Privacy
Policy

This Privacy Policy describes the personal data processing activities carried out within the framework of the Meliovate platform operated by AGENCITY VIDEO MARKETING S.R.L. (hereinafter: "Data Controller"), based on the European Union's General Data Protection Regulation (GDPR — Regulation 2016/679/EU) and applicable Romanian data protection legislation.

The Data Controller processes personal data according to the following principles:

• Lawfulness, fairness and transparency — data is processed only for lawful purposes, in a transparent manner to the data subject.
• Purpose limitation — data is collected for specified, explicit and lawful purposes; it is not processed for other purposes.
• Data minimisation — only data necessary for achieving the purpose is collected and stored.
• Accuracy — we ensure data is up to date; inaccurate data is immediately deleted or corrected.
• Storage limitation — data is stored only for as long as necessary.
• Integrity and confidentiality — data is protected with AES-256 encryption and appropriate organisational measures.
• Accountability — the Data Controller is responsible for compliance with these principles and can demonstrate this.

The Meliovate platform processes the following categories of personal data:

3.1 Registration and account data

• Full name
• Email address
• Password (stored in hashed form, irreversible)
• Chosen username
• Preferred language and country
• Date and time of registration

3.2 Beekeeping data

• Apiary names and descriptions — GPS coordinates stored anonymised at regional level, not directly linked to the User
• Hive identifiers, types, location data — stored with AES-256 encryption, assigned to regional code
• Colony log entries (treatments, inspections, honey extractions) — protected with AES-256 encryption
• Queen registration data
• IoT hardware device measurement data (temperature, humidity, weight, sound pattern) — stored separately from personal identification, linked to regional code

3.3 Payment data

• Subscription plan and billing cycle
• Transaction ID (token returned by Stripe)
• Billing name and address
• The Data Controller does NOT store bank card data — these are exclusively handled by Stripe Inc. with PCI-DSS certification.

3.4 Technical and log data

• IP address (anonymised after 30 days)
• Browser type and version
• Operating system
• Date, time and duration of logins
• Features used (aggregated, anonymised form)

3.5 Community content

• Community post text and images
• Comments and reactions
• Private messages (stored on encrypted channel)
• Profile photo (if uploaded)

The Data Controller processes data on the following legal bases and for the following purposes:

The Data Controller retains data for the following periods:

The Data Controller uses the following data processors, with each of which a data processing agreement is in place and GDPR compliance is verified:

The Data Controller does not share personal data with third parties, except where required by law (e.g. authority or court request) or where the data subject has expressly consented. Data is only transferred to third countries (outside the EU) with appropriate safeguards (e.g. standard contractual clauses, Privacy Framework).

Based on GDPR, the data subject may exercise the following rights against the Data Controller:

🔍 Right of access (GDPR Art. 15)

• The data subject is entitled to request information about whether the Data Controller processes their personal data, and if so, may request a copy.

✏️ Right to rectification (GDPR Art. 16)

• The data subject may request rectification of inaccurate personal data or completion of incomplete data.

🗑️ Right to erasure — "right to be forgotten" (GDPR Art. 17)

• The data subject may request erasure of their personal data if the purpose of processing has ceased, consent has been withdrawn, or processing was unlawful.

⏸️ Right to restriction of processing (GDPR Art. 18)

• The data subject may request restriction of processing, e.g. during a period of contesting the accuracy of data.

📦 Right to data portability (GDPR Art. 20)

• The data subject is entitled to receive their personal data in a structured, machine-readable format (JSON/CSV) and to have it transferred to another controller.

🚫 Right to object (GDPR Art. 21)

• The data subject may object to processing of their personal data based on legitimate interest or for direct marketing purposes.

📧 How to exercise rights

• To exercise the above rights, send your request to hello@meliovate.io, clearly indicating your name, account and the action requested.
• The Data Controller will respond to the request within 30 days. For complex or numerous requests this period may be extended by up to 60 days, of which the data subject will be notified.
• If the data subject believes their rights have been violated, they may file a complaint with the competent Romanian data protection authority (ANSPDCP — www.dataprotection.ro) or take the matter to court.

The Data Controller applies the following technical and organisational measures to protect data:

• AES-256 encryption for all stored sensitive data
• HTTPS/TLS 1.3 encryption on all data transmission channels
• Passwords stored with bcrypt hashing (irreversible)
• Token-based authentication (dj-rest-auth) with automatic expiry
• Regular backups in an EU data centre
• Access control: platform data is accessible only to authorised personnel, with role-based permission management
• Regular security audits and vulnerability assessments

The Data Controller ensures end-to-end encrypted communication between IoT hardware devices and the platform. Devices running Meliovate OS communicate with the server via a secure, authenticated channel.

In case of a personal data breach — likely to result in a risk to the rights and freedoms of natural persons — the Data Controller will notify the competent Romanian supervisory authority (ANSPDCP) within 72 hours of becoming aware of the breach.

Where the breach is likely to result in a high risk to data subjects, the Data Controller will promptly notify affected Users in plain language via the registered email address.

The Data Controller documents all personal data breaches — their circumstances, effects and remedial measures taken — regardless of whether they trigger a supervisory notification obligation.

The Meliovate website and platform uses the following types of cookies and local storage technologies:

Necessary cookies and storage items are essential for the site to function. Optional categories are only activated with your express consent; if you decline, only the feature concerned is unavailable (a load button appears in place of the video, or the referrer receives no commission) and the rest of the site works as usual. You can change or withdraw your consent at any time via the “Cookie settings” link in the footer.

The platform does NOT use analytics, marketing or remarketing cookies.

The Meliovate platform is only accessible to persons aged 16 or older. The Data Controller does not knowingly collect personal data of persons under 16.

If the Data Controller becomes aware that it is processing data of a person under 16, it will immediately delete that data, suspend the account and if necessary notify the legal guardian.

If you become aware that a minor has registered on the platform without authorisation, please notify us at hello@meliovate.io.

The Data Controller reserves the right to amend this Policy. Data subjects will be notified of material changes by email to their registered address and by in-platform notification at least 15 days before the change takes effect.

Continued use of the platform after the amendment takes effect constitutes acceptance of the new terms.

This Policy is effective from 24 May 2026. Version: v1.0.

For data protection questions, requests and complaints, please contact us:

• Romanian Data Protection Authority (ANSPDCP): B-dul Magheru 28-30, Bucharest — www.dataprotection.ro
• At the data protection authority of the EU member state of your residence or place of work
• At a competent court, if you have suffered direct damage

Supervisory authority — if you believe your personal data processing violates the GDPR, you may file a complaint: