Star17 Privacy Policy

1. Personal Data We May Collect About You

Personal data we receive directly from you.

With regard to categories with a (*) these data may be collected by means of cookies or similar technologies. For such processing, please also see more details in Section 4.

We do not intentionally collect sensitive personal data unless required and permitted by law.

2. How We Use Your Personal Data And The Legal Basis For This Use

We will only use the information identified in Section 1 for the purposes and legal bases identified below and share this data only with the data recipients identified below.

There are instances where we have a legitimate interest to use your data. Our legitimate interest will vary depending on what we are using your data for, and we explain above what the interest is and how it relates to the processing operations that we are carrying out. Where we process personal data on the basis of a legitimate interest, then - as required by data protection law - we have carried out a balancing test to document our interests, to consider what the impact of the processing will be on individuals and to determine whether individuals' interests outweigh our interests in the processing taking place. You can obtain more information about this balancing test by using the contact details at the end of the notice.

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on individuals.

3. Marketing Communications & Email Compliance

3.1 United States (CAN-SPAM)

We comply with the CAN-SPAM Act by:

• Using accurate sender information and non-deceptive subject lines
• Identifying promotional messages as advertising where required
• Including a valid physical mailing address in marketing emails
• Providing a clear and functional unsubscribe mechanism
• Honoring opt-out requests within 10 business days

To exercise your rights, including requests to access, correct, or delete personal data, you may contact us using the details listed in Section 13.

3.2. Canada (CASL)

Where CASL applies, we send commercial electronic messages only with:

• Express or implied consent as permitted by law
• Clear identification of the sender and contact information
• An easy-to-use unsubscribe mechanism

You may withdraw consent at any time, and unsubscribe requests are processed within 10 business days.

3.3. United Kingdom & European Union (GDPR / PECR / ePrivacy)

We send marketing emails to individuals in the UK and EU only where:

• You have provided valid opt-in consent, or
• A limited soft opt-in applies (existing customer relationship, similar products/services, and opt-out provided at collection and in each message)

All marketing emails include an unsubscribe link, and you may object to direct marketing at any time.

To exercise your rights, including requests to access, correct, or delete personal data, you may contact us using the details listed in Section 13.

4. Cookies And Tracking Technologies

4.1 What are cookies?

A cookie is a small file that is placed in the browser files of your computer, smartphone, tablet or similar device or on your computer's hard drive. Cookies are used to collect information for various business purposes. For example, we may use cookies to help make interactions with our website easier for you and help us analyze trends, administer our services, and track activity and interactions with our Services.

4.2 What cookies do we use, what information do they collect and how long are they stored for?

You can find more information about the individual cookies we use and the purposes for which we use them in the table below:

4.3 Third-Party Cookies

We use first- and third-party cookies. First party cookies come from us and send information only to us. Third-party cookies are placed by third parties and send information about your device to other companies to analyze how you are using our website.

We may use these third-party cookies for our marketing efforts as well as to understand user website activity (for example, what page you visited and how long you stayed on a page). To the extent the information collected on our behalf by these third parties contains any personally identifiable information, we will protect it in accordance with this privacy policy.

You should review the privacy and cookie policies of these third parties to find out how these third parties use cookies and whether your cookie data will be transferred to a third country. Third-party cookies are placed on this website by third parties such as Google Analytics, HubSpot, and Mux.

5. Where We Transfer Your Personal Data

Due to the global nature of our business, your personal data may be transferred to recipients located outside the UK and the EEA, including in particular to the United States, Canada and Mexico. Where such transfers are made to countries that have not been the subject of an adequacy decision, we ensure that appropriate safeguards are in place including by way of Standard Contractual Clauses (SCCs) to protect your personal data.

A copy of the relevant mechanism can be obtained for your review on request by using the contact details below.

If you are located in Mexico, your personal data may also be transferred to, and processed in, countries outside Mexico, including the United States, Canada, and other jurisdictions where our service providers operate. Under the LFPDPPP, we may carry out such transfers without obtaining your separate consent where the transfer is made to a third party that processes personal data on our behalf and under our instructions (for example, our service providers identified in Section 2), or where another exception recognized under Mexican law applies. Where a transfer falls outside these exceptions, we will obtain your consent before transferring your personal data abroad.

