Privacy Policy

When we refer to ‘we’ (or ‘our’ or ‘us’), that means Mundo Pato. Mundo Pato is based in Portland, Oregon,USA.

This Privacy Policy describes our policies and procedures on the collection, use and disclosure of your information when you use mundopato.com or UnitusTI and tells you about your privacy rights and how the law protects you.

Mundo Pato takes data privacy seriously and we are committed to protecting and respecting your privacy in accordance with applicable data privacy regulations. This privacy notice describes how and why we, as Data Controller, obtain, store and process personal data. We are the Data Controller when we are responsible for determining how and why your personal data is processed. We will process your personal data fairly, lawfully and transparently.

For clarity, this Privacy Notice does not apply when we process personal data in the role of a Processor on behalf of our Customers, including with respect to the processing of our Customer End User Data (as defined below in the "'Information we process on behalf of Customers" section). If you would like to understand how we process data as a Data Processor, please see our Data Processing Addendum (DPA), which can be found in our Privacy Center. As the nature of our offering involves the processing of sensitive health information, we want to assure you that we will only process this data in line with the instructions received from our Customer in accordance with the DPA.

‘Personal data’ means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

We commit to processing your personal data fairly, lawfully, and transparently. Please do not hesitate to contact us if you have questions in addition to the information provided in this Privacy Notice at compliance@mundopato.com (or privacy@mundopato.com for those in the EEA)

Depending on the type and level of engagement you have with us, we may collect the following categories of personal data:

• Identifying and Demographic Information: such as your full name, date of birth, email address, postal address, job title and phone number (if provided)
• Purchase and Billing Information: such as purchase history, payment preferences, address, bank account details and billing address (if provided)
• Communications: such as a records of our interactions with you using one or multiple of the following; direct messages, emails, posts, phone conversations
• User Feedback: while using our services, occasionally you may be asked to provide feedback. Providing this feedback is entirely optional.

When you visit our website, we collect technical data such as:

• Usage data: (if permitted) we collect certain information related to your device. This can include your computer or mobile device operating system type and version number, manufacturer and model, browser type, screen resolution, IP address, the website you visited before browsing our site, what pages your device visited, the time that your device visited our website, how long you spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen, and general location information such as city, state or geographic area (for more information please see the 'Our Use of Analytics' and 'Our Use of Cookies' sections later in this policy)

This Privacy Notice does not apply to Customer End User Data. With respect to our Customers, we are a Data Processor, and we process the personal data collected by our Customers and sent to our platform only in accordance with the instructions of our Customers. Our Customers may integrate into their mobile applications, websites or other services (collectively, "Customer Applications") certain aspects of our Services in order to interact with their own users ("Customer End Users").

Our Customers, not us, choose the type of personal data and other information (“Customer End User Data”) collected by Customer Applications, and processed, transferred and stored through our Customers’ use of our Services. We process the Customer End User Data only according to the instructions of Customers and, our legal obligations with respect to the Customer End User Data is set forth in the agreement between us and our Customers. The collection of Customer End User Data through Customer Applications is governed by our Customers’ privacy policies, and if you are a Customer End User then you should review the Customer’s privacy policy to learn more about the Customer’s data handling practices.

While we recognise that an individual has the right to access, delete and amend the data collected about that individual, we do not have a relationship with the Customer End Users but rather only with our Customers. If you are a Customer End User and you would like to access, amend or delete your data, then you need to contact the Customer directly and we will respond within a reasonable period of time to any such request by our Customer.

We only retain the Customer End User Data we process on behalf of our Customers for as long as necessary to provide the Services to our Customers or as required to comply with legal obligations, resolve disputes and enforce any agreement.

Sensitive personal data we process on behalf of Customers

As part of using the Services our Customers may collect and process sensitive personal information. Sensitive data refers to specific categories of personal information that are considered highly private and require special protection. This includes (but is not limited to) data related to an individual's race or ethnicity, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health information, and any data revealing sex life or sexual orientation. This information is considered Special Categories Personal Data under GDPR. We will only process Special Categories Personal Data under the direction of our Customer and in accordance with the agreement between us and our Customer.

While our services are designed for a general audience, we will not knowingly collect any data from children under the age of 16 or sell products to children, without the consent of a parental guardian to do so. If you are under the age of 16 and we do have the consent of a parental guardian, you are not permitted to use or submit your data to the website.

We may collect your personal data in one of the following ways:

• When you provide information directly into our products and services
• When you visit our website
• When you express an interest to use our services
• When you contact us for service related queries
• When you engage with us on social media
• When you review our services
• When you interact with our website (see our Cookies Policy for more details)
• When you contact support
• When you book a demo
• When you subscribe to Unitus

We may also receive data about you from various third parties, including:

• Technical data from analytics providers. Please see further information in the section entitled ‘Our Use of Analytics'
• Technical data from our website and cookies providers. Please see further information in the section entitled ‘Our Use of Cookies'
• Contact and/or transactional data from our trusted third-party providers. Please see further information in the section entitled ‘How We Share Your Data'

We will only collect and process your personal data where we have a legal basis to do so. As a data controller, the legal basis for our collection and use of your personal data varies depending on the manner and purpose for which we collected it. We will only collect personal data from you when:

• We have your consent to do so, or
• We need your personal data to perform a contract with you, or
• We are pursuing our legitimate interests in a way that you might reasonably expect to be a part of running our business and that does not significantly impact your interests, rights, and freedoms. For example, communicating with you if we have a sufficient legal ground based on the e-marketing laws in your country
• We have a legal obligation to collect or disclose personal data from you (for example, in suspected instances of fraud we may need to give personal data to relevant government bodies).

Purpose: To provide, update, maintain and protect our Services, Websites and business. This includes use of service, account and usage information to support delivery of the Services under a Client Agreement, prevent or address service errors, security or technical issues, analyze and monitor usage, trends and other activities or at an Authorized User’s request.

Legal Basis: The processing is necessary for the performance of a contract or in order to take steps to enter into a contract with you.

Purpose: To register your user account

Legal Basis: The processing is necessary for the performance of a contract or in order to take steps to enter into a contract with you.

Purpose: To communicate with you by responding to your requests, comments and questions.

Legal Basis: Where you have purchased our services this processing is necessary for the performance of a contract with you. If you are not an existing customer and have contacted us via a form on our website the processing is necessary for our legitimate interests to respond to you.

Purpose: To carry out our obligations arising from any agreements entered into between you and us.

Legal Basis: The processing is necessary for the performance of a contract with you.

Purpose: For billing, account management and other administrative matters. Mundo Pato may need to contact you for invoicing, account management and similar reasons and we use account data to administer accounts and keep track of billing and payments.

Legal Basis: The processing is necessary for the performance of a contract with you.

Purpose: To improve and customise your browsing experience when visiting our website via the use of Cookies (See Cookies Policy)

Legal Basis: You have given consent to the processing of your personal data (non-essential cookies information) through the Cookies Banner available on our website.

Purpose: To develop and provide search, learning and productivity tools and additional features. Mundo Pato tries to make the Services as useful as possible for specific Services and Authorized Users. For example, we may improve search functionality by using service, account and usage information to help determine and rank the relevance of content, channels or expertise to an Authorized User, make Services suggestions based on historical use and predictive models, identify organizational trends and insights, to customize a Services experience or create new productivity features and products.

Legal Basis: The processing is necessary for our legitimate interests in assessing areas for business improvement as well as improvement of services offered. Except where such interests are overridden by your interests or fundamental rights and freedoms.

Purpose: To send emails and other communications. We may send you service, technical and other administrative emails, messages and other types of communications. We may also contact you to inform you about changes in our Services, our Services offerings, and important Services-related notices, such as emails about new product features, security and fraud notices. These communications are considered part of the Services.

Legal Basis: The processing is necessary for the performance of a contract with you.

Purpose: Marketing - Having obtained your consent (or other legal basis) to contact you, we will retain your personal data for marketing and analysis purposes until you withdraw your consent. If you choose to withdraw your consent to marketing, we will add your personal data to our suppression list so that you will not receive further marketing.

Legal Basis: You have given consent to the processing of your personal data for marketing purposes, or we rely on another legal basis such as our legitimate interest to market to existing customers provided they have not opted out. (Sensitive personal data will not be processed for this purpose without your explicit consent)

Purpose: To investigate and help prevent security issues and abuse.

Legal Basis: The processing is necessary for our legitimate interests in protecting our property and services and maintaining the safety of your data. Except where such interests are overridden by your interests or fundamental rights and freedoms.

We sometimes share your personal data with our trusted categories of third parties we use to conduct our business. Our trusted categories of third parties include:

• Website provider
• Cloud service (SaaS) providers
• Professional services providers (e.g., our lawyers, accountants, and insurance providers)
• E-marketing providers
• Advertising providers

A full List of our Data Sub-Processors can be found in our Privacy Center on our website.

As part of fraud monitoring and prevention, we may be legally required to share your personal data with government bodies and law enforcement. Please note that these bodies may retain a record of the information that we provide to them for this purpose.

We may share your personal information as part of a merger or acquisition. If Mundo Pato is involved in a merger, financing, transaction or proceeding involving sale, transfer, divestiture, or disclosure of all or a portion of our business or assets, or in the event of a liquidation, insolvency, bankruptcy, or receivership, we may share your information with that company before and after the transaction closes. In such a case, unless otherwise directed by applicable law, your information would remain subject to the terms of the applicable privacy policy in effect at the time of such transfer. You will be notified of any such changes in advance.

We may send you direct marketing communications, product information and promotional offers:

• If you have consented to receiving such communications from us
• If we have an existing business relationship with you and can rely on your implied consent
• If you are from a country where the laws permit us to send you such communications based on our legitimate interests, if you have bought a product or service from us, and have not opted out of receiving communications from us (for example the EEA or UK)
• If you are from a country where the laws permit us to send you such communications
• The marketing communications we send will be in relation to our own products or services, your personal data will not be used for third-party direct marketing unless separate explicit consent has been collected for that or you are from a country where the laws permit such processing.

You will always have full control of your marketing preferences. If you do not wish to continue receiving marketing information from us at any time:

• You can unsubscribe by using the unsubscribe directions or link included in marketing communication from us; or
• You may withdraw your consent by contacting us by e-mail at compliance@mundopato.com (or privacy@mundopato.com for those in the EEA)

Customers located in certain regions, such as the EEA and UK, also have the right to object to their personal data being processed for direct marketing purposes at any time. If you would like to object you can contact us by e-mail at compliance@mundopato.com (or privacy@mundopato.com for those in the EEA).

We will process all requests as soon as possible, but please note that due to the nature of our IT systems and servers it may take a few days for any opt-out request to be implemented.

Our website uses cookies. They help us to provide you with the very best experience when you browse our website and to make improvements to our website. You can accept or reject cookies by clicking on the cookie consent banner on our website or by navigating to the ‘Cookies Preferences’ Area in our Privacy Center on our website.

For detailed information on the cookies we use and the reasons why we use them, please refer to our Cookie Policy and Cookie Declaration in our Privacy Center on our website.

We use analytics to continuously enhance our website, products, services, and features, ensuring an improved user experience. To achieve this, we rely on third-party tools and services that provide valuable insights and analysis of user behavior.

These third-party tools help us collect information automatically when you visit our website (where we have a legal basis to do so). The data includes details such as device type, browser, IP address, pages visited, and the date and time of your visit. By analyzing this information, we gain valuable insights into user preferences, interactions, and usage patterns. Through the use of these analytics tools, we can optimize website performance, personalize content, and enhance our offerings to better meet customer expectations.

If you would like any further information about the data collected by these third parties or the way in which the data is used, please have a look at our List of Sub-processors or contact us on compliance@mundopato.com (or privacy@mundopato.com for those in the EEA).

We use targeted advertising tools to advertise our services, including (but not limited to):

• Facebook
• Google Analytics
• LinkedIn
• Vimeo
• Youtube

We use these tools to deliver relevant content to you in marketing communications (where applicable), and to measure the effectiveness of the advertising provided.

If you would like any further information about the data collected by these third parties or would like to opt-out of targeted advertising, please contact us on compliance@mundopato.com (or privacy@mundopato.com for those in the EEA). Similarly, Mundo Pato account holders can opt out of targeted advertising by managing their preferences in the Mundo Pato Privacy Center.

Our website may include links to and from the websites of our partner networks, advertisers and affiliates, or to social media platforms. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to their websites.

The communication between your browser and our website uses a secure encrypted connection wherever your personal data is involved.

We have put in place physical, electronic, and managerial security procedures in the storage and disclosure of your personal data to protect it against accidental loss, destruction or damage. Nevertheless, any data transmission over the internet or by any other means can never be fully secure, such is the character of the internet, and provision of personal data by you to us is at your own risk. We take all reasonable measures to protect your personal data by putting appropriate technical and operational security measures in place.

When we disclose your personal data to trusted third parties (for the purposes set out in this Privacy Notice and our List of Data Sub-Processors), we require all third parties to have appropriate technical and operational security measures in place to protect your personal data, and we work with them to ensure that your data privacy rights are respected. Where your personal data is shared with a third party, it must only be used for the purposes for which it was supplied.

In the unfortunate event of a personal data breach, we will notify you and any applicable data protection authority when we are legally required to do so.

We will not keep your personal data for longer than is necessary and when we no longer need to keep it, we will securely destroy, delete or anonymise it in line with our Data Retention policy.

Having obtained your consent (or other legal basis) to contact you, we will retain your personal data for marketing and analysis purposes until you withdraw your consent or unsubscribe. If you choose to withdraw your consent or unsubscribe from marketing, we will delete your personal data from our systems, unless we have another legal basis to retain it, which may include performance of our contract with you or to maintain your contact details on an 'unsubscribed list' to ensure we do not send you further communications.

We may need to retain your personal data to satisfy our legal obligations, to deal with complaints and queries, in order to resolve, litigate or defend a dispute and to prevent fraud and abuse.

For Users from the European Economic Area ("EEA"), your personal data may be processed outside the EEA by staff who work for us or by one of our Data Sub-processors. When we transfer your information outside of the European Economic Area, we ensure it benefits from an adequate level of data protection by:

• relying on an adequacy decisions by the European Commission made under Article 45 of the GDPR, finding that the third country to which the information is being transferred offers an adequate level of data protection; or
• if there is no adequacy decision, using standard contractual clauses approved or permitted under Article 46 of the GDPR.

We will take all steps necessary to ensure that your data is treated securely and in accordance with this privacy notice. Please contact us if you want further information on the countries to which we may transfer personal data and the specific mechanism used by us when transferring your personal data outside the EEA – compliance@mundopato.com (or privacy@mundopato.com for those in the EEA).

You have rights under data privacy laws and Mundo Pato is committed to you being able to freely exercise your Rights. Where possible, we have incorporated automated tools on our website that enable you to facilitate your rights in real-time. Use the Data Access Gateway in our Privacy Centre to access and manage the personal data that we process and submit any access requests in line with your rights below. Alternatively you can also send us an email at compliance@mundopato.com (or privacy@mundopato.com for those in the EEA) to exercise your rights. You are not required to pay any charge for exercising your rights.

EEA and UK General Data Protection Regulation (EU GDPR and UK GDPR)

Your rights include, under certain circumstances, the right to:

Be informed: you have the right to be informed if and how your personal data is being processed.

Access, rectification, or erasure: you have the right of access to personal data we hold about you in our records. You are also entitled to have your personal data corrected if it is inaccurate, or to have it erased if we do not have a legitimate reason for retaining your data.

To request data portability: you have the right to obtain a digital copy of your personal data, request the transfer of your personal data to another company or request to move your data from one IT system to another in a safe and secure way. This right only applies to personal data you provide to us, and we process it with your consent or in order to fulfill our contract with you by automated means. It also only applies to the extent that it does not affect the rights and freedoms of others.

To request restriction of processing: you have the right to restrict the processing of your personal data where you are contesting the accuracy of that information, you have objected to processing (as described below), or where the processing is unlawful. Where processing is restricted, we may need to retain sufficient information about you to ensure that the restriction is respected in future.

To object to processing: you have the right to object to the processing of your personal information in certain circumstances such as where your personal data is being processed based on our legitimate interests or the legitimate interests of a third party.

To object to automated decision-making including profiling: you have the right not to be the subject of any automated decision-making or profiling by us.

To withdraw consent: in cases where we are relying on your consent for the processing of your personal data, you have the right to withdraw your consent at any time. In respect of the e-marketing we conduct, an unsubscribe option is included with every e-marketing communication we send.

