This Privacy Policy (“Privacy Policy”) explains how PLNTY LABS LTD (“Plnty”, “Company”, “we”, “us” or “our”) collects, uses, discloses, retains and otherwise processes Personal Data in connection with the Plnty website (the “Website”), the Plnty collaborative creative platform, any related application, application programming interface or other technological interface (collectively, the “Platform”), and any other of our services, features, tools and functionality (collectively, the “Services”).
This Privacy Policy applies when you visit the Website, create or use an Account, access the Platform or Services, participate in a workspace, communicate with us, receive our marketing, or otherwise interact with Plnty. It should be read together with the Plnty Terms of Use (the “Terms”) and any applicable Customer Agreement, Model Terms or other supplemental terms. Capitalized terms not defined in this Privacy Policy have the meanings given in the Terms. This Privacy Policy does not apply to Personal Data processed in the context of employment or another staff engagement with Plnty.
For purposes of this Privacy Policy, “Personal Data” includes “personal information” and similar terms defined by applicable privacy laws. “Process” and “processing” include any operation performed on Personal Data. References to a “Controller” includes a “business” or similar entity that determines the purposes and means of processing, and references to a “Processor” include a “service provider” or “contractor” processing Personal Data on another entity’s behalf, in each case as those terms are defined by applicable law.
IMPORTANT INFORMATION REGARDING CUSTOMER-MANAGED ACCOUNTS. If your access to the Services is purchased, sponsored, provisioned or administered by your employer, client or another organization, including under a Customer Agreement, through an organization-controlled email domain, or by a workspace administrator (each, a “Customer”), that Customer may control the applicable Account or workspace. Subject to its agreement with Plnty and applicable law, the Customer and its authorized administrators may receive information about you and your use of the Services and may access, export, modify, restrict, transfer or delete workspace information and User Content. Plnty may disclose such information to the Customer and its administrators for those purposes. Your use may also be subject to the Customer’s own privacy notice and internal policies, and you should direct questions about the Customer’s use of such information to the Customer.
To the extent Plnty processes Personal Data contained in User Content or other workspace data solely on a Customer’s documented behalf under a Customer Agreement or data processing agreement, the Customer is the Controller and Plnty acts as its Processor. Requests concerning that Personal Data should generally be directed to the Customer or workspace administrator, and Plnty will assist the Customer as required by applicable law and the governing agreement.
This allocation is limited to processing performed solely for the Customer. Plnty remains an independent Controller for Personal Data it processes for its own purposes, including Account and relationship administration, billing, security, fraud and abuse prevention, service integrity, usage analytics, product development and improvement, support, legal compliance, communications, marketing, and the publication or showcase of User Content as permitted by the Terms and applicable settings. The parties’ actual roles are determined by applicable law and, where relevant, the Customer Agreement or data processing agreement, which will control within its scope.
You are not required by law to provide Personal Data to Plnty. However, certain Personal Data is necessary for us to create and administer an Account, provide requested Services, process payments, respond to you, or comply with legal requirements. If you do not provide such information, we may be unable to provide some or all of the Services.
Contact Information and Data Controller
Unless the Customer-managed Account provisions above apply to a particular processing activity, PLNTY LABS LTD is the Controller responsible for the Personal Data described in this Privacy Policy. You may contact us regarding this Privacy Policy or our privacy practices as follows:
- By email: support@plnty.app.
- By mail: PLNTY LABS LTD, 10 Luria St., Tel Aviv 6314210, Israel.
Personal Data We Process and Why
The table below describes the categories of Personal Data we may process, representative examples, the purposes for which we process them, and the lawful bases on which we generally rely where the GDPR, UK GDPR or another law requiring a lawful basis applies. More than one lawful basis may apply to the same processing activity.
