Introduction
The Developer is committed to protecting the privacy of Users interacting with the 99 Pelicans Challenge System. This Privacy & Data Protection Policy describes how the Developer collects, processes, stores, and safeguards personal data within the System.
This Policy is issued in compliance with:
- Regulation (EU) 2016/679 — the General Data Protection Regulation (“GDPR”);
- Directive 2002/58/EC (“ePrivacy Directive”) and its national implementations;
- the Law of Ukraine “On the Protection of Personal Data” (No. 2297-VI);
- and any other applicable data-protection legislation in the User’s country of residence.
Identity of the Controller
Data Controller
- Company Name: LIMITED LIABILITY COMPANY “SMART EXPERIENCE”
- Registered Address: Ukraine, city Kyiv, street Polova, build 24
- Company Registration Number: 46145133
- Privacy Contact: hello@99pelicans.com
Independent Controller for Payments
The Seller of Record contracted by the Developer for the processing of all sales and consumer billing operates as an independent Data Controller for payment-transaction data and operates under its own privacy policy. The Seller of Record is identified to the User at checkout and listed on https://99pelicans.com/imprint.
Categories of Personal Data Collected
To provide the System and operate the scoring interface, the Developer processes the following categories of data:
Team Lead Contact Information
Full name, email address, and mobile phone number of the Team Lead (the person registering and managing the Team Account).
Other Team Member Information
Full names of additional authorised Team members added to the Team Profile, together with their electronic confirmation of these Terms and of being 18 years or older. No phone numbers or postal addresses of additional members are collected. No shipping address is collected, as complementary physical materials are provided to Team members in person at the Series activation event.
Billing and Verification Telemetry
Personal or corporate billing address (collected by the Seller of Record at checkout), IP address, payment timestamps, country of card issuance. The Developer does not store raw card numbers, CVV codes, or financial account credentials.
Challenge Telemetry
Verification coordinates, digital analytical solution submissions, system timestamps, and scoring metadata submitted by the Team to the platform during a Series.
Media Submissions
Photos or video files submitted voluntarily by the Team to validate analytical task completion. Users may opt out of promotional use of any submitted media at any time.
Communications
Records of correspondence with the Developer support team (email, support tickets).
Marketing Subscribers
Email addresses of Users who have explicitly opted in to receive Series announcements, news, and promotional communications. Marketing subscription is separate from account registration and is based on consent.
Website Analytics
Aggregated usage data of https://99pelicans.com collected via Google Analytics 4 (GA4), with consent obtained through the cookie banner.
Purposes and Legal Basis for Processing
Each category of data is processed for specific purposes on a specific legal basis under Article 6 GDPR:
| Data Category | Purpose | Legal Basis (GDPR Art. 6) |
|---|---|---|
| Team Lead contact (name, email, phone) | Account management, contract performance, communications | Art. 6(1)(b) performance of contract |
| Other Team member names + 18+ confirmation | Authorisation of additional seats, age verification | Art. 6(1)(b) performance of contract |
| Billing & Verification Telemetry (IP, payment timestamps, card country) | Fraud prevention, regional verification, security | Art. 6(1)(f) legitimate interest |
| Transactional records, invoices | Tax, accounting, AML compliance | Art. 6(1)(c) legal obligation |
| Challenge Telemetry (verification coordinates, scoring submissions) | Operation of the scoring engine, Pelican calculation | Art. 6(1)(b) performance of contract |
| Media Submissions (photos, videos) | Verification of analytical tasks; promotional use (with opt-out) | Art. 6(1)(a) consent |
| Marketing email subscribers | Newsletters and Series announcements | Art. 6(1)(a) consent |
| Website analytics (GA4) | Measure aggregate usage of 99pelicans.com | Art. 6(1)(a) consent (via cookie banner) |
Where processing is based on consent (Article 6(1)(a)), the User may withdraw consent at any time without affecting the lawfulness of prior processing.
Recipients of Personal Data and Sub-processors
The Developer shares personal data only with the following categories of recipients, each under contractual obligations consistent with GDPR:
| Sub-processor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Seller of Record (identified at checkout) | Payment processing, EU VAT, invoicing, billing support | US / UK / EU (per Seller) | Independent Controller — own DPA |
| Cloud hosting provider | Platform infrastructure, database, scoring engine | Ukraine (subject to change) | Processor — DPA in place; Art. 46 SCCs for EU data subjects |
| Google Analytics 4 (Google Ireland Limited) | Aggregate website analytics (only with cookie consent) | Ireland / US | Processor — DPA + Google EU SCCs |
| Developer personnel (Smart Experience) | Operations, customer support, content development, email correspondence | Ukraine | Internal — confidentiality obligations |
The Developer does not sell, rent, trade, or lease personal user data to advertising networks or data brokers.
Where Your Data Is Hosted and International Transfers
Personal data processed by the Developer is hosted on cloud infrastructure with primary servers located in Ukraine. The specific hosting provider and region may change from time to time, and material changes will be communicated via update to this Policy.
As of the Effective Date of this Policy, Ukraine has not received a finalised adequacy decision from the European Commission under Article 45 GDPR. Transfers of personal data of EU/EEA data subjects to Ukraine are therefore made under the following Article 46 safeguards:
- Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 (“SCCs”), executed by the Developer where applicable;
- Supplementary technical measures including encryption-at-rest, encryption-in-transit (TLS 1.2+), role-based access control, audit logging, and the least-privilege principle;
- Supplementary organisational measures including written confidentiality undertakings, access reviews, and documented incident-response procedures.
Where the Seller of Record transfers payment data to jurisdictions outside the EU/EEA (e.g., the United States or the United Kingdom), such transfers are governed by the Seller’s own privacy policy and any applicable adequacy decision, SCCs, or other Article 46 safeguards.
Retention Periods
Personal data is retained only for as long as necessary for the purposes for which it was collected:
| Data Category | Retention Period | Legal Basis |
|---|---|---|
| Active Team Account data | Term of the active license + 12 months | Contract performance |
| Financial / tax / invoice records | 10 years (UA & EU accounting law) | Legal obligation |
| Challenge telemetry & scoring submissions | 24 months after Series completion | Contract performance, then erasure |
| Media submissions (photos/videos) | Until withdrawal of consent or 36 months | Consent |
| Marketing list | Until consent withdrawn (unsubscribe) | Consent |
| GA4 analytics data | 14 months (default), aggregated only | Consent |
| Security logs (server access) | 12 months | Legitimate interest |
Following the retention period, data is securely deleted or anonymised. Some data may be retained for longer where required by law or in connection with the establishment, exercise, or defence of legal claims.
Data Security
The Developer implements appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction:
- Encryption-in-transit (TLS 1.2 or higher) for all communications between the User device and the System;
- Encryption-at-rest for personal data stored in operational databases;
- Role-based access control and least-privilege principle for staff;
- Audit logging of administrative access;
- Regular vulnerability scans and security reviews;
- Documented incident-response and breach-notification procedures.
In the event of a personal data breach likely to result in a risk to the rights and freedoms of natural persons, the Developer will notify the competent supervisory authority within 72 hours, and affected data subjects where the breach is likely to result in a high risk.
Automated Decision-Making and Profiling (Article 22 GDPR)
Pelican points are calculated by an automated scoring algorithm based on Team submissions to the System. While this constitutes automated processing, scoring decisions do not produce legal effects in the meaning of Article 22 GDPR. Nevertheless, Users have the right to request human review of any specific scoring decision, to express their point of view, and to contest the decision.
Requests should be sent to hello@99pelicans.com within thirty (30) days of the decision. The Developer will provide a substantive response within fifteen (15) business days.
Children’s Data
The System is strictly for users aged 18 and over. The Developer does not knowingly collect personal data from persons under 18. If the Developer becomes aware that personal data of a minor has been collected, such data will be deleted promptly upon notification. Parents or guardians who become aware that a minor has provided personal data may contact hello@99pelicans.com for immediate erasure.
Cookies and Tracking Technologies
The website https://99pelicans.com uses cookies and similar technologies. A consent management banner is displayed on first visit, and a separate Cookie Notice is available at https://99pelicans.com/cookies.
Categories of cookies used:
- Strictly necessary cookies: required for the operation of the website (e.g., session management). No consent required.
- Analytics cookies (Google Analytics 4): measure aggregate usage. Set only with consent.
- Functional cookies: improve user experience (e.g., language preference). Set only with consent.
Users may at any time withdraw or change cookie preferences via the consent banner or by clearing browser cookies.
Marketing Communications
Users may opt in to receive marketing communications (Series announcements, newsletters, promotional offers) at registration or via the website. Marketing communications are based on consent and may be withdrawn at any time by:
- Clicking the unsubscribe link in any marketing email; OR
- Sending a request to hello@99pelicans.com.
Withdrawal of marketing consent does not affect transactional communications relating to an active or past license (order confirmations, refund notifications, security alerts, support correspondence).
Your Rights as a Data Subject
Under GDPR, you have the following rights with respect to your personal data:
- Right of access (Art. 15): obtain confirmation of whether your data is being processed and a copy of that data.
- Right to rectification (Art. 16): correct inaccurate data or complete incomplete data.
- Right to erasure (Art. 17): request deletion of your data, subject to legal exceptions.
- Right to restriction of processing (Art. 18): limit how we use your data in certain situations.
- Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format.
- Right to object (Art. 21): object to processing based on legitimate interests, including profiling.
- Right to withdraw consent: withdraw any consent at any time without affecting prior lawful processing.
- Right regarding automated decision-making (Art. 22): see Section 9 above.
- Right to lodge a complaint: lodge a complaint with the supervisory authority in your country of residence (e.g., BfDI in Germany, DSB in Austria, Garante in Italy, AP in the Netherlands, UODO in Poland).
How to Exercise Your Rights
To exercise any of the rights above, contact hello@99pelicans.com with the subject line “GDPR Request — [type of request]”. The Developer will respond within one month of receipt of your request (extendable by two further months for complex requests, with notice). The Developer may request additional information to verify your identity. Exercise of these rights is free of charge, save for manifestly unfounded or excessive requests.
Changes to this Policy
The Developer may update this Policy from time to time to reflect changes in legal requirements, processing operations, or sub-processor arrangements. The current version is always available at https://99pelicans.com/privacy with the Effective Date and Version number. Material changes will be communicated to registered Users by email at least 14 days before they take effect.
Developer Contact and Legal Identity
- Company Name: LIMITED LIABILITY COMPANY “SMART EXPERIENCE”
- Registered Address: Ukraine, city Kyiv, street Polova, build 24
- Company Registration Number: 46145133
- Privacy Contact: hello@99pelicans.com
- Website: https://99pelicans.com