Privacy Policy

TABLE OF CONTENTS

1. Introduction and Scope

2. Definitions

3. Data Controller and Data Protection Officer

4. Categories of Personal Data We Collect

5. How We Collect Personal Data

6. Legal Bases for Processing (GDPR/LGPD)

7. Purposes of Processing

8. Data Sharing and Disclosure

9. International Data Transfers

10. Data Retention

11. Your Rights as a Data Subject

12. Cookies and Tracking Technologies

13. Third-Party Communication Channels

14. AI and Automated Processing

15. Children's Privacy

16. Security Measures

17. Data Breach Notification

18. HIPAA and Protected Health Information

19. California Privacy Rights (CCPA/CPRA)

20. Updates to This Policy

21. Contact Information

1. INTRODUCTION AND SCOPE

1.1 About Mavens

Mavens ("we," "us," "our," or the "Company") is an omnichannel lead management platform that provides software-as-a-service ("SaaS") solutions combined with professional services, including custom AI agents for sales, marketing, and customer engagement purposes.

Mavens operates globally with headquarters in Lisbon, Portugal, and offices in:

1.2 Scope of This Policy

This Privacy Policy ("Policy") describes how Mavens collects, uses, discloses, retains, and protects Personal Data in connection with:

This Policy applies to:

1.3 Our Role: Controller vs. Processor

Mavens acts in different capacities depending on the context:

(a) DATA CONTROLLER

Mavens acts as the data controller when we:

(b) DATA PROCESSOR

Mavens acts as the data processor when we:

When we act as a data processor, our customers are the data controllers and are responsible for ensuring they have appropriate legal bases and consents for the data they process through our Platform. Our processing activities are governed by our Data Processing Agreement with each customer.

1.4 Agreement to This Policy

By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Policy. If you do not agree with this Policy, please do not use our Services.

If your organization is subject to the General Data Protection Regulation (GDPR) or Brazil's Lei Geral de Proteção de Dados (LGPD) and uses our Services to process Personal Data, you must enter into a Data Processing Agreement with Mavens prior to such processing.

2. DEFINITIONS

For purposes of this Policy:

ANPD means the Autoridade Nacional de Proteção de Dados, Brazil's national data protection authority.

Customer means a business entity that has entered into a contract with Mavens to use our Services.

Data Processing Agreement or DPA means the agreement between Mavens and a Customer governing the processing of Personal Data on behalf of that Customer.

Data Subject means an identified or identifiable natural person whose Personal Data is processed.

End User or Contact means an individual whose Personal Data is processed through our Platform on behalf of a Customer.

GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation).

LGPD means Lei nº 13.709/2018, Brazil's General Data Protection Law (Lei Geral de Proteção de Dados).

Personal Data means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, location data, online identifier, or factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

Processing means any operation performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure, or destruction.

Sensitive Personal Data or Special Categories of Data means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, sex life, or sexual orientation, as well as financial account information, government-issued identification numbers, and precise geolocation data.

Sub-processor means any third party engaged by Mavens to process Personal Data on behalf of a Customer.

3. DATA CONTROLLER AND DATA PROTECTION OFFICER

3.1 Data Controller

The data controller for Personal Data processed in connection with our Services is:

Mavens

Lisbon, Portugal (Headquarters)

For customers and data subjects in the United States:

Mavens

Wilmington, Delaware, USA

For customers and data subjects in Brazil:

Mavens Brazil

Porto Alegre, Rio Grande do Sul, Brazil

3.2 Data Protection Officer

Mavens has appointed a Data Protection Officer (DPO) who is responsible for overseeing our data protection strategy and ensuring compliance with applicable data protection laws.

You may contact our Data Protection Officer at:

Email: [email protected]

For LGPD-specific inquiries, our Encarregado (DPO under Brazilian law) can be reached at the same contact information.

4. CATEGORIES OF PERSONAL DATA WE COLLECT

4.1 Data We Collect Directly From You

(a) ACCOUNT AND IDENTITY DATA

(b) BILLING AND PAYMENT DATA

(c) COMMUNICATION DATA

(d) PROFESSIONAL SERVICES DATA

4.2 Data We Collect Automatically

(a) TECHNICAL AND DEVICE DATA

(b) USAGE DATA

(c) LOCATION DATA

4.3 Data Processed on Behalf of Customers

When acting as a data processor, we may process the following categories of data as directed by our Customers:

(a) CONTACT DATA

(b) COMMUNICATION CONTENT

(c) ENGAGEMENT DATA

(d) INTEGRATION DATA

4.4 Business Contact Database

Our business contact database contains professional information about business contacts, including:

We do NOT intentionally collect personal (non-business) contact information such as home addresses, personal email addresses, personal phone numbers, dates of birth, or any Sensitive Personal Data for our business contact database.

