Privacy Policy

newsletter about platform news and features. Subscription is voluntary and is not required to create or use an account. The legal basis for newsletter delivery is your consent under Art. 6(1)(a) GDPR. You can withdraw consent at any time in your account settings or through the unsubscribe link in each newsletter. Withdrawal does not affect the lawfulness of processing before withdrawal or the delivery of necessary account and security messages.

8.7 We process your current verified e-mail address, account reference, communication language,

subscription decision and its date, source and wording version, together with campaign and technical delivery records. We select the newsletter language using the order described in 8.5. We use Postmark as an e-mail delivery processor. Where processing involves transfers outside the EEA, the safeguards described in this Privacy Policy apply.

8.8 We retain consent and withdrawal evidence while consent is active and for three years after

withdrawal or account deletion, limited to documenting compliance and establishing, exercising or defending legal claims. The legal basis for this limited retention is Art. 6(1)(f) GDPR. Identifiable campaign audience and delivery records are deleted or irreversibly anonymised within 90 days after the campaign ends. Non-identifying campaign totals and campaign content may remain. Deleting an account stops pending newsletters; the limited evidence-retention rule above continues to apply. Residual copies in rolling backups follow the backup-retention rules in this policy.

9) Public profiles, portfolios and published content

9.1 Our platform is designed to enable users to publish public profiles, portfolios, media content and other platform-related information.

9.2 If you use the relevant functions, the profile details, portfolios, media, comments, interactions or other content that you release may be publicly visible or shared with other users.

9.3 Which content is visible depends on the respective function, the type of content, the releases granted and the platform settings.

9.4 The legal basis is Art. 6(1)(b) GDPR where publication is part of the service you use, and Art. 6(1)(f) GDPR on the basis of our legitimate interests in operating a portfolio and community platform.

10) Comments, interactions and reporting system

10.1 If you use comment functions or comparable interaction functions, we process your comment, the time of creation, the assignment to your user account or username and, where applicable, other technically required contextual data.

10.2 We use this data to provide the respective function, display content, enable communication between users and prevent abuse or legal infringements.

10.3 Users may under certain circumstances report content. In this context, we process the data necessary for review, moderation, documentation and, where applicable, enforcement of our rules.

10.4 The legal basis is Art. 6(1)(b) GDPR where the processing is necessary to provide the respective function, and Art. 6(1)(f) GDPR on the basis of our legitimate interests in the security, integrity and lawful use of our platform.

11) Own web analytics and event tracking

11.1 We may use our own analytics and event-tracking functions to evaluate the use of our website and platform, improve technical stability, detect abuse, analyse the reach of content and support the ongoing development of our services.

11.2 In particular, information about pages accessed, referrers, technical request data, timestamps, campaign parameters, interactions, share-related events and usage-related contextual data may be processed.

11.3 Where the analysis is technically necessary or serves the security and operation of our services, the processing is carried out on the basis of Art. 6(1)(f) GDPR. Where legally required, the processing is carried out only on the basis of your consent in accordance with Art. 6(1)(a) GDPR.

11.4 To measure the effectiveness of our own user-acquisition channels, we may process information about the source and campaign from which a visit originated, a pseudonymous click identifier, the landing page, the referring domain, the approximate country and limited technical information that allows us to classify the type of traffic in broad terms. If a user creates an account during the same flow, the acquisition-source information may be linked to that account and subsequently used for an aggregate assessment of the effectiveness of our acquisition channels. For this purpose, we do not store an attribution identifier in cookies or browser storage and do not link separate visits by fingerprinting, meaning the creation of a device or browser fingerprint by combining an IP address with other technical information.

11.5 Raw click records used for attribution are generally deleted after 180 days. Acquisition-source information linked to an account may be retained for as long as it is needed to analyse acquisition effectiveness and the quality of accounts acquired through particular channels, but no longer than the lifetime of the account. When an account is deleted or anonymised, this information is deleted or anonymised as appropriate. Aggregate statistics that do not permit the identification of a particular person may be retained for longer. The legal basis for this processing is Art. 6(1)(f) GDPR: our legitimate interest in assessing the effectiveness of our own acquisition channels and planning the development of the service in a reasonable manner. Information about the right to object to this processing is provided in section 25.

