Privacy Policy

1. Data Controller

FREEPIK COMPANY, S.L.U. is the Data Controller of Users’ data for the purposes of providing the Services:

FREEPIK COMPANY, S.L.U., with Tax ID B-93183366 and registered office at Calle Molina Lario, 13, 5th floor, 29015, Málaga (Spain).

Contact email: rpd@freepik.com.

Data Protection Officer: Abisko Data, S. L.

You can contact Freepik through email at rpd@freepik.com to raise any question, request or exercise of rights regarding personal data protection.

2. Use of our Services Subject to Terms and Conditions

You can only contract our services and validly consent to the Conditions applicable to our Services if you are of legal age.

Our products are aimed at persons of legal age. In specific cases, we may explicitly allow their contracting for use by minors. These must be reviewed and accepted on their behalf by the adult person holding parental authority or responsible for their custody or education.

Outside of these cases, if you are a minor, in accordance with our terms and conditions, you cannot validly enter into any of the contracts we offer.

3. Purpose and Legal Basis for the Use of Data

Your personal data is processed for different purposes or legitimate purposes. Each processing of personal data must be based on a legitimising basis, among those provided for in the regulations. We use the following bases:

1. Consent: you have given your informed, unequivocal and specific consent to the processing of your personal data for a specific purpose.
2. Legal obligation: the Law requires processing and transferring certain data to certain institutions on occasion (e.g., to Judges and Courts or to Law Enforcement, or the Tax Agency, in their respective areas of competence).
3. Performance of a contractual relationship: the data is strictly necessary to perform our service or fulfil what has been agreed with you.
4. Our legitimate interests, provided that your interests, rights or freedoms do not prevail over them.

The legitimate bases for our data processing carried out through our Services, in relation to the purposes for which we will use your data, are as follows:

3.1. Browsing through our Services

When you browse and use our Services, even if you do not register, identifiers such as your IP address, the unique ID of the device from which you access and certain metadata (such as your browser or HTTP headers) are automatically collected. This information is recorded for the purpose of monitoring compliance with the download limit authorised for each user category, thus allowing us to detect fraudulent or illegitimate use of our Services, and therefore ensure compliance with the applicable Conditions in each case, i.e. the management and fulfilment of our agreements with you.

These same technical data observed in the mere browsing of the user are processed for the purpose of detecting and mitigating risks of cyberattacks (bots, code injections, or distributed denial of service attacks –DDOS–) and in general maintaining the security of our Services. Our legitimisation basis is our legitimate interest in maintaining the security, integrity and resilience of our systems and ensuring the regular provision of the service, compliance with our agreements and protecting the company’s assets.

Personal data subject to processing: IP address, device ID and certain metadata such as the browser used or the HTTP/HTTPS header.

3.2. Contractual relationship as a registered user

When you register as a user (whether free or “premium”), we request the personal data we need for the formalisation, management and fulfilment of our contractual relationship with you.

When you are asked for personal data classified as necessary, due to legal obligation or in accordance with our contracting conditions, and you refuse to provide them, we may not be able to formalise said contract or provide you with the service, which will be duly communicated to you.

• Personal data subject to processing (free): username, email address, name, address and profession. Only the email address and username are mandatory.
• Personal data subject to processing (premium): the above, plus country, city of residence, identity document, tax residence, and payment method (all data is mandatory).

You can open your account as a registered User on Freepik with your own account on other platforms, such as Google, using the federated Logins you will find at the top of our websites, and access whenever you want through them, without the need to create and remember a specific username and password to access Freepik.

This option is possible thanks to the collaboration between Freepik and Google as joint controllers of the processing of your personal data, so that (i) you can identify yourself directly on said platform, (ii) they confirm to us that you are who you say you are, and (iii) we facilitate your registration as a registered user on Freepik.

Freepik obtains from this platform, with your consent, your username, image and your email address for the purpose of registering you as a Freepik user. On the other hand, these platforms capture online identifiers (IP address), technical identifiers (of your device, as well as its advertising identifiers such as "Google ID") and record, each time you use their login, the date and time of your access to Freepik. You can find additional information in the Privacy Policy Google.

