Privacy Policy

Data Controller

The entity responsible for your personal data (the "Data Controller") under the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA/CPRA) is:

CC Global Nexus Inc.

Operating as: PR Portal

Website: https://prportal.io

Data Protection Contact

For all privacy enquiries, data subject requests, and privacy-related communications, please contact our designated Data Protection Contact:

Email: privacy@prportal.io

General support enquiries may also be directed to info@prportal.io.

EU and UK Article 27 Representative

PR Portal targets users in the European Union and the United Kingdom. In accordance with Article 27 of the GDPR, PR Portal has appointed (or is in the process of appointing) an EU representative in an EU Member State and a UK representative in the United Kingdom to act as a point of contact for data protection authorities and data subjects in those jurisdictions. The contact details of the appointed representative will be published here upon appointment. Until then, all privacy enquiries should be directed to privacy@prportal.io.

We collect the following categories of personal information. The table below is provided in the format required by CCPA/CPRA and aligns with GDPR Article 13 transparency requirements.

Sensitive Personal Information (CPRA)

Under CPRA, "Sensitive Personal Information" includes categories such as government ID numbers, precise geolocation, racial or ethnic origin, religious beliefs, health data, biometric data, and financial account credentials. PR Portal does not knowingly collect Sensitive Personal Information beyond the financial account information described above (card type and last four digits, which are not stored on our servers). If you submit content that contains Sensitive Personal Information, it will be processed in accordance with this Policy.

We process your personal information only for specified, explicit, and legitimate purposes, in accordance with GDPR Article 6. The table below maps each processing purpose to its lawful basis.

Where we rely on legitimate interests as the lawful basis for processing (analytics, fraud prevention, and platform improvement), we have conducted a balancing test to ensure your rights and interests are not overridden. Our assessment is summarised below:

Purpose: Platform analytics

• Interest: Understanding how users interact with the Platform to improve usability, performance, and content relevance.
• Necessity: Analytics data is necessary to identify bugs, measure feature adoption, and prioritise improvements. No less intrusive alternative achieves this.
• Impact on data subjects: Low — analytics data is aggregated and pseudonymised where possible. Individual users are not identifiable from analytics reports.
• Safeguards: IP anonymisation, data minimisation, short retention periods, and opt-out via browser cookie controls.
• Balance: The benefit to users (a better Platform) and to PR Portal (business improvement) is not overridden by the limited impact on privacy, given the safeguards in place.

Purpose: Fraud prevention and security

• Interest: Protecting the Platform, its users, and PR Portal from fraudulent activity, abuse, and security threats.
• Necessity: Monitoring IP addresses, device information, and usage patterns is necessary to detect and prevent fraud. There is no less intrusive method that provides equivalent protection.
• Impact on data subjects: Minimal — security monitoring data is used only for threat detection and is not used for marketing or profiling.
• Balance: The vital interest of protecting users and the Platform from fraud and abuse overrides the minimal privacy impact of security monitoring.

You have the right to object to processing based on legitimate interests. See Section 11 for instructions on exercising this right.

PR Portal provides AI-assisted content generation tools (including the "Jade AI" writing assistant) to help users draft articles and press releases.

AI Service Providers

We use the following AI service providers to process content you submit to the AI tools:

• OpenAI — processes text submitted to the AI writing assistant for content generation
• Google (Gemini) — processes text for content generation and web-search-augmented responses

Training Data

Content you submit to the AI tools is processed for the sole purpose of generating your requested output. Our AI service providers may temporarily retain inputs as necessary to provide the service and to monitor for safety and abuse. We have configured our integrations to opt out of using submitted content for model training where the provider offers this option. We cannot guarantee that a provider will not use submitted content for training if their default terms permit it — you should review the provider's terms if this is a concern for your organisation. For enterprise and agency clients with specific training-opt-out requirements, please contact privacy@prportal.io.

Lawful Basis

Processing of content through AI tools is based on your consent (GDPR Art. 6(1)(a)) and the performance of a contract (Art. 6(1)(b)) — you provide content voluntarily to use the AI features, and processing is necessary to deliver the requested output.

International Transfers

AI processing may involve transfers to the United States. See Section 8 for the transfer mechanisms we rely on.

Your Responsibility

Users remain responsible for reviewing, editing, and verifying all AI-generated content before submission for publication. PR Portal makes no guarantee regarding the accuracy, originality, or reliability of AI-generated content.

PR Portal uses cookies and similar tracking technologies. A detailed description of each cookie category, its purpose, and retention period is provided in our Cookie Policy.