12) Meta Pixel

12.1 We use the "Meta Pixel" (formerly "Facebook Pixel") on our website, provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

12.2 The Meta Pixel allows us to measure the effectiveness of our advertising activities on Facebook and Instagram and to determine whether users reach our website via our advertisements placed there. Depending on the design of our marketing activities, the Meta Pixel may also be used to support the creation of audiences and to optimize the delivery of advertising.

12.3 When using the Meta Pixel, information about pages accessed, interactions, technical device and browser information, and the IP address may in particular be transmitted to Meta. If you are logged into Meta, Meta may, where applicable, associate this information with your user account.

12.4 The processing takes place exclusively on the basis of your consent in accordance with Art. 6(1)(a) GDPR. Consent is obtained via our consent management tool (Cookiebot). Without your consent, the Meta Pixel is not loaded. You may withdraw or adjust your consent at any time with effect for the future via the Cookiebot settings.

12.5 To the extent that personal data is transferred to the USA, Meta states that it relies on its certification under the EU-U.S. Data Privacy Framework. On this basis, an adequacy decision of the European Commission exists for certified U.S. companies.

13) Map and location functions

13.1 We may use map and geolocation functions in order to provide locations, regional assignments, search results or location-related information visually or functionally.

13.2 When using the relevant functions, in particular IP address, technical request data, location references, search details or map-related usage data may be transmitted to the map services used in each case or to supporting geodata providers.

13.3 The legal basis is Art. 6(1)(f) GDPR on the basis of our legitimate interests in the user-friendly and needs-based provision of map and location functions. Where legally required, the processing is carried out on the basis of your consent in accordance with Art. 6(1)(a) GDPR.

14) Bot protection and abuse prevention with Cloudflare Turnstile

14.1 To prevent automated entries, abusive requests, spam activities and other automated harmful access, we may use the Cloudflare Turnstile service.

14.2 In the course of using Turnstile, in particular IP address, browser and device information, operating system information, time and duration of a visit, and further technical signals may be processed where this is necessary to distinguish human use from automated or abusive use.

14.3 The processing is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our legitimate interests in protecting our website and platform against abuse, spam, DDoS attacks and other automated disruptions. Where legally required, we obtain consent for this in accordance with Art. 6(1)(a) GDPR.

15) Age verification and youth-protection related checks with Ondato

15.1 Where we use age-verification, age-assurance, identification or youth-protection related procedures on our platform, we may use Ondato as a service provider for this purpose.

15.2 Such processing may take place in particular in order to restrict access to certain areas, content, functions or user groups to adults, to implement youth-protection requirements, to prevent abuse, and to enforce access-control rules or comparable protective mechanisms. Where relevant for our youth-protection setup, the triggering of such checks may depend on the jurisdiction determined by us on a server-side basis from request-related data, including country information derived from the request, and not solely on information self-declared by the user.

15.3 Depending on the verification flow used in the individual case, the following categories of personal data may in particular be processed by us and/or by Ondato on our behalf:

first and last name
date of birth
information from identity documents
photo, selfie or other facial capture of the person
photo of the identity document
IP address
technical request, device, session and consent-related data
biometric facial data or biometric facial features used for biometric age-assurance or identity-related checks
result, status and reference data of the age or identity check
where applicable, video recordings or other verification data, where required for the specific procedure or fallback flow

15.4 Where special categories of personal data are processed, in particular biometric data, this is done only where and to the extent necessary for the respective procedure. The processing is based on an applicable legal basis under data protection law. Depending on the context, this may include in particular Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR and, where required for the processing of special categories of personal data, your explicit consent pursuant to Art. 9(2)(a) GDPR.

15.5 We process the outcome of such checks only to the extent necessary for age assurance, access control, youth-protection enforcement, abuse prevention, evidentiary purposes, dispute handling and compliance with legal obligations. We generally aim to store on our side only the minimum result and reference data necessary for these purposes. Additional verification materials may be processed and stored within Ondato’s systems for up to 60 days after the relevant verification, subject to the configured retention settings and unless a different retention period is required by law or is necessary in an individual case. After deletion or redaction, limited status, timestamp, reference and audit-related information may remain where necessary for documentation, security, compliance or evidentiary purposes.

15.6 Ondato acts for these purposes generally as our processor on the basis of the applicable contractual arrangements. According to the contractual framework currently in place, processing is intended to take place within the EEA and is not intended to be transferred outside the EEA without the prior written consent of the controller.

