Third-Party Privacy Notice.

1. GENERAL INFORMATION

In this section, we have included general information about us and our activities in which we use personal data. 

We are committed to respecting and protecting your privacy and the data and information concerning you that we use in our activities. Through this Privacy Notice (“Privacy Notice“), we provide you with information about our activities in which we use your personal data when carrying out said activities, according to applicable legal requirements.

The current Privacy Notice has been prepared by Shape Robotics  A/S, a company based in Lyskær 3C, 4th, 2730 Herlev, Denmark, registered with the Danish Trade Registry under no. 38322656 and having tax code no. DK38322656 (in this Privacy Notice, “we” or “the Company” or “Shape Robotics”). We use data and information related to you to carry out our activities and provide our services. We obtain this data and information directly from you when we come into contact, or from other individuals (e.g., schools may provide information about children and educators participating in our training sessions). We may also automatically obtain data and information about you, for example, when you interact with us through our website or social media pages.

We commit to using your data and information in good faith and in accordance with legal requirements and high data protection standards, fully aware of the importance of the data and information received for you. “Personal data” means any information about an identified or identifiable natural person, and an identifiable person is one who can be identified, directly or indirectly, especially by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific elements specific to their physical, physiological, genetic, mental, economic, cultural, or social identity. In our relationship, personal data includes identification data, images, and contact data for you or for minors for whom you are responsible, as well as data about our interaction through our websites or email and data from your social media profiles. On the other hand, general information that does not relate to a specific individual or data concerning a legal person (e.g., a company, association, or public authority) is not considered personal data.

We only use data and information related to you in connection with our activities and for our interests as a data controller. We do not use your data and information for other companies; if this happens in the future, we will inform you. It is important that the data and information you provide to us are accurate and up-to-date. If you notice, in our interaction with us, that some data and information related to you or to other individuals whose data you provide to us are not up-to-date, please correct that data and information. We may not be able to provide certain services if the data we have is not accurate and up-to-date, or if they are not provided correctly and completely. We assume no responsibility for any situation that may arise from the use of incorrect data and information received from you.

This Privacy Notice is addressed to users of our services, especially minors participating in our events, their parents, teachers, and accompanying persons, our partners and their representatives, visitors to our websites, as well as other individuals with whom we interact in the course of our activities. You will find specific details for each category of individuals whose personal data we use in our activities in this Privacy Notice.

Therefore, we encourage you to take the necessary time to read our Privacy Notice in its entirety and carefully. Please do not hesitate to communicate any uncertainties using the contact details at the end of this Note. The provision of our services, including our aforementioned websites, is based on the information described in this Privacy Notice, which we expect you to have read before using Shape Robotics services and websites.

This Privacy Notice is prepared by Shape Robotics A/S as the data controller, based on the data protection legislation applicable in the European Union, especially Articles 13-14 of Regulation 2016/679 on the protection of individuals concerning the processing of personal data and the free movement of such data (“GDPR”). The Privacy Notice is supplemented with forms, information, or documents generally applicable in our relationship with you.

2. THE PRIVACY OF YOUR DATA WITH SHAPE ROBOTICS – IN SHORT

In this Section, we summarized the essential information from this Privacy Notice regarding the use of your personal data, as well as the data of individuals for whom you are responsible.

3. YOUR RIGHTS RELATED TO THE USE OF YOUR DATA

We have detailed, in this Section, the rights you are entitled to, in accordance with data protection legislation, regarding the use by us of your personal data or the data of individuals for whom you are responsible.

According to applicable law, you have the following rights related to our use of your personal data or the data of individuals for whom you are responsible:

1. Right of access: you can obtain from us confirmation that we process your personal data or the data of individuals for whom you are responsible, as well as information regarding the specific processing, such as: purpose, categories of processed personal data, recipients of the data, the period for which the data is stored, the existence of the right to rectify, erase, or restrict processing. This right allows you to obtain a free copy of the processed personal data and, at an additional cost, extra copies.
2. Right to rectification of data: You can request us to modify incorrect personal data or, as the case may be, to complete incomplete data.
3. Right to erasure: You can request the erasure of your personal data or the data of individuals for whom you are responsible when: (i) they are no longer necessary for the purposes for which we collected and use them; (ii) you have withdrawn your consent for the processing of personal data, and we cannot use them on other legal grounds; (iii) the personal data are processed unlawfully, and you oppose the erasure, instead requesting the restriction of their use; or (iv) personal data must be erased according to relevant legislation.
4. Withdrawal of consent: You can withdraw your consent at any time regarding the processing of personal data based on consent, without affecting the processing carried out before the withdrawal. You can identify situations where we use personal data based on consent in Section 4 (When and why we use your personal data) of this Information Note. Please also consider the information in Section 5 (How to give and withdraw your consent for the use of your data) regarding the withdrawal of consent for data processing.
5. Right to object: You can object at any time to processing based on our legitimate interests by presenting reasons specific to your situation or to the individuals for whom you are responsible. For details on the processing we carry out based on legitimate interests, please refer to Section 4 (When and why we use your personal data) below.
6. Restriction of data processing: You can request the restriction of processing your personal data or the data of individuals for whom you are responsible by Shape Robotics if: (i) you contest the accuracy of personal data for a period that allows us to verify the accuracy of the data in question; (ii) the processing is unlawful, and you oppose the erasure of personal data, instead requesting the restriction of their use; (iii) the data are no longer needed for processing, but you request them for a legal action; or (iv) if you have objected to the processing, for the time period during which it is verified whether our legitimate interests as the data controller prevail over your rights as the data subject or those of the individuals for whom you are responsible.
7. Right to data portability: You may, under the law, request us to provide your personal data or the data of individuals for whom you are responsible that you have provided to us in a structured, commonly used, and machine-readable format (e.g., in CSV format). Also, if expressly requested, we can transmit your personal data to another entity, if technically possible. You can exercise the right to data portability only if (cumulatively): (i) the processing is carried out by automated means, and (ii) the processing is based on your consent or to perform a contract with you.
8. Right not to be subject to automated individual decision-making, including profiling: Currently, we do not process your personal data exclusively through automated individual decision-making processes. If we initiate such personal data processing, we will appropriately supplement this Information Note.
9. Right to lodge a complaint with the The Danish Data Protection Agency: You have the right to lodge a complaint with the National Authority for the Supervision of Personal Data Processing (https://www.datatilsynet.dk/english) if you believe that your rights have been violated, using the contact details of the authority included below. However, we kindly ask you to contact us with any complaints or concerns you may have before contacting the authority.

Carl Jacobsens Vej 35, 2500 Valby, Denmark

dt@datatilsynet.dk 

You can exercise these rights at any time by writing to us at the following postal address: Lyskær 3C, 4th, 2730 Herlev, Denmark, or at legal@shaperobotics.com.

When exercising any right, we reserve the right to request additional information to help identify you and ensure that we provide information only to individuals entitled to receive it, or to help us more clearly identify the data and information to which you refer in your request. If you write to us on behalf of someone else, we will need evidence of your identity and the identity of the person you represent, as well as evidence of your powers of representation.

4. WHEN AND WHY WE USE YOUR PERSONAL DATA

In this Section, we inform you about the data and information related to you or the individuals for whom you are responsible that we use in our activities. Please access the category or categories to which you belong, or the person for whom you are responsible, for details on the processing purposes pursued, the legal justifications we rely on when using your data, the categories of data we use, and finally, to whom else we may transmit your data.

• If you participate in our training sessions as a student, minor, parent, or other companion or legal guardian, or as a teacher or representative of a provider or partner:

We use your data and information as described below:

Generally, enrollment in our training courses and granting consent for promoting our activities through photographs, recordings, and testimonials are carried out by the parents or legal guardians of minor students participating in them through the agreement of the service contract with us, and the issuance of the necessary consents, as applicable.

In the case that you have disabilities or represent a person with disabilities, we will consider that you consent to us using information about the specific disabilities when you provide them to us. We assure you that we will not use this information for purposes other than organizing our courses and sessions, and the information will be deleted shortly after the respective event.

• If you are or represent a school, a potential client, a partner, or a supplier of Shape Robotics:

We use your data and information as described below:

*If you express your intention to purchase Shape Robotics’ products or services, or if you wish to discuss collaboration opportunities and options with us, we will collect your professional identification and contact data and share them with our partners who may contact you using the provided contact details. In such cases, we act as a joint controller with each of our partners regarding your contact and professional data.