To complain to the relevant supervisory authority: should you have any concerns or complaints regarding the way in which we process your data, you also have the right to make a complaint to the relevant European Supervisory Authority. We would, however, appreciate the chance to deal with your concerns before you approach a Supervisory Authority, so please do contact us in the first instance - compliance@mundopato.com (or privacy@mundopato.com for those in the EEA). For EU citizens, the relevant data protection authority for Mundo Pato is the Comissão Nacional de Proteção de Dados (CNPD) in Portugal. The contact details of European Supervisory Authorities can be found here: https://edpb.europa.eu/about-edpb/about-edpb/members_en

Cookie Preferences: you can accept or reject cookies by navigating to the ‘Cookie Preferences’ Area in our Privacy Center on our website. You can also do so by adjusting your web browser controls. Please consult our Cookie Policy for more information about our use of cookies on the website and how to accept and reject them.

In this section we use the terms “personal information”, "sensitive personal information", “sale” and "sharing" as defined in the California Consumer Privacy Act (“CCPA”).

“Personal information” is defined as information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

"Sensitive Personal Information (SPI)" is personal information that reveals a consumer’s:

• Social Security, driver’s license, state identification card, or passport number
• Account login, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account
• Precise geolocation
• Racial or ethnic origin, religious or philosophical beliefs, or union membership
• Mail, email, and text message content, unless the Business is the intended recipient of the communication
• Genetic data.

“Sale” is defined broadly as the selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by us to another business or a third party in exchange for monetary or other valuable consideration.

"Sharing" is defined as sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer’s personal information by the business to a third party for cross‐context behavioural advertising, whether or not for monetary or other valuable consideration”. This also includes “transactions between a business and a third party for cross-context behavioural advertising for the benefit of a business in which no money is exchanged.” Cross-context behavioural advertising (CCBA) is defined as targeting advertising at a consumer based on the personal information collected from their activity across businesses, websites, applications, or services with which the consumer did not intentionally interact.

The California Consumer Privacy Act (“CCPA”) provides consumers with specific rights regarding their personal data.

Right of access: You have the right to request that we disclose certain information to you about our collection and use of your personal data over the past 12 months. This information will include the categories and sources of the personal information that we collect about you, the purposes for which we use your information and with whom such information is shared. If your personal information has been sold or disclosed for business purposes over the past 12 months, you have the right to know the categories of personal information that were sold or disclosed and to which category of recipient they were sold or disclosed to. To exercise this right, you can go to the Privacy Centre on our website and use the Data Access Gateway to access your personal information that we process. You can also submit a custom request in the Data Access Gateway.

Right to opt out of the sale or sharing of personal information: If we sell or share personal information, you have the right to opt out of the sale or sharing of your personal information. This means that whenever you request us to stop selling or sharing your data, we will abide by your request. Such requests can be made freely, at any time, by clicking the “Do not sell or share my data” link in cookie banner on our website. You can access the cookie banner at any time by clicking “Cookie Preferences” in the Privacy Centre on our website.

Right to correct: you have the right to request that we correct any inaccurate personal information we have about you.

Right to limit the use and disclosure of Sensitive Personal Information (SPI): You have the right to limit the use of your sensitive personal information. You can request that we only use your SPI as necessary to provide the goods or services (as reasonably expected by an average consumer who requests such goods and services) and as authorised by further regulations.

Right to delete: You have the right to request the deletion of your personal information, subject to certain exceptions. Once we receive and confirm your request, we will delete (and direct our Service Providers to delete) your personal information from our records, unless an exception applies. To exercise this right, you can go to the Privacy Centre on our website and use the Data Access Gateway to manage your personal information that we process. You can also submit a custom request in the Data Access Gateway.

Right not to be discriminated against: A business cannot discriminate against you for exercising a CCPA right. if you choose to exercise your applicable CCPA rights, we will not charge you different prices or provide you a different quality of services.

When offering services to its Merchants, Mundo Pato Inc. acts as a “service provider” under the CCPA and our receipt and collection of any consumer Personal Information is completed on behalf of our Merchants in order for us to provide the Service. Please direct any requests for access or deletion of your Personal Information under the CCPA to the Member with whom you have a direct relationship.

We may change this policy from time to time, to reflect how we are processing your data. If we make significant changes, we will make that clear on our website or by some other means of contact such as email, so that you are able to review the changes before you continue to use our services.

We welcome feedback and are happy to answer any questions you may have about your data.

You can contact us at:

Email: compliance@mundopato.com (or privacy@mundopato.com for those in the EEA)

This notice was most recently updated: August 30, 2023