Where we rely on legitimate interests, those interests include operating and improving a secure, useful and sustainable business service; administering relationships; protecting Plnty, Customers, users, providers and the public; enforcing agreements; and promoting the Services, in each case balanced against the rights and interests of affected individuals. Where we rely on consent, you may withdraw it at any time, without affecting processing carried out before withdrawal. Where processing is necessary to perform a contract, failure to provide the relevant information may prevent us from providing the applicable Service.
| CATEGORY OF PERSONAL DATA | PURPOSES AND PROCESSING ACTIVITIES | LAWFUL BASIS UNDER GDPR |
|---|---|---|
| Contact, communications and support information. Name, business contact details, company and role, correspondence, inquiries, requests, complaints, Feedback, support tickets, and any materials, screenshots, files or diagnostic information you choose to provide when contacting us. |
To communicate with you; respond to inquiries and requests; provide support and customer success services; investigate and resolve technical or service issues; maintain records of our communications; manage our relationship; improve the Services and our internal operations; resolve disputes; and establish, exercise or defend legal claims. | Legitimate interests in communicating with users and business contacts, administering relationships, improving operations, handling disputes and responding to general inquiries. Where the communication or support request concerns an Account or Services provided to you, performance of a contract. Compliance with legal obligations where applicable. |
| Registration, Account and basic profile information. Name, email address, username, profile image, company, role, country, language, authentication or sign-in identifiers, Account and workspace settings, membership, roles, permissions, plan and subscription information. If you register or sign in through Google, Meta or another identity provider, we may receive the basic Account, profile and authentication information made available by that provider, such as your name, email address, profile image and provider identifier. |
To register and authenticate users; create and administer Accounts and workspaces; maintain settings, roles and permissions; associate an Account with a Customer or organization; manage plans and entitlements; communicate operational and service notices; and protect Account and Platform security. | Performance of a contract; legitimate interests in Account and workspace administration, authentication, security, fraud prevention and managing business relationships; consent where required for an optional connection or feature; and compliance with legal obligations. |
| Payment, billing and transaction information. Subscription, plan, invoice, transaction, currency, tax and payment-status information, billing contact details, merchant or payment-provider identifiers, and limited payment-method information made available to Plnty. Complete payment-card details are generally collected directly by the applicable payment provider. |
To process purchases, subscriptions, renewals and refunds; issue invoices; administer credits and payment status; maintain accounting and tax records; detect and prevent payment fraud; collect amounts due; and respond to billing inquiries. | Performance of a contract; compliance with tax, accounting and other legal obligations; and legitimate interests in payment administration, fraud prevention and enforcing agreements. |
| Platform and Account use information. Information submitted, generated, stored or recorded as part of your use of the Services, including projects and boards, prompts and generation requests, Inputs and Outputs, files and assets, comments and messages, workspace activity, selected tools, features, integrations and Model Endpoints, generation and editing history, uploads, downloads, exports, sharing and collaboration activity, settings, credits and related service records and metadata. |
To provide, host, store, process, transmit and display the Services; carry out instructions; maintain Account and workspace functionality and history; enable collaboration and sharing; route requests to Model Endpoints and integrations; administer plans, entitlements and credits; provide support; secure and troubleshoot the Services; and enforce applicable terms and restrictions. | Performance of a contract; legitimate interests in operating, securing, supporting and improving the reliability of the Services and preventing misuse; and legal obligations. Where processed solely on behalf of a Customer, the Customer determines the applicable lawful basis. |
| Technical usage and diagnostic information. IP address, approximate location derived from IP, browser and device type, operating system, device and session identifiers, login records, timestamps, feature interactions, request and response identifiers, latency, errors, logs, crash reports, performance data, and security, safety or moderation signals. |
To operate, secure, monitor, maintain and troubleshoot the Platform and Services; understand how the Services are used; measure performance and reliability; detect and prevent fraud, abuse and security incidents; enforce applicable restrictions; improve functionality, design and user experience; and create aggregated or de-identified analytics. | Performance of a contract where processing is necessary to provide or secure the Services; legitimate interests in operating, protecting, measuring and improving the Services, preventing misuse and maintaining service integrity; and compliance with legal obligations. |
| Website monitoring, cookies and similar technology information. IP address, approximate location derived from IP, cookie, browser or device identifiers, browser and device information, referring and exit pages, pages viewed, links or buttons selected, timestamps, interactions with the Website, and cookie consent or preference records, as further described in the Cookies and Similar Technologies section below. See more information under Cookies below. |
