Processing of personal data

4. Canta, in its capacity as Controller of personal data, processes personal data in a manner that ensures appropriate level of security, including protection against unauthorised or illegal processing and against accidental loss, destruction or damage, while applying suitable technical and / or organisational measures in compliance with the following principles:
• lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency")
• data is collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes ("appropriateness in the processing of personal data and purpose limitation")
• adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimisation")
• accurate and kept up to date
• limitation of the storage for periods not longer than necessary for the purposes for which they are processed ("storage limitation")
• processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures ("integrity and confidentiality").
5. Canta processes personal data only if and to the extent at least one of the conditions listed below shall apply:
• Processing is required for the performance of an agreement with the Canta under which the data subject is party or to undertake steps at the request of the data subject prior to the signing of an agreement with the Canta.
• Processing is required for compliance with a legal obligation which applies to the Canta in its capacity as Canta of personal data. the data subject has given consent
• the data subject has given consent for the processing of their personal data for one or more specific purposes. In the cases when personal data are processed solely on the grounds of consent, the data subject has the right to withdraw such consent at any time. Withdrawal of the consent of the data subject is not applicable in the cases when the processing of the data is based on the provisions of items "a" and "b" above.
6. Canta, does not process personal data which reveal racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data solely for the purpose of identification of the natural person, data concerning health or data concerning sex life or sex orientation of the natural person unless the data subject have given an explicit consent for the processing of such data for one or more specific purposes.

Purpose of personal data processing (how we use your data)

Type of purpose

We collect the information you provide when:

• when you fill in forms;
• when you communicate with us;
• when you register to use the our app/site;
• when you open an account or use our services;
• when you participate in online discussions, surveys or promotions;
• when you contact us for any other reason.

We will collect the following information:

• Your name, address and date of birth
• Your email address, phone number and information about the device used (for example, your phone, computer or tablet);
• Information about your bank account, such as account number, sort code or IBAN number;
• Information about your debit and credit cards (or other debit and credit cards you have on file), such as card number, expiration date, and CVC (the last three digits on the back of the card);
• Identification documents (for example, your passport or driver's license), copies of any documents provided to identify you and any other information provided to prove your eligibility for our services;
• Information you provide when applying for credit, including details of your income and financial obligations;
• Records of our discussions, if you contact us or if we contact you (including records of telephone calls)
• Your image as a photo or video (if required as part of our KYC checks or when you upload a photo to your account).

Using the company's website (canta.io):

• We collect a variety of information through your general interaction with the website.
• Personal Data we collect may include, but is not limited to, browser and device information, data collected through automated electronic interactions and application usage data.
• Likewise, we will track your process across our websites and applications to verify that you are not a bot and to optimize our services

Tracking data and cookies:

• We use "Cookies&", which are text files placed on your computer, to help us analyze how users use our services, and similar technologies (e.g. web beacons, pixels, ad tags and device identifiers) to recognize you and/or your device(s) on, off and across different devices and our services, as well as to improve the services we are offering, to improve marketing, analytics or website functionality. The use of Cookies is standard on the internet. Although most web browsers automatically accept cookies, the decision of whether to accept or not is yours. You may adjust your browser settings to prevent the reception of cookies, or to provide notification whenever a cookie is sent to you. You may refuse the use of cookies by selecting the appropriate settings on your browser. However, please note that if you do this, you may not be able to access the full functionality of our websites.

Google Analytics:

• The Canta website uses Google Analytics, a web analytics service from Google, Inc. ("Google"). Google Analytics uses cookies-text files hosted on visitor computers that help website operators analyze how visitors use the site. Information about the use of the website by visitors, created using cookies, is usually transmitted and stored on Google's servers in the United States.
• On behalf of the website operator, Google will use this information for the purpose of evaluating the website for its users, in order to compile reports on website activity, and to provide other services relating to website activity and internet usage for website operators.
• Google will not associate the IP address transferred in the context of Google Analytics with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser. However, please note that in this case you may not be able to use the full functionality of this website.
• Furthermore, users can prevent the collection of data about their use of the website (including their IP address) generated by the cookie, and the processing of data by Google, by downloading and installing the browser plug-in through the following link: http://tools.google.com/dlpage/gaoptout?hl=en .

