4. Use of Social Media Access Credentials

If you have provided us with access to your social media accounts:

• We will use this access solely for the purpose of providing the agreed services.

• Access will be limited to the management team and relevant freelancers only (Social Media Managers) who are subject to confidentiality agreements (NDAs).

5. Sharing Information with Third Parties

We do not sell your personal data. We share information only with the following entities for the purpose of providing the service:

​

5.1. Service Providers and Technology Systems ("Data Processors")

We use reliable third-party services to process data. The current list of our main service providers includes:

• Clearing and Payments: Stripe.

• Mailing and Marketing: ActiveCampaign and Wix.

• Task and Client Management (CRM): Asana and Zapier.

• Storage and File Sharing: Google Drive and Canva.

• Communication and Training: Zoom.

5.2. Freelancers and External Consultants

• To provide Agency and management services, we employ external service providers (such as Social Media Managers, Club Managers, and Agency Managers).

• These service providers are granted access only to the personal data relevant to performing their role.

• All freelancers are signed on Non-Disclosure Agreements (NDAs) and commitments to maintain data privacy in accordance with Company standards.

6. International Data Transfers

The Company is incorporated in Cyprus (an EU member state). Information about clients from Israel may be transferred for processing in Cyprus, and information about clients from the EU may be transferred to Israel or servers in the USA.

• Israel: Recognized by the European Union as a country ensuring an adequate level of data protection (Adequacy Decision); therefore, transferring data from Cyprus to Israel is permitted.

• Cloud Services (USA): Providers such as Google, Zoom, Stripe, and ActiveCampaign operate in accordance with international data transfer frameworks (such as the DPF) or use Standard Contractual Clauses (SCCs) to ensure data protection.

7. Data Retention

We retain your personal data only for as long as necessary for the purposes detailed in this Privacy Policy:

• Operational Information: Will be retained as long as your account is active or as required to provide the services.

• Client-Owned Materials (Agency): Materials stored in your Google Drive account are not stored on Company servers. Full control over the data remains with you, and you may revoke the Company's access permissions at any time and/or upon termination of the engagement. The Company will not retain copies of these materials after access is revoked, except for final deliverables that have already been actually published on social media.

• Accounting Information: Invoices and transaction details will be retained for 7 years as required by tax laws.

• Marketing Information: Will be retained until you request to remove your name from the mailing list (Unsubscribe).

After these periods expire, the information will be deleted or anonymized.

8. Your Rights (Under the GDPR)

As a Data Subject, you have the following rights:

• Right of Access: To request a copy of the personal data we hold about you.

• Right to Rectification: To request correction of incorrect or outdated information.

• Right to Erasure ("Right to be Forgotten"): To request that we delete your data (subject to legal limitations).

• Right to Portability: To receive your data in a readable format.

• Right to Object: To request that we stop processing your data for direct marketing purposes.

• Right to Withdraw Consent: In cases where data processing is based on your consent (such as a newsletter), you may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

• Right to Lodge a Complaint: If you believe your rights have been violated, you may file a complaint with a data protection authority. The relevant authority for the Company is the Commissioner for Personal Data Protection in Cyprus:

Office of the Commissioner for Personal Data Protection

Website: http://www.dataprotection.gov.cy

9. Data Security

We take reasonable technical and organizational precautions to protect personal data. However, please remember that data transmission over the Internet is not 100% secure, particularly when transferring materials via social media platforms or saving recordings in the cloud.

10. Children's Privacy

Our services are not intended for children under the age of 16. We do not knowingly collect personal data from minors under this age.

11. Changes to this Privacy Policy

We may update this policy from time to time. In the event of material changes, we will post a prominent notice on the website or send you a notification via email. Continued use of the services after the policy update constitutes acceptance of the updated terms.

12. Contact Us

For any questions or requests regarding this Privacy Policy, you can contact us at:

• Company Name: SheBossit (Cyprus) Ltd

• Email: contact@shebossit.com

• Mailing Address: Ifigenias 8, Livadia, Cyprus