WHAT ACTIONS DO WE AVOID WHEN HANDLING YOUR DATA?

 

We are dedicated to respecting your privacy and safeguarding your personal data. In line with this commitment, we adhere to principles regarding the handling of your information, as detailed below:

 

No Sale, License, or Rental of Personal Data. We do not sell or rent your personal data for financial gain. Your personal data is only disclosed as outlined in this Privacy Policy.

 

Limited Sharing with Service Providers. We share your personal data exclusively with service providers who assist in delivering and supporting our Service, as described herein. We ensure that no data is shared with external providers or partners without appropriate data protection agreements or contractual terms in place to safeguard your information.

 

Protection of Children’s Data. We do not knowingly collect personal data from children who do not meet the minimum age requirement in their jurisdiction. If you are under the applicable minimum age, as defined in our Terms, you are not permitted to use our Service.

​

​

WHAT ARE OUR RULES FOR STORING YOUR DATA?  

 

We store your personal data only for as long as it is necessary and relevant to achieve the purposes for which it was originally collected. This includes providing our Service, maintaining security, resolving disputes, and complying with legal and regulatory obligations.

 

Retention Periods. When your personal data is no longer required for its original purpose, we will either securely delete or anonymize it so that it can no longer be linked to you. If you deactivate or delete your account, we will retain your personal data for no longer than two (2) months, unless retention is required for legal, regulatory, or contractual obligations. In cases where legal or regulatory requirements necessitate longer retention, we will store only the minimum personal data necessary and ensure it is appropriately protected.

 

Exceptions to Deletion Requests. Even if you request the erasure of your personal data, certain circumstances may require us to retain minimal personal data, including:

 

a) Legal compliance: to adhere to applicable laws, regulations, or law enforcement requests.

b) Dispute resolution: to investigate, defend, or settle legal claims.

c) Contract enforcement: to uphold our agreements and protect our legitimate business interests.

 

Once retention is no longer required for these purposes, we will ensure the final deletion or anonymization of your personal data securely.

​

​

WHAT SECURITY MEASURES DO WE USE?  

 

We take data security seriously and have implemented both organizational and technical safeguards to protect your personal information against unauthorized access, loss, alteration, or misuse.

 

Organizational Security Measures. We enforce strict internal policies and procedures to maintain the security and confidentiality of personal data, including:

​

a) Access Control Policies: Only authorized personnel with a legitimate need can access sensitive data.

b) Login & Password Management: We enforce multi-factor authentication (MFA) and strong password policies.

c) Physical Security: Our premises and data storage facilities are secured through restricted access, surveillance, and security protocols.

 

Technical Security Measures. We deploy reasonable cybersecurity protections to safeguard your personal data, including:

​

a) Encryption & Pseudonymization: Sensitive data is encrypted at rest and in transit to prevent unauthorized access. b) Secure Networks & Firewalls: We use firewalls, intrusion detection systems (IDS), and endpoint protection to prevent cyber threats.

c) Regular Security Audits & Assessments: We conduct penetration testing, vulnerability scanning, and security reviews to proactively identify and mitigate risks.

d) Backups & Disaster Recovery: Our systems include secure backups and failover mechanisms to ensure resilience against data loss or service disruptions.

 

Acknowledgment of Security Limitations. We take commercially reasonable measures to protect your personal data, utilizing security technologies and best practices to guard against unauthorized access, data breaches, and cyber threats. However, no security system is entirely impervious to risks. Ensuring the safety of your information is an ongoing effort that involves continuous monitoring, risk evaluation, and enhancement of security protocols. The presence of a security incident does not automatically imply non-compliance with legal requirements or industry standards.​

​

​

HOW DO WE RESPOND TO SECURITY INCIDENTS?  

 

Immediate Assessment and Containment. In the unlikely event of a personal data breach, we will promptly assess the incident, contain its impact, and evaluate the risks to individuals’ rights and freedoms. Our breach response may involve actions such as logging affected users out, resetting passwords, and enhancing security protocols to mitigate potential harm. By maintaining strong personal security practices and promptly reporting any concerns, you can help us protect your information effectively.

 

Regulatory Reporting Obligations. If the breach is likely to result in a high risk, we will notify affected individuals without undue delay, providing details of the breach, mitigation steps, and recommended protective actions. When required, we will report the breach to the relevant supervisory authority - such as the Information Commissioner’s Office (ICO) for the UK or the appropriate EU authority - within 72 hours of becoming aware. All breaches will be documented, and measures will be implemented to prevent recurrence.