4.5 Data We Do NOT Collect

Unless specifically required and agreed upon pursuant to a Business Associate Agreement for HIPAA-covered entities, Mavens does not collect or process:

5. HOW WE COLLECT PERSONAL DATA

5.1 Data Provided Directly by You

We collect Personal Data that you voluntarily provide when you:

5.2 Data Collected Automatically

We automatically collect certain data when you:

See Section 12 for more information about cookies and tracking technologies.

5.3 Data Received from Third Parties

We may receive Personal Data from:

(a) CUSTOMERS

When a Customer uploads contact lists or connects their CRM or other data sources to our Platform.

(b) THIRD-PARTY DATA PROVIDERS

We license business contact information from reputable data providers who represent that they have collected such data lawfully.

(c) PUBLICLY AVAILABLE SOURCES

We gather professional information from publicly accessible sources such as:

(d) CONNECTED SERVICES

When you connect third-party services to the Platform (e.g., Gmail, Microsoft 365, CRM systems), we receive data necessary to provide the requested integration functionality.

(e) REFERRALS

When someone refers you to our Services, we may receive your contact information from the referring party.

5.4 Google API Data

If you connect a Google account (including Gmail) to Mavens:

6. LEGAL BASES FOR PROCESSING (GDPR/LGPD)

6.1 Legal Bases Under GDPR (Article 6)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your Personal Data based on one or more of the following legal bases:

(a) CONTRACT PERFORMANCE (Article 6(1)(b))

We process Personal Data when necessary to:

(b) LEGITIMATE INTERESTS (Article 6(1)(f))

We process Personal Data when necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. Our legitimate interests include:

(c) CONSENT (Article 6(1)(a))

We process Personal Data based on your consent when:

You may withdraw consent at any time (see Section 11).

(d) LEGAL OBLIGATION (Article 6(1)(c))

We process Personal Data when necessary to comply with applicable laws, such as:

6.2 Legal Bases Under LGPD (Article 7)

If you are located in Brazil, we process your Personal Data based on one or more of the following legal bases under the LGPD:

6.3 Processing as a Data Processor

When we process Personal Data on behalf of our Customers (as a data processor), the legal basis for processing is determined by the Customer (as data controller). Our Customers are responsible for:

7. PURPOSES OF PROCESSING

7.1 Providing and Maintaining the Services

We process Personal Data to:

7.2 Improving and Developing the Services

We process Personal Data to:

7.3 Communication

We process Personal Data to:

7.4 Security and Fraud Prevention

We process Personal Data to:

7.5 Legal and Compliance

We process Personal Data to:

7.6 Business Contact Database

We process business contact information to:

8. DATA SHARING AND DISCLOSURE

8.1 Categories of Recipients

We may share Personal Data with the following categories of recipients:

(a) SERVICE PROVIDERS AND SUB-PROCESSORS

We engage third-party service providers to perform functions on our behalf, including:

All service providers are contractually bound to protect Personal Data and may only process it for the specific purposes we authorize.

(b) THIRD-PARTY COMMUNICATION PLATFORMS

To enable omnichannel communications, we share data with:

These platforms process data according to their own privacy policies and terms. See Section 13 for more details.

(c) CUSTOMERS

When acting as a data processor, we provide Customers with access to Personal Data of their End Users as necessary to deliver our Services.

(d) INTEGRATION PARTNERS

When you connect third-party services to the Platform, we share data as necessary to enable the integration functionality you have requested.

(e) PROFESSIONAL ADVISORS

We may share Personal Data with our attorneys, accountants, auditors, and other professional advisors in connection with the services they provide to us.

(f) CORPORATE TRANSACTIONS

In connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy, Personal Data may be transferred to the acquiring entity or successor. We will provide notice of any such transfer and any choices you may have.

(g) LEGAL AND REGULATORY AUTHORITIES

We may disclose Personal Data when required by law or in response to valid legal process, including:

See Section 8.3 for our protocol for handling such requests.

8.2 Sub-Processors

A current list of our sub-processors is available upon request by emailing [email protected]. Customers who have entered into a Data Processing Agreement with us will be notified of any changes to our sub-processors in accordance with that agreement.

