Effective date: The date displayed when this Policy is published or last updated on Univerax.
1.1. This GDPR / Data Protection Policy (“Policy”) describes the principles and governance framework used by Zenlyai OÜ, trading as Univerax (“Univerax,” “we,” “us,” or “our”), to protect personal data and comply with applicable data protection laws.
1.2. This Policy supports compliance with Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), and other applicable privacy and data protection requirements.
1.3. This Policy applies to personal data processed in connection with Univerax, its websites, applications, marketplace, communications, transactions, professional and social-network features, analytics, artificial intelligence features, Digital Twins, and related services (collectively, the “Platform”).
1.4. This Policy should be read together with the Privacy Policy, Cookies Policy, Data Retention and Deletion Policy, Security and Responsible Disclosure Policy, AI Transparency and Automated Decision Policy, and any feature-specific privacy notice.
1.5. This Policy does not replace the Privacy Policy or any notice that must be provided to an individual at the point personal data is collected.
2.1. This Policy applies to personal data relating to:
a. Platform visitors;
b. Customers;
c. Creators, authors, sellers, and service providers;
d. account holders and social-network users;
e. transaction participants;
f. recipients of communications;
g. individuals represented in User Content, AI inputs, or Digital Twins;
h. complainants, reporters, and appellants;
i. business contacts and representatives; and
j. other identifiable individuals whose data is processed through the Platform.
2.2. This Policy applies to personal data processed electronically and to relevant structured non-electronic records.
2.3. Data that has been irreversibly anonymised so that no individual is identifiable is not personal data. Pseudonymised data remains personal data where it can be attributed to an individual using additional information.
3.1. Unless another entity is expressly identified for a particular activity, the controller responsible for the Platform processing described in the Privacy Policy is:
Legal entity: Zenlyai OÜ
Trade name: Univerax
Registered address: Harju maakond, Tallinn, Kesklinna linnaosa, Veskiposti tn 2-1002, 10138
https://ariregister.rik.ee/eng/company/17160305, Estonia
Registration number: 17160305
Privacy email: author@univerax.com
Legal email: info@univerax.com
Phone: +90 850 532 23 02
3.2. Univerax may act as:
a. a controller where it determines why and how personal data is processed;
b. a joint controller where it determines purposes and means together with another party; or
c. a processor where it processes personal data solely on documented instructions from another controller.
3.3. Creators commonly act as independent controllers when they determine how Customer data will be used to fulfil products, Digital Content, Services, or Bookings.
3.4. Using the Platform does not automatically make Univerax and a Creator joint controllers. The factual allocation of decisions and responsibilities determines the parties’ legal roles.
3.5. Where joint controllership exists, responsibilities will be allocated transparently as required by law.
3.6. Where Univerax acts as a processor, processing will be governed by legally required contractual terms.
Univerax applies the following principles to personal data processing.
Personal data must be processed under a valid legal basis, fairly, and in a manner that individuals can reasonably understand.
Personal data must be collected for specified, explicit, and legitimate purposes and must not be used for an incompatible purpose unless permitted by law.
Only personal data that is adequate, relevant, and reasonably necessary for the identified purpose should be collected or used.
Reasonable steps must be taken to keep personal data accurate and, where necessary, current. Material inaccuracies should be corrected or deleted without undue delay.
Identifiable personal data must not be retained longer than reasonably necessary for the purpose, subject to legal, security, evidentiary, and dispute-related requirements.
Personal data must be protected through technical and organisational measures appropriate to the risks.
Univerax must be able to demonstrate compliance through appropriate policies, records, assessments, contracts, controls, training, and review processes.
5.1. Before processing personal data, Univerax will identify an appropriate legal basis.
5.2. Depending on the circumstances, processing may be based on:
a. consent;
b. performance of a contract or steps requested before entering into a contract;
c. compliance with a legal obligation;
d. protection of vital interests;
e. performance of a task in the public interest where applicable; or
f. legitimate interests pursued by Univerax or a third party, except where those interests are overridden by the individual’s rights and interests.
5.3. Where legitimate interests are relied upon, Univerax will consider:
a. the purpose and benefit of the processing;
b. whether the processing is necessary;
c. the individual’s reasonable expectations;
d. the nature and sensitivity of the data;
e. the possible effect on the individual; and
f. available safeguards and user controls.