Facebook Tracking Pixel service:

• Facebook Tracking Pixel with Remarketing is used by Canta to display targeted ads to visitors to this website, depending on how they are used when visiting the Facebook social network (hereinafter referred to as Facebook Advertising). With Facebook Tracking Pixel, a direct link to Facebook servers is used when visitors use this website. He sends information to the Facebook server about the user visiting this website, and Facebook processes this information and can link it to a Facebook user account. For more information about how Facebook collects, processes data, and protects their privacy, see Facebook Privacy Policy at https://www.facebook.com/about/privacy.
• You may at any time object to using your information for such remarketing. You can disable Facebook Tracking Pixel in your Facebook account settings or in the following cookie tracking settings at any time.

Content recommendation

• In accordance with your individual consent or in cases where this is expressly permitted by applicable e-mailing laws, Canta may send you marketing messages on your email address about products and services offered by Canta. In this case, we can also use your collected information to set up such marketing messages, and collect information about whether you opened the message and what link in the text you clicked on).
• You can opt out or withdraw your consent to receive marketing emails at any time by either withdrawing the consent clicking the "unsubscribe"; link provided in every marketing email.

Rights of the data subjects

7. Right to information (in relation to the processing of the data subject's personal data by the Canta- the natural persons that are data subjects have the right to receive information* as to the Canta as personal data Canta, as well as the processing of their personal data.

8. Right of access to own personal data - the data subjects have the right to receive from the Canta confirmation as to whether personal data related to them are processed and if so, to be given access to the data and the following information: purpose of the processing; respective personal data categories; personal data recipients or categories of recipients, if any; the intention of the Canta to transmit personal data to a third party (where applicable); personal data storage period; existence of the right to correct personal data, as well as the right to object against the processing of personal data; existence of automated decision making, including profiling (if any); information as to all rights that the data subject has; the right to file a complaint with the supervision authority.

9. Right to rectification of personal data (if data is not accurate) - the data subject has the right to request the Canta to rectify, without undue delay, any incorrect data pertaining to the data subject.

10. Right to erasure of personal data (right "to be forgotten") - the data subject may request from the Canta to erase personal data, if any of the conditions listed below exist:
• Personal data are no longer needed for the purposes they have been collected for or processed otherwise;
• The data subject withdraws his / her consent, which data processing is solely based on, and no other legal grounds for the processing exist (processing due to regulatory obligation of the Canta, an agreement signed with the Canta);
• The data subject objects against the processing and no legal grounds for the processing exist that prevail;
• The personal data were processed unlawfully;
• The personal data should be erased in order to comply with a legal obligation under the European Union law or the laws of the United Kingdom, which apply to the Canta in its capacity as personal data Canta;
• The personal data have been collected in relation to the offering of information society services to children and consent was given by the holder of parental responsibilities for the child.

11. Right to limitation of processing by the Canta or by the personal data processor - specific conditions are required to be in place for that right to be exercised, namely:
• Accuracy / up to date nature of the data is disputed by the data subject. In this case the limitation of the processing is over a period of time allowing the Canta to check the accuracy of the personal data;
• The processing is unlawful, but the data subjects do not wish their personal data to be erased, but rather require limitation of their use;
• The Canta no longer needs such personal data for processing purposes, but the data subject requires them for establishing, exercising or defending legal claims;
• The data subject has objected to the processing while awaiting a check to be performed whether the Canta's legal grounds prevail over the interests of the data subject.

12. Right to transferability (data portability) of the personal data between the various Cantas - the data subjects have the right to receive personal data pertaining to them, which they have provided to the Canta in a structured, widely used and machine readable format and have the right to transfer such data to another Canta without hindrance by the Canta, to which personal data has been provided, when processing is based on consent or contractual obligation and the processing is automated. When exercising the right to transferability the data subject has the right to receive also direct transfer of the personal data from the Canta to another Canta, where technically feasible.