Cookie Categories

• Strictly necessary: Required for the Platform to function (e.g., session authentication, security). These cannot be disabled.
• Functional: Remember your preferences (e.g., language, currency). These are optional.
• Analytics: Help us understand how visitors use the Platform (e.g., Google Analytics). These are optional and can be disabled.
• Marketing: Used to deliver relevant content and advertisements across the web. These are optional and require consent where required by law.

You can manage cookie preferences through your browser settings or our cookie consent tool. Some Platform features may not function if cookies are disabled.

Under CCPA/CPRA, cookies that involve "sharing" personal information for cross-context behavioural advertising may trigger "sharing" rights. See Section 12 for your "Do Not Sell or Share" rights.

PR Portal shares personal information with third parties only for the purposes described in this Policy. We categorise our recipients as follows:

Media Partners and Publications

User-submitted content (articles, press releases, images) may be shared with editors, journalists, contributors, and media publications for the purpose of evaluating or publishing submitted content. These recipients are independent controllers of the content they receive.

Named Sub-Processors

The following sub-processors process personal information on our behalf. We have entered into data processing agreements (DPAs) with each sub-processor, incorporating Standard Contractual Clauses where international transfers are involved.

Change Notification

We will update this sub-processor list whenever a new sub-processor is engaged. We will provide at least 30 days' notice of new sub-processors by updating this page. You may object to a new sub-processor by contacting privacy@prportal.io within the notice period.

Legal Disclosures

We may disclose personal information if required to comply with legal obligations, respond to lawful requests from public authorities, protect our rights, or prevent fraud or abuse.

PR Portal is operated from the United States. If you access the Platform from the European Union, the United Kingdom, or another jurisdiction with data protection laws that differ from those in the United States, your personal information will be transferred to and processed in the United States.

Transfer Mechanisms

To ensure an adequate level of protection for personal data transferred outside the EU/UK, we rely on the following transfer mechanisms:

• EU-US Data Privacy Framework (DPF) — Where a sub-processor is self-certified under the EU-US Data Privacy Framework, we rely on that certification for the transfer.
• Standard Contractual Clauses (SCCs) — For transfers to sub-processors not covered by the DPF, we have executed the European Commission's Standard Contractual Clauses (Modules 2 and 3, as applicable) with each sub-processor. These are binding contractual commitments that provide safeguards for personal data transferred outside the EU/UK.
• UK International Data Transfer Addendum — For transfers from the United Kingdom, we rely on the UK Addendum to the SCCs.

Transfer Impact Assessment

We have conducted a Transfer Impact Assessment (TIA) for transfers to the United States, considering the legal landscape following the EU-US Data Privacy Framework. Where supplementary measures are necessary (e.g., encryption, pseudonymisation), we have implemented them. A summary of our TIA is available on request to privacy@prportal.io.

We retain personal information only for as long as necessary to fulfil the purposes described in this Policy, unless a longer retention period is required by law. Specific retention periods are set out below and in our Data Retention Policy, which is incorporated by reference. Where this Policy and the Data Retention Policy address the same data category, the specific periods in the Data Retention Policy apply.

When the retention period expires, we will either delete the data or anonymise it so it can no longer be linked to you.

PR Portal implements reasonable technical and organisational security measures to protect personal information, including:

• Encryption in transit (TLS/HTTPS) for all data transmitted between your browser and our servers
• Encryption at rest for stored data
• Role-based access controls — personal data is accessible only to authorised personnel with a legitimate need
• Multi-factor authentication for administrative access
• Continuous monitoring for suspicious activity and security threats
• Regular security reviews and vulnerability assessments
• Cloudflare Web Application Firewall (WAF) and DDoS protection

Despite these measures, no online system can guarantee absolute security. In the event of a personal data breach affecting your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to your rights and freedoms.

If you are located in the European Union or the United Kingdom, you have the following rights under the GDPR and UK GDPR:

• Right of access (Art. 15): You may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): You may request correction of inaccurate or incomplete personal data.
• Right to erasure (Art. 17): You may request deletion of your personal data, subject to legal retention obligations.
• Right to restriction of processing (Art. 18): You may request that we limit processing of your data in certain circumstances.
• Right to data portability (Art. 20): You may receive your personal data in a structured, machine-readable format and transmit it to another controller.
• Right to object (Art. 21): You may object to processing based on legitimate interests or for direct marketing. We will stop processing unless we can demonstrate compelling legitimate grounds.
• Right to withdraw consent (Art. 7(3)): Where processing is based on your consent (e.g., AI processing, marketing), you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint with a supervisory authority (Art. 77): You may lodge a complaint with the supervisory authority in your EU Member State or with the UK Information Commissioner's Office (ICO). We encourage you to contact us first, but you are not required to do so.