To operate and secure the Website; provide requested functionality; remember settings and preferences; prevent fraud; diagnose errors; measure Website traffic, performance and use; understand engagement; improve the Website and Services; and measure the effectiveness of marketing communications and campaigns. | Legitimate interests in operating, securing, measuring and improving the Website and Services, where permitted by law; performance of a contract for technologies necessary to authenticate users or provide requested Platform functionality; consent where required for non-essential cookies or similar technologies; and compliance with legal obligations concerning consent and preference records. |
| Marketing communications. Name, email address, company, professional role, Account or business-relationship information, marketing preferences, product or service interests, and information concerning your interaction with our marketing messages. |
To send newsletters, product and feature updates, offers, event invitations and other information concerning Plnty and the Services; personalize communications; manage marketing preferences and suppression records; and measure engagement with our communications and campaigns. | Legitimate interests in promoting Plnty and the Services and communicating with users, Customers and business contacts, where permitted by law; consent where required; and compliance with legal obligations relating to marketing preferences and objections. |
The categories listed above describe the Personal Data we may collect during the twelve (12) months preceding the effective date of this Policy and expect to continue collecting. The actual data processed depends on the Services, plan, settings, Model Endpoint and interaction concerned. We may also process a category for another compatible purpose or as otherwise permitted by applicable law, and will provide additional notice or obtain consent where required.
U.S. Statutory Categories
For purposes of the California Consumer Privacy Act and similar U.S. state privacy laws, the Personal Data described above includes the following statutory categories collected during the twelve (12) months preceding the effective date of this Privacy Policy: identifiers; Personal Data categories described in California Civil Code section 1798.80(e); commercial information; internet or other electronic network activity information; approximate geolocation data; audio, electronic, visual or similar information; professional or employment-related information; and inferences drawn from the foregoing. Characteristics of protected classifications, education information and sensitive Personal Data may also be processed only to the extent they are included in User Content by a user or Customer, are needed for Account security or payment processing, or are otherwise described at collection. Plnty does not collect biometric information for the purpose of uniquely identifying or authenticating a person. None of these categories is currently sold or shared for cross-context behavioral advertising. The retention criteria described in the Data Retention section apply separately to each category.
Sensitive Personal Data
The Services are not designed to require special categories of Personal Data or other sensitive Personal Data. You should not submit regulated, confidential or sensitive information unless you are authorized to do so and have selected Services, settings and Model Endpoints appropriate for that information. If you choose to include sensitive Personal Data in User Content, you instruct Plnty and the applicable providers to process it to provide the requested Services, subject to the Terms and applicable agreements. Plnty does not use sensitive Personal Data to infer characteristics about an individual or for purposes other than providing, securing and complying with law in relation to the Services, unless we provide additional notice and obtain any consent required by law. Accordingly, Plnty does not use or disclose sensitive Personal Data for purposes that require a right to limit under applicable U.S. state privacy laws.
Aggregated and De-identified Information
We may derive statistical, aggregated or irreversibly de-identified information from operation and use of the Services. We may use and disclose information that no longer identifies and cannot reasonably be linked to an individual for any lawful purpose, including analytics, security, research, product development and business planning. Where required by law, we will maintain such information in de-identified form and will not attempt to re-identify it except to test the effectiveness of de-identification or as otherwise permitted by law.
Sources of Personal Data
Depending on how you interact with Plnty, we may obtain Personal Data from the following sources:
- Directly from you, including when you register, configure an Account, submit User Content, purchase Services, contact support, complete a survey, provide Feedback or communicate with us.
- Automatically from the Website, Platform and Services, including through logs, cookies, local storage, analytics, diagnostic and security technologies.
- From Customers, Account owners, workspace administrators and collaborators, including invitations, role and permission information, corporate domain associations, workspace activity and materials shared with you or about you.
- From providers and connected services, including authentication providers, payment and billing providers, third-party model providers, integrations and services you authorize us to connect to or use.
- From public and business sources, including company websites, professional networks, social media, referrals and information you direct us to retrieve or process.
