Privacy policy
Version: hackera.rewards 1.0
At Hackera we believe good technology starts with trust. That is why we aim to collect only the data we need, use it for clear purposes and protect it with appropriate technical and organisational measures.
This policy explains how we process personal data when you visit the website, register, use the platform and communicate with us.
1. Who is responsible for your data?
The controller of personal data, for operations where we determine the purposes and means, is:
Imoti 98 EOOD
Company ID (EIK): 207210213
Address: Lyulin 8 residential district, 1324 Sofia, Bulgaria
Privacy email: support@hackera.online
Website: https://rewards.hackera.online/
For certain operations, payment, card and technology partners may act as independent controllers or as processors of personal data. This depends on the specific service and the contractual relationship.
2. What data may we process?
We process only the data that is necessary for the relevant purpose and feature.
2.1. Contact and identification data
This may include first and last name, work email, phone number, job title, company, correspondence address and information about representation.
2.2. Account data
This may include a user identifier, settings, access rights, account status and the history of actions in the platform.
2.3. Security data
This may include IP address, timestamps, technical logs, session data, failed access attempts and information needed to investigate incidents.
2.4. Service usage data
Depending on the active features, we may process virtual card settings, operation statuses, transaction identifiers, spending information and technical data from integrations.
2.5. Payment and invoicing data
We may process subscription information, price, invoice, payment status and transaction identifiers.
Full payment card data is processed by the relevant provider, where applicable. We should not collect or store such data in our own systems, unless the specific architecture and the applicable requirements expressly allow it and the necessary safeguards are in place.
2.6. Correspondence
We may keep enquiries, support requests, complaints and communication needed to serve the customer.
3. Why do we process data?
We use personal data for the following purposes:
Providing the service. Creating and managing accounts, handling requests and delivering the agreed features.
Customer verification. Identification, checking representation and meeting applicable requirements of partners or the law.
Payments and accounting. Processing subscriptions, invoicing and meeting legal obligations.
Security. Preventing abuse, detecting unauthorised access and protecting the platform.
Support. Answering enquiries, resolving problems and improving service.
Product development. Diagnostics, performance analysis and improving features, in line with applicable requirements.
Marketing. Sending permitted business messages and product news, where we have an applicable legal basis.
4. On what legal basis do we process data?
Depending on the specific purpose, processing may be based on:
- performance of a contract or taking steps before entering into one;
- compliance with a legal obligation;
- legitimate interest, where it is permitted and does not override the rights and freedoms of the individual;
- consent, where the law requires it or provides for it as a basis.
We do not use one general basis for all operations. The applicable basis is determined by the specific purpose and the way the data is processed.
5. Stripe and other partners
For certain features we may use Stripe or other providers of payment infrastructure, card services, hosting, email and technical support.
When a customer uses such a feature, the necessary data may be passed to the relevant provider for registration, verification, payment processing, managing a card operation or delivering the service.
Each provider processes data according to its applicable role, its contractual terms and its own privacy policy.
Stripe privacy information: https://stripe.com/privacy
We do not claim that a provider issues cards, holds customer funds or performs any other specific regulated function until this is confirmed for the product in use.
6. Who may we share data with?
Data may be shared only where necessary and with an appropriate legal basis, including with:
- payment and card providers;
- providers of hosting, databases and cloud infrastructure;
- providers of email and support tools;
- accountants, auditors and professional advisers;
- competent public authorities, where the law requires it.
We do not sell personal data to third parties for their own independent marketing purposes.
7. Transfers outside the EEA
Some providers may process data, or provide access to data, outside the European Economic Area.
Where this amounts to an international transfer of personal data, we apply the appropriate mechanisms under applicable law, where required. These may include an adequacy decision, standard contractual clauses and supplementary measures.
8. How long do we keep data?
We keep data for the period needed for the specific purpose, taking into account legal obligations, security and the need to protect legal claims.
- Account data: for the period of use and the necessary period afterwards.
- Accounting documents: for the periods set by applicable legislation.
- Technical logs: for a reasonable period, in line with security and diagnostics.
- Correspondence: for the time needed to serve and resolve the relevant matter.
- Marketing data: according to the applicable legal basis and until consent is withdrawn or an objection is made, where applicable.
When data is no longer needed, we delete or anonymise it, unless the law requires otherwise.
9. What rights do you have?
Subject to applicable law, you can ask for:
- access to your personal data;
- correction of inaccurate data;
- deletion of data, where the legal conditions are met;
- restriction of processing;
- data portability, where this right applies;
- objection to certain types of processing;
- withdrawal of any consent you gave, without affecting the lawfulness of earlier processing.
You can exercise your rights by writing to support@hackera.online.
We will consider your request within the applicable legal period. We may ask for reasonably necessary information to confirm your identity.
10. Supervisory authority
If you believe the processing of your personal data breaches applicable law, you can lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), or with the authority in your own country.
Website: https://www.cpdp.bg/
The right to complain does not limit your ability to seek other remedies provided by law.
11. Security
We apply appropriate technical and organisational measures according to the nature of the data and the risks of processing.
These may include access control, rights management, system protection, monitoring of technical events and incident response procedures.
Security is a shared responsibility. Customers should protect their access credentials, use strong passwords and report any suspected account compromise promptly.
No technology can guarantee absolute security.
12. Cookies
The website may use strictly necessary cookies, as well as analytics or marketing technologies, if any are deployed.
Where prior consent is required, the relevant technologies will not be activated before consent is received.
Additional information about the cookies actually used, their purposes and their durations is provided through the relevant notice or cookie policy.
13. Changes to this policy
We may update this policy when our services, technologies, providers or legal requirements change.
The current version is published on the website, with the date of the last update.
14. Contact
For questions about personal data:
Hackera Rewards
Imoti 98 EOOD
Company ID (EIK): 207210213
Email: support@hackera.online
Website: https://rewards.hackera.online/
Privacy is not a feature we add later. It is part of how we build.