Automated Decision-Making and Profiling (Art. 22)

PR Portal uses AI-assisted tools for content generation (see Section 5). These tools assist users in drafting content but do not make automated decisions that produce legal or similarly significant effects on individuals. We do not engage in automated profiling that produces such effects. Where AI is used, a human (the user) reviews and edits the output before submission.

Response Timeline

We will respond to your data subject request within one month of receipt. Where requests are complex or numerous, we may extend this period by up to two further months, in which case we will inform you of the extension and the reasons within the first month.

Identity Verification

To protect your personal data, we will verify your identity before responding to a data subject request. Verification may include confirming the email address associated with your account or requesting additional information. Where requests are made by an authorised agent, we will verify the agent's authority to act on your behalf.

How to Submit a Request

To exercise any of the above rights, please contact us at privacy@prportal.io or through your Account Settings page.

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purpose for collecting, and the categories of third parties to whom we disclose.
• Right to delete: You may request deletion of personal information we have collected from you, subject to legal exceptions.
• Right to correct: You may request correction of inaccurate personal information.
• Right to opt-out of sale or sharing: You have the right to opt out of the "sale" or "sharing" of your personal information. PR Portal does not sell personal information to third parties. For information on "sharing" for cross-context behavioural advertising, see below.
• Right to limit use of Sensitive Personal Information: You may request that we limit the use of your Sensitive Personal Information to what is necessary to perform the services or provide the goods reasonably expected. See Section 2 for the categories of Sensitive Personal Information we may collect.
• Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights.

Do Not Sell or Share My Personal Information

PR Portal does not sell personal information to third parties for monetary or other valuable consideration. Regarding "sharing" (as defined under CPRA) for cross-context behavioural advertising: we use analytics cookies that may involve the disclosure of personal information to advertising networks for the purpose of cross-context behavioural advertising. If you wish to opt out of such sharing, you may do so by:

• Clicking the "Do Not Sell or Share My Personal Information" link in the website footer
• Enabling the Global Privacy Control (GPC) signal in your browser — we honour GPC signals and will treat them as an opt-out request
• Contacting privacy@prportal.io

If we determine after review that no sharing for cross-context behavioural advertising occurs, we will update this section to state that definitively and remove the opt-out link.

Authorized Agent

You may designate an authorised agent to submit requests on your behalf. To protect your personal information, we require written authorisation signed by you (under penalty of perjury) before processing a request from an agent. The agent must also provide their own identity verification.

Response Timeline

We will acknowledge your request within 10 business days of receipt. We will respond to your request within 45 days. If we require an extension (up to an additional 45 days), we will inform you of the extension and the reasons within the initial 45-day period.

12-Month Lookback

When you request disclosure of personal information collected, the response will cover the 12-month period preceding your request.

This Privacy Policy serves as the notice at collection required under CCPA/CPRA. At or before the point of collection, we provide notice of:

• The categories of personal information to be collected (see Section 2)
• The business or commercial purpose for collecting each category (see Section 3)
• The categories of third parties to whom the information may be disclosed (see Section 7)
• The retention period for each category (see Section 9)

This notice is provided at the point of account registration, checkout, and content submission.

PR Portal services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children under 18.

If we become aware that personal data from a minor has been collected, we will take steps to delete such information promptly. If you believe we have collected information from a minor, please contact privacy@prportal.io.

The Platform may contain links to third-party websites, including media publications and partner platforms. PR Portal is not responsible for the privacy practices of these external websites.

Users should review the privacy policies of third-party sites separately. Our privacy commitments apply only to personal information collected by PR Portal directly.

PR Portal may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or operational needs.

Material changes will be posted on this page with a revised "Last Updated" date. Where required by law, we will provide direct notice of material changes. Continued use of the Platform after updates constitutes acceptance of the revised Privacy Policy.

If you have questions regarding this Privacy Policy, wish to exercise your privacy rights, or have a complaint about our data practices, please contact our Data Protection Contact:

CC Global Nexus Inc. (PR Portal)

Email: privacy@prportal.io

Website: https://prportal.io

You may also submit data subject requests through your Account Settings page, or by email. We will verify your identity before processing any request that involves accessing, correcting, or deleting your personal data.

For general support enquiries (not related to privacy), please contact info@prportal.io.