In all cases, we require the recipients of your personal data to maintain confidentiality and security obligations consistent with those described in this Privacy Policy, whether through contractual commitments, Standard Contractual Clauses, or other appropriate safeguards.

6. Data Retention

We retain personal data for a period of 5 years from the date of collection or your last interaction with us (whichever is later), unless a longer retention period is required or permitted by law (for example, for litigation or regulatory compliance purposes).

Where we process personal data for marketing purposes or with your consent, we process the data until you ask us to stop, and for a short period of 1- 3 business days after this (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing or to process your data so that we can respect your request in future.

If you would like to receive any further information about our data retention periods, please contact us via the details set out in Section 13.

7. Your Rights

Mexican residents should refer to Section 7.1 for the specific rights applicable to you.

Depending on your location, you may have the following rights:

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep.

Wherever we rely on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. We may however have other legal grounds for processing your data for other purposes, such as those set out above.

In some cases, we are able to send you direct marketing without your consent, where we rely on our legitimate interests. You have an absolute right to opt-out of direct marketing, or profiling we carry out for direct marketing, at any time. You can do this by following the instructions in the communication where this is an electronic message, or by contacting us using the details set out below.

If you have unresolved concerns, you have the right to complain to a data protection authority in the country that you reside in or, the country of your place of work or the country where the alleged infringement took place.

7.1 Mexico (LFPDPPP - ARCO Rights)

If you are located in Mexico, the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, "LFPDPPP") grants you the following rights, known collectively as ARCO rights:

• Access (Acceso): You have the right to know what personal data we hold about you and how it is being used.
• Rectification (Rectificación): You have the right to request that we correct any personal data that is inaccurate, incomplete, or out of date.
• Cancellation (Cancelación): You have the right to request that we delete your personal data from our records when it is no longer necessary for the purposes for which it was collected, subject to any legal or contractual retention obligations.
• Opposition (Oposición): You have the right to object to the processing of your personal data for specific purposes, where such processing would cause you harm or where you have a legitimate reason for opposing it.

To exercise any of your ARCO rights, you may contact our designated personal data department at privacy@star17.com, identifying your request as an "ARCO request" or "Solicitud ARCO." We may ask you to verify your identity before processing your request, and we will respond within the timeframes established by applicable Mexican law.

Revoking your consent. Where we process your personal data based on your consent, you have the right to revoke that consent at any time, free of charge and without retroactive effect. Revoking your consent does not affect the lawfulness of any processing carried out before the revocation. To revoke your consent, please contact us at privacy@star17.com, identifying your request as a "consent revocation." Once we receive a valid revocation request, we will stop processing your personal data for the relevant purpose, except where we are required or permitted by law to continue (for example, to comply with a legal obligation or to defend against a legal claim).

If you have unresolved concerns regarding the processing of your personal data, you may file a complaint with the Secretariat of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), the authority responsible for enforcing data protection law in Mexico.

8. California Privacy Rights

If you are a resident of California, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with specific rights regarding your personal information.

Subject to certain limitations, California residents may have the right to:

• Request disclosure of the categories and specific pieces of personal information we collect about you
• Request deletion of personal information we have collected from you
• Request correction of inaccurate personal information
• Opt out of the sale or sharing of personal information
• Limit the use or disclosure of sensitive personal information
• Not be discriminated against for exercising privacy rights

Star17 does not sell personal information as defined under the CCPA/CPRA. However, we may share personal information with third parties for purposes such as advertising, analytics, and marketing, as described in this Privacy Policy.

To exercise your California privacy rights, including requests to access, correct, or delete personal data, you may contact us using the details listed in Section 13.

You can amend your preferences in our opt-out page.

9. Exercising Your Privacy Rights

To exercise your rights, including requests to access, correct, or delete personal data, you may contact us using the details listed in Section 13.

We may need to verify your identity before responding to your request. Verification may require confirming information associated with your account or prior interactions with us.

We will respond to valid requests within the timeframes required by applicable law.

10. How We Protect Your Personal Data

We implement appropriate administrative, technical, and organizational safeguards to protect personal data against unauthorized access, disclosure, or misuse.

11. Children's Privacy

Our services are not directed to children, and we do not knowingly collect personal information from individuals under 18. If you are under the age of 18, you can use this service only in conjunction with your parent's or guardian's permission.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised “Last Updated” date. We may also notify you in other ways from time to time about the processing of your personal data.

13. Contact Us