15.7 A successful age-verification result does not necessarily expire automatically after a fixed period. However, we may revoke, review or require a renewed verification where this is necessary for legal, regulatory, security, abuse-prevention or operational reasons, including where there are indications of misuse, changes in the applicable rules, or justified doubts regarding the continued validity of the previous result.

16) Storage of media and uploaded content

16.1 If you upload images, avatars, portfolios, files or other content to our platform, we process this content for storage, provision, delivery, protection and, depending on the permissions granted, publication.

16.2 Technical meta and access data may also be processed where this is necessary for upload, storage, access protection, display and delivery.

16.3 The legal basis is Art. 6(1)(b) GDPR where the processing is necessary for the provision of upload and platform functions, and Art. 6(1)(f) GDPR on the basis of our legitimate interests in the secure, high-performance and user-friendly provision of media.

16.4 Separately from Ondato, we may ask selected account holders to submit a selfie holding a handwritten card showing their username and the date the photograph is taken. Authorised administrators use the photograph to review the account and indications of impersonation or abuse. We process the photograph, account reference, card information, submission times, review decisions and access records for this purpose. This manual procedure does not use automated facial recognition and does not certify identity or age. The legal basis is our legitimate interest in preventing abuse under Art. 6(1)(f) GDPR.

16.5 The photograph is private, accessible only to the account holder and authorised administrators, and processed using our existing hosting and private storage providers. It is not published in the profile or sent to Ondato as part of this procedure.

16.6 Photographs are deleted within 30 days after the review closes and no later than 90 days after upload. Detailed closed review records are deleted after 90 days. A documented preservation hold may retain specifically required evidence under the separate preservation rules. Minimal security decision receipts and backups follow the applicable security and backup retention rules. This procedure does not by itself restrict portal access or award a referral reward.

17) Payment processing with Stripe

17.1 Where we offer paid services, subscriptions or other paid functions, payments may be processed through the payment service provider Stripe.

17.2 In particular, master data, contact data, transaction data, payment information, billing data and security-related information may be processed where this is necessary for payment processing, fraud prevention, invoicing and performance of the contractual relationship.

17.3 The legal basis is Art. 6(1)(b) GDPR.

18) Login or linking via third-party platforms, in particular Meta/Instagram

18.1 Where we offer functions that allow you to link your user account with third-party services or log in via third-party services, we process the data required for this.

18.2 Depending on the function, this may include in particular your external user identifier, profile information, technical authentication data and account information made available by you.

18.3 The processing is carried out on the basis of Art. 6(1)(b) GDPR where the respective function is necessary for the provision of the service and, where required, on the basis of your consent in accordance with Art. 6(1)(a) GDPR.

18.4 If you link an Instagram Professional account (Business or Creator) to PortfolioReach, we may process the technical account linkage data, authentication data, imported Instagram media and related metadata required to provide the Instagram import feature within our platform.

18.5 After import, you may manually hide selected imported Instagram media from public view within PortfolioReach. Hiding imported Instagram media only changes its visibility within PortfolioReach and does not by itself delete the Instagram connection or the imported Instagram data stored for this feature.

18.6 You may also refresh, reconnect or disconnect the Instagram connection in PortfolioReach. If you disconnect Instagram in PortfolioReach, we remove the Instagram connection data associated with this feature from PortfolioReach, including stored tokens or credentials, imported Instagram media and related import metadata stored by us for the feature. Imported Instagram media is then removed from your PortfolioReach profile and from PortfolioReach storage or database records used for this feature.

18.7 Disconnecting Instagram in PortfolioReach affects only data stored in PortfolioReach for the Instagram import feature. It does not delete your content from Instagram itself and does not by itself revoke the app connection on the Instagram/Meta side. If you revoke PortfolioReach access from the Instagram/Meta side, we process this through the corresponding deauthorization flow and apply the same local cleanup in PortfolioReach.

18.8 If we receive a valid Meta data deletion request or comparable deauthorization signal relating to the Instagram connection, we process it through the same local cleanup flow in PortfolioReach, subject only to any limited retention that may be necessary for security, fraud prevention, legal compliance or evidentiary purposes.

18.9 You may sign in or register using Google. We verify Google's sign-in confirmation and process your account identifier, e-mail address and information about its verification. We store the connection to your PortfolioReach account and the dates when that connection was created and last used. We do not receive your Google password or store Google access or refresh tokens. We do not transfer your Google name or photo to your public PortfolioReach profile. You provide your profile information and required registration choices separately.