Cookies and Similar Technologies
We and providers acting for us may use cookies, local storage, pixels, software development kits and similar technologies to operate the Website and Platform, remember settings and sessions, authenticate users, maintain security, prevent fraud, diagnose errors, measure performance and understand how the Services are used. These technologies may collect device, browser, identifier, interaction and usage information described above.
Some technologies are strictly necessary to provide requested functionality and cannot be disabled through our systems. Where required by law, we will request consent before using non-essential technologies and provide a mechanism to manage that consent. You may also control cookies through your browser or device settings, although blocking necessary storage may prevent parts of the Services from functioning. Browser “Do Not Track” signals are not governed by a uniform standard. If we use Personal Data for a sale, sharing, targeted advertising or another activity requiring recognition of an opt-out preference signal, we will recognize legally valid signals, including Global Privacy Control where required.
Marketing Communications
Subject to applicable law, we may use your name, email address, company, professional role, Account or business-relationship information, marketing preferences and information about your interaction with our communications to send newsletters, product and feature updates, offers, event invitations and other information concerning Plnty and the Services that may be relevant to you. We may do so based on your consent or our legitimate interests in promoting the Services and maintaining business relationships, as permitted by applicable law. We may use service providers to deliver these communications and measure engagement.
You may opt out of marketing communications at any time by using the unsubscribe mechanism included in the relevant message or by contacting support@plnty.app. We may retain limited contact and preference information on a suppression list in order to honor your request. Opting out of marketing will not prevent us from sending operational, transactional, security, billing or other non-marketing communications reasonably necessary to administer the Services, your Account or our relationship with you.
How We Disclose Personal Data
We may disclose the categories of Personal Data described above to the following categories of recipients for the purposes stated below, subject to applicable law, the Terms, and any applicable Customer Agreement or data processing agreement:
| CATEGORY OF RECIPIENT | PURPOSE OF DISCLOSURE |
|---|---|
| Customers, Account owners and workspace administrators | Where an Account or workspace is purchased, sponsored, provisioned or administered by a Customer, we may provide that Customer and its authorized administrators with Account, workspace, activity, billing and User Content information and the administrative access described in this Policy and the Terms. |
| Authorized Users, collaborators and persons you direct | To enable sharing, commenting, project and workspace collaboration, publication, export and other actions you request. The persons you invite may view or further use information made available to them. |
| Third-party model providers, model hosts, aggregators and inference services | To transmit Inputs and related technical information, process generation requests, obtain Outputs, route requests, apply provider restrictions, troubleshoot generation and provide AI-enabled features. The provider’s handling, retention and use of information may differ by Model Endpoint and are governed by the applicable Model Terms and technical configuration. A Protected Endpoint is subject to a then-current written restriction reviewed by Plnty against using submitted User Content to train or improve models made generally available by the provider or to third parties, but that designation does not necessarily mean zero retention or that the provider does not process technical or Usage Data. A Model Endpoint that is not designated as a Protected Endpoint may retain, use, disclose or otherwise process Inputs and Outputs, including for service improvement or model training, as described in the applicable Model Terms and the Terms. Depending on the applicable Model Terms, a provider may process information on Plnty’s behalf or under its own terms and privacy practices. |
| Infrastructure and business service providers | To provide hosting, cloud storage, databases, content delivery, security, monitoring, diagnostics, analytics, communications, customer support, customer-relationship management, email delivery, marketing, collaboration, search, file processing and other operational services. We contractually restrict service providers as appropriate to their role. |
| Payment, billing and merchant-of-record providers | To process payments, subscriptions, refunds, taxes, invoicing, fraud checks and collections. A payment provider may act as an independent controller or business for information it collects directly under its own privacy notice. |
| Authentication providers, integrations and connected third-party services | To authenticate you and create or associate an Account when you choose third-party sign-in, and where you connect, import from, export to or otherwise direct us to interact with another service. To the extent a third party processes information independently, its terms and privacy practices apply. |
| The public, social networks and marketing channels | Where content is selected for showcase or publication under the Terms and your settings, we may display User Content with attribution information in the Platform gallery, on login or Website pages, through Plnty social-media accounts and in other promotional materials. |
| Affiliates, professional advisers, authorities and transaction parties | For internal administration; audit, insurance, legal, security and compliance purposes; to establish or defend legal claims; to respond to lawful requests; and in connection with a merger, acquisition, financing, reorganization, insolvency or sale of all or part of the business, subject to appropriate confidentiality and legal safeguards. |
During the twelve (12) months preceding the effective date of this Privacy Policy, Plnty has not sold Personal Data for monetary or other valuable consideration and has not shared Personal Data for cross-context behavioral advertising. Plnty does not currently process Personal Data for targeted advertising as those terms are defined by applicable U.S. state privacy laws, and does not have actual knowledge that it has sold or shared the Personal Data of any person under 16. During the same period, Plnty has disclosed, as applicable, the categories of Personal Data described in the Personal Data We Process and Why section to service providers or contractors for the business purposes described in this Privacy Policy, and to the other recipient categories identified in the table above as directed by a user or Customer or otherwise permitted by law. If these practices change, we will update this Privacy Policy and provide any notice and choice required by law.
