1. Scope
This Supplement applies when you are in the EEA, UK, or Switzerland and Black Pearls Operator processes your personal data subject to the GDPR or UK GDPR.
It supplements the Privacy Policy and Terms; where conflict exists on data protection topics, this Supplement prevails.
2. Legal bases
Contract: account, workspace, and billing data necessary to provide the Service.
Legitimate interests: security, fraud prevention, product improvement, and analytics where balanced against your rights.
Consent: optional marketing or non-essential cookies where required.
Legal obligation: compliance with law, regulators, and court orders.
3. Data subject rights
You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests. Contact us using the email below.
You may lodge a complaint with your local supervisory authority. UK users may contact the ICO.
4. International transfers
Where personal data is transferred outside the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses, UK IDTA, or adequacy decisions as applicable.
A list of subprocessors and transfer mechanisms is available on request for enterprise customers with a signed DPA.
5. EU representative
If required under Article 27 GDPR, the Operator will appoint an EU representative and publish contact details in the Service and legal hub before processing EEA data at scale.
Until published, direct inquiries to navophoto@protonmail.com.
6. DPIA and high-risk processing
The Service is designed to support your professional judgment and analysis, not automated credit, employment, or legal decisions about data subjects. Enterprise customers remain responsible for data protection impact assessments for their own use cases and webhook recipients.
7. Disputes and mandatory data protection rights
Sections 17 and 18 of the Terms of Service govern governing law and arbitration for the Service generally.
Nothing in those sections prevents you from lodging a complaint with your supervisory authority under Articles 77–79 GDPR (or UK equivalent), or from seeking judicial or administrative remedies for data protection claims where applicable law requires that forum and cannot be validly waived by contract.
Where mandatory EU or UK consumer or data protection law grants you a right to bring a claim in your country of residence, that right is not limited by the arbitration clause to the extent the law prohibits waiver.