GDPR Compliance

1. Data Controller

WatchPartyLive, Inc. (548 Market St, Suite 22000, San Francisco, CA 94104, USA) is the data controller for personal data processed through the Service. Our Data Protection Officer can be reached at dpo@watchpartylive.com.

2. Legal Bases for Processing

We process your personal data under the following legal bases:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide the service you signed up for (creating your account, delivering watch party features).
• Legitimate Interests (Art. 6(1)(f)): Analytics to improve the product, security monitoring, fraud prevention.
• Consent (Art. 6(1)(a)): Marketing emails — you can withdraw consent any time.
• Legal Obligation (Art. 6(1)(c)): Compliance with applicable laws.

3. Your GDPR Rights

Under GDPR, you have the following rights, which you can exercise by contacting privacy@watchpartylive.com:

• Right of Access (Art. 15) — Request a copy of all personal data we hold about you.
• Right to Rectification (Art. 16) — Correct any inaccurate or incomplete data.
• Right to Erasure (Art. 17) — Request deletion of your personal data ("right to be forgotten").
• Right to Restriction (Art. 18) — Request we limit processing of your data.
• Right to Data Portability (Art. 20) — Receive your data in machine-readable format.
• Right to Object (Art. 21) — Object to processing based on legitimate interests.
• Right to Withdraw Consent (Art. 7.3) — Withdraw consent for consent-based processing at any time.

We will respond to all GDPR requests within 30 days. You have the right to lodge a complaint with your national data protection authority if dissatisfied with our response.

4. International Data Transfers

WatchPartyLive is based in the United States. When we transfer data from the EEA/UK to the US, we use Standard Contractual Clauses (SCCs) approved by the European Commission to ensure adequate protection. A copy of our SCCs is available upon request from dpo@watchpartylive.com.

5. Data Processing Agreements

If you use WatchPartyLive for business purposes and process personal data of EU residents, a Data Processing Agreement (DPA) may be required under GDPR Art. 28. Request one at dpo@watchpartylive.com.

All our sub-processors are listed in our Sub-Processor Policy, available on request. We will notify you of any new sub-processors with at least 30 days notice.