8.3 Handling Requests from Public Authorities

When we receive requests from public authorities for Personal Data, we follow this protocol:

(a) LEGAL REVIEW

Each request is evaluated to confirm its legal validity. We verify that the requesting authority has appropriate legal grounds (subpoena, court order, warrant, or equivalent legal basis).

(b) SCOPE LIMITATION

We limit disclosure to only the information strictly required to fulfill the request. We do not provide excessive or unrelated data.

(c) CUSTOMER NOTIFICATION

Unless prohibited by law or the request pertains to an ongoing investigation where notification could compromise the investigation, we will:

(d) USER NOTIFICATION

For data we control directly, we will notify affected users unless prohibited by law.

(e) DOCUMENTATION

All requests and our responses are documented, including the legal basis for disclosure and the specific data provided.

(f) CHALLENGING OVERBROAD REQUESTS

We will challenge requests that we believe are overbroad, vague, or otherwise legally deficient.

8.4 No Sale of Personal Data

Mavens does not sell Personal Data to third parties. We do not exchange Personal Data for monetary or other valuable consideration.

9. INTERNATIONAL DATA TRANSFERS

9.1 Locations of Processing

Mavens operates globally with data processing activities in:

Personal Data may be transferred to, stored, and processed in countries other than the country in which it was collected.

9.2 Transfers from the EEA, UK, and Switzerland

When we transfer Personal Data from the European Economic Area, United Kingdom, or Switzerland to countries that have not received an adequacy decision from the European Commission or relevant authority, we implement appropriate safeguards, including:

(a) STANDARD CONTRACTUAL CLAUSES (SCCs)

We use the European Commission's Standard Contractual Clauses for international transfers, as updated and approved.

(b) DATA PROCESSING AGREEMENTS

Our DPAs with Customers include commitments regarding international transfers and appropriate safeguards.

(c) SUPPLEMENTARY MEASURES

Where required, we implement additional technical and organizational measures to ensure an adequate level of protection.

9.3 Transfers from Brazil

When we transfer Personal Data from Brazil to other countries, we comply with LGPD requirements by:

9.4 Your Consent to Transfer

By using our Services, you acknowledge and consent to the transfer of your Personal Data to countries outside your country of residence, including to the United States, which may have different data protection laws than your jurisdiction.

10. DATA RETENTION

10.1 General Retention Principles

We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. To determine the appropriate retention period, we consider:

10.2 Retention Periods by Data Category

(a) ACCOUNT DATA

Retained for the duration of your account plus 30 days after account termination to allow for account recovery and data export.

(b) CUSTOMER DATA (DATA WE PROCESS AS PROCESSOR)

Retained according to the Data Processing Agreement with each Customer. Upon termination or expiration of Services:

(c) BILLING AND TRANSACTION DATA

Retained for 7 years after the transaction to comply with tax and accounting requirements.

(d) COMMUNICATION RECORDS

Support tickets and correspondence retained for 3 years after resolution for quality assurance and dispute resolution.

(e) MARKETING DATA

Retained until you opt out or withdraw consent, plus a record of your opt-out preference to ensure we honor it.

(f) WEBSITE ANALYTICS

Aggregated analytics data retained indefinitely; individual-level data retained for 26 months.

(g) BUSINESS CONTACT DATABASE

Professional contact information is retained and updated on an ongoing basis. Individuals may request removal at any time (see Section 11).

(h) SECURITY LOGS

Retained for 12 months for security monitoring and incident investigation.

10.3 Data Deletion

Upon expiration of the applicable retention period, Personal Data is:

Backup copies may be retained for a limited additional period as part of our disaster recovery procedures, during which they remain subject to this Policy.

11. YOUR RIGHTS AS A DATA SUBJECT

11.1 Rights Under GDPR (EEA, UK, Switzerland)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights regarding your Personal Data:

(a) RIGHT OF ACCESS (Article 15)

You have the right to obtain confirmation as to whether we process your Personal Data and, if so, to access that data and receive information about how it is processed.

(b) RIGHT TO RECTIFICATION (Article 16)

You have the right to have inaccurate Personal Data corrected and incomplete data completed.

(c) RIGHT TO ERASURE / "RIGHT TO BE FORGOTTEN" (Article 17)

You have the right to request deletion of your Personal Data in certain circumstances, such as when:

(d) RIGHT TO RESTRICTION OF PROCESSING (Article 18)

You have the right to request that we restrict processing of your Personal Data in certain circumstances, such as when you contest the accuracy of the data or object to processing.