 

To report a personal data breach or seek assistance, please contact us via https://account.dance-bit.com/contact-form or dpo@gismart.com. We will address your concerns accordingly.\

​

​

WHAT ARE YOUR RIGHTS OVER YOUR DATA?  

​​

As a resident of the European Union (EU), European Economic Area (EEA), or the United Kingdom (UK), you are entitled to certain rights regarding your personal data under the General Data Protection Regulation (GDPR) and the UK GDPR. Below is a summary of your key rights and how you can exercise them:

 

Right to Access Your Data. You have the right to request access to the personal data we hold about you. Upon request, we will provide a copy of your personal data along with details about how it is processed, shared, and stored.

 

Right to Rectification. If your personal data is inaccurate, incomplete, or outdated, you have the right to request corrections or updates to ensure it is accurate and complete.

 

Right to Erasure (‘Right to be Forgotten’). You can request the deletion of your personal data where:

 

a) the data is no longer necessary for the purposes for which it was collected;

b) you withdraw consent and there is no other legal basis for processing;

c) you object to processing and there are no overriding legitimate grounds;

d) your data was unlawfully processed; or

e) deletion is required to comply with a legal obligation.

 

Your right to erasure may not apply where processing is necessary for legal compliance, public interest, or the establishment, exercise, or defense of legal claims.

 

Right to Restrict Processing. You may request that we restrict the processing of your personal data if:

 

a) you contest its accuracy (while we verify the accuracy);

b) processing is unlawful, and you prefer restriction over deletion

c) we no longer need the data, but you require it for legal claims; or

d) you object to processing, pending verification of our legitimate interests.

 

Right to Data Portability. You have the right to receive your personal data in a structured, commonly used, and machine-readable format and, where feasible, request the direct transfer of this personal data to another service provider.

 

Right to Object to Processing. You have the right to object to the processing of your personal data where:

 

a) processing is based on legitimate interests or public interest unless we demonstrate compelling legitimate grounds that override your interests.

b) your data is used for direct marketing purposes, in which case we will immediately stop processing for this purpose.

 

Right to Withdraw Consent. If we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing conducted before consent was withdrawn.

 

Right to Lodge a Complaint. If you believe your privacy rights have been violated, you have the right to file a complaint with your local data protection authority (DPA).

 

a) EU Residents: You can find your relevant supervisory authority here.

b) UK Residents: You can lodge a complaint with the UK’s Information Commissioner’s Office (ICO) here.

 

To exercise your rights, please contact us via https://account.dance-bit.com/contact-form or write to us at the address set forth above.

 

If you reside outside the European Union (EU), European Economic Area (EEA), or the United Kingdom (UK), you may have specific privacy rights under your country’s applicable data protection laws. Below is a summary of key rights based on various jurisdictions:

 

United States – State-Specific Privacy Rights

 

If you are a resident of California, Virginia, Colorado, Connecticut, or other U.S. states with privacy laws, you may have certain rights under laws such as the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), and others.

 

If applicable, you have the right to:

a) Access Your Data: Request details about the categories and specific pieces of personal data we collect, use, disclose, or sell.

b) Request Deletion: Ask us to delete your data, subject to legal exceptions.

c) Opt-Out of Sale or Sharing of Data: If applicable, opt out of the sale or sharing of your data for targeted advertising or analytics purposes.

d) Correct Your Data: Request correction of inaccurate personal information we maintain.

e) Limit Use of Sensitive Data: If applicable, restrict the processing of sensitive personal information.

f) Non-Discrimination: You will not be discriminated against for exercising your privacy rights.

 

If you are a California resident, you may also use an authorized agent to submit requests on your behalf.

 

Canada – Personal Information Protection and Electronic Documents Act (PIPEDA)

 

If you are a resident of Canada, you have the following rights under PIPEDA:

 

a) Right to Access and Portability: Request a copy of the data we hold about you.

b) Right to Correction: Request modifications to any inaccurate or incomplete personal information.

c) Right to Withdraw Consent: If we process your data based on consent, you can withdraw it at any time.

d) Right to Challenge Compliance: You can challenge our privacy practices with Canada’s Office of the Privacy Commissioner (OPC).

