Supplemental EEA+ Privacy Notice

This Supplemental EEA+ Privacy Notice is addressed to individuals located in the European Economic Area (EEA), the United Kingdom (UK), and Switzerland. When we refer to our products in this Notice, we’re referring to all of the products and services that we provide directly to you, including our mobile applications, websites, software, newsletters, and emails. For more details on how we collect, use, and disclose your personal data, please refer to the Fireflow Creative Collective LLC Privacy Policy.

1. What Laws Apply?

If you are located in the EEA, the processing of your personal data is governed by the EU General Data Protection Regulation (GDPR). If you are in the UK, the UK General Data Protection Regulation applies to the processing of your personal data. References to the “GDPR” in this Notice should be interpreted as applying to the General Data Protection Regulation in the country where you are located. If you are in Switzerland, the provisions of the Swiss Federal Data Protection Act (FDPA) apply, and references to the GDPR should be read accordingly in the context of the FDPA.

2. Who is the Data Controller and Who is Its EEA and UK Representative?

The data controller for your personal data is Fireflow Creative Collective LLC.

3. What Lawful Bases of Processing Do We Rely On?

We rely on the following legal bases to process your personal data, as applicable:

Contract Performance Legal Basis: Processing is necessary for us to perform a contract with you or to take steps at your request before entering into a contract, per Article 6(1)(b) GDPR.
Legal Obligations Legal Basis: Processing is necessary for us to comply with a legal obligation, per Article 6(1)(c) GDPR.
Legitimate Interest Legal Basis: Processing is necessary for the purposes of our legitimate interests, provided that these interests are not overridden by your rights and interests, per Article 6(1)(f) GDPR.
Consent Legal Basis: Processing is based on your consent, per Article 6(1)(a) GDPR. You can withdraw your consent at any time, which will take effect for future processing.

The table below outlines the legal basis and, where applicable, the legitimate interests pursued with respect to each purpose for which we process personal data.

4. Where Is Your Personal Data Processed and On What Basis Do We Transfer Personal Data Across Borders?

We rely on service providers located in various countries, including the United States. We ensure that these service providers offer an adequate level of data protection by entering into appropriate data transfer agreements based on Standard Contractual Clauses, where applicable, and by conducting data protection assessments of data transfer arrangements as necessary. You can request a copy of these data transfer agreements by contacting us at the details provided below. We also comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework as established by the U.S. Department of Commerce.

5. Do You Have to Provide Personal Data?

You are not legally required to provide us with your personal data; however, if you choose not to provide certain personal data, you may not be able to fully utilize our products. If you opt out of allowing us to collect information through cookies or similar technologies, some features of our website may not function properly, but you will still be able to use our services. We will clearly indicate which data fields are mandatory when we collect personal data from you through online forms.

6. What Rights Do You Have?

In the EEA, UK, and Switzerland, you have the following rights, subject to the conditions set forth in the GDPR and/or local data protection laws:

Right to Object: You have the right to object, on grounds relating to your particular situation, to our processing of your personal data. This includes objecting to processing for direct marketing purposes or where we are processing your data based on legitimate interests. If you object to our processing based on legitimate interests, we will cease processing your personal data unless we have compelling legitimate grounds or legal reasons to continue.
Right of Access: You have the right to request confirmation as to whether we process your personal data and, if so, to access details about how we process your data, including obtaining copies of the personal data.
Right to Rectification: You have the right to request the correction of inaccurate personal data concerning you.
Right to Erasure: You can ask us to delete your personal data where it is no longer required for legally required purposes.
Right to Restrict Processing: You can request that we limit the processing of your personal data to specific purposes only.
Right to Data Portability: You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit this data to another entity without hindrance.
Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority, particularly in the EEA, UK, or Switzerland, if you believe your data protection rights have been violated.
Post-Mortem Data Rights: In certain jurisdictions, such as France and Portugal, you may also have the right to provide us with guidelines regarding the processing of your personal data after your death.

You can view a list of supervisory authorities and their contact information here:

To exercise your rights under applicable privacy laws, raise a privacy concern, or make a data-related request, please contact us using the contact information provided below. We may ask for additional information to verify your identity and ensure that you are authorized to make the request. We will respond to your requests in accordance with applicable laws.

7. Contact Information

If you have any questions regarding this Notice or wish to exercise your privacy rights, please contact us by submitting a help request or by emailing us at [email protected].