5.4. Processing will not be presented as based on consent where the individual does not have a genuine and sufficiently informed choice.
5.5. If processing relies on consent, withdrawal must be possible as easily as reasonably appropriate to the method by which consent was given.
5.6. Withdrawal does not affect processing lawfully performed before withdrawal.
6.1. Special-category personal data includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data used for unique identification, health data, and data concerning a person’s sex life or sexual orientation.
6.2. Univerax will process special-category data only where:
a. a valid GDPR Article 9 condition or other applicable legal condition applies;
b. the processing is necessary and proportionate;
c. appropriate safeguards are implemented; and
d. any required information or explicit consent has been provided.
6.3. Personal data concerning criminal convictions and offences will be processed only under official authority or where authorised by applicable law with appropriate safeguards.
6.4. Users should not provide sensitive data through ordinary profile, messaging, support, AI, Digital Twin, listing, or transaction fields unless it is necessary, permitted, and requested through an appropriate process.
6.5. The availability of a technical field does not establish a lawful basis for uploading another person’s sensitive data.
7.1. Individuals must receive clear and accessible information about relevant processing.
7.2. Depending on whether data is collected directly or from another source, the information may include:
a. the controller’s identity and contact details;
b. Data Protection Officer or representative details where applicable;
c. processing purposes and lawful bases;
d. legitimate interests where relied upon;
e. categories of personal data;
f. recipients or categories of recipients;
g. international transfers and safeguards;
h. retention periods or criteria;
i. applicable data protection rights;
j. the right to withdraw consent;
k. the right to complain to a supervisory authority;
l. whether providing data is required and the possible consequences of not providing it;
m. the source of data collected from elsewhere; and
n. meaningful information about qualifying automated decision-making.
7.3. Information will be provided within the period required by applicable law, subject to lawful exceptions.
7.4. Layered and feature-specific notices may be used to present important information at an appropriate time without making notices unnecessarily difficult to understand.
8.1. Data protection considerations should be integrated into the design, selection, development, testing, deployment, and operation of Platform features and business processes.
8.2. Measures will be selected by considering:
a. the nature, scope, context, and purposes of processing;
b. the likelihood and severity of risks to individuals;
c. the state of the art;
d. implementation costs; and
e. the need to implement data protection principles effectively.
8.3. Appropriate measures may include:
a. data minimisation;
b. pseudonymisation;
c. encryption;
d. role-based access controls;
e. separation of data and environments;
f. limited default visibility;
g. consent and preference controls;
h. retention and deletion rules;
i. security and abuse monitoring;
j. testing and human oversight; and
k. documentation of decisions.
8.4. By default, only personal data reasonably necessary for each specific purpose should be processed.
8.5. Default settings should not make personal data publicly available to an indefinite audience unless this is necessary for the requested feature and the user has received clear information and appropriate control.
8.6. Privacy review should take place before launching a feature that introduces material new processing.
9.1. A Data Protection Impact Assessment (“DPIA”) will be conducted before processing that is likely to result in a high risk to individuals’ rights and freedoms.
9.2. A DPIA may be required for activities involving:
a. systematic and extensive profiling;
b. solely automated significant decisions;
c. large-scale processing of special-category data;
d. systematic monitoring of publicly accessible areas;
e. biometric identification;
f. children or other vulnerable individuals;
g. combining datasets in unexpected ways;
h. innovative technologies with significant privacy implications;
i. large-scale location or behavioural tracking;
j. high-risk AI systems; or
k. Digital Twins using extensive identity, voice, image, behavioural, or knowledge data.
9.3. A DPIA should document:
a. the proposed processing and its purposes;
b. the lawful basis;
c. necessity and proportionality;
d. risks to individuals;
e. measures intended to address those risks;
f. residual risk; and
g. consultation and approval requirements.
9.4. Where a DPIA indicates a high residual risk that cannot be adequately reduced, the competent supervisory authority will be consulted before processing where required by law.
9.5. DPIAs should be reviewed when the relevant processing or risk materially changes.
10.1. Univerax will maintain records of processing activities where required by law.
10.2. Records may include:
a. controller, representative, and Data Protection Officer details;
b. processing purposes;
c. categories of individuals and personal data;
d. recipients;
e. international transfers and safeguards;
f. retention criteria;
g. general security measures; and
h. processor activities conducted for controllers.