You can exercise your rights of access, rectification, erasure, restriction of processing, portability and withdrawal of consent related to the personal data obtained from these platforms (and others you may have provided to Freepik in your relationship with us) by contacting Freepik at the email address provided in this same policy.

Please note! The rectification or deletion of your data in your Freepik account does not automatically imply the rectification or deletion of your data and accounts on the platforms that authenticate your identity: you must also contact them to exercise your rights.

To exercise your personal data protection rights in relation to any other data derived from your relationship with these platforms, you must contact the corresponding platform.

3.3. Contractual relationship as an external creator

When we formalise a collaboration agreement with you as a “commissioned” or “contributor” (hereinafter, “External Creators”) –content creators for distribution by Freepik–, we request the personal data we need for the management and fulfilment of our contractual relationship.

Personal data subject to processing: email address, name, surnames, address, city of residence, tax residence, identity document and payment method.

3.4. Models included in our content

If you appear as a model in images or videos offered as content in our Services, we process your personal data inserted in the legal documentation and your image and/or voice are incorporated into our products for marketing on our websites, based on your contract with the External Creator or directly with us, as the case may be.

Personal data processed: The data recorded in the image rights assignment document –name, surnames, identity document or equivalent and address– are only processed for the purpose of verifying regulatory compliance and are not included in the training of machine learning or AI models.

Your image and/or voice may be used for the purposes of development, training, testing or improvement of software, algorithms and machine learning and artificial intelligence models in combination with other images, texts, graphics, films, audio and audiovisual works, always in aggregate form, without the processing seeking or enabling your unique identification.

Personal data processed: your image or voice incorporated into our content.

Your image and voice incorporated into our content are publicly communicated worldwide via the internet –our websites– and are transferred to third parties in the form of licences or access to the content.

3.5. Promotion of our products through personalised advertising on Freepik or other websites

We promote our products:

- Among social media users and other platforms, among profiles of potential Freepik customers (audiences segmented by interests, not created by Freepik, but already offered by platforms such as Pinterest, Google and Twitter and contracted by Freepik for this purpose). Likewise, we can only identify you if you register with us.

Our legitimisation basis is our legitimate interest in acquiring new customers via personalised advertising of our products through the profiling offered by social media platforms.

Personal data subject to processing: We do not directly process your personal data: we select the groups of users to whom advertising will be shown based on segments offered by the platforms, such as age range or country. These platforms provide us with aggregated information about the success of each campaign, but we cannot identify the specific users who have registered as a result of it.

- Through retargeting: reaching visitors who have visited and left our website without registering, when they have accepted the use of our cookies, and these allow us to present them advertising on third-party websites.

In this case, our legal basis is your consent (given on our Services and also on the third party’s on which our advertising is shown to you). You can find more information about this processing in our cookie policy.

3.6. Commercial communications by email

We will send you commercial communications by email if (i) you have registered or contracted any of the Services, (ii) you request information about our products through any of the forms provided for this purpose. In any case, we will do so provided that you have not expressed your opposition to receiving such communications (you can do so conveniently through the specific slider in your user profile, as well as in each communication you receive, at the bottom, through the "Unsubscribe" button).

Likewise, we will send you content updates that the creators you follow have made, provided you have specifically consented to this via the specific slider in your user profile. You can revoke your consent by unchecking it.

Our legitimisation basis is our legitimate interest (offering you commercial information about products or services similar to those you have already contracted or about which you have requested information) legally enshrined in Art. 21 of Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI).

Personal data subject to processing: email address.

3.7. Advertising exploitation of our website

Unless you become a premium user (exempt from advertising), we show you personalised advertising in the advertising spaces on our Services, if you consent to the use of cookies for this purpose (more information in our Cookie Policy).

When we use cookies, we do so based on your prior consent. You can accept or reject all our cookies in bulk or granularly some yes and some no, through our CMP or One Trust cookie configuration panel.

3.8. Personalised advertising through preference form

We offer you voluntary surveys to learn about your basic user profile and preferences, in order to personalise your experience on our websites as well as the advertising we show you or the information of interest we send you, based on the profile you place yourself in.