18.10 When you sign in, we may automatically link your Google account to an existing PortfolioReach account if the same Gmail or Google Workspace address is already verified on that account and Google confirms your current control of that address. Access restrictions and any required additional PortfolioReach authentication still apply. After you disconnect Google, you can reconnect it only in your security settings.

18.11 Loading the Google sign-in interface on the login, registration or security pages connects your browser to Google and transmits the technical data necessary for that connection. This function does not require a newsletter subscription or consent to optional analytics. Temporary sign-in attempt data protects against reuse of Google's response and account substitution. The initial Google confirmation attempt is valid for 5 minutes. Confirmation allowing you to complete registration is valid for 15 minutes, and any additional authentication or security-change confirmation stage is valid for 5 minutes from the start of that stage. Used or expired attempt records are removed at the next successful run of our daily cleanup process. The registration confirmation is temporarily stored in your browser tab and removed when registration is completed or cancelled, or when its expiry is detected.

18.12 You can disconnect Google in your security settings after setting a PortfolioReach password. Disconnecting removes the connection stored by us and ends the account's existing sessions. It does not remove the connection in your Google Account settings, which you manage separately. Deleting your PortfolioReach account also removes the Google connection stored by us. Account-security records and backups are subject to the retention rules described elsewhere in this policy.

18.13 You may copy selected photos from your connected Instagram account to your SFW portfolio in PortfolioReach. We save these copies in our storage as ordinary portfolio photos, public by default, together with a minimal Instagram media identifier to prevent duplicate imports. Disconnecting Instagram removes the connection and Instagram gallery data described above, but does not remove these separately selected portfolio copies. You can manage and delete them in your portfolio; the usual content-rights, account-deletion and retention rules continue to apply.

Publishing to your connected Instagram account

18.14 When you use this feature, we process your account and connection identifiers, the selected photo reference, the final image and caption you approve, and technical publication results. Preparation of the publication image, including cropping and any edits made with the Photo editor, takes place in your browser. After you select “Publish now”, we upload the approved image and transmit it and the caption to Meta to carry out your request, on the basis described in section 18.3. Meta retrieves the image through a short-lived access link and processes the publication under its own terms and privacy rules. Your original portfolio photo is not replaced by this export. If you enable contributor tagging, we also process their Instagram usernames and the positions of their tags in the photo, drawn from the current contributor information available for the photo in PortfolioReach, and transmit them to Meta with the publication. We use limited contributor data on the basis of Article 6(1)(f) GDPR to attribute their contributions accurately, taking their rights and interests into account. This does not replace any required rights or consents for publishing the photo or a person’s likeness. Contributors may request rectification or object to tagging by contacting us as described in section 20, including if they do not have a PortfolioReach account.

18.15 The uploaded publication image, caption, contributors’ Instagram usernames and the positions of their tags are due for deletion 24 hours after the publication request is created and are removed by our scheduled cleanup process. We keep a minimal publication record for 30 days from that request, then remove it through the same process: account and photo identifiers, approval and file fingerprints, attempt identifiers, dates, status, error and warning codes, and any Instagram publication identifiers and link. These records let us show the result and help avoid duplicate publication after an uncertain response. Access tokens and signed media links are not included in these publication records. Failed cleanup is retried; the exceptions in section 18.19 also apply.

18.16 Disconnecting Instagram, revoking access through Meta or a valid Meta data-deletion request stops further publication and queues the related publication images and records for local deletion. Deleting your PortfolioReach account also removes these data through our account-deletion process. A narrowly scoped legal retention obligation or authorised evidence preservation may apply under sections 22–23; it does not permit further publication or keeping access tokens as evidence. Local cleanup does not remove posts from Instagram. The data-protection rights described in this notice continue to apply.

Messages in your Instagram inbox

18.17 Where available, enabling the Instagram inbox instructs PortfolioReach to provide technical handling of messages for your connected professional Instagram account. After activation, we receive, store and display supported new messages and transmit replies you choose to send. We process message text, account and participant identifiers, message and conversation identifiers, dates, delivery and read states, the local inbox read status, and technical operation and error codes. This feature does not import your full previous Instagram message history or create PortfolioReach accounts for your Instagram correspondents. We process the correspondence on your behalf, within the scope needed to provide the requested inbox function and according to the retention and deletion rules below. Where you act as the controller of this correspondence under applicable data-protection law, PortfolioReach acts as your processor for this handling, on your documented instructions.

