We collect information directly and indirectly to provide our services effectively.

Account and Identity Data: name, surname, nickname, email, organization, role, phone, profile picture, banner, social media links, website URL, and IP address. This data is collected directly and via third party applications such as Auth0 by Okta, Kinde, etc.

Login and Authentication Data: credentials via third-party login services (such as Google, GitHub, or similar) - we never store your passwords.

Company Information (for Sellers): company name, address, registration ID, website, social media links, sales email, logo, banner, and related metadata. Additional verification documents may be requested (e.g., incorporation papers, passport, driving license).

Usage and Analytics Data: session activity, dataset views, downloads, heatmaps, and interactions collected via analytics and tracking services (such as Google Analytics, Hotjar, Mixpanel, Vercel analytics, or similar).

Platform Interaction Records: when you are registered or logged in, records linked to your account of the data products and provider profiles you view, samples you download, enquiries, quotation requests and data requests you make, and links you follow from Opendatabay to data provider websites.

Payment Information: transaction IDs, billing address, and related identifiers provided by payment processors (such as Stripe, PayPal, GoCardless or similar). We never store your card numbers.

Cookies and Tokens: session cookies and tokens used for secure authentication and account management.

We use the data we collect to:

• Provide, operate, and maintain our Services.

• Authenticate users and secure accounts.

• Facilitate dataset uploads, purchases, and downloads.

• Improve our user experience, platform design, and identify potential areas for enhancement.

• Process payments and payouts to sellers.

• Attribute transactions and opportunities to Opendatabay, and establish, recover and defend our entitlement to commission under our terms.

• Send important communications (e.g., account verification, deletion requests, assistance or service updates).

• Comply with legal obligations and prevent fraudulent or illegal activities.

We process personal data on the following legal bases:

• Contract: to provide your account, the Services, purchases, sales and payouts.

• Legitimate interests: to secure the platform, prevent fraud, improve our Services, keep Platform Interaction Records, and establish, recover and defend our commission and other legal claims. You may object to processing based on legitimate interests by contacting us.

• Legal obligation: to comply with tax, accounting and other legal requirements.

• Consent: for optional marketing communications and non-essential cookies. You may withdraw consent at any time without affecting your use of the Services.

We only share data where necessary and in accordance with applicable laws.

Service Providers: including cloud providers, payment processors, email services, analytics providers, and similar infrastructure partners (e.g., Google Cloud, Stripe, etc.).

Data Providers: if you download a sample, enquire about, or purchase a data product, we may share your name, email, company and stated use case with the relevant data provider where needed to facilitate a transaction through Opendatabay.

Buyers and their clients: where a data provider supplies data through a brokered transaction, we may disclose the data provider’s business identity to the buyer, the buyer’s end client and their auditors and advisers, under obligations of confidentiality.

Professional Advisers and Insurers: where needed to obtain advice, insurance, or to establish or defend legal claims.

Legal Authorities: we may disclose data when required by law or to investigate suspected illegal activity.

We do not share your personal data with third parties for the purpose of training Artificial Intelligence (AI), Machine Learning (ML), or Large Language Models (LLMs). We may use aggregated or anonymised information derived from use of the Services, which does not identify you, to improve our Services and for commercial purposes, including AI and ML training.

We use cookies, session tokens, and analytics tools to understand user behaviour, improve performance, and enhance security. Essential cookies are required for the Services to work. Non-essential cookies are used only with your consent, which you can give or withdraw through our cookie settings. You can also manage or delete cookies through your browser settings.

All payments are processed securely through Stripe and PayPal. We receive transaction IDs and user billing information for verification and record-keeping purposes. For sellers, we may store payout details such as bank account information required for withdrawals.

We retain user and dataset information only as long as necessary:

• User account data is deleted within 48 hours of a verified deletion request, but may be retained for up to 100 days for compliance and audit purposes.

• Deleted datasets are permanently removed from our systems; only minimal metadata may persist for up to 100 days.

• Platform Interaction Records and transaction records are retained for at least twenty-four (24) months, or for longer where needed to establish, recover or defend legal claims (including commission), notwithstanding a deletion request.

• Financial and tax records are retained for the period required by law.

Opendatabay serves users globally but operates under UK law. All personal data is processed in accordance with the UK GDPR, and any international data transfer is safeguarded through standard contractual clauses, the UK International Data Transfer Agreement or Addendum, or equivalent protection mechanisms.

We use encryption, access control, HTTPS, and secure hosting environments to protect your data. Despite these measures, no online service can guarantee absolute security, but we work continuously to minimize risks.

Under applicable laws, you have the right to access, correct, delete, or restrict processing of your personal data, to object to processing based on legitimate interests, and to data portability. You can request account deletion or data export by contacting us at support@opendatabay.com. Some data may be retained where the law allows, as described in Data Retention and Deletion.

Our Services are intended for users aged 18 and above. We do not knowingly collect data from minors. If you believe a child has provided information to us, please contact us immediately.

We may contact you via email for account support, legal notifications, or important platform updates. Marketing emails are optional - users may unsubscribe at any time. Newsletters or promotional communications comply with UK GDPR and PECR consent requirements.

Opendatabay supports GDPR compliance through the following measures:

• A legal basis is established for each category of personal data, as set out in Legal Bases for Processing. Accepting this Privacy Policy is not consent to processing.

• Profiling or automated decision-making, including AI recommendations or analytics, is disclosed, and users’ rights in this context are protected.

• Data breach notification procedures comply with GDPR requirements.

• All third-party processors have GDPR-compliant agreements and safeguards in place.

This Privacy Policy is governed by the laws of England and Wales.

We may update this Privacy Policy. We will notify registered users of material changes by email before they take effect.

For any concerns, contact us:

• Data Controller: Opendatabay Ltd

• Privacy contact: justin@opendatabay.com

• General Support: support@opendatabay.com

If you believe your data rights have been violated, you can contact the UK Information Commissioner’s Office (ICO) for assistance.