Makeshapes Privacy Notice

Makeshapes operates through two companies. Which one is responsible for your personal information depends on where you are and how you interact with us (see "What is the role of Makeshapes?" below).

• Makeshapes Limited — 18 Riro Street, Point Chevalier, Auckland 1022, New Zealand
• Makeshapes Inc. — 1933 Kalli Jo Ln, New Braunfels, TX 78130, United States
• For any privacy question, or to exercise your rights, you can contact either company at: [email protected]

In legal terms, Makeshapes acts as a data controller when we determine the means and purposes of processing. This is the case for our sales and marketing activities, and for any experiences, demos, or trials that are run directly by Makeshapes for our own business purposes. This privacy notice applies to these situations.

Which company is the controller depends on where you are and how you interact with us. Makeshapes Inc. is the controller for US sales and marketing, and where named as the contracting entity in your Service Order. Makeshapes Limited is the controller in all other cases. Whichever company holds your information, you can contact us at [email protected].

Makeshapes acts as a data processor when we process personal data on behalf of our customers. This is the case for experiences where a Customer has arranged for their personnel to participate using our platform. In this situation, this privacy notice does not apply, and the respective customer’s privacy notice should be referred to. Our role as a processor is governed by our Data Processing Agreement (DPA).

As part of our services to you, we will collect your personal information. The following provides details of what personal information is collected per service:

• Engaging with Makeshapes
  When you engage with our marketing materials or contact our teams, we may collect basic contact information (name and email address). This includes activities such as subscribing to our newsletter, requesting information, or contacting our team.
  When you purchase our services, we will ask you to provide basic contact and billing information.
• Participating in a Makeshapes-Run Experience
  When you participate in a demo, trial, or other experience run by a Makeshapes team member or provided by a Makeshapes team member, we will collect your name and email address to provide you with access. We may also collect any content or responses you submit during the experience. This may include your opinions, feedback, or other information you choose to share.

• Tracking Information
  We may collect statistical information about your visit to our website and how you use Makeshapes to help us improve it and track trends in usage.
• Contacting us via Social Media
  When you contact us via social media we collect information about your social media ‘handle’ used and the contents of your posting.
• Emailing us
  When you email us, we will collect your email address and any contact information provided. We will also collect the contents of your email.
• Meeting us
  When you meet with us, we may record our meeting.

A cookie, or similar tracking technology, is a piece of code that creates a file on your computer to track the pages that you view on our website. You may turn off cookies at any time, however this may impact your experience. Most browsers have a feature that allows the user to refuse cookies, or issues a warning when cookies are being sent. Turning off cookies may affect your ability to use websites.

For Marketing website visitors, you can review or change your cookie preferences for our website at any time by clicking the "Cookie preferences" link in the footer of the page.

Makeshapes requires a small number of our own tracking technologies to enable your use of Makeshapes. We do not track you over time or track you on other websites.

The table below sets out the main tracking technologies that we use and what we use them for:

We collect personal information for some or all of the following reasons:

• To enable us to provide the services you have purchased.
• To provide you with a demonstration of our services.
• To provide you with content we created.
• To support capacity planning.
• To comply with our legal obligations (e.g. tax obligations).
• To provide information to you about our services.
• To enable us to identify breaches of our terms and conditions.
• To answer your query.
• To identify areas of improvement of our services.

We process your personal information because you have given us permission and we need to process the information to provide the services you have requested and/or to fulfil our Terms of Service with you.

You may withdraw your consent at any time by contacting us.

We may also process your personal information to comply with the law (e.g. our tax obligations).

We use appropriate technical, organizational and administrative security measures to seek to protect any information we hold from loss, misuse, and unauthorised access, disclosure, alteration and destruction.

You must prevent unauthorised access to your account, where applicable, by selecting and protecting your password appropriately and limiting access to your computer or device and browser by signing off after you have finished accessing your account.

Makeshapes does not carry out automated decision-making that produces legal effects concerning you, or that similarly significantly affects you, within the meaning of Article 22 of the GDPR.

We use AI tools in parts of our business (see "How do we use AI?" below). These tools do not make decisions about you, and no decision affecting you is taken on the basis of their output alone.

We do carry out ordinary marketing and audience analysis in relation to our own products and services. This does not produce legal effects concerning you or similarly significantly affect you, and you can object to it at any time by contacting us at [email protected].

We use AI tools in our day-to-day work. This includes AI features built into Google Workspace, and specialist tools for transcribing meetings, drafting outbound messages and producing content. Where we use them, your personal information — for example your contact details, or what you say in a meeting with us — may be processed by those tools.

These AI providers act as our processors: they process your information on our behalf, under contract, only to return a result to us.

We do not use your information to train AI models, and our AI providers are contractually prohibited from using it to train theirs.

If you would like more detail about the AI tools we use, please contact us at [email protected].

AI features inside the Makeshapes platform, which customers can switch on for their own organisations, are governed by our Data Processing Agreement and its AI Services Addendum rather than by this notice.

We will keep your personal information:

• Until we no longer have a valid reason for keeping it
• Until you request us to stop using it.
• For as long as required by law (e.g we keep invoice information for 7 years to fulfil our tax obligations.)

We may keep just enough of your personal information to ensure that we comply with your requests to not use your personal information or comply with your right to deletion.

We hold your personal information mainly in Australia, in secure data centres operated by our cloud provider.

Because Makeshapes operates through both a New Zealand and a United States company, some of your information may also be held in, accessed from, or transferred to New Zealand and the United States, as well as other countries where our service providers operate.

Wherever your information is transferred, we take steps to ensure it stays protected. We do this by:

• Relying on adequacy decisions where they are available (for example, New Zealand benefits from an EU adequacy decision, so EEA data can be transferred there freely);
• Putting in place Standard Contractual Clauses — and the UK International Data Transfer Addendum where relevant — for transfers to countries without an adequacy decision, including transfers to the United States; and
• Maintaining appropriate safeguards such as encryption of your information in transit and at rest.
• Individuals in the European Economic Area also have a redress mechanism in relation to US signals-intelligence activities under US Executive Order 14086.
• If you are in the European Economic Area or the United Kingdom and would like more information about these transfer safeguards, please contact us at [email protected].

If you are in the European Economic Area or the United Kingdom, you can contact our representative about how we handle your personal information. Please quote "Makeshapes" in your correspondence.

• European Economic Area: DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland
• United Kingdom: DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom

DataRep also maintains a contact address in each EEA member state. The full list is at makeshapes.com/legal/eu-representative.

Contacting our representative does not replace contacting us directly — you can always reach us at [email protected].

We hold your personal information mainly in Australia. However some of your information may be held elsewhere in the world.

You can complain by emailing us.

You also have the right to make a complaint to the New Zealand Office of the Privacy Commissioner. Information about how to lodge a complaint is available on their website.

If you are a British or European resident, you also have the right to make a complaint to the relevant Supervisory Authority.

We may change this notice from time to time in the future. Any such changes will be posted here and, where appropriate, notified to you in writing. We advise you to check back frequently to see any updates or changes, or subscribe to updates here.