18.18 To help you recognise who is writing, we may retrieve Instagram usernames and profile pictures from Meta and display them in the inbox. We do not keep these profile lookups as a separate lasting profile record. Profile images load from Meta’s delivery infrastructure, which receives the technical request data needed to deliver them. The current inbox supports text messages. We do not store attachment contents or message text exceeding the supported limit, although a record that unsupported content was received may remain. Marking a message as read in PortfolioReach updates the local inbox state and does not itself send a read receipt to Meta. Replies you send are transmitted to Meta and processed under Meta’s own terms and privacy rules. Processing by infrastructure providers and international transfers are also described in sections 3 and 24.

18.19 Messages and their message-level metadata become unavailable in the PortfolioReach inbox 30 days after the message event and are removed by our scheduled cleanup process. Conversation records are removed once they no longer contain retained messages. Disconnecting Instagram, a valid Meta deauthorization or data-deletion request, or deleting your PortfolioReach account stops further use of the connection and initiates local deletion. Failed cleanup is retried. Narrowly scoped legal retention or authorised evidence preservation may apply under sections 22–23. Backups and recovery follow the common rules in sections 23.3–23.4. Removing data from PortfolioReach does not delete messages held by Instagram or another conversation participant.

18.20 The content of Instagram messages is encrypted during storage. Our service decrypts it to display messages to the authorised account user and provide the functions described in this notice. The PortfolioReach administration panel does not provide a function for viewing or exporting the content of these messages, including content preserved as evidence. Diagnostic metadata, such as identifiers, dates, message direction, status and error codes, remain available to authorised operators.

18.21 The rights and contact details in sections 20–21 apply to this processing, including when you communicate with a connected Instagram account without having a PortfolioReach account. You can contact the connected account holder or us at contact@portfolioreach.com. Where we act as a processor, we assist the account holder in handling data requests and forward requests as appropriate. We may request information needed to verify your identity and locate the relevant correspondence. Where available, the account holder’s data export includes retained Instagram messages and associated metadata, subject to the rights of other people. Historical administrative content-access records from before removal of the readers are retained for 30 days from the recorded access event, then removed through our scheduled cleanup process. This period runs independently of the message’s deletion date. Historical access records for separately preserved evidence follow the case-retention rules in sections 22–23; backups follow section 18.19.

Starting registration and securing the connection

18.22 If you choose “Start with Instagram”, we receive your Instagram account identifier, username, account type, granted permissions, access token and its expiry, and supported media-preview information from Meta. We use these data to suggest a profile name, establish your Instagram connection when you complete registration, add your Instagram social link and populate your Instagram gallery. Your email address, password, required profile details and registration confirmations are provided separately in PortfolioReach, and email verification remains required. We process these data to provide the registration you requested on the basis described in sections 7.4 and 18.3. Copying selected photos into your portfolio is optional and follows section 18.13.

18.23 A temporary registration context is valid for 30 minutes from the start of the attempt. It includes the connection information described above, your language, registration entry and any supplied referral or limited acquisition information used by the ordinary registration process. A necessary first-party cookie binds the attempt to your browser; the temporary context stores a hash of its secret and an encrypted Instagram access token. Completing registration transfers the required connection data to your account and deletes the temporary context. Cancelling or replacing the attempt removes its context; expired contexts are removed by scheduled daily cleanup. Used authorisation states are consumed once, and expired states are also cleaned up. These technical records help prevent reuse of an authorisation response and connection of an account from a different browser. A completed Instagram connection is retained while connected and is subject to the disconnection and deletion rules above.

18.24 At your request, we save publication drafts: a reference to the selected photo and Instagram account, editing and appearance settings, the caption and tagging preferences. We do not create a separate copy of the photo for this purpose. Templates contain a name, appearance settings and an optional caption pattern; they do not store the photo, censorship edits or a list of people to tag. We retain drafts and templates until you delete them or your PR account is deleted. We also delete drafts when the photo is deleted or Instagram is disconnected or access to it is revoked; templates may remain. Deletion is completed by the next successful cleanup process, subject to the evidence-preservation and backup exceptions described in sections 22–23. Saving a draft or template does not instruct us to publish on Instagram.

19) Advertising monetisation with ExoClick

19.1 Where we use advertising services or advertising-based monetisation, we may use external advertising service providers such as ExoClick for this purpose.

19.2 In the course of such services, cookies, similar technologies, device identifiers, IP addresses, browser information, interaction data and usage-related information may be processed in order to deliver advertising, measure reach, prevent abuse or implement frequency limitations.