(e) RIGHT TO DATA PORTABILITY (Article 20)

You have the right to receive your Personal Data in a structured, commonly used, machine-readable format and to transmit it to another controller, where technically feasible.

(f) RIGHT TO OBJECT (Article 21)

You have the right to object to processing of your Personal Data:

(g) RIGHT NOT TO BE SUBJECT TO AUTOMATED DECISION-MAKING (Article 22)

You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you, unless such processing is necessary for a contract, authorized by law, or based on your explicit consent.

(h) RIGHT TO WITHDRAW CONSENT

Where processing is based on consent, you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

(i) RIGHT TO LODGE A COMPLAINT

You have the right to lodge a complaint with a supervisory authority, particularly in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

11.2 Rights Under LGPD (Brazil)

If you are located in Brazil, you have the following rights under the LGPD (Article 18):

You have the right to petition the ANPD (Autoridade Nacional de Proteção de Dados) regarding your Personal Data.

11.3 Exercising Your Rights

To exercise any of these rights, please contact us at:

Email: [email protected]

We will respond to your request within:

We may need to verify your identity before processing your request. If we cannot verify your identity, we may request additional information.

11.4 Rights for End Users of Our Customers

If you are an End User whose data is processed by Mavens on behalf of one of our Customers, please direct your requests to the Customer directly. We will assist our Customers in responding to such requests in accordance with our Data Processing Agreement.

11.5 Removal from Business Contact Database

If your professional contact information is included in our business contact database and you wish to be removed, please email [email protected] with the subject line "Database Removal Request." We will process your request within 30 days and add your information to our suppression list to prevent re-addition.

12. COOKIES AND TRACKING TECHNOLOGIES

12.1 Types of Cookies We Use

(a) STRICTLY NECESSARY COOKIES

Essential for the Website and Platform to function. These cannot be disabled.

(b) PERFORMANCE/ANALYTICS COOKIES

Help us understand how visitors interact with our Website by collecting anonymous information.

(c) FUNCTIONALITY COOKIES

Remember your preferences and settings to enhance your experience.

(d) MARKETING/TARGETING COOKIES

Track your browsing activity to deliver relevant advertisements. These are only placed with your consent.

12.2 Cookie Consent

For visitors from the EEA, UK, Switzerland, Brazil, and other jurisdictions requiring consent:

12.3 Web Beacons and Tracking Pixels

We use web beacons (tracking pixels) in our emails to understand:

You can disable image loading in your email client to prevent tracking, or click "unsubscribe" in any email to opt out of future communications.

12.4 Do Not Track

Some browsers offer a "Do Not Track" (DNT) signal. Our Website does not currently respond to DNT signals. However, you can manage your cookie preferences as described above.

12.5 Third-Party Analytics

We use third-party analytics services (such as Google Analytics) to analyze Website usage. These services may use cookies and similar technologies. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

13. THIRD-PARTY COMMUNICATION CHANNELS

13.1 Overview

Mavens enables omnichannel communications through various third-party platforms. When you or your End Users communicate through these channels, data is shared with and processed by the respective platform providers.

13.2 WhatsApp and Meta Platforms

If you use WhatsApp Business API through our Services:

13.3 Telecommunications Providers (SMS/Voice)

If you use SMS or voice services through our Platform:

13.4 Email Services

If you connect email services (Gmail, Microsoft 365, etc.):

13.5 Your Responsibilities

When using third-party communication channels through our Services, you are responsible for:

14. AI AND AUTOMATED PROCESSING

14.1 AI-Powered Features

Our Platform includes AI-powered features such as:

14.2 How AI Processes Data

Our AI systems process:

To:

14.3 Automated Decision-Making

We do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect individuals without human oversight.

Where our Customers use AI features that may involve automated decision-making affecting End Users, Customers are responsible for:

14.4 AI Training

We may use aggregated, anonymized, or de-identified data derived from usage of our Services to train and improve our AI models. We do NOT use identifiable Customer data or End User data for AI training without explicit consent or a specific contractual agreement permitting such use.

14.5 Disclosure of AI Use

When AI or automated systems interact with End Users on behalf of our Customers, our Customers are responsible for providing appropriate disclosures that the communication is automated or AI-assisted, as required by applicable law.

15. CHILDREN'S PRIVACY

Our Services are designed for business use and are not intended for children. We do not knowingly collect Personal Data from:

If we learn that we have collected Personal Data from a child in violation of applicable law, we will delete that information promptly. If you believe we have collected information from a child, please contact us at [email protected].