The purpose of the processing is to personalise our advertising and information based on the information you decide to provide us and our legitimate interest is the continuous improvement of our products and services and obtaining relevant information in a transparent, respectful and approachable way.

Personal data subject to processing: username, type of use of our products (personal, freelance, company and its approximate size and industry or activity of the user) and personal preferences included in the form.

You can object to this processing simply by omitting the response and closing the screens.

3.9. Satisfaction surveys

Likewise, based on our legitimate interests (improving our products, increasing our sales) we offer you the opportunity to participate in surveys in order to learn first-hand your opinion and preferences about our products and, on that basis, eliminate friction, facilitate their use and improve your interactions with them. Therefore, we will contact you to request your opinion through satisfaction surveys.

Personal data subject to processing: user contact data.

3.10. Support

When you contact us requesting information, support or "feedback" (comments or suggestions), or support, we process your data for the purpose of assisting you, based on your consent expressed in your own request.

Personal data subject to processing: contact data that you provide us to respond to you and content of the enquiry.

3.10.1. Support through AI assistant

Similarly, based on your explicit consent provided by clicking the acceptance buttons, our AI assistant will process your data for the same purposes of support and information requests. The AI assistant operates through the fully automated analysis and comparison of your request and responses with a database generated from frequently asked questions, your account data, and predefined customer-support rules.

If you believe that the assistant’s response is unsatisfactory or prejudicial, or if it is unable to provide you with a satisfactory answer or solution, you may challenge the decision or lodge a complaint at support@freepik.com. Our human supervisor team will take into account any additional details and context you submit with your complaint before reaching a final decision.

Personal data processed: content of your request, username, email address registered with Freepik, language preference, browser, time zone, and operating system.

Description of the logic involved: The AI assistant analyses your query using natural language processing and predefined rules to identify its topic and provide the most suitable response from our knowledge base.

International data transfer and recipients

In order to provide this service, your data will be transferred outside the European Union in accordance with the terms set out in this privacy policy, but will not be disclosed to third parties.

In relation to customer management processing by AI assistant, your data will be processed for a maximum period necessary to attend to your request or until you object to it. Whichever occurs first.

3.11. CV submission

When you submit your application to join Freepik’s staff or as a freelance designer or collaborator, we process your personal data based on your consent, to assess your hiring.

Personal data subject to processing: contact data and data included in your CV and/or cover letter that you provide to support your application.

3.12. Professional contact with individual professionals or contact persons in companies.

If you are an individual professional or contact person of a company with whom we have contacted, or we have obtained your data through a form we offer on our websites for this purpose, your data will be processed for the purpose of maintaining professional contact with you as an individual professional or contact person. We will process your data based on the legitimate interest of being able to maintain strictly professional contact with you or the organisation you represent, in the terms provided for in Article 19 of the LOPDgdd.

Likewise, the legal basis for data processing for the implementation of pre-contractual measures requested and preparatory, where applicable, for the execution of an agreement with you or your company may be applicable, and if a commercial agreement is reached, based on that contract or pre-contract entered into.

Personal data processed: name and surnames, corporate or non-personal email address, corporate or non-personal telephone number (optional), position (optional) and data contained in the message.

3.13. Third-Party Integrations, APIs, Plugins and Extensions

We may integrate or use various extensions, plugins, APIs and other third-party technologies (collectively, "Third-Party Integrations") within our platform or services. These Third-Party Services are operated and provided by independent companies that are not under our direct control.

For example, using Google APIs, Freepik has developed and made available to you specific extensions that allow you to use certain functionalities connected with Google services. Our extension for Google Slides would allow you to use the functionalities of our Slidesgo product. This involves the connection and access to some of your data on Google, always in strict adherence to the Google API Services User Data Policy, including its Limited Use requirements.

Regarding the processing of your personal data granted by Google, we inform you of the following:

The data obtained from Google, such as email, name, language preference and image, and the same information explained in sections 3.1 and 3.2, are collected to provide you with access to our products and ensure compliance with our terms and conditions, i.e., with our agreement with you through our extension.