19.3 Such services are used only where this is legally permissible and, where required, on the basis of your consent in accordance with Art. 6(1)(a) GDPR.

20) Exercise of your data subject rights

20.1 Applicable data protection law grants you the statutory data subject rights, in particular:

access pursuant to Art. 15 GDPR
rectification pursuant to Art. 16 GDPR
erasure pursuant to Art. 17 GDPR
restriction of processing pursuant to Art. 18 GDPR
right to be informed of rectification, erasure or restriction pursuant to Art. 19 GDPR
data portability pursuant to Art. 20 GDPR
withdrawal of consents granted pursuant to Art. 7(3) GDPR
complaint to a supervisory authority pursuant to Art. 77 GDPR

20.2 To exercise your rights, you may contact us at contact@portfolioreach.com.

20.3 We reserve the right to require suitable proof of your identity before processing a request where this is necessary for the protection of personal data.

21) Data export and DSAR process

21.1 Where we provide corresponding functions, users may also submit data protection-related requests, in particular access and export requests, via platform functions or through support.

21.2 We process the identification data, contact data and request-related information required for this in order to review, assign, process and document your request.

21.3 The legal basis is Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR on the basis of our legitimate interests in the proper, timely and secure handling of data protection-related requests.

22) Account deletion and deletion requests

22.1 You may delete your user account by using the "Delete account" function in your profile settings or by contacting us at contact@portfolioreach.com.

22.2 In the event of account deletion, we generally delete or anonymise personal data unless statutory retention obligations, security interests, evidentiary interests or other legitimate reasons prevent immediate complete deletion.

22.3 Public or community-related content may in certain cases be technically or organisationally adjusted, anonymised or removed where this is envisaged by the nature of the function and the specific content.

22.4 Where your account includes an Instagram connection and imported Instagram media within PortfolioReach, account deletion may also include the removal of the related Instagram connection data, imported Instagram media and associated import metadata stored in PortfolioReach for that feature, subject to any statutory retention obligations, security interests, evidentiary interests or other legitimate reasons that may require limited retention.

23) Data retention period

23.1 We store personal data only for as long as this is necessary for the respective purposes of processing.

23.2 Beyond this, we store data only where statutory retention periods exist or where we have legitimate interests in the establishment, exercise or defence of legal claims.

23.3 We keep database backups to protect availability and integrity, recover from failures and test recovery. Render’s point-in-time recovery window is 3 days. Encrypted NAS backups follow a rotation of 14 daily, 8 weekly and 12 monthly copies. Data deleted from the active database may remain in restricted backups until rotation, for up to 12 months in the ordinary cycle. This does not extend the time for which those data are available in the service.

23.4 Backup access is restricted to authorised persons for recovery and verification; backups are not a routine archive for using deleted data. Deleting or encrypting active records does not rewrite earlier copies. Before reopening access after a restore, we reapply current deletions, corrections, access restrictions and session revocations and preserve original retention deadlines. Restoring a copy does not renew a retention period or restore withdrawn permissions. The current application access rules continue to apply.

24) Transfers of data to third countries

24.1 In the course of using external service providers, personal data may be transferred to or processed in states outside the European Union or the European Economic Area.

24.2 In such cases, we ensure that appropriate safeguards within the meaning of Art. 44 et seq. GDPR are in place, such as adequacy decisions, standard contractual clauses or comparable protective mechanisms.

24.3 Where a service provider processes data within the European Economic Area or processing outside the EEA takes place only under additional conditions, we take this into account when selecting and contractually engaging the respective provider.

25) Right to object

25.1 If we process your personal data on the basis of our legitimate interests, you have the right to object to this processing at any time with effect for the future on grounds relating to your particular situation.

25.2 If you exercise your right to object, we will stop processing the data concerned unless we can demonstrate compelling legitimate grounds for the processing or the processing serves the establishment, exercise or defence of legal claims.

26) On-demand machine translation of user content

26.1 Where this function is available, authenticated users may request a machine translation of an individual Feed post, comment or reply by actively selecting the translation control. Translation is not performed automatically when content is displayed.

26.2 For this purpose, we process the current plain-text content selected by the user, its content type, internal identifier and revision, the requested source and target languages, and the minimum account and access-control information needed to verify that the requesting user may view the original content. The purpose is to make user-generated content understandable across supported languages.

