プライバシーポリシー

This Privacy Policy describes how personal data is processed in connection with Votinova, a software service (SaaS) for interactive presentations and real-time audience voting, developed and operated by Atbion OÜ.

Atbion OÜ provides the software service directly to its customers. Votinova is neither a marketplace nor an intermediary between third parties. The Platform allows a presenter to create or import presentations with interactive questions, run them live, and have an audience of participants respond in real time.

The processing of personal data is governed by the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Estonian data protection law (Isikuandmete kaitse seadus). This Policy is addressed both to customers acting as businesses or professionals (B2B) and to customers acting as consumers (B2C), as well as to the participants in sessions.

For any query relating to the processing of your personal data or the exercise of your rights, you may contact privacy@votinova.com.

For the purposes of this Policy, the GDPR definitions apply:

In addition, this Policy uses the following service terms: presenter (the customer who runs the sessions), organisation (the holder of the multi-tenant account and of the billing), participant (a member of the audience who responds), session (a live event) and presentation (the set of slides and interactive questions).

In Votinova there are two distinct processing relationships that must be clearly differentiated.

3.1. Account data — Atbion OÜ as controller

With respect to the account data of the presenter and of the members of the organisation, Atbion OÜ is the controller. Atbion OÜ determines the purposes and means of the processing of the data necessary to create and manage the account, provide the service to the customer, issue invoices and ensure the security of the Platform.

3.2. Participant data — the customer as controller and Atbion OÜ as processor

With respect to the personal data processed during the sessions run by the customer (the audience data), the customer or the organisation is the controller and Atbion OÜ acts as the processor, processing such data on behalf of the customer and according to its instructions, on the terms of Article 28 of the GDPR.

The customer decides what data it collects from its audience —depending on whether it configures anonymous, identified or authenticated mode— and is responsible for the lawfulness of such processing vis-à-vis its audience. Atbion OÜ provides the Data Processing Agreement (DPA) and the security measures. The terms of this processing on behalf of the controller are set out in detail in the Data Processing Agreement.

If you are a participant in a session and wish to exercise your rights over the data processed during that session, you must contact the responsible customer (the presenter or organisation that organised the session). Atbion OÜ, as processor, will provide the controller with reasonable assistance in accordance with the DPA.

4.1. Account data (Atbion OÜ as controller)

4.2. Participant data (the customer as controller, Atbion OÜ as processor)

By default, participants are anonymous. The collection of a name or email address only occurs when the responsible customer expressly configures it for its session.

The processing of account data by Atbion OÜ as controller is based on the following purposes and legal bases under Article 6 of the GDPR:

Where the processing is based on legitimate interest, Atbion OÜ has weighed that interest against the rights and freedoms of the data subjects. Where it is based on consent, this may be withdrawn at any time, without affecting the lawfulness of the prior processing.

With respect to participant data, the legal basis for the processing is determined by the customer responsible for the session, in accordance with section 3.2.

In order to detect potentially unlawful or inappropriate content before it is shown to the audience, Votinova applies automated content moderation filters:

• Images (for example, those uploaded or used in heatmap questions over images) are analysed using AWS Rekognition.
• Text (for example, open-ended responses and audience questions) is analysed using AWS Comprehend.

These automated filters operate as an assisted prior control. The final decision rests with a person: the presenter has human review tools to moderate audience questions and responses before their publication.

This moderation does not constitute an automated individual decision producing legal effects concerning persons or significantly affecting them in a similar way within the meaning of Article 22 of the GDPR. It is an assisted filter subject to human control.

Atbion OÜ relies on carefully selected service providers that act as processors or sub-processors, or as independent controllers as applicable. All processors are bound by contractual confidentiality and security obligations compliant with Article 28 of the GDPR.

Atbion OÜ may disclose personal data to public authorities where there is a legal obligation to do so.

Account data is hosted and processed primarily in the European Union (infrastructure in the AWS EU region and MongoDB Atlas cluster in the EU).

Certain providers may process personal data outside the European Economic Area, in particular in the United States. In such cases, the transfers are covered by the mechanisms provided for in Chapter V of the GDPR:

• The EU-U.S. Data Privacy Framework, where the provider is certified under it, in relation to Stripe, Google, Apple and Firebase, as applicable.
• The standard contractual clauses approved by the European Commission, supplemented with additional measures where necessary, in relation to Stripe, Sentry and Firebase, as applicable.

You may request additional information on the safeguards applicable to these transfers by writing to privacy@votinova.com.

When the data is no longer necessary for the purposes for which it was collected, it is securely erased or anonymised, unless its retention is required by a legal obligation.

In accordance with Articles 15 to 22 of the GDPR, data subjects have the right to:

• Access their personal data.
• Rectify inaccurate or incomplete data.
• Request the erasure of their data.
• Request the restriction of processing.
• Obtain the portability of their data.
• Object to processing based on legitimate interest.
• Withdraw the consent given, at any time, without retroactive effect.

To exercise these rights with respect to account data (processing for which Atbion OÜ is the controller), you may write to privacy@votinova.com. Atbion OÜ will respond to your request within one month of its receipt, extendable by a further two months where the complexity or the number of requests so justifies, in which case you will be informed of the extension.

If your request relates to participant data processed during a session, the controller is the customer that organised the session; you must contact that customer to exercise your rights. Atbion OÜ, as processor, will provide the reasonable assistance that the controller requires.

If you consider that the processing of your data does not comply with the applicable rules, you have the right to lodge a complaint with the competent supervisory authority (see section 15).

The Platform uses cookies and equivalent storage mechanisms. Detailed information on the cookies used, their purposes, their periods and the management of consent is set out in the Cookie Policy.

Atbion OÜ applies appropriate technical and organisational measures to protect personal data, in accordance with Article 32 of the GDPR. Among others, passwords are stored hashed by means of the Argon2 key derivation function, communications are encrypted in transit by means of TLS, and data is hosted on infrastructure located in the EU region.

The detail of the security measures is set out in the Safety Standards.

The Platform is not directed at minors as account holders. Atbion OÜ does not knowingly collect data from minors for the creation of presenter accounts.

Where an audience includes minors, it is for the customer responsible for the session to ensure the lawfulness of the processing of the data of minor participants, including obtaining the consent of the holders of parental responsibility where appropriate, in accordance with the applicable legislation.

Atbion OÜ reserves the right to amend this Privacy Policy. Material changes will be notified with reasonable advance notice by means of their publication on the Platform and, where appropriate, by email. The version in force will always be the one published at https://votinova.com/legal/privacy-policy, with an indication of its effective date.