16. SECURITY MEASURES

16.1 Technical Safeguards

We implement appropriate technical measures to protect Personal Data, including:

16.2 Organizational Safeguards

We implement appropriate organizational measures, including:

16.3 Payment Card Security

We do not store complete payment card numbers. Payment processing is handled by PCI DSS-compliant third-party processors.

16.4 Your Security Responsibilities

You are responsible for:

16.5 No Guarantee

While we implement security measures consistent with industry standards, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security of your Personal Data.

17. DATA BREACH NOTIFICATION

17.1 Our Commitment

In the event of a security incident involving Personal Data, we are committed to:

17.2 Notification to Supervisory Authorities

Where required by GDPR (Article 33), we will notify the relevant supervisory authority within 72 hours of becoming aware of a breach involving Personal Data, unless the breach is unlikely to result in a risk to individuals' rights and freedoms.

Where required by LGPD, we will notify the ANPD and affected data subjects within a reasonable time as determined by the ANPD.

17.3 Notification to Customers

If a breach involves Personal Data we process on behalf of a Customer, we will notify the Customer promptly (and in any event within the timeframe specified in our Data Processing Agreement) to enable the Customer to fulfill its own notification obligations.

17.4 Notification to Individuals

Where a breach is likely to result in a high risk to individuals' rights and freedoms, we will notify affected individuals directly, unless:

18. HIPAA AND PROTECTED HEALTH INFORMATION

18.1 Default Status

BY DEFAULT, Mavens IS NOT A HIPAA-COVERED ENTITY AND THE SERVICES ARE NOT DESIGNED OR INTENDED FOR USE WITH PROTECTED HEALTH INFORMATION (PHI).

You should NOT use our standard Services to collect, store, process, or transmit PHI unless you have entered into a Business Associate Agreement (BAA) with Mavens.

18.2 HIPAA-Eligible Services

For Customers who are HIPAA-covered entities or business associates and require HIPAA compliance:

18.3 Third-Party Platform Limitations

IMPORTANT: Certain third-party platforms integrated with our Services (including WhatsApp/Meta) explicitly do NOT support HIPAA compliance. You must NOT transmit PHI through channels that do not support HIPAA, even if you have a BAA with Mavens.

18.4 Your Responsibilities Under HIPAA

If you are a HIPAA-covered entity or business associate, you are responsible for:

19. CALIFORNIA PRIVACY RIGHTS (CCPA/CPRA)

19.1 Applicability

This section applies to California residents and supplements the other provisions of this Policy pursuant to the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA").

19.2 Categories of Personal Information

In the preceding 12 months, we have collected the following categories of Personal Information:

19.3 Your California Rights

You have the right to:

(a) KNOW

Request disclosure of the Personal Information we have collected about you, including categories, sources, purposes, and third parties with whom we share it.

(b) DELETE

Request deletion of your Personal Information, subject to certain exceptions.

(c) CORRECT

Request correction of inaccurate Personal Information.

(d) OPT OUT OF SALE/SHARING

We do not sell Personal Information or share it for cross-context behavioral advertising. Therefore, no opt-out is necessary.

(e) NON-DISCRIMINATION

We will not discriminate against you for exercising your privacy rights.

19.4 Exercising Your California Rights

To exercise your rights, contact us at [email protected]. We will verify your identity before processing your request.

19.5 Authorized Agents

You may designate an authorized agent to make requests on your behalf. We may require verification that you authorized the agent.

20. UPDATES TO THIS POLICY

20.1 Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.

20.2 Notification of Changes

For material changes, we will:

20.3 Your Continued Use

Your continued use of our Services after any changes to this Policy constitutes your acceptance of the updated Policy. If you do not agree with any changes, you should discontinue use of our Services.

21. CONTACT INFORMATION

21.1 General Inquiries

For questions about this Privacy Policy or our privacy practices:

Email: [email protected]

Website: www.mavensforce.com

21.2 Data Protection Officer

Email: [email protected]

21.3 Mavens Europe (Headquarters)

Lisbon, Portugal

Email: [email protected]

21.4 Mavens Brazil / Encarregado

Porto Alegre, Rio Grande do Sul, Brazil

Email: [email protected]

21.5 Other Inquiries

Legal/Terms of Service: [email protected]

General Support: [email protected]

21.6 Supervisory Authorities

EEA residents may lodge a complaint with their local data protection authority. A list of EU data protection authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

Brazil residents may petition the ANPD at: https://www.gov.br/anpd/

By using Mavens Services, you acknowledge that you have read and understood this Privacy Policy.