You can deactivate or unsubscribe at any time and exercise your privacy rights, in particular your right to object, by contacting us at the address provided in the specific section of this policy.

3.14. Processing Required by Legal Obligations

When in some cases we are legally obligated by different regulations (regardless of whether you give your consent or not), to process and/or transfer certain personal data to different entities or bodies (e.g. Judges and Courts, Security Forces and Bodies, or the Tax Agency), we will process your data to comply with the corresponding legal obligation.

Personal data subject to processing: those required by the relevant regulations in each case.

4. Privacy Policy for AI Suite Services

This section of the privacy policy covers the specificities related to Freepik’s AI Suite (its generative AI services available to the User). Its content constitutes an exception to the general privacy policy, which continues to apply to these services in all matters not covered here.

In everything related to its AI Suite services, Freepik acts as a mere service provider, i.e., as a data processor of the personal data uploaded to our platform by the User, with the specific exceptions that will be described.

This Specific Privacy Policy applies to Users on Individual, Teams, Business plans.

Users of Individual, Business, and Teams plans who require the formalization of a Data Processing Agreement (DPA) may request it by sending a communication to rpd@freepik.com, indicating their account identification details and the service contracted.

The User is the data controller for these purposes, as explained below.

The generative AI tools that Freepik makes available to the User allow them to generate, based on their Inputs (prompts or instructions, images, videos, audio files or voices, or any content sent, uploaded or transmitted to Freepik’s systems) the Outputs (image or video) desired, either (i) simply describing them without starting from any base content or (ii) uploading initial content to our platform, consisting of image or audio files.

The User is the data controller of the personal data that may be found in the content they decide to upload to our platform.

If third-party personal data is involved, the User has the responsibility to (i) inform and (ii) have a sufficient legal basis (usually informed consent or contract), in accordance with data protection regulations (and image rights, among others) if they intend to:

(i) use as “Input” images or voice of another person (the “Data Subject”), so that the resulting Output may resemble or be confused with the Data Subject.

(ii) give third parties access to Outputs based on third-party content (through publication, distribution or dissemination on social media or any other means).

Freepik acts as data processor of the data supplied by the User, to provide the service corresponding to each of its tools:

• Collection, storage, hosting and transmission of Inputs and Outputs.
• Application of AI to the Inputs to generate the required Outputs.
• Display, delivery and storage of Inputs.
• Account and permission management.
• Support and maintenance strictly in relation to the service.
• Recording of technical metadata (e.g., timestamp, file type or size), for the sole purpose of ensuring the provision of the Services, applying usage limits and detecting technical errors or malfunctions.

Exceptionally, Freepik acts as data controller, in relation to the personal data that may be found in the Inputs (excluding images and audio) and in the Output or synthetic content generated by our tools, for three purposes:

• The maintenance of security of our systems, tools and data hosted on them.
• The verification of compliance with the law and our terms and conditions in the generation of Outputs, with safeguards and filters.
• For the improvement of our services, based on our legitimate interest in achieving more useful, effective, efficient and satisfactory tools for the User by studying the relationship between Inputs-Outputs-feedback. Under no circumstances will we use your images or voices, or those of third parties that you upload to our platform, to train or improve our artificial intelligence models or those of third-party providers.

You have the right to object to this processing based on our legitimate interests.

Data processing is fully automated and takes place in performance of our service contract. In no case is the data processing covered by this section aimed at uniquely identifying the Data Subjects.

In fulfilment of our compliance and proactive accountability obligations, we will remove any content subject to a complaint for non-compliance with regulations or our policies and will cooperate with the competent authorities, suspending the account of the User involved and providing the relevant information required in an appropriate manner.

Personal data subject to processing:

• General User data if you are a registered User.
• Where applicable, the image or voice, or other data you decide to upload as Inputs for our tools, as well as, where applicable, the Outputs generated.

In the event of subscribing to an enterprise or professional plan, the contact data or content incorporated by your authorised users in their inputs, under the same data categories as the previous point.