13. Right to object against the processing of their personal data - data subjects have the right to object before the Canta against the processing of their personal data, whereby the Canta shall cease such processing, unless Canta is able to prove that compelling legitimate grounds for the processing exist that override the interests, rights and freedoms of the data subject, or for the establishment, exercising or defense of legal claims. In case of objection against the processing of personal data for direct marketing purposes the Canta shall cease such processing forthwith.

14. The data subject also has the right not to be subject to decision based solely on automated processing, including profiling, which ensues legal consequences for the data subject or significantly affects the data subject otherwise.

15. Right to defense through judicial or administrative procedure if the data subject's rights have been breached - if the data subjects decide that their right to personal data protection and privacy has been violated, they may file a complaint with the relevant supervision authority - or to file a claim with the court to defend their rights.

16. For Residents of California - California Consumer Privacy Act (CCPA)

The CCPA provides consumers (California residents) with specific rights regarding their personal information. This section provides additional details about the personal information we collect about California consumers and the rights afforded to them under the California Consumer Privacy Act or “CCPA.”

Subject to certain limitations, the CCPA provides California consumers the right to request to know more details about the categories or specific pieces of personal information we collect (including how we use and disclose this information), to delete their personal information, to opt out of any “sales” that may be occurring, and to not be discriminated against for exercising these rights.

California residents may make requests to obtain certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please send an email to support@Cantas.com. Your request will be responded to within 45 days. Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. You may only make a verifiable consumer request for access or data portability twice within a 12-month period. Government identification may be required to verify any requests received.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. We only use personal Information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request.

For more details about the personal information, we have collected over the last 12 months, please see section ‎1 regarding the types of information collected by us. We collect this information for the business and commercial purposes that are described in our Privacy policy. We share this information with the types of third parties as described in our Privacy Policy We do not sell the personal information we collect and will not sell it without providing users right to opt out. Please note that we do use third-party cookies for our advertising purposes, which is further described in our Privacy policy.

Disclosure of personal data

17. Canta may disclose the personal data to the following categories of persons:
• The persons whom the data relate to, namely: persons using Canta services or products, or persons filing a request to use Canta services, as well as persons who are party to Canta and / or other transactions and contractual relations with the Canta;
• Persons that have right to access to personal data by virtue of law or another regulation;
• Persons as to whom the right to disclosure is stipulated in an agreement signed with the Canta.

Exercise the rights

18. In exercising their right to access natural persons have the right to request from Canta at any time:
    1. Confirmation as to whether data related to them are processed by the Canta, the purpose of the processing, the data category and recipients of such data or the categories of recipients' data is disclosed to;
    2. To send them a message in an understandable format, containing the personal data subject to processing and any information available as to the source of such data;
    3. Information as to the logic of any automated processing of personal data pertaining to natural persons, at least in the case of automated decisions under the provisions of the General Data Protection Regulation
    • erases, rectifies or blocks their personal data the processing of which is not compliant with the requirements of the effective legislation
    • notifies the third parties to which the personal data of the natural persons have been disclosed as to any erasure, rectification or blocking in accordance with item 1 above, except when this proves to be impossible or would involve a disproportionate effort.

19. (a) Natural persons exercise their rights by filing a written request to the Canta, containing as a minimum the following information:

    • name, personal ID number, address and other data allowing identification of the respective natural person; description of the request;
    • Signature, date, correspondence address and telephone number.

    (b) The filing of the request is free of charge.

    (c) Upon filing of a request by an authorized person, the notarized power of attorney must be attached to the request.

    (d) In case of death of the natural person, his / her rights are exercised by his / her heirs and certificate of heirs shall be attached to the request.

20. The Canta shall review and pronounce on the request within 1 month as of its filing. This period may be extended by further two months, if necessary. The Canta informs the data subject as to any such extension within 1 month as of receipt of the request, stating the reasons for the delay. When the data subject files a request by electronic means, the information is provided electronically, if possible, unless the data subject has requested otherwise.
21. The Canta provides an answer to the requesting person taking into account their preferred form for the provision of the information (orally or in writing - as a hard copy of electronically).
22. Where data do not exist or their provision is forbidden by law, access of the requesting party to such data is refused.