26.3 PortfolioReach sends the authorised text and requested language codes from its application backend to Microsoft Azure Translator, a Microsoft cloud translation service. The browser does not communicate directly with Azure, and we do not send internal content, account or user identifiers to the translation service. When the global endpoint is used, a request may be processed in the closest available data centre, including potentially outside the EEA; the safeguards for international transfers are described in section 24. According to Microsoft's current service documentation, Text Translation processes the submitted text to handle the request and does not persist customer data submitted for translation.

26.4 Translation takes place on request. For Feed posts and Feed or photo comments, a translated result may currently be retained in a bounded server-side cache for up to 15 minutes so that repeated authorised requests do not unnecessarily repeat the processing. The cache does not store a separate copy of the source text and becomes inaccessible after the content is edited, deleted, hidden or otherwise changes revision or access state. Operational logs and metrics are designed not to contain source or translated text. If translation is later made available for private messages, message translations will be processed at request time and will not be stored in this translation cache or otherwise persisted as a translated message copy.

26.5 The legal basis is Art. 6(1)(b) GDPR insofar as the processing is necessary to provide the translation function requested by the user and Art. 6(1)(f) GDPR on the basis of our legitimate interests in accessible cross-language communication, secure access control, abuse prevention and reliable operation of the function.

26.6 Users can choose the target language, correct the detected source language and return to the unchanged original at any time. Results are labelled as machine-generated and may be inaccurate or incomplete. Editing or deleting the original invalidates the displayed result and the associated cache revision.

26.7 Moderation, reporting, search, notifications and abuse or enforcement decisions continue to use the original user-authored content, not the machine translation.

27) Google Analytics 4 (GA4)

27.1 We use Google Analytics 4 ("GA4"), an analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

27.2 GA4 helps us understand how visitors reach PortfolioReach and use the service, which traffic sources and campaigns are effective and whether visits lead to registration. We use GA4 to analyse traffic and the effectiveness of user acquisition. We do not use GA4 to establish the identity of particular individuals, for remarketing or to build advertising audiences.

27.3 After consent has been given, GA4 may process information about the use of the service, in particular data about pages visited, the source of the visit, the campaign, basic interactions with the site, the session, the type of browser and device and the approximate location. An IP address is also processed during the technical connection to Google's services. Google states that it does not log or store individual IP addresses for users in the EU, Switzerland or the United Kingdom and discards them after using them to derive approximate location.

27.4 We limit the scope of data transmitted to GA4. In particular, we do not deliberately transmit names, usernames, email addresses, PortfolioReach account identifiers, authentication tokens, content published or submitted by users or precise location data. Page addresses and parameters transmitted to GA4 are additionally restricted so that authentication data and other sensitive technical values are not sent to Google. We replace dynamic parts of page addresses with general route templates, so, for example, a username in a public-profile address is not transmitted to GA4. We do not transmit a PortfolioReach user identifier to GA4. Google Signals and advertising-personalisation features remain disabled.

27.5 After the required consent has been obtained, GA4 may use cookies to distinguish users and sessions. Standard GA4 cookies may remain valid for up to two years, although their actual lifetime may be limited by browser settings or our configuration. The retention period for user and event data in our GA4 configuration is 14 months. This setting does not limit the retention period of standard reports containing aggregated data.

27.6 GA4 is used only after we have obtained your consent. The legal basis for processing personal data is Art. 6(1)(a) GDPR and, insofar as information is stored on or accessed from the user's device, also section 25(1) TDDDG. GA4 is assigned to the statistics category in our Cookiebot consent-management system and is not started before consent to statistics is given. You may change or withdraw your consent at any time with effect for the future through the Cookiebot settings. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

27.7 In connection with providing the service, Google may transfer or process data outside the European Economic Area, in particular through companies in the Google group or its subcontractors. Where such a transfer takes place, the appropriate mechanisms required by data-protection law apply, in particular adequacy decisions or standard contractual clauses, in accordance with the principles described in section 24. Further information about Google's processing is available in Google's privacy policy and the Google Analytics terms.

28) Referral programme and campaign rewards

28.1 When you use a referral link or code, or a registration is attributed to you through the

referral programme, we process the referral code, references to the accounts involved, and the status, timestamps and history of the attribution. These records are generated from use of the service and may include registrations that do not qualify under the applicable campaign terms.

