Privacy policy
If you live in Russia, our personal data policy under Federal Law No. 152-FZ (in Russian) applies to you.
1. Who processes your data
The data controller is LLC XP Digital Solutions, Kyrgyz Republic, registration number 330289-3301-ООО.
For any question about your data, email hello@dubseat.com. We have not appointed a data protection officer (DPO).
2. What data we collect
When you join the waitlist, we receive:
- your email address;
- the city you entered;
- the language of the page you signed up on, and the date.
The site doesn’t use advertising cookies, analytics or tracking pixels. The server hosting the site automatically keeps technical logs: IP address, browser type and request time. Logs aren’t kept indefinitely; new entries gradually overwrite old ones.
3. Why we process it and on what legal basis
| To send your app invite and important Dubseat news | Your consent, Art. 6(1)(a) GDPR. You give it when you click “Get my invite”. |
|---|---|
| To decide which cities get access first | Your consent, Art. 6(1)(a) GDPR. For this we only look at the number of sign-ups per city. |
| To protect the site from attacks and outages (technical logs) | Our legitimate interest in keeping the site secure, Art. 6(1)(f) GDPR. |
Giving us your data is optional, but without an email address we can’t send your invite. We don’t make automated decisions about you or build user profiles.
4. How long we keep it
We keep your email and city until you unsubscribe or withdraw consent, and then delete them within 30 days. If we close the waitlist, we delete all sign-ups within the same period.
Encrypted server backups may still hold the data for up to 6 months, after which they are deleted automatically. We only restore from them after a failure.
5. Who we share it with
We don’t sell your data or share it for advertising. Only the services that help us run Dubseat have access, and only under a data processing agreement:
- Fornex Hosting S.L. (Spain): the server that runs the site and the form, and backup storage. The data is stored in a data centre in the EU;
- Migadu (Switzerland): email for hello@dubseat.com, which we use to reply to you;
- Web3Forms: the form service. It receives your sign-up from the site and forwards it to hello@dubseat.com. It runs on Amazon Web Services infrastructure and processes data under its own privacy policy;
- hCaptcha (Intuition Machines, Inc., USA): protects the form from spam. During the check it receives technical data about your browser and your IP address and processes them under its own privacy policy. Legal basis: our legitimate interest in protecting the form, Art. 6(1)(f) GDPR.
We may disclose data to public authorities where the law requires it.
6. Transfers outside the EU and EEA
If a service listed in section 5 stores data outside the EU and EEA, we only transfer it to a country covered by a European Commission adequacy decision, or under the European Commission’s standard contractual clauses (Arts 45–46 GDPR). Switzerland, where our email provider operates, has an adequacy decision. You can request a copy of the safeguards at hello@dubseat.com.
7. Your rights
At any time, you can:
- find out what data we hold about you and get a copy;
- correct inaccurate data;
- ask us to delete your data;
- restrict or object to processing;
- receive your data in a machine-readable format and move it to another service;
- withdraw your consent. This doesn’t affect processing that took place before you withdrew it. You can unsubscribe through the link in any email or by writing to us.
To exercise any of these rights, email hello@dubseat.com. We’ll reply within one month.
You can also complain to a data protection authority: in the EU country where you live or work, or where the infringement took place. In the UK, that’s the Information Commissioner’s Office (ICO); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik).
8. Users in other countries
We give the same rights to all users, wherever they live. For residents of California and other US states: we don’t sell personal data or share it for targeted advertising.
9. Children
The site isn’t intended for children under 16. If you learn that a child has given us their data, let us know and we’ll delete it.
10. Security
The site uses an encrypted connection (HTTPS), and backups are encrypted. The Dubseat team can access sign-ups. Our hosting provider can also access them technically, under its contract.
11. Changes
If we change this policy, we’ll update it on this page along with the date at the top. We’ll email you about any significant changes.