**In this case, we will process personal data of representatives, shareholders, associates, and ultimate beneficiaries of our partners and suppliers. We will obtain this information from public sources and consultants specialized in such assessments.

• If you visit our headquarters (including by participating in our training courses):

We use your data and information as described below:

*We will provide you with the opportunity to provide us, if you wish, with your contact details so that we can contact you regarding our products and services (including through our partners, as described in this notice).

**In this case, we will transmit your data to the building’s reception where our headquarters is located.

• If you participate in our events

We use your data and information as described below:

*We consider only our data processing activities carried out at events, not those conducted by the event organizers.

• If you use our website https://shaperobotics.com 

We use your data and information as described below:

• If you interact with us through our Social Media pages 

We use your data and information as described below:

We wish to clarify that we expect you to give your consent when interacting with us through social media pages so that we can use data from your social media profiles; if you do not wish us to access your profile data, please refrain from interacting with our pages or adjust your profile availability settings.

• If you choose to receive newsletters and other communications regarding Shape Robotics’ activities or relevant matters

We use your data and information as described below:

• If you interact with our partners

In case you are conducting a business relationship with our partners regarding Shape Robotics products and services, we use your data and information as described below:

In this case, our partners provide us with data and information regarding the clients with whom they have entered into contracts or whom our partners consider potential clients. In these cases, we act as joint controllers with each of our partners regarding the personal data of clients or potential clients of our partners. You can exercise your rights as a data subject with respect to any of us and our partner with whom you are in contact, regarding the personal data processed by each of us and our partners.

1. If you fall into any of the categories mentioned above, as well as in any other situations in which you interact with us

We use your data and information as described below:

*In general, we will seek not to transmit your data in the context of transactions. If, however, the transmission of your data to third parties is necessary, we will carry out such transfers only based on confidentiality agreements signed with the data recipients.

5. HOW YOU GRANT AND CAN WITHDRAW YOUR CONSENT FOR THE USE OF YOUR DATA

In this section, you will learn how and when you can withdraw the consent given regarding the use of your data or the data of minors for whom you are responsible by us. This procedure is available only when we use this data based on your agreement as mentioned above.

You can withdraw your consent for the use of your data or the data of individuals for whom you are responsible, such as your children or others under your responsibility, at any time. We will cease using the respective data from the moment we become aware of the withdrawal of your consent. However, we note that our activities carried out before the withdrawal of your consent will remain valid. Nevertheless, we will comply with any requests for the deletion of data, images, and records processed by us based on your consent, under legal conditions, if you wish so.

You can withdraw your consent for the use of your data and information by writing to us at the following correspondence address: Lyskær 3C, 4th, 2730 Herlev, Denmark, or at legal@shaperobotics.com. If we need any clarifications from you to process the withdrawal of your consent, such as properly identifying you, we will request them at that time.

To withdraw your consent for receiving our periodic communications regarding our activities (newsletters), it is sufficient to use the “unsubscribe” option in our electronic communications. You can also write to us at the following correspondence address: Lyskær 3C, 4th, 2730 Herlev, Denmark, or at legal@shaperobotics.com.

6. HOW WE USE DATA OF INDIVIDUALS WITH WHOM WE ARE NOT IN DIRECT CONTACT

We specify below how we use the data of those individuals with whom we do not have a direct relationship, i.e., whose information, data, and images are transmitted to us by others.

When you provide the data of an individual with whom we do not have a direct relationship, for example, when you provide the data of a minor under your authority for participation in our activities, we expect that you represent that person (e.g., as a parent or legal guardian or with power of attorney).

Please inform these individuals, before disclosing their data to us, that you are about to provide us with information related to their activity and how we intend to use their data, for example, by transmitting a link to this Privacy Notice. We expect you to provide us with the data of these individuals only if they do not object to this transfer once they have been informed. For the purposes of informing these individuals about our Privacy Notice, we will consider making the Privacy Notice public on our website, accessible to anyone interested. Also, if we come into direct contact with these individuals, for example, to request their consent to the use of their data when necessary, we will ensure that we provide them with this Privacy Notice.