 

Brazil – Lei Geral de Proteção de Dados (LGPD)

 

If you are a resident of Brazil, you are entitled to rights under the LGPD, including:

​

a) Right to Confirm Processing: Request confirmation on whether we process your data.

b) Right to Access and Correction: Request access to or corrections of your data.

c) Right to Anonymization or Blocking: Request anonymization, blocking, or deletion of unnecessary or excessive data.

d) Right to Data Portability: Receive your data in a structured format or transfer it to another provider.

e) Right to Withdraw Consent: Revoke your consent for data processing at any time. For privacy concerns, you may contact the Brazilian Data Protection Authority (ANPD) at ANPD website.

 

Australia – Privacy Act 1988 & Australian Privacy Principles (APPs)

 

If you are a resident of Australia, you have rights under the Privacy Act 1988, including:

 

a) Right to Know: Request information about how we collect, use, and disclose your data.

b) Right to Access and Correction: Request copies of your data and corrections if inaccurate.

c) Right to Restrict Processing: Limit how we use your personal data.

 

Japan – Act on the Protection of Personal Information (APPI)

 

If you are located in Japan, your rights under the APPI include:

 

a) Right to Notification of Purpose of Use: Request details on how and why your personal data is being used.

b) Right to Access: Request disclosure of your personal data held by us.

c) Right to Correction or Deletion: Request correction, addition, or deletion of data that is inaccurate or outdated.

d) Right to Suspension of Use or Erasure: Request us to stop using or delete your data if we are using it in violation of the APPI.

e) Right to Object to Third-Party Transfer: Object to the sharing of your personal data with third parties without your consent.

 

We will respond to requests within a reasonable timeframe, as required by Japanese law.

 

Mexico – Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP)

 

If you reside in Mexico, you are granted rights under the LFPDPPP, commonly known as ARCO rights:

 

a) Access: Know what personal data we hold about you and how we use it.

b) Rectification: Request corrections to inaccurate or incomplete data.

c) Cancellation: Request deletion of your data when it is no longer necessary or used without your consent.

d) Objection: Object to the processing of your data for specific purposes, such as marketing.

 

You also have the right to revoke consent for the use of your personal data, subject to certain exceptions. To exercise your rights, you may contact our privacy team using the details in the “Contact Us” section.

​

​

HOW CAN YOU MANAGE YOUR DATA?

​​

We provide you with the ability to access, update, and delete your personal data in accordance with applicable privacy laws.

 

Accessing, Correcting, or Updating Your Data. You can review, modify, or update your personal data at any time by contacting us via our support form: https://account.dance-bit.com/contact-form

 

Deleting Your Data. If you wish to delete your personal data, you may do so using the following methods:

 

Option 1: Submit a request via our support form at: https://account.dance-bit.com/contact-form

Please include a brief description of your request.

 

Option 2: Delete Your Account via the App

 

Android Users:

Open Profile → Settings.

Select Manage Account Details.

Press Delete Account and confirm on the popup.

 

Contact our support team via https://account.dance-bit.com/contact-form for final confirmation.

 

iOS Users:

Open Profile → Select Profile Details.

Press Delete Account and confirm on the popup.

​

If you purchased a subscription via the App Store or Google Play, your account will be deleted automatically with no further action required.

 

If you purchased a subscription on our website, you must send a request to our support team via our contact form at: https://account.dance-bit.com/contact-form.

 

Important Considerations for Account Deletion. If you delete your Account, you will lose access to all associated subscriptions, progress, and Content (including User-Generated Content) in the App. Once your Account is deleted, we may not be able to restore any lost data. If you purchased a subscription via our website, deleting your Account means you will no longer have access to your subscription.

 

For any further assistance, please contact our support team via https://account.dance-bit.com/contactform.

​

​

HOW WE PROCESS YOUR REQUESTS?  

 

If you submit a request to exercise your data protection rights, we will process it as follows:

 

Response Timeframe. We aim to respond to valid requests within 30 days from the date of receipt. If your request is complex, or we receive a high volume of requests, we may require additional time. In such cases, we will inform you of the extension and provide a revised timeline for our response.

 

Right to Decline Requests. We reserve the right to decline requests that are manifestly unfounded, excessive, or repetitive under applicable privacy laws. If your request falls into this category, we will notify you of our decision and provide reasons where required by law.