Retention Period

Images and audio files uploaded by the User are deleted immediately after the generation of the synthetic content based on them. Prompts and Outputs are retained for the duration of our contractual relationship, and are kept blocked upon its termination during the statute of limitations period for infringements that may arise from the processing operations.

Your image or voice (or those you upload of third parties) are not transferred to third parties (they are processed directly by the AI model provider you select in our suite). These providers render a service to us as sub-processors and personal data is retained for a maximum of 30 days after the generation of the Output.

Recipients / International Data Transfers

Freepik offers a variety of AI models clearly identified as (i) hosted in countries deemed adequate by the EU or (ii) in countries whose regulations do not offer the same level of protection as the GDPR.

The decision to use or not any of the third-party generative models offered –including when such use involves the international transfer of data– taking into account the information and characteristics provided for each one (for example, the country in which personal data is processed) lies exclusively with the User.

Freepik enters into Standard Contractual Clauses (Art. 46.2.c) of the GDPR with all third-party model providers it offers.

5. How Long We Keep Your Data

We process your personal data only for the time necessary, depending on each case. Once our processing is complete, we keep your data blocked for different periods of time (in general, until the statute of limitations for any liabilities that may have arisen from our interactions). The relevant periods in each case are listed below:

1. In relation to maintaining the security of our websites and anti-fraud measures, we keep your data for thirteen months.
2. In relation to the data necessary to manage and fulfil our contractual relationships with users, your personal data is processed while the contractual relationship continues, and is subsequently kept blocked for a period of five years (until the statute of limitations for possible contractual liabilities or intellectual property rights claims) or six years (in relation to documentation for accounting purposes).
3. In relation to the data necessary to manage and fulfil our contractual relationships with external creators, your personal data is processed while the intellectual property rights arising from said contract remain in force, and is subsequently kept blocked for a period of five years (until the statute of limitations for possible contractual liabilities).
4. In relation to the sending of commercial communications, the data will be processed for three years from the last interaction with you, or until you decide to object, whichever occurs first.
5. In relation to the advertising exploitation of our website through cookies, we refer to the descriptive tables of the persistence or duration of each of them available in our Cookie Policy.
6. We process your data to offer you surveys while our contractual relationship is in force, unless you have objected to receiving them.
7. In relation to your non-commercial enquiries, the data is deleted once they have been answered.
8. We will process the data provided for your selection process for a period of one year from its receipt.
9. In relation to the management processing through cookies, we refer to the Cookie Policy where you will find detailed information about the persistence or duration of our own cookies and links to detailed information about third-party cookies.
10. In relation to the processing of data of models incorporated in the available content, they will be processed while the contractual relationship with the External Creator lasts, being subsequently retained for a period of five years for the purpose of managing possible liabilities arising from the processing.
11. In relation to the processing of data for professional contact, for a maximum period of 3 years from the last interaction or until you object to the communication. Whichever occurs first.
12. In relation to the processing of support managed by the AI assistant, your data will be retained only processed for the time necessary to manage and resolve your request, being subsequently retained, duly blocked, for a period of five years (until the statute of limitations for possible contractual liabilities or liabilities arising from the processing carried out), and will be deleted once the conversation has ended or the support ticket has been closed, or until you withdraw your consent, whichever occurs first.
13. In relation to the data used for fraud prevention and detection purposes, the personal identifiers of users suspended for fraudulent or abusive activities may be retained in a restricted and pseudonymised format for the time strictly necessary to prevent the recurrence of such conduct, or the possible opening of new accounts by the offending user.
14. We keep your data in relation to compliance with legal obligations, in general, during the statute of limitations periods for possible liabilities arising from our data processing, and specifically during the periods imposed by the regulations in each case.

6. Data Update

We ask you to inform us immediately of any changes to your data so that the information contained in our systems is always up to date and does not contain errors. In this regard, you represent and warrant that the information and data you have provided to us are accurate, current and truthful.

