Purpose of Data Processing 

Legal Basis for Processing Personal Data 

Data Retention Period 

Contact Section 

Article 6(1)(b) of the GDPR: “Performance of a contract to which the data subject is a party or implementation of pre-contractual measures taken at the request of the data subject.” 

For the period necessary to respond to your request and to document its handling, with the possibility to retain relevant records for longer where necessary to comply with a legal obligation or to establish, exercise or defend the Company’s rights before a judicial, administrative or other authority. 

Compliance with Legal Obligations 

Article 6(1)(c) of the GDPR: “Processing is necessary for compliance with a legal obligation to which the controller is subject.“ 

Personal data will be retained for the period strictly necessary to allow the Data Controller to fulfill the legal obligations to which they are subject. 

Assessment, Exercise, and Defense of Legal Rights 

Article 6(1)(f) of the GDPR: “Processing is necessary for the purposes of the legitimate interests pursued by the controller.” 

Personal data will be retained for the strictly necessary period of the litigation, until the exhaustion of the deadlines for appeals and legal actions. 

Upon expiry of the applicable retention criteria described above, personal data are deleted, anonymised or securely archived in accordance with documented internal retention and deletion procedures. Account deletion requests are handled in accordance with the same principles, subject to legal obligations requiring longer retention. 

Your personal data may be disclosed to and processed by the following categories of recipients: 

A) Independent data controllers (where applicable):  

● competent public authorities, supervisory authorities and law enforcement agencies; 

● professional advisers (e.g., legal counsel, accountants, auditors) acting as independent data controllers, where necessary for compliance with legal obligations and/or to establish, exercise or defend legal claims; 

● third parties involved in extraordinary transactions (e.g., mergers and acquisitions, corporate reorganisations, transfer of assets), to the extent permitted by applicable law and subject to appropriate safeguards. 

B) Data processors (service providers acting on our behalf) 

Your personal data may also be processed on our behalf by selected service providers acting as data processors, subject to contractual safeguards and appropriate instructions. These may include, as applicable: 

● hosting and cloud infrastructure providers; 

● IT maintenance and technical support providers; 

● customer support/ticketing and email communication providers; 

● payment service providers and, where applicable, verification/KYC and fraud-prevention service providers; 

● analytics and security service providers, where enabled and in accordance with applicable law. 

The updated list of data processors is available by sending a written request to the data controller or an email to [email protected]. 

My Aion Inc. is established in the United States.  

Personal data may therefore be processed in the United States and, where necessary for the provision of the Service, technical maintenance, or business operations, in other countries as well. 

Where personal data of individuals located in the European Economic Area (“EEA”) or the United Kingdom is transferred to a country that has not been recognized as providing an adequate level of protection, the Company implements appropriate safeguards in accordance with applicable data protection laws, including, where applicable, the execution of Standard Contractual Clauses or equivalent transfer mechanisms pursuant to Articles 46 et seq. of the GDPR and corresponding UK legislation. 

Evidence of the safeguard measures taken by the Company can be obtained by sending an e-mail to [email protected] 

If you reside in the United States, the processing of your personal data may also be subject to applicable U.S. federal and state privacy laws, including, where relevant, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and other comparable state regulations. Additional disclosures and rights applicable to U.S. residents are described in the relevant sections of this Notice. 

If you reside in jurisdictions outside the European Union, the United Kingdom, or the United States, your personal data will be processed in accordance with applicable local laws and, where required, subject to appropriate safeguards for international data transfers. 

Users may exercise their applicable rights by contacting [email protected] and specifying their jurisdiction of residence. 

You can obtain access to your personal data and relevant copy, as well as their erasure, the rectification of inaccurate or incomplete data, or the limitation of the processing of your personal data according to Article 18 of GDPR; 

You also have the right to object to the processing of your personal data at any time in relation to your particular situation. Right to object to the processing of personal data for direct marketing purposes is absolute and can be exercised at any time (Article 21 of GDPR). 

If the processing of your personal data is based on consent, you have the right to withdraw your consent at any time (Article 7 of GDPR). 

If the conditions for the right to data portability under Article 20 of the GDPR are met, you have the right to receive in a structured format, commonly used and readable by automatic device the personal data you provided us and, where technically feasible, to the secure transmission of your personal data to another data controller.  

In order to protect your rights and your personal data, anytime, you may decide to file a complaint to the competent supervisory authority (in particular, in the EU State where you usually reside or work or in the State where any alleged violation of your data has been committed). 

You can exercise your rights by writing to the Data Controller by mail at the address indicated above or by e-mail at the following address: [email protected]. 

It is understood that, where your request is made by electronic means, the information will be provided in a commonly used electronic format.