 

Identity Verification. To protect your privacy and prevent unauthorized access, we may request additional information to verify your identity before processing your request. This step is necessary to ensure:

 

a) the requestor is entitled to access or modify the personal data;

b) the rights and privacy of third parties are not compromised.

 

If we are unable to reasonably verify your identity, we may be unable to fulfill your request. We will inform you of this and provide guidance on any alternative steps you may take.

​

​

PRIVACY NOTICE FOR CALIFORNIA RESIDENTS, US    

 

General Details. Residents of certain U.S. states, such as California, may have additional rights regarding their personal information under applicable state laws. These include the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), among other state privacy laws. Where specific legal provisions in this notice do not apply, the Privacy Policy shall govern the processing and handling of personal information.

 

Exercising Your Rights. Only you or an authorized representative legally permitted to act on your behalf may submit a request related to your personal information. Please refer to the previous section for details on the rights available to you and how to exercise them. In addition to those rights, this section provides further information about the processing, collection, and disclosure of personal information under U.S. State Privacy Laws.

 

Definition of Personal Information. Personal Information refers to any information that identifies, relates to, describes, or can reasonably be linked to you as an individual.

 

Pursuant to the CCPA, the term “personal information” excludes:

 

• information that is publicly available through official government sources;

• consumer data that has been de-identified, anonymized, or aggregated in a manner that prevents re-identification

 

Data Controller Responsibilities. Gismart Limited is responsible for determining how your personal information is collected, used, disclosed, and shared in accordance with applicable US privacy laws, including the CCPA and other state-level privacy regulations.

 

No Sale of Personal Information. We do not sell your personal information in exchange for money, nor are we in the business of trading or monetizing user information. However, like many online businesses, we collaborate with advertising and analytics partners to deliver relevant ads across different platforms.

 

How This May Be Considered “Selling” or “Sharing” Under the CCPA? Under the CCPA, the sharing of personal information for targeted advertising or cross-context behavioral advertising may be classified as "selling" or "sharing", even if no money is exchanged. This means that certain activities, such as allowing advertising networks to collect identifiers or browsing behavior to show you personalized ads, could be considered data sharing under California law.

 

Your Right to Opt-Out of Targeted Advertising and Data Sharing. Even though we do not sell your personal information for direct monetary gain, you still have the right to opt out of any sharing of your personal information with our advertising and analytics partners. This includes targeted advertising, personalized marketing, behavioral tracking and analytics-based audience insights.

 

You can exercise this right by:

 

• Submitting an opt-out request via https://account.dance-bit.com/contact-form.

• Adjusting your cookie and tracking preferences through our website’s settings.

• Configuring your browser or device settings to restrict online tracking.

 

Please note that under California’s "Shine the Light" law (California Civil Code § 1798.83), residents of California may request information about the disclosure of their personal information to third parties for direct marketing purposes. If applicable, you may submit such a request by contacting us.

 

Do Not Track. The "Do Not Track" (DNT) feature is a privacy preference that some web browsers offer, allowing users to indicate their preference not to be tracked by websites or online services. However, at this time, there is no universally accepted standard for implementing DNT signals, and not all browsers support this feature. Consequently, we do not currently respond to DNT signals.

 

Request for Access: you have the right to ask for access to (i) the personal and sensitive information we have about you and how we use it; and (ii) the categories, sources, and third parties that have received your personal information or to whom it has been "sold" or disclosed in the past 12 months. You can make this request once a year at no cost. Please ensure the subject line reads "California Privacy Rights Request," and include relevant details such as your name, street address, city, state, and zip code. Once we validate your request, we will provide the requested disclosure within 30 days of receipt, unless an extension is necessary. If we require additional time due to the complexity of the request or the high volume of requests, we may extend the response period by an additional 30 days. In such cases, we will notify you within the initial 30-day period, explaining the reason for the extension and the expected response timeline.

 

Under the CCPA, privacy rights extend beyond users to all individuals, including job applicants, employees, independent contractors, and business partners who are California residents. These individuals may request information about our information collection practices regarding their personal information and may also exercise rights to access, delete, correct, or opt out of certain information sharing as permitted under California law. To make a request, please follow the instructions outlined in this Privacy Policy.

 

Categories of Personal Information Collected & Disclosed. We collect the following categories of personal information in connection with the Service. The table below outlines:

 

a) the specific categories of personal information we collect;

b) the business purposes for which this information is collected and disclosed;

c) the categories of service providers to whom we have disclosed this personal information in the past 12 months.

​