72 hours under GDPR where required).  
- Notification to affected individuals without undue delay where the breach is likely to result in high risk to their rights and freedoms.  
- Cooperation with Merchants to support their own breach notification duties.
‍
‍6(d). Your responsibilities
‍You are responsible for:
- Keeping account credentials confidential.  
- Using strong, unique passwords and enabling multi‑factor authentication where available.  
- Promptly notifying us of any suspected unauthorized access or compromise.

‍7. Your Privacy Rights
‍The rights available to you depend on your location and applicable law (e.g., GDPR, CCPA/CPRA, and other state or national laws).
‍
‍7(a). Your Rights
‍Depending on your jurisdiction, you may have the right to:

• Right of Access/Know: Request confirmation of what Personal Data we process about you, and to receive copies of that data.
• Right to Rectification/Correction: Have inaccurate or incomplete Personal Data corrected.
• Right to Erasure/Deletion: Request the deletion of your Personal Data in certain circumstances (e.g., when the data is no longer necessary for the purpose for which it was collected).
• Right to Restriction of Processing: Limit the way we process your Personal Data in certain cases.
• Right to Data Portability: Receive your Personal Data in a structured, commonly used, and machine-readable format and transmit that data to another controller (GDPRonly).
• Right to Object: Object to certain processing, including processing based on legitimate interests and direct marketing.
• Right to Opt-Out of Sale or Share: Opt out of the "sale" or "sharing" of your Personal Data (including certain cookie-based sharing) as defined under US state laws (US State Laws only).
• Right to Limit Use and Disclosure of Sensitive Personal Data: Limit the use and disclosure of sensitive Personal Data (US State Laws only).
• Right to Not be Subject to Automated Decision-Making: Not be subject to a decision based solely on automated processing where it has legal or similarly significant effects (GDPR only).
• Right to Non-Discrimination: Not be discriminated against for exercising your privacy rights.
• Right to Appeal: Appeal a refusal of a privacy request (in some US states).
• Right to Withdraw Consent: Withdraw consent where processing is based on consent.

We provide a “Do Not Sell or Share My Personal Information” mechanism where required (for example, via website footer or cookie settings).

‍7(b). Other jurisdictions
‍Residents of other jurisdictions (for example, Switzerland, United Kingdom, Canada, or additional US states) may have similar rights under their respective privacy laws.

‍7(c). How to exercise your rights
‍To exercise your rights:

• Email privacy@cleeng.com with a clear subject (e.g., “Data Access Request”, “Deletion Request”, “Correction Request”).
• Provide sufficient information to verify your identity (and, where applicable, authority to act on another’s behalf).
• Describe your request in detail (e.g., what data, which right, and scope).

We will respond within the timelines set by applicable law (typically 30–45 days, with possible extensions for complex requests). If we deny or limit your request, we will explain the reasons and tell you how you can appeal or complain to a regulator.

‍7(d). Complaints to supervisory authorities
‍If you believe that our processing of your Personal Data infringes data protection laws, you may lodge a complaint with a competent supervisory authority or regulator in your jurisdiction. You are also encouraged to contact us first so that we can try to resolve your concerns.

‍8. Cookies, Tracking Technologies, and Analytics
‍We use cookies and similar technologies to operate, secure, and improve our services, personalize content, and support marketing and analytics, as described in our Cookie Policy.Cookies are grouped into categories, such as:
- Strictly necessary / essential cookies (required for core functionality and security).  
- Performance / analytics cookies (for understanding usage and improving services).  
- Functional / preference cookies (for remembering settings and preferences).  
- Marketing / advertising cookies (for measuring and delivering relevant advertising).

You can manage cookie and tracking preferences using:
- Our cookie consent banner and settings.  
- Your browser or device settings.  
- Global Privacy Control or similar signals where supported.

For full technical details about the cookies and trackers we use, please see our separate Cookie Policy.

9. Contact Information and Data Protection Officer
‍If you have questions about this Privacy Policy or our data practices, or you wish to exercise your privacy rights, please contact:

We review this Privacy Policy at least annually and update it as needed to reflect changes in our practices, legal requirements, and industry standards.

Effective Date: 13 March, 2026
Last Updated: 13 March, 2026

Privacy Policy - 13 March 2026 (current)

Privacy Policy - 29 March 2022