10.3. Any legal exemption from recordkeeping will be interpreted narrowly and will not be relied upon where processing is not occasional, presents risks, or involves special-category or criminal-offence data.
10.4. Processing records should be reviewed when material changes occur.
11.1. Depending on the applicable law and circumstances, individuals may have rights to:
a. information and transparent communication;
b. access personal data;
c. rectify inaccurate or incomplete data;
d. erase personal data;
e. restrict processing;
f. object to processing based on legitimate interests or public-interest grounds;
g. object to direct marketing;
h. data portability;
i. withdraw consent;
j. protection from qualifying solely automated decisions;
k. lodge a complaint with a supervisory authority; and
l. seek an effective judicial remedy.
11.2. Rights are not absolute and may be limited by lawful exceptions.
11.3. Univerax will not discriminate against an individual for exercising a data protection right.
11.4. Privacy requests may be submitted through available account controls or to author@univerax.com.
12.1. Requests must be recorded, assessed, and answered within the period required by applicable law.
12.2. Univerax may request information reasonably necessary to verify:
a. the requester’s identity;
b. the account or data concerned; and
c. the authority of a representative.
12.3. Verification must be proportionate and must not require unnecessary additional personal data.
12.4. Requests should be routed to other controllers where Univerax does not control the relevant processing.
12.5. Searches and responses should be reasonably comprehensive and should consider relevant systems, recipients, archives, and legally accessible records.
12.6. Information concerning other people must be protected when responding to a request.
12.7. Requests will normally be handled without charge. A reasonable fee may be charged, or action may be refused, only where permitted by law, including where a request is manifestly unfounded or excessive.
12.8. If a request is refused or restricted, the individual will be informed of the reason and available complaint or remedy rights where required.
13.1. Univerax may use automated systems to assist with recommendations, security, fraud prevention, verification, moderation, transaction review, and Platform integrity.
13.2. Before using automated processing that may materially affect an individual, Univerax will assess:
a. the lawful basis;
b. necessity and proportionality;
c. data quality and relevance;
d. the risk of error or discrimination;
e. transparency requirements;
f. security and robustness;
g. human oversight; and
h. available rights and remedies.
13.3. A decision based solely on automated processing that produces legal or similarly significant effects will be made only where permitted by applicable law.
13.4. Where required, affected individuals will receive:
a. notice of the automated decision;
b. meaningful information about the logic or principal factors involved;
c. information about the significance and expected consequences;
d. an opportunity to express their point of view;
e. a way to contest the decision; and
f. meaningful human review by a person with authority to change the outcome.
13.5. A nominal or purely procedural human check will not be treated as meaningful human involvement.
13.6. Further information is provided in the Privacy Policy and AI Transparency and Automated Decision Policy.
14.1. Personal data used in the development, configuration, testing, deployment, or operation of AI and Digital Twin features remains subject to applicable data protection law.
14.2. Before using personal data for an AI or Digital Twin purpose, Univerax will consider:
a. the purpose and lawful basis;
b. the provenance and expected accuracy of the data;
c. whether individuals received appropriate information;
d. whether consent or an objection mechanism is required;
e. intellectual property, confidentiality, and identity rights;
f. special-category and children’s data;
g. bias, discrimination, and inaccurate inference risks;
h. security and misuse risks;
i. retention and deletion; and
j. whether a DPIA is required.
14.3. Private User Content will not be used to train general-purpose AI models unless a valid legal basis has been identified and required notices, permissions, consent, or objection controls have been provided.
14.4. Users must not use AI or Digital Twin features to process another person’s personal data unlawfully.
14.5. Individuals may challenge materially inaccurate personal data or inferences attributed to them, subject to applicable law.
15.1. Processing involving children or other vulnerable individuals requires particular care.
15.2. Univerax will consider:
a. the individual’s age, capacity, and reasonable expectations;
b. whether parental or guardian authorisation is required;
c. the clarity and age-appropriateness of information;
d. whether profiling or advertising should be restricted;
e. default privacy settings;
f. risks of manipulation, exploitation, or unwanted contact; and
g. appropriate reporting and support mechanisms.
15.3. Where consent is relied upon for an information society service offered directly to a child, parental or guardian authorisation will be obtained where required by applicable law.