7. Data Disclosure

7.1. Access by Third Parties Providing Services to Us

We allow access to the personal data under our responsibility to third parties who provide us with their services, and who require such access to do so. These are companies that provide us with services necessary for the fulfilment of our contract with you or the provision of our services, in compliance with the applicable Conditions in each case and for compliance with applicable laws:

• Service providers for systems administration and information technology, such as hosting, broadband, IT security or web analytics providers.
• Payment platforms, banks and companies for which such communication is necessary so that the transactions required at any given time can be processed.
• Advertising platforms, CRM and other marketing tools.
• Recruitment management platforms.
• User enquiry management platforms.
• Professional advisors such as lawyers, auditors and banking, legal and accounting consultancy services.

These services provided by third parties are necessary for the development of our activity and, at all times, the data processing they carry out is governed by a contract that binds the processor to the data controller (us), as well as the corresponding confidentiality agreement. In no case will they use the information for other purposes and they will process it in accordance with the guidelines and instructions provided by us, consistent with their privacy policy and the current data protection regulations.

In our commitment to your privacy and your right to data protection, we choose only first-class service providers, leaders in their sectors. You can request the list of providers who have access to your personal data, as well as the services each one provides, through the email address provided in the rights exercise section.

We commercially exploit the advertising shown to you on our Services by third parties, and we do so through “cookies” and other similar technologies, and always with your prior consent, collected through One Trust’s CMP (the cookie configuration panel that informs you of the different purposes of data processing carried out by the advertising companies).

You have all the information in our Cookie Policy.

In our Services we include plugins that allow certain actions on third-party social networks such as Twitter or Pinterest, such as republishing our images on other platforms or showing support for our Services. These plugins are indicated by the logo of the corresponding social network, and require the access data for each platform and your consent.

If you use these plugins, the corresponding content will be transferred to the relevant social network. You can find in our Cookie Policy the links to the respective Privacy Policies of each platform.

7.2. Data flows within the Freepik Group of Companies

The Freepik Company Group of Companies, with the purpose and interest of centralising administrative and business infrastructure functions and to benefit from the functional specialisation and compartmentalisation inherent to these corporate structures, will carry out intra-group personal data processing of providers, users and employees based on our legitimate corporate interests.

These processing operations, depending on the case, are carried out mainly as data processor and exceptionally as joint controller (for the execution of strategic decisions of the Group).

Data origin: each of the Group’s subsidiaries collects the relevant data directly from the data subject in each case.

Personal data subject to processing: depending on the processing: basic identification and contact data, data necessary to perform the login (single login), economic and professional data, image, audio and video (contractual management of providers –creators and models), data and metadata from web browsing (IT and web security processing).

Processing with impact on the user’s web experience: The “unified login” or centralised management from Freepik Company of user data allows facilitating access to services, improving user knowledge and offering products or services from other group companies, centrally managing incident and rights support, as well as improving cross-cutting security and management of our services.

Data subjects have the right to object to any of these processing operations based on our legitimate interests through the channels described in the following section.

8. Your Rights

We guarantee the exercise of rights in the terms established in the General Data Protection Regulation or GDPR.

You may exercise your rights, set out in this section, by accessing your user account at the following link, through the support page, or by sending an email to rpd@freepik.com.

Please note that we may ask you to verify your identity before taking any action you have requested for the exercise of your rights.

The following are the rights you may exercise, in accordance with the provisions of the GDPR:

• Transparency and information about how we use your personal data (right to be informed). A right we satisfy, for example, through this legal text.
• Right to request a copy of the information we hold, which will be provided to you within one month (right of access).
• Right to update or modify the information we hold if it is incorrect or inaccurate (right of rectification).
• Right to request that we stop using your information while a filed claim is being resolved, among other cases (right to restriction of processing).
• Right not to be subject to a fully automated decision based solely on the processing of your data, that produces legal effects on you or significantly affects you (right not to be subject to automated individual decision-making).

Additionally, when we process your personal data based on your consent or our contractual relationship with you:

• Right to request that we delete personal data from our records (right to erasure or “right to be forgotten”). You can make this request at any time by closing your account, through your profile page.
• Right to obtain and reuse personal data for your own purposes (right to data portability).
• Right to revoke at any time the consent previously given to any of our processing of your personal data.