28.2 We use referral attribution and qualification status to operate the programme, maintain

programme records and determine eligibility under the applicable campaign terms. For these purposes, we also process points-ledger entries, campaign ranking and reward status, and records of acceptance of campaign terms, including the version and time of acceptance. The campaign terms set out the programme rules; this section describes how we process the associated personal data.

28.3 To detect and investigate misuse, we process hashed values derived from the IP address and

browser identification at registration, automated risk indicators, and records of human review, including relevant observations, decisions and their reasons. Hashing does not by itself make these data anonymous. We use them to identify potentially related registrations or activity requiring review and to document how a case was handled. We also compare network observations for the referrer and the referred account from registration, sign-in, session refresh and authenticated activity, taking their source and observation time into account. We retain limited pseudonymous records of detected matches, rather than a complete IP-address history. A shared IP address is a signal for human review and does not by itself establish that the same person controls the accounts.

28.4 Automated checks support the assessment of possible misuse. Their risk indicators are

reviewed by authorised staff; decisions on granting rewards are made by a person. You may contact us using the details in section 20 to request information about the processing or to exercise your data protection rights, including rectification of inaccurate personal data.

28.5 We process data necessary to administer your participation and fulfil campaign obligations

on the basis of Art. 6(1)(b) GDPR. Processing for abuse prevention, programme integrity and the security and accountability of internal access is based on Art. 6(1)(f) GDPR, our legitimate interests in preventing misuse and protecting participants and payment data. Where payment records must be retained to comply with accounting or other statutory obligations, the basis is Art. 6(1)(c) GDPR. Acceptance of campaign terms records your agreement to those terms; it is not consent to all processing described in this section.

28.6 Following deletion of an account with a recorded referral, we retain a pseudonymous

identifier derived from its email address using a keyed hash. It enables comparison with a later registration to detect repeat participation and prevent duplicate referral attribution. The identifier is not stored with the deleted account's email address, username or account reference. It remains pseudonymous personal data because it can be matched against an email address using our protected key. This processing is based on Art. 6(1)(f) GDPR for the abuse-prevention purpose described above. We retain the identifier for the life of the referral programme and for 24 months after the last campaign that could be affected closes, then delete it. The right to object in section 25 applies.

28.7 To pay a cash reward, we collect the account holder name, IBAN and, where necessary, BIC from

the recipient. We use these details to arrange and resolve the bank transfer on the basis of Art. 6(1)(b) GDPR. Providing them is voluntary, but we cannot make a transfer without usable bank details. Deadlines and other conditions of payment are set out in the campaign terms.

28.8 We protect stored bank details with encryption and restrict access to authorised staff who

need them to handle payouts. Routine payment views use masked details. Access to full bank details is subject to additional authentication and is logged for security and accountability. Infrastructure and storage providers process data on our behalf as described in section 3; the safeguards for transfers outside the EEA in section 24 also apply to this processing.

28.9 We provide the details necessary to execute the transfer to our bank. Banks involved in

executing and receiving the transfer process payment data as independent controllers under their own privacy notices and applicable obligations.

28.10 We process payment amounts, currency, dates, status and references, the bank's transfer

record and a payment statement for the recipient. The bank's record contains bank-account data and is kept as restricted accounting evidence. The recipient's statement contains the reward and payment particulars, without bank details or a transaction reference. We do not collect a postal address or tax identification number to produce that statement. Operator access to statements is audited; we do not create a dedicated statement-access audit entry when recipients read their own statement.

28.11 We remove the encrypted bank details from the operational payout record 90 days after

the payout is settled or closed and, in any event, no later than 12 months after submission. Masked details and payment history remain subject to the retention rules below. This removal does not erase bank details contained in the bank's transfer record, which is retained separately as accounting evidence.

28.12 Payment records, transfer records, statements and supporting decision records are retained

for the applicable statutory accounting retention period. Review and decision records for candidates who were not paid are retained for 24 months after campaign finalisation. Other referral data are subject to the necessity and retention criteria in section 23, except for the specific periods in 28.6 and 28.11. Deleted data may remain in restricted backup copies until those copies are rotated, for up to 12 months.

28.13 If you delete your account, referral and payout data are deleted, anonymised or retained in

accordance with sections 22 and 23 and the specific periods above. Account deletion does not remove records that we must retain to comply with statutory obligations. Access to statements through your account ends when the account is deleted; you may still exercise your data protection rights through the contact and request procedures in sections 20 and 21. Those rights, and the right to object under section 25, remain subject to the applicable legal conditions.