International Data Transfers
Plnty is established in Israel and operates a global service. Personal Data may be processed in Israel, the United States and other countries in which Plnty, Customers or providers operate. Those countries may have privacy laws that differ from the laws of your jurisdiction, and information may be subject to lawful access by courts, regulators or authorities in those countries.
Where applicable law requires a transfer mechanism, we rely on an adequacy decision, including the European Commission’s adequacy decision concerning Israel where applicable, approved standard contractual clauses, an approved UK transfer mechanism, contractual safeguards, a legally recognized certification or framework, or another lawful derogation or mechanism. You may contact us for additional information about the safeguards relevant to a transfer, subject to confidentiality and legal restrictions.
Data Retention
We retain Personal Data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services; maintain an Account or Customer relationship; comply with Customer instructions; support security, continuity and fraud prevention; meet legal, tax, accounting and reporting obligations; resolve disputes; and establish, exercise or defend legal claims. These criteria apply separately to each category of Personal Data described in the Personal Data We Process and Why section. The applicable period for a particular record depends on the nature, volume and sensitivity of the information, the purpose of processing, the duration of the Account, subscription or Customer Agreement, the risk of harm from unauthorized use or disclosure, and legal or contractual requirements; different records within the same category may therefore be retained for different periods.
When Personal Data is no longer required, we will delete, anonymize or securely isolate it, subject to ordinary backup and archival cycles. Account closure or workspace deletion may not immediately remove information from backups, legal holds, security records, transaction records, previously published materials, or systems controlled by a Customer, collaborator or third-party provider.
In particular, where information is transmitted to a Model Endpoint, the applicable provider may retain Inputs, Outputs and related technical information for the periods and purposes permitted by the applicable Model Terms and technical configuration. Unless expressly stated otherwise, designation as a Protected Endpoint does not mean that the provider applies zero retention.
User Content previously published may remain as described in the Terms. A Customer Agreement or data processing agreement may set different retention and deletion requirements for data processed solely on the Customer’s behalf.
Data Security
We maintain commercially reasonable administrative, technical and organizational measures designed to protect Personal Data against unauthorized access, acquisition, loss, misuse, alteration and disclosure. Measures are selected in light of the nature of the processing and may include access controls, authentication, encryption in transit and at rest where appropriate, logging, monitoring, confidentiality obligations, vendor controls, incident response and continuity measures. No system, transmission or security measure is completely secure, and we cannot guarantee that a security incident, unauthorized access or loss will never occur.
You and any applicable Customer are responsible for safeguarding credentials and devices, configuring workspace and sharing permissions, selecting an appropriate plan and Model Endpoint, and maintaining independent copies of User Content you wish to preserve. If you believe that an Account or Personal Data has been compromised, contact support@plnty.app promptly.
Your Privacy Rights and Choices
Depending on your location, relationship with Plnty and applicable law, you may have some or all of the following rights with respect to Personal Data processed by Plnty as Controller:
- Transparency and access: request confirmation as to whether we process your Personal Data, obtain access to and a copy of such Personal Data and receive information concerning the processing. Where applicable, this may include the categories and specific pieces of Personal Data collected, the sources from which it was obtained, the purposes for which it is processed and the categories or identity of recipients to whom it has been disclosed.
- Correction: request that inaccurate Personal Data be corrected and that incomplete Personal Data be completed, taking into account the purposes of the processing.
- Deletion: request deletion of Personal Data, subject to applicable exceptions and any information that we are permitted or required to retain, including for security, fraud prevention, recordkeeping, contractual, legal or compliance purposes.
- Restriction and objection: request restriction of certain processing or object to processing carried out on the basis of legitimate interests. You may object at any time to the processing of Personal Data for direct marketing purposes, in which case we will cease such processing as required by applicable law.
- Portability: receive certain Personal Data that you provided to us in a structured, commonly used and machine-readable format and, where applicable and technically feasible, request that it be transmitted directly to another controller.
- Withdrawal of consent: withdraw consent at any time where processing is based on consent. Withdrawal will not affect the lawfulness of processing carried out before the withdrawal.
- Automated decision-making: where applicable, request information about, object to or exercise other rights in relation to a decision based solely on automated processing that produces legal or similarly significant effects, including the right to obtain human intervention, express your point of view and contest the decision. Plnty does not currently use Personal Data to make solely automated decisions that produce legal or similarly significant effects concerning users.
- U.S. state privacy rights: where applicable, confirm whether Plnty processes your Personal Data, access, correct, delete or obtain a portable copy of such information, and opt out of its sale, sharing for cross-context behavioral advertising, processing for targeted advertising or profiling in furtherance of decisions producing legal or similarly significant effects. You may also have the right to limit certain uses or disclosures of sensitive Personal Data and to obtain information concerning third parties to whom Personal Data has been disclosed. As described in the How We Disclose Personal Data section, Plnty does not currently sell Personal Data, share it for cross-context behavioral advertising or process it for targeted advertising.
- Complaint: submit a complaint to us concerning our processing of your Personal Data or our handling of a privacy request, and lodge a complaint with a competent privacy or data protection authority. If you are located in the EEA, you may contact the supervisory authority in your country of residence or work or where the alleged infringement occurred. If you are located in the United Kingdom, you may submit a complaint to the UK Information Commissioner’s Office (“ICO”).
Submitting a Request. You may exercise an applicable privacy right by emailing support@plnty.app. To help us identify you, locate the relevant Personal Data and respond efficiently, please include, as applicable: (i) your full name and the email address associated with your Account or communications with Plnty; (ii) your country and, for U.S. residents, state of residence; (iii) the nature of your relationship with Plnty, such as an Account holder, workspace user, website visitor, marketing recipient or job applicant; (iv) the Account, workspace, organization or Customer concerned; (v) the right you wish to exercise; and (vi) sufficient details to enable us to understand and address your request. You may use the subject line “Privacy Request,” although failure to do so will not invalidate an otherwise identifiable request.
We may request additional information that is reasonably necessary to verify your identity, authority, jurisdiction or the applicability of the request. The nature and extent of verification will depend on the sensitivity of the Personal Data and the exercised right. We will not request information that is disproportionate to the request. If we cannot reasonably verify your identity or authority or cannot identify the Personal Data to which the request relates, we may be unable to complete the request. Information obtained for verification and request-handling purposes will be used for those purposes and for related security, fraud-prevention, recordkeeping and legal-compliance purposes.
An authorized agent may submit a request on your behalf where permitted by applicable law. We may require evidence of the agent’s authority and may contact you directly to verify your identity, confirm the authorization or obtain any confirmation permitted by law. A parent, guardian or other legal representative submitting a request on behalf of another person should identify that capacity and provide reasonable supporting documentation upon request.
We will respond within the period prescribed by applicable law. Where the EU GDPR or UK GDPR applies, we will ordinarily respond without undue delay and within one month after the applicable response period begins, subject to any extension or suspension permitted by law. Where permitted due to the complexity or number of requests, this period may be extended by up to two additional months, in which case we will notify you within the initial response period and explain the reason for the extension. If a request is unclear or additional information is reasonably required, we may ask you to clarify or supplement it, and the applicable response period may be affected as permitted by law.
