CrossOver Policies

1. Introduction

This Privacy Policy explains how CheckFirst (FI31436034) ("we", "our", or "us") collects, uses, and protects personal data when you use our crossover.social service ("Service").

We are committed to ensuring that your privacy is protected and that we comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Data We Collect

We collect and process the following personal data:

• Account Information: Your name, email address, and organisation details.
• Usage Data: Information about how you use our Service, including login times, features used, and user preferences.
• Technical Data: IP address, browser type and version, device information, and other technical identifiers.

We do not store passwords in our system. Instead, we use a one-time code authentication system that sends verification codes to your registered email address.

3. How We Use Your Data

We use your personal data for the following purposes:

• To provide and maintain our Service
• To authenticate your access to the Service
• To notify you about changes to our Service
• To provide customer support
• To gather analysis or valuable information so that we can improve our Service
• To monitor the usage of our Service
• To detect, prevent and address technical issues

4. Legal Basis for Processing

We process your personal data on the following legal grounds:

• Contract: Processing is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into a contract.
• Legitimate Interests: Processing is necessary for our legitimate interests, provided these interests do not override your fundamental rights and freedoms.
• Consent: Where applicable, you have given consent to the processing of your personal data for specific purposes.
• Legal Obligation: Processing is necessary for compliance with a legal obligation to which we are subject.

5. Data Storage and Security

All personal data is hosted at OVH Europe. We have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data where appropriate
• Regular testing and evaluation of security measures
• Access controls and authentication procedures
• Regular backups and disaster recovery procedures

6. Data Retention

We will retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your personal data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.

7. Your Data Protection Rights

Under the GDPR, you have the following rights:

• Right to Access: You have the right to request copies of your personal data.
• Right to Rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
• Right to Erasure: You have the right to request that we erase your personal data, under certain conditions.
• Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
• Right to Object to Processing: You have the right to object to our processing of your personal data, under certain conditions.
• Right to Data Portability: You have the right to request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.

To exercise any of these rights, please contact our Data Protection Officer at gdpr@checkfirst.network.

8. Cookies and Tracking

We do not use cookies or similar tracking technologies to track activity on our Service and hold certain information.

9. Third-Party Services

Our Service aggregates publicly available data from third-party platforms such as YouTube, TikTok, X (formerly Twitter), Bluesky, Google, and others. We do not share your personal data with these third parties.

However, when you access content from these platforms through our Service, your interactions may be subject to their respective privacy policies.

1. Overview

CheckFirst recognise that the security of our CrossOver service and the protection of your data are of paramount importance. This Security Policy provides an in‐depth explanation of the robust measures we have implemented to safeguard our systems and ensure the confidentiality, integrity and availability of your information. We continually assess and update our security protocols to respond to emerging threats and to maintain the highest standards of data protection across our service.

Our commitment extends to all aspects of the service, ensuring that every component of our platform is monitored, maintained and enhanced to mitigate risks and to protect our users and their data.

2. Authentication Security

To ensure that only authorised users can access our service, we have implemented a passwordless authentication process. When you attempt to log in, a one‐time code is generated and sent to your verified email address. This code is valid only for a short period, which minimises the risk of unauthorised access. In addition, our systems keep detailed records of every authentication attempt and are configured to automatically restrict access after several unsuccessful attempts. These measures, combined with ongoing monitoring, ensure that our authentication process remains robust and secure.

We continuously review and update our authentication protocols in order to meet the evolving security challenges and to provide a secure user experience.

3. Data Security

Data security is at the heart of our operations. All data is stored on secure servers located in OVH Europe data centres, which are managed in accordance with stringent security standards. Data transmitted between your device and our servers is encrypted using TLS 1.3, ensuring that your information remains confidential during transit. Furthermore, data stored at rest is protected with industry-standard encryption, and access to our databases is tightly controlled and continuously monitored.

These measures work together to protect your data from unauthorised access, modification or disclosure, and we take every precaution to ensure that your information is handled securely.

4. Infrastructure Security

Our infrastructure is designed with comprehensive security measures to provide a resilient and robust service environment. We maintain a secure network architecture that includes advanced firewalls, intrusion detection and prevention systems, and continuous monitoring of all systems and services. Regular maintenance, including the timely application of security patches and updates, is carried out to ensure that our infrastructure remains protected against emerging threats. In addition, we perform routine audits and maintain regular backups to ensure rapid recovery in the event of any disruption.

By adopting a proactive approach, we ensure that our infrastructure remains secure, stable and capable of supporting the high demands of our service.

