International Data Notice

About this notice

This notice adds to our Privacy Notice for people outside the United States. Where the two differ for someone outside the United States, this notice applies.

It covers the regions we hear from most: Canada, the United Kingdom, the European Union, the Middle East, Africa and East Asia. If you live somewhere else, Your rights wherever you live still applies to you.

What we hold about people outside the United States

Our data products cover U.S. adults only. We do not use information about people outside the United States in our data products.

Outside the United States, we hold personal information only in these situations:

Where your information is processed

We are based in the United States and process this information there, with the service providers listed on our Sub-processors page. When the law requires a mechanism for sending personal information to the United States, we use the European Commission’s standard contractual clauses, the UK International Data Transfer Addendum, or another mechanism the law allows. You can ask us for a copy of the safeguards that apply to you.

Your rights wherever you live

Depending on where you live, you may have the right to:

• know what personal information we hold about you and get a copy of it;
• have it corrected;
• have it deleted;
• object to, or restrict, how we use it;
• receive it in a portable format;
• withdraw consent you have given, such as for cookies or email, at any time; and
• complain to your local data protection authority.

We will not treat you differently for using these rights. We answer within one month, or sooner where your local law requires, and tell you if we need more time and why. We may ask you to confirm your identity before we act on a request.

Canada

• Consent. We ask for your consent where Canadian law requires it, and you can withdraw it at any time, subject to legal and contractual limits. We send commercial email only with your consent, and every email lets you unsubscribe.
• Who is responsible. Our Chief Executive Officer is the person in charge of the protection of personal information at Moonbrush. You can reach them at privacy@moonbrush.com.
• Quebec. You have the rights Quebec law gives you, including to know how your information was collected and to have it corrected or deleted. This notice is available in French.
• Complaints. You can complain to the Office of the Privacy Commissioner of Canada, to the Commission d’accès à l’information du Québec, or to your provincial commissioner.

United Kingdom

• Legal bases. We rely on your consent for analytics cookies and for marketing email, and you can withdraw it at any time. We rely on our legitimate interests to run and secure the website, answer inquiries, manage business relationships and consider job applications. We rely on contract when we enter into or perform an agreement with you or your organization, and on legal obligation where the law requires us to process information.
• Transfers. We use the UK International Data Transfer Addendum, or another mechanism UK law allows, to send personal information to the United States.
• Complaints. You can complain to the Information Commission (ICO). We would like the chance to resolve your concern first, so please contact us.

European Union

This section also covers Iceland, Liechtenstein and Norway, which apply the same law as members of the European Economic Area.

• Legal bases. The same as for the United Kingdom, above.
• Transfers. We use the European Commission’s standard contractual clauses, or another mechanism the GDPR allows, to send personal information to the United States.
• Complaints. You can complain to the data protection authority in the country where you live or work, or where you believe the problem happened.

Middle East

Country	Law	Who oversees it
United Arab Emirates	Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. In the Dubai International Financial Centre, DIFC Data Protection Law No. 5 of 2020. In Abu Dhabi Global Market, the ADGM Data Protection Regulations 2021	UAE Data Office, now part of the Federal Authority for Artificial Intelligence and Data. DIFC Commissioner of Data Protection. ADGM Office of Data Protection
Saudi Arabia	Personal Data Protection Law	Saudi Data and Artificial Intelligence Authority (SDAIA)
Qatar	Law No. 13 of 2016 on Personal Data Privacy Protection	National Cyber Security Agency
Bahrain	Law No. 30 of 2018 on Personal Data Protection	Ministry of Justice, Islamic Affairs and Waqf, acting as the Personal Data Protection Authority
Oman	Personal Data Protection Law, Royal Decree No. 6/2022	Ministry of Transport, Communications and Information Technology

Where these laws apply to our handling of your information, you have the rights they give you, including access, correction and deletion, and you can complain to the authority named above. Some of these laws limit sending personal information outside the country. Where they do, we rely on the conditions the law allows, including your consent where the law requires it.

Africa

Country	Law	Who oversees it
South Africa	Protection of Personal Information Act, 2013 (POPIA)	Information Regulator
Nigeria	Nigeria Data Protection Act, 2023	Nigeria Data Protection Commission
Kenya	Data Protection Act, 2019	Office of the Data Protection Commissioner
Ghana	Data Protection Act, 2012 (Act 843)	Data Protection Commission
Egypt	Law No. 151 of 2020 on the Protection of Personal Data	Personal Data Protection Center

Where these laws apply to our handling of your information, you have the rights they give you, including access, correction, deletion and objection, and you can complain to the authority named above. Where a law limits sending personal information outside the country, we rely on the conditions it allows, including your consent where the law requires it.

East Asia

Country or region	Law	Who oversees it
Japan	Act on the Protection of Personal Information (APPI)	Personal Information Protection Commission
South Korea	Personal Information Protection Act (PIPA)	Personal Information Protection Commission
China	Personal Information Protection Law (PIPL)	Cyberspace Administration of China
Hong Kong	Personal Data (Privacy) Ordinance (Cap. 486)	Office of the Privacy Commissioner for Personal Data

Where these laws apply to our handling of your information, you have the rights they give you, including access and correction, and you can complain to the authority named above. These laws can require your consent before personal information is sent to another country. Where they do, we ask for it, and we tell you what we send, to whom and why.

How to make a request

Email privacy@moonbrush.com, or write to us at the address for your region below. Tell us what you would like us to do and where you live. You can write to us in English or French. The Your Privacy Choices form is for U.S. residents, so if you live elsewhere, please email us.

Where to send requests and legal notices

Email is the fastest way to reach us: privacy@moonbrush.com for privacy requests and legal@moonbrush.com for legal notices. To write to us, address your letter to Moonbrush Inc., Attn: Privacy and Legal, at the address for your region.

Changes to this notice

We update this notice when our practices, or the laws it describes, change. When we do, we change the date at the top.

Contact us

Privacy questions and requests: privacy@moonbrush.com
Legal notices: legal@moonbrush.com
Online: Your Privacy Choices (U.S. residents)

Language. This document is written in English. Translations are provided for convenience. If a translation differs from the English version, the English version governs, except where the law requires otherwise.