When interacting with our business partners, we may receive from their representatives the data of other employees or representatives of our partners. In this case, we expect that all individuals whose professional data is transmitted to us have access to this Privacy Notice to understand how we use their professional data and information.

If we obtain your data from other persons than yourself, we will send our Privacy Notice to you at our first direct communication with you. We will not ask for your consent to allow us to use your personal data without ensuring that you have received this Privacy Notice.

7. HOW LONG WE RETAIN YOUR DATA AND INFORMATION

Below are details about the time periods for which we retain your data or the criteria we consider when establishing these periods.

We retain and use your data only for the time necessary for our activities, including up to 3 years after the termination of our relationship (in the absence of other specific retention periods stipulated by law, detailed below in this section, or in other applicable documents and forms in our relationship).

In some cases, the law requires us to retain certain information and data, including your data, for legal retention periods, generally set for archival and document retention purposes; for example, retention periods of 5 or 10 years for financial and accounting documentation.

The data you specifically provide for participating in our events, courses, and sessions is primarily used for their organization, and we will delete them shortly after the conclusion of the event.

When we receive unsolicited or unnecessary data from you, for example, when you request services we cannot offer, we will delete the respective data after determining they are unnecessary, no later than 3 months from their receipt.

We may need to retain some data and information about you to support and protect our own interests, but we will not do this for more than 3 years after the termination of our relationship.

When we rely on your consent to use your data or the data of someone for whom you are responsible (e.g., a minor), for example, for the publication of images and video and/or audio recordings, we will retain the data and processing until you withdraw your consent or request deletion, in principle. However, we may delete, for our own reasons, the images and recordings of you and/or the person for whom you are responsible before you withdraw your consent or request deletion.

We retain the contact data of representatives of our customers, partners, and service providers for up to 3 years after the termination of our relationships.

At the expiration of data retention periods or at your request, if we have no legal justifications to continue retaining the data, we will delete your data or anonymize it, making it impossible to identify directly. However, we want to draw your attention to the fact that, for images or recordings published on our websites or social media pages, their deletion means that we will only remove them from our websites and social media pages, and we will request third parties to whom we have transmitted those images or recordings to delete them. Unfortunately, we cannot ensure the deletion of images and recordings from the websites or pages of third parties that have taken them from our websites or pages without our knowledge.

8. TO WHOM WE TRANSFER YOUR DATA

Below are general information related to individuals and entities to whom we may transmit your data for our activities.

We transmit your data only to individuals and entities that support us in our activities and provide sufficient guarantees regarding how they handle the data and information we provide to them. We do not sell your data and do not make them available to anyone for activities unrelated to us and our services.

We transmit information received from you to our partners so that they can provide you with services related to our activities; usually, our partners use your personal data independently of us, according to their own privacy notices made available to you by law and under their exclusive responsibility.

We may transmit or grant access to your data to some of our regular service providers, including providers of services related to our websites, communication services, our IT service providers (e.g., programming or data hosting), operators of social networks where we have accounts, and other online service providers, or our consultants and collaborators. We transmit your data only to providers we consider trustworthy, subject to confidentiality and data security obligations regarding your data and information. In most cases, these providers work under our instructions, but there are situations where these providers use your data independently of us, according to their own privacy policies.

We may transmit some data and information related to you, for promotional purposes, on our website or to various media organizations, journalists, and influencers, or distribute them on social networks such as Facebook, Instagram, YouTube, or TikTok, based on your explicit consent (which we will obtain separately) or our legitimate interest in promoting our activities, as applicable. See more about how your data is used by social network operators in Section 9 (How we use social networks and other online services and tools) below.

We may also transmit various documents containing your data to public authorities, at their request (e.g., tax authorities, courts, etc.), based on our legal obligations in this regard.

We may transmit some data and information related to you to other entities within the Shape Robotics group for the provision of our activities, e.g., those related to some checks we perform on our partners or website security issues. In these situations, the data transfer is made each time based on intra-group agreements we conclude with the other entities in our group and uniform security measures applied at the group level.

We will transmit some data and information about you to our product and service distribution partners, and we will receive some data and information about you from them. In these situations, we act as joint controllers with each of our partners regarding the data and information exchanged with them, for the processing purposes specified in this Privacy Notice. You can exercise your rights as a data subject against any of us and our partner you are in contact with.