5. Application Security

We prioritise the security of our application by integrating secure development practices throughout the development lifecycle. Security is built into our processes from the initial design phase through to deployment, with regular code reviews and extensive security testing conducted to identify and rectify vulnerabilities. Our application is engineered to protect against common web threats, utilising measures such as input validation, output encoding and rate limiting. Ongoing monitoring and iterative improvements to our security protocols ensure that our application remains robust against an ever‐changing threat landscape.

These practices help to safeguard the application and ensure that your experience is both secure and reliable.

6. Access Controls

We implement strict access controls to ensure that only authorised personnel have access to our systems and data. Access to our service is granted on the basis of the principle of least privilege, meaning that users receive only the access necessary for their roles. We utilise role‐based access control and regularly review user permissions to ensure compliance with our security standards. Any access granted for maintenance purposes is carefully monitored, and rights are immediately revoked when no longer required.

This rigorous control of access helps prevent unauthorised use and ensures that your data remains secure.

7. Security Incident Response

In the event of a security incident, we are fully prepared to respond promptly and effectively. We maintain a comprehensive incident response plan that outlines the procedures for detecting, assessing, and mitigating any security breach. Our dedicated team is trained to manage incidents swiftly and to conduct thorough investigations as soon as an issue is identified. In line with GDPR requirements, we will notify affected customers without undue delay and work to minimise any potential impact.

Following any incident, a detailed review is undertaken to identify vulnerabilities and to implement additional measures aimed at preventing recurrence.

8. Compliance

Our security practices are designed to comply with relevant regulations and standards, including the General Data Protection Regulation (GDPR) principles. We routinely review our policies and procedures to ensure full compliance with industry and legal requirements. Regular audits are conducted to verify that our systems remain secure and that our security measures are up to date with current regulatory standards.

This commitment to compliance ensures that we maintain a high level of data protection and security across all aspects of our service.

1. Purpose and Scope

This Device Hosting Policy ("Policy") sets forth the terms governing the installation and operation of CheckFirst’s device ("Device") within your network. The Device is designed solely to function as a standard web browser and is not intended to collect personal data, monitor network traffic, or record private communications.

2. Device Operation

The Device is exclusively operated and maintained by CheckFirst. It is configured to access publicly available website content in the same manner as a conventional web browser. Under no circumstances does the Device record data beyond what is necessary for standard browsing functionality.

3. Data Collection and Host Information

For administrative and operational purposes, CheckFirst collects the following host information: your name, address, email, and telephone number. This information is used solely to contact you regarding device status, including notifications if the Device goes offline or requires maintenance.

If you need to take the Device offline or relocate it, you must notify CheckFirst in advance. CheckFirst reserves the right to request the return of the Device at any time, with the return shipping costs covered by CheckFirst.

In the event of a malfunction, CheckFirst may supply a replacement Device at no cost.

Any unauthorized tampering, modification, or interference with the Device is strictly prohibited.

4. Network Performance and Security

CheckFirst warrants that the operation of the Device is configured so as not to adversely affect the performance or security of your network. However, you remain responsible for ensuring that your network infrastructure adequately supports the Device’s operation.

1. Introduction

This Data Retention Policy outlines how CheckFirst (FI31436034) manages, stores and deletes data collected through our crossover.social service ("Service"). This policy should be read in conjunction with our Terms and Conditions and Privacy Policy.

The purpose of this policy is to ensure that:

• We comply with all applicable data protection laws, including the General Data Protection Regulation (GDPR)
• We only retain personal data for as long as necessary
• We protect the rights of individuals whose data we process
• We operate transparently with respect to data management practices

2. Categories of Data and Retention Periods

3. Data Deletion and Anonymisation

4. Data Retention Exceptions

5. Data Subject Rights

As detailed in our Privacy Policy, individuals have various rights regarding their personal data, including:

• The right to request deletion of their personal data
• The right to request restriction of processing
• The right to data portability

Requests to exercise these rights should be directed to our Data Protection Officer at gdpr@checkfirst.network. We will respond to such requests within 30 days.

6. Review and Updates

This Data Retention Policy will be reviewed annually and updated as necessary to reflect changes in our business practices, legal requirements, or technical systems.

Changes to this policy will be communicated to users through our website and, where appropriate, via email notification.

7. Contact Information

If you have any questions about this Data Retention Policy, please contact our Data Protection Officer:

Email: gdpr@checkfirst.network

Mail:
Check First oy - DPO Office
PL 7
00351 HELSINKI
Finland