Privacy Policy.

Effective date: 18 April 2025

Thank you for visiting direktedigital.com (the “Site”), operated by DirekteDigital (“DirekteDigital,” “we,” “us,” or “our”). We respect your privacy and are committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, disclose and safeguard your information when you visit our Site or use our outcome-based (“Zero Dollar Contract”) AI services for hospitality, healthcare and real-estate clients (collectively, the “Services”).

By accessing the Site or engaging our Services, you agree to the terms of this Policy. If you do not agree, please do not use the Site or provide any personal information.

1. Information We Collect

We do not intentionally collect sensitive personal data (e.g., government IDs, health records) unless required to deliver a contracted Service and processed under a data-processing agreement (DPA) compliant with HIPAA, GDPR Art. 28 or similar laws.

2. How We Use Your Information

We process personal information only where lawful grounds exist (GDPR Art. 6, CCPA §1798.100):

• Contractual necessity – to evaluate, launch and perform Zero Dollar Contracts, calculate outcome metrics, issue gain-share invoices, provide support and notify you of service changes.
• Legitimate interests – to operate, secure and improve our Site, prevent fraud, perform anonymised analytics and develop new AI models.
• Consent – to send marketing communications you opt-in to receive; you may withdraw at any time.
• Legal obligations – to comply with tax, accounting, healthcare or financial-services regulations, respond to lawful requests and enforce agreements.

3. Cookies & Similar Technologies

We use strictly necessary, functionality, analytics and advertising cookies. You can manage cookies via your browser or by using the cookie-consent banner on our Site. Disabling cookies may impair certain Site functions.

4. How We Share Information

We never sell your personal data. We disclose information only:

• Service providers & subprocessors (e.g., cloud hosting, secure file transfer, payment processors, analytics platforms) under confidentiality obligations.
• Vertical partners who help deliver specific business outcomes (e.g., payment networks for revenue-recovery or recruitment-platform APIs) — only with your authorisation and under a DPA.
• Legal & compliance – when required by law or to protect rights, safety or property.
• Business transfers – in connection with a merger, acquisition or asset sale; you will be notified before personal data becomes subject to a different policy.

A current list of subprocessors is available on request.

5. International Data Transfers

We are headquartered in the United States but serve clients globally. Where we transfer data from the EEA/UK/Switzerland or other regions with data-transfer restrictions, we rely on an Adequacy Decision, Standard Contractual Clauses (SCCs) or another lawful mechanism, combined with technical and organizational safeguards (encryption in transit/at rest, role-based access, zero-trust architecture).

6. Data Retention

We retain personal information only as long as necessary to fulfil the purposes outlined in this Policy, meet contractual and legal obligations, resolve disputes and enforce agreements. Business-outcome data is typically stored for 7 years (audit cycle) unless a shorter or longer retention period is required by law or contract. Aggregated or anonymised data may be retained indefinitely.

7. Security

We implement industry-standard safeguards, including ISO 27001-aligned policies, multi-factor authentication, network segmentation, encryption, least-privilege access controls, regular penetration testing and 24 × 7 SIEM monitoring. Despite our efforts, no system can be 100 % secure; you share information at your own risk.

8. Your Privacy Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Erase or anonymise data under certain conditions (“right to be forgotten”).
• Restrict or object to processing.
• Receive a portable copy of your data (data portability).
• Opt out of marketing at any time.
• Non-discrimination for exercising CCPA rights.

To exercise any of these rights, e-mail us at Operations@direktedigital.com with “Privacy Request” in the subject. We will verify your identity and respond within the timeframe required by applicable law.

9. Children's Privacy

Our Site and Services are intended for business professionals. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Third-Party Links

The Site may contain links to third-party websites or tools. We do not control, and are not responsible for, the privacy practices of such third parties. We encourage you to review their privacy statements.

11. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in technology, legal requirements or our practices. We will post the revised version and update the “Effective Date” above. Material changes will be announced via the Site or by e-mail if you have an active contract.

12. Contact Us

If you have questions, concerns or complaints regarding this Privacy Policy or our privacy practices, please contact:

• Data Protection Officer
• DirekteDigital
• E-mail: Operations@direktedigital.com
• Web: https://www.direktedigital.com

You also have the right to lodge a complaint with your local supervisory authority (e.g., the European Data Protection Board, UK ICO or your state Attorney General).

By continuing to use the Site or our Services, you acknowledge that you have read and understood this Privacy Policy.