Or, when we process your personal data based on our legitimate interests:

• Right to object to the processing of personal data based on our legitimate interests alleging circumstances based on your personal situation (right to object). You can object to these processing activities related to the sending of advertising both in the registration form, and through your own profile, by unchecking the box enabled in the "Notifications" section, as well as in each of the commercial communications we send you.

9. Data Security

We have adequate security measures in place to prevent your personal data from being accidentally lost, used, accessed in an unauthorised manner, modified or disclosed.

For example, to protect your personal data, Secure Socket Layer (SSL) technology is used during data transmission. This means that an approved encryption procedure is used for the communication between your computer or device and Freepik’s servers, as long as your browser supports SSL.

10. International Transfers

We carry out international data transfers in relation to some of the data disclosures described above and with certain data processors: subcontractors and content delivery networks that help us in the provision of our Services.

A data processor, as already mentioned, is an external data processor that we engage, and which may have access to personal data about customers or collaborators, or which processes or stores it in the context of the service it provides to us.

Some of these external service providers are located outside the European Economic Area (EEA), so the processing of your personal data involves an international data transfer.

Your data may be transferred outside the European Union in accordance with the terms established in this Privacy Policy, and in the specific information notices for certain tools, but will not be disclosed to third parties, except in cases expressly provided for in the applicable regulations or when necessary for the provision of the contracted services.

11. Filing Complaints

If as a user you deem it appropriate, you can file your complaint through the email rpd@freepik.com, or to the corresponding supervisory authority. In this case, the Spanish Data Protection Agency (AEPD) through its own website: www.aepd.es.

12. Additional Information for California Residents

This section of the privacy policy provides additional information for California residents and describes our information practices in accordance with applicable privacy laws, including the California Consumer Privacy Act (CCPA) and its regulations, as enacted.

To the extent that you are a California resident and we collect "personal information" subject to the CCPA, this section will apply.

This section does not refer to or apply to the handling of personal information that is exempt from the CCPA, such as publicly available information or anonymised or aggregated information. The information provided in this section is intended to provide a general description of how we process the personal information of California consumers. This section does not apply to information or practices not subject to the CCPA, or to personal information collected from contractors, job applicants, employees, ambassadors or professional designers, or to information processed in connection with events we host or sponsor, which are subject to separate notices.

12.1 Categories of Personal Information Collected and Disclosed

We generally collect the following categories of personal information:

• Identifiers such as name, alias, address, unique personal identifier, IP address, email address or other similar information.
• Customer records such as account and profile information, and customer records containing personal data such as name and contact information.
• Characteristics of protected classifications such as date of birth, gender, national origin and citizenship.
• Commercial information such as products or services purchased, considered or purchase and usage histories.
• Internet or other electronic network activity information such as browsing history, search history and information about your interaction with our Services and advertisements.
• Geolocation data such as general location information of an individual or device.
• Professional information such as current or former employer, position, professional contact information and professional memberships.
• Visual, electronic or similar information such as photographs and images you provide to us.
• Inferences such as inferences obtained from other personal data collected to create a profile about the individual’s preferences.
• Sensitive personal information such as driver’s licence number and state identification card number.

12.1.2 Disclosure of personal information to third parties for commercial or business purposes

We may disclose each of the following categories of personal information to the following third parties for business or commercial purposes. We may disclose identifiers, professional information, Internet and other electronic activity information, and inferences to advertising networks, Internet service providers, data analytics providers, government entities, operating systems and platforms, social networks, data brokers and others, as permitted by law. We may disclose protected classifications and commercial information to advertising networks, Internet service providers, data analytics providers, government entities and others as permitted by law. We may disclose consumer records, characteristics of protected classifications, geolocation information, sensitive personal information and audio, electronic, visual or similar information to government entities and others as permitted by law.