15.4. Commercial interests will not override the best interests and fundamental rights of a child.
16.1. Personal data may be shared only where:
a. there is a defined and lawful purpose;
b. the disclosure is necessary and proportionate;
c. an appropriate legal basis exists;
d. required information has been provided;
e. confidentiality and security are addressed; and
f. any international transfer requirements are satisfied.
16.2. Sharing with Creators, Customers, authorities, professional advisers, and other controllers must be limited to what is reasonably necessary.
16.3. A recipient must not be described as a processor where it independently determines its own processing purposes.
16.4. Requests from public authorities should be assessed for legal validity, necessity, proportionality, and scope where applicable.
17.1. Before appointing a processor, Univerax will seek sufficient assurances that the processor can implement appropriate technical and organisational measures.
17.2. Processor arrangements will include legally required terms concerning:
a. subject matter and duration;
b. nature and purpose of processing;
c. types of personal data and categories of individuals;
d. documented instructions;
e. confidentiality;
f. security;
g. subprocessors;
h. assistance with rights requests and compliance;
i. personal data breaches;
j. deletion or return of data;
k. audits and compliance information; and
l. international transfers.
17.3. Subprocessors must be subject to data protection obligations providing an appropriate level of protection.
17.4. Providers should be reviewed according to the nature and risk of their processing.
17.5. If a processor determines its own incompatible purposes or means, its legal role and responsibility will be assessed under applicable law.
18.1. Transfers of personal data outside the European Economic Area or another protected jurisdiction will take place only where a valid transfer mechanism or legal exception applies.
18.2. Transfer mechanisms may include:
a. an adequacy decision;
b. approved standard contractual clauses;
c. binding corporate rules;
d. an approved code of conduct or certification mechanism where available; or
e. a legally permitted derogation for a specific situation.
18.3. Where required, Univerax will assess whether the laws and practices of the destination country may undermine the selected safeguard.
18.4. Supplementary contractual, technical, or organisational measures will be implemented where necessary.
18.5. Transfer safeguards will be reviewed when material legal, technical, or operational circumstances change.
19.1. Personal data must be assigned an appropriate retention basis or criterion.
19.2. Retention decisions should consider:
a. the processing purpose;
b. account and transaction duration;
c. contractual obligations;
d. tax, accounting, consumer, and regulatory requirements;
e. applicable limitation periods;
f. security and fraud-prevention needs;
g. complaints, disputes, and legal claims;
h. the sensitivity of the data; and
i. technical backup cycles.
19.3. When personal data is no longer needed, it should be securely deleted, irreversibly anonymised, or isolated where continued restricted retention is legally necessary.
19.4. Personal data must not be retained indefinitely merely because storage is technically available.
19.5. Further information is provided in the Data Retention and Deletion Policy.
20.1. Univerax will implement technical and organisational measures appropriate to the risks presented by the processing.
20.2. Measures may include:
a. access and authentication controls;
b. least-privilege permissions;
c. encryption and pseudonymisation;
d. secure development and change management;
e. logging and monitoring;
f. vulnerability and patch management;
g. backups and recovery testing;
h. availability and resilience controls;
i. provider security assessment;
j. staff confidentiality and awareness measures; and
k. incident detection and response.
20.3. Security measures will be reviewed and adjusted according to changes in risks, systems, threats, technology, and applicable law.
20.4. Users and Creators must also take reasonable measures to protect credentials, devices, integrations, and personal data accessible through their accounts.
21.1. A personal data breach is a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
21.2. Suspected breaches must be escalated promptly for assessment.
21.3. The assessment should consider:
a. the nature and volume of affected data;
b. the number and characteristics of affected individuals;
c. potential consequences;
d. identifiability;
e. security protections such as encryption;
f. containment and remediation; and
g. the likelihood and severity of risk.
21.4. Where required by the GDPR, a qualifying breach will be notified to the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of it.
21.5. Where notification is made later than required, reasons for the delay will be documented where necessary.
21.6. Where a breach is likely to result in a high risk to individuals, affected individuals will be informed without undue delay unless a lawful exception applies.
21.7. Breaches will be documented, including relevant facts, effects, assessment, decisions, and remedial action, whether or not external notification is required.
21.8. Processors acting for Univerax must notify Univerax of personal data breaches without undue delay and provide the information reasonably required for compliance.