As a rule, we do not transmit data and information about you outside the European Economic Area; when we transfer such data, we will ensure that these transfers are made in accordance with applicable legal conditions and with adequate data protection measures. However, we draw your attention to the fact that some data posted on our pages on Facebook, Instagram, YouTube, or TikTok, as well as information about your visits to our website, may be transferred by the operators of these social networks mentioned above outside the European Economic Area. Social network operators make such transfers independently of us to organize their own activities and under their exclusive responsibility, according to the details available in the data processing policies of these companies, which you can consult at the links indicated in Section 9 (How we use social networks and other online services and tools).

9. HOW WE USE SOCIAL MEDIA SERVICES AND OTHER ONLINE PLATFORMS

We have included details below on how we use your data when interacting through our social media pages, as well as information on how social networks use your data when interacting with our pages.

We use social networks and various online service providers to carry out our activities and improve and optimize the visibility of our websites and services. In each case, both we and the social network operators and our service providers use your data.

We operate accounts on behalf of Shape Robotics on social networks to showcase our activities, news about our products and services, or events we are involved in. According to applicable data protection rules, we are joint controllers with the social network operators, generally for statistical purposes related to our pages on those social networks – see the joint controller agreements applicable between us and the social network operators below in this section. However, it is not excluded, in general, that social networks may use your data obtained when interacting with our pages on those social networks for their own purposes, following their privacy and data usage policies. For questions related to the activities of social networks with your data, you need to contact them directly, following their privacy policies indicated below in this section.

We provide links below to the privacy policies of the social networks we use so that you can see how they use your data collected when visiting our websites, where you will also have access to the contact details of the social network operators:

Facebook: 

• Privacy Policy: https://www.facebook.com/policy.php  
• Cookie Policy: https://www.facebook.com/policies/cookies/  
• Joint Controller Agreement between us and Facebook: https://www.facebook.com/legal/controller_addendum  
• Information on how Facebook displays ads outside the social network: https://www.facebook.com/help/119468292028768?ref=shareable 

Instagram: 

• Privacy Policy: https://help.instagram.com/519522125107875   
• Cookie Policy: https://help.instagram.com/1896641480634370?ref=ig 

YouTube: 

• Privacy and Terms: https://policies.google.com/privacy?hl=en-US 

TikTok: 

• Privacy Policy: https://www.tiktok.com/legal/privacy-policy  
• Joint Controller Agreement: https://ads.tiktok.com/i18n/official/policy/controller-to-controller 

10. HOW WE PROTECT YOUR DATA

We have included below general information about the security measures we take to protect your data

We take reasonable and appropriate measures to protect the confidentiality, integrity, availability, and resilience of personal data we use against abuse, loss, or unauthorized access. We achieve this by implementing a variety of technical and organizational measures, including (but not limited to) restricting data access to our personnel, implementing user-specific single sign-on and confidential passwords for our systems and workstations, using secure VPN technology for remote connections to our networks and systems, maintaining up-to-date firewalls and antivirus programs, encryption, periodic testing and assessment of our systems, etc. We also have responsive measures in place in case of any suspected data security breaches in our activities. Additionally, we have implemented physical security measures for our headquarters and work locations.

We use secure servers meeting high standards located in the European Union. We create daily backups of frequently used data, retaining these backups for up to 90 days, and can quickly restore our services in case of incidents.

Our activities involve rules and procedures that aim to restrict access to data and information only to individuals with work tasks requiring the use of such data and information.

We encourage you to maintain the security of your personal data and equipment used for internet browsing, for example, by keeping antivirus programs up to date or accessing secure online resources. Do not provide your data to unknown individuals. If you are contacted by someone claiming to act on our behalf, please inform us.

If you suspect any abusive use, loss, or unauthorized access to your personal information, please notify us immediately at legal@shaperobotics.com or in writing at the following correspondence address: Lyskær 3C, 4th, 2730 Herlev, Denmark.

11. HOW YOU CAN CONTACT US ABOUT YOUR DATA

To get in touch with us for information regarding how we use your data or to exercise one or more of the rights outlined in this Privacy Notice, please contact us via email at legal@shaperobotics.com or in writing at the following correspondence address: Lyskær 3C, 4th, 2730 Herlev, Denmark.