Privacy requests are generally processed without charge. Where permitted by law, we may charge a reasonable fee or decline to act on a request that is manifestly unfounded, excessive or repetitive. Privacy rights are not absolute, and we may deny, limit or defer a request where an exception applies or where complying would adversely affect the rights and freedoms of others. If we do not act on a request, we will provide the explanation and information concerning available complaint or appeal rights required by applicable law.
Where applicable U.S. state law provides a right to appeal our refusal or limitation of a request, you may submit an appeal by replying to our decision or emailing support@plnty.app with the subject line “Privacy Appeal.” Please identify the original request and briefly explain the basis for the appeal. We will review and respond to the appeal within the period required by applicable law. We will not unlawfully discriminate against you for exercising a privacy right, although fulfilling a valid deletion, restriction or opt-out request may affect functionality that depends on the relevant information.
Privacy Complaints. You may submit a complaint concerning Plnty’s processing of Personal Data or compliance with applicable privacy law by emailing support@plnty.app with the subject line “Privacy Complaint.” Please describe the processing or conduct concerned, your relationship with Plnty, the Account, workspace or communications involved, the relevant dates and the outcome you are seeking. No separate complaint form is required.
Where UK data protection law applies, Plnty will facilitate the submission of the complaint, acknowledge its receipt within 30 days, take appropriate steps to investigate and respond without undue delay, make such enquiries into the subject matter as are appropriate in the circumstances, keep you reasonably informed of the progress of the complaint and inform you of its outcome. Where appropriate, our response will explain the conclusions reached and any remedial or corrective steps taken or proposed. You may submit a complaint to the ICO regardless of whether you first complain to Plnty. Complaints arising under other applicable laws will be handled within the timeframes and in accordance with the procedures prescribed by those laws.
Customer-Managed Accounts. If a request or complaint concerns Personal Data controlled by a Customer in a Customer-managed Account or workspace, you should ordinarily direct it to that Customer or its administrator. If you submit it to Plnty, we may refer it to the Customer and disclose the information reasonably necessary to identify, authenticate and address the request or complaint. Plnty will assist the Customer as required by applicable law and the applicable Customer Agreement. This does not affect your ability to exercise rights directly against Plnty with respect to Personal Data for which Plnty acts as Controller.
Communications Preferences. You may opt out of marketing emails at any time by using the unsubscribe mechanism included in the relevant message or by contacting us at support@plnty.app. You may continue to receive operational, transactional, security, billing and other non-marketing communications reasonably necessary to administer the Services, your Account or our relationship with you.
Third-Party Websites and Services
The Platform may link to or interoperate with websites, applications, social networks, content and services controlled by third parties. This Privacy Policy does not govern a third party’s independent processing. The applicable third party’s terms and privacy notice apply to information it collects directly or receives at your direction. We encourage you to review those notices before connecting a service or providing Personal Data. Plnty is not responsible for a third party’s privacy or security practices except to the extent required by applicable law or a written agreement signed by Plnty.
Age Limitation
The Platform and Services are intended only for persons who are at least eighteen (18) years old. A person under 18 may not create or independently operate an Account. As permitted by the Terms, a parent or legal guardian may use an Account in the adult’s own name on behalf of, or for the benefit of, a minor, provided that the adult controls the Account, has all required authority and consents, and is responsible for the minor’s activity and content. If we learn that a person under 18 has independently created or operated an Account or provided Personal Data contrary to the Terms, we may suspend the Account and delete the information, subject to applicable law and legitimate retention requirements. Please contact us if you believe this has occurred.
Policy Amendments
We may amend this Privacy Policy from time to time. The most recent version will be posted through the Website or Platform, and the date of the latest revision will appear under “Last Modified” above. If a change materially affects how we process previously collected Personal Data, we will provide prior notice through the Platform, by email or by another reasonable means, and will obtain consent where required by law. We encourage you to review this Privacy Policy periodically.