22.1. Access to personal data should be limited to authorised individuals with a legitimate operational need.
22.2. Individuals with access must be subject to appropriate confidentiality obligations.
22.3. Relevant personnel should receive data protection and security information appropriate to their responsibilities.
22.4. Elevated, administrative, or sensitive access should be subject to additional controls and review.
22.5. Access should be removed or adjusted promptly when no longer required.
23.1. Responsibility for data protection is shared across relevant Platform, product, engineering, security, legal, support, moderation, marketing, and operational functions.
23.2. Senior management is responsible for supporting appropriate data protection governance and resources.
23.3. Relevant teams are responsible for identifying processing activities and raising material privacy risks before implementation.
23.4. Data protection advice should be sought for high-risk, unusual, or materially changed processing.
23.5. Compliance measures may include:
a. policies and procedures;
b. processing records;
c. privacy notices;
d. consent records;
e. legitimate-interest assessments;
f. DPIAs;
g. contracts and transfer safeguards;
h. security controls;
i. rights-request records;
j. breach records; and
k. periodic review and audit.
24.1. Univerax will appoint a Data Protection Officer (“DPO”) where required by applicable law.
24.2. If appointed, the DPO will:
a. be involved appropriately and in a timely manner in data protection matters;
b. operate with the independence required by law;
c. report to the appropriate management level;
d. monitor compliance and awareness;
e. advise on DPIAs;
f. cooperate with supervisory authorities; and
g. act as a contact point for data protection matters.
24.3. A DPO will not be dismissed or penalised for properly performing legally protected duties.
24.4. Univerax will designate and publish details of an EU, EEA, UK, or other representative where legally required.
24.5. Contact details for an appointed DPO or representative will be published when applicable. Until then, privacy communications may be sent to author@univerax.com.
25.1. Creators and other users who process personal data through the Platform are responsible for determining and complying with their own legal obligations.
25.2. A Creator must not:
a. use Customer data for an incompatible or undisclosed purpose;
b. send unlawful direct marketing;
c. sell or disclose Platform-obtained personal data without lawful authority;
d. retain data longer than necessary;
e. upload another person’s sensitive data without a valid legal basis;
f. use analytics to unlawfully identify or discriminate against individuals; or
g. use AI or Digital Twins to impersonate or profile individuals unlawfully.
25.3. Where a Creator processes personal data solely on behalf of a Customer or another organisation, the parties must determine whether a data processing agreement is required.
25.4. Univerax may restrict access to personal data or Platform functions where reasonably necessary to prevent unlawful processing or protect individuals.
26.1. Individuals may raise a data protection concern by contacting author@univerax.com.
26.2. Complaints will be assessed fairly and within the period required by applicable law.
26.3. Univerax will cooperate with competent supervisory authorities as required by law.
26.4. Nothing in this Policy prevents an individual from lodging a complaint directly with a competent supervisory authority or seeking an available judicial remedy.
27.1. This Policy will be reviewed periodically and when material changes occur in:
a. applicable law or regulatory guidance;
b. Platform functionality;
c. processing purposes or data categories;
d. AI or Digital Twin systems;
e. security risks;
f. international transfers; or
g. organisational responsibilities.
27.2. Compliance may be monitored through assessments, testing, reviews, audits, incident analysis, complaints, and remediation tracking.
27.3. Identified deficiencies should be prioritised according to risk and corrected within a reasonable period.
28.1. The Privacy Policy provides the primary public notice concerning Univerax’s collection and use of personal data.
28.2. The Cookies Policy governs cookies and similar device technologies.
28.3. The Data Retention and Deletion Policy provides additional information concerning retention and deletion.
28.4. The AI Transparency and Automated Decision Policy provides additional information concerning profiling, AI-supported processes, and automated decisions.
28.5. The Security and Responsible Disclosure Policy provides additional information concerning security and vulnerability reporting.
28.6. If documents conflict, mandatory data protection law prevails. The more specific notice governs the processing activity to which it expressly applies.
Questions, privacy requests, or complaints concerning this Policy may be directed to:
Legal entity: Zenlyai OÜ
Trade name: Univerax
Registered address: Harju maakond, Tallinn, Kesklinna linnaosa, Veskiposti tn 2-1002, 10138
https://ariregister.rik.ee/eng/company/17160305, Estonia
Registration number: 17160305
Privacy email: author@univerax.com
Legal email: info@univerax.com
Support email: support@univerax.com
Phone: +90 850 532 23 02