12.2 Sale and Sharing of Personal Information

The CCPA defines "sale" as the disclosure or making available of personal information to a third party in exchange for monetary or other valuable consideration, and "sharing" includes the disclosure or making available of personal information to a third party for cross-context behavioural advertising purposes. Although we do not disclose personal information to third parties in exchange for monetary compensation, we may "sell" or "share" the following categories of personal information: identifiers; commercial information; and Internet and network activity information. We may disclose these categories to third-party advertising networks, analytics providers and social networks for marketing and advertising purposes and to improve and measure our advertising campaigns.

We do not sell or share sensitive personal information, nor do we sell or share personal information about individuals we know to be under sixteen (16) years of age.

12.3 Sources of Personal Information

We collect personal information from the following sources: directly from individuals, through our Services, service providers, business partners, advertising networks, Internet service providers, operating systems and platforms, social media platforms, public and third-party databases, or other third parties.

12.4 Retention

We retain the personal information we collect only for as long as is reasonably necessary for the purposes described above or as communicated to you. For example, we will retain information as necessary to comply with our tax, accounting and record-keeping obligations, to provide you with the Services, and for an additional period of time as necessary to protect, defend or establish our rights, defend against potential claims and comply with our legal obligations. In some cases, instead of deleting your personal information, we may de-identify or aggregate it and use it in accordance with the CCPA.

12.5 Purposes of Processing Personal Information

As described in more detail in the "Purposes and Legal Basis for the Data We Collect" section, we collect, use and otherwise process the categories of personal data mentioned above to operate and improve our Services, to manage your account, to contract with you, to promote our Services, including through other third-party Services, to communicate with you, to show you personalised advertisements, to conduct surveys and for research and analysis purposes, to develop new features, for security and safety reasons, to prevent fraud, to respond to enquiries and complaints, for other customer service purposes, to comply with legal obligations, for general business operations and for other business administration purposes, including the investigation, prevention or action in connection with illegal activities, suspected fraud and situations involving potential threats to the safety of any person or violations of this privacy policy.

12.6 Sensitive Personal Information

We do not use or disclose sensitive personal information beyond the purposes authorised by the CCPA. Accordingly, we use and disclose sensitive personal information as reasonably necessary (i) to provide the services requested by you, (ii) to help ensure security and integrity, including the prevention, detection and investigation of security incidents, (iii) to detect, prevent and respond to malicious, fraudulent, deceptive or illegal conduct, (iv) to verify or maintain the quality and safety of our services, (v) for compliance with our legal obligations, (vi) to our service providers who provide services on our behalf, and (vii) for purposes other than inferring characteristics about you.

12.7 Rights of California Residents

The CCPA grants California residents certain rights in relation to their personal information. This section describes those rights and how to exercise them. Please note that these rights are subject to certain conditions and exceptions.

• Right to Know/Request Access: Right to know:
  • The categories of personal information we have collected about you;
  • The categories of sources from which we have collected your personal information;
  • The business or commercial purposes for collecting, selling or sharing your personal information;
  • The categories of third parties to whom we have disclosed your personal information; and
  • The specific pieces of your personal information we have collected.
• Right of Deletion: Subject to certain conditions and exceptions, you have the right to request that we delete your personal information.
• Right of Correction: Subject to certain conditions and exceptions, you have the right to request that we correct inaccuracies in your personal information.
• Right to Opt-Out of the Sale and Sharing of Your Personal Information: Although we do not "sell" personal information in the traditional sense (i.e., in exchange for money), our use of third-party analytics and advertising cookies may be considered "selling" and "sharing" under the CCPA.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of the rights described in this section.

12.8 Contact and Exercise of Your Rights

If you reside in California and wish to exercise your rights under the CCPA, you may do so in the following ways:

• By sending us an email to rpd@freepik.com.
• By completing an online request form: https://fp.stock-pik-api.com/profile/support.

When you submit a request, we will take steps to verify your identity and your request by cross-referencing the information you provide with what we have in our records. In some cases, we may request additional information to verify your identity or when necessary to process your request. If we cannot verify your identity after a good faith attempt, we may deny the request and, in such case, we will explain the reasons for the denial. You may also designate someone as an authorised agent to submit requests and act on your behalf. Authorised agents must present proof of their authorisation, and we may also require the relevant consumer to verify the identity and authority of the authorised agent.