COPPA Compliance Statement

This COPPA Compliance Statement ("Statement") is issued by Tanqory Inc. (Delaware, USA) on behalf of itself and its affiliate Tanqory OÜ (Estonia) (together, "Tanqory" or the "Company"). The Statement describes the Company's position with respect to the United States Children's Online Privacy Protection Act of 1998 ("COPPA"), 15 U.S.C. §§6501–6506, and the Federal Trade Commission's implementing rule, 16 C.F.R. Part 312 (the "COPPA Rule").

1) Purpose

1.1 The purpose of this Statement is to (i) describe the nature of the Tanqory service and explain why Tanqory's first-party processing is not directed to children under 13; (ii) state Tanqory's position with respect to the collection of personal information from children under 13 in its own processing; (iii) describe the COPPA-related expectations that apply to merchants who use the Tanqory platform to operate consumer-facing experiences; (iv) describe the procedure by which Tanqory responds if it becomes aware of inadvertent collection of personal information from a child under 13; (v) describe how this Statement coordinates with other child-protection regimes in the EU, UK, California, and Quebec; and (vi) provide contact information for COPPA-related inquiries.

2) Scope

2.1 Tanqory operates a business-to-business ("B2B") commerce platform. Tanqory's direct customers are merchants — businesses that use Tanqory to operate online stores, manage products and orders, communicate with end-users, and integrate with third-party services. Tanqory's marketing and the design of its services are addressed to businesses, not to children.

2.2 Tanqory's services are not directed to children under 13. Tanqory does not, in its own first-party capacity, knowingly create general-audience or child-directed properties for consumer end-users under 13.

2.3 Notwithstanding paragraph 2.2, merchant storefronts and other consumer-facing properties operated by Tanqory's merchants on the Tanqory platform may interact with consumer end-users, some of whom may be under 13. Where a merchant operates a storefront or other property that is directed to children under 13, or where the merchant has actual knowledge that it is collecting personal information from children under 13, the merchant has independent COPPA obligations as the operator of that property; see Section 5.

2.4 This Statement applies to Tanqory's first-party processing under the Tanqory Privacy Policy. It is not, and is not represented as, a privacy notice for any merchant storefront. Merchants are responsible for their own privacy notices and consents on their consumer-facing properties.

3) Tanqory's position on COPPA

3.1 No knowing first-party collection from children under 13. Tanqory does not knowingly collect personal information from children under 13 in its own first-party processing. The Tanqory platform is designed and marketed to merchants and developers, and account registration, the merchant dashboard, the developer program, and the Tanqory consumer-facing tanqory.com properties are not directed to children under 13.

3.2 Independent controller relationships. Where personal information is collected on a merchant storefront through use of the Tanqory platform, the merchant is the controller (under GDPR terminology) or the "operator" (under COPPA terminology) of that personal information with respect to its own consumers, including any consumer who is a child under 13. Tanqory acts in the role of a processor or service provider on behalf of the merchant in respect of personal information collected through the merchant's storefront. Tanqory's role is reflected in the Data Processing Addendum and the Merchant Agreement.

3.3 No COPPA Safe Harbor participation. Tanqory is not currently a participant in an FTC-approved COPPA Safe Harbor program.

4) COPPA expectations for merchants

4.1 If a merchant operates a website, online service, or mobile application that is directed to children under 13, or if the merchant has actual knowledge that it is collecting personal information from a child under 13, the merchant is an "operator" within the meaning of the COPPA Rule and bears the obligations of an operator under COPPA. Those obligations include, without limitation:

4.1.1 Posting a clear and comprehensive online notice of the merchant's information practices with regard to children, in accordance with 16 C.F.R. §312.4;

4.1.2 Providing direct notice to parents prior to collection of personal information from a child;

4.1.3 Obtaining verifiable parental consent prior to any collection, use, or disclosure of personal information from a child, in accordance with 16 C.F.R. §312.5, except where an exception to prior verifiable parental consent applies;

4.1.4 Providing parents with the right to review, delete, and refuse further collection or use of the child's personal information;

4.1.5 Maintaining the confidentiality, security, and integrity of personal information collected from children; and

4.1.6 Retaining personal information collected from a child only as long as reasonably necessary to fulfill the purpose for which it was collected, and then deleting it using reasonable measures.

4.2 Merchants that operate properties directed to children under 13 should consider engaging counsel familiar with COPPA, conducting a COPPA-specific privacy assessment, and (where appropriate) participating in a Safe Harbor program.

4.3 The Tanqory Acceptable Use Policy and the Merchant Agreement (collectively, the "Tanqory Contracts") require merchants to comply with all applicable laws, including COPPA where applicable. Merchants must not use the Tanqory platform in a manner that causes Tanqory to violate COPPA or any other applicable child-protection law.

5) Notice and consent expectations for merchants

5.1 A merchant whose property is directed to children under 13 or who has actual knowledge of collection from a child under 13 is expected to (i) prepare and publish a COPPA-compliant privacy notice on its property; (ii) implement a mechanism to obtain verifiable parental consent before the merchant or any service provider operating on the merchant's behalf collects personal information from a child; (iii) document and retain records of parental consent; and (iv) honor parental requests to review, delete, or stop further collection of the child's personal information.

5.2 The technical implementation of consent and parental controls on a merchant storefront is the responsibility of the merchant. Where Tanqory's platform offers technical features that may assist (for example, age gating, consent records, or deletion APIs), the availability and configuration of those features is described in the Tanqory product documentation and is subject to change.

6) Parental rights

6.1 COPPA confers on parents the following rights with respect to personal information collected from their child by an operator: (a) the right to review the child's personal information; (b) the right to direct that the operator delete the child's personal information; and (c) the right to refuse to permit further collection or use of the child's personal information.

6.2 Tanqory acts on parental requests as follows:

6.2.1 Requests directed to a merchant's property. Where a parent contacts Tanqory in respect of personal information collected on a merchant's storefront, Tanqory will route the request to the merchant, which is the COPPA operator with respect to that information, and will provide reasonable assistance to the merchant in responding.

6.2.2 Requests directed to Tanqory's first-party processing. Where a parent identifies Tanqory's first-party processing as the subject of the request (for example, in the rare case that a child has registered for a developer or merchant account in violation of the Tanqory Terms), Tanqory will follow the procedure in Section 7.

7) Removal procedure for inadvertent collection

7.1 If Tanqory becomes aware that it has inadvertently collected personal information from a child under 13 in its own first-party processing — for example, through a child's registration for a Tanqory account in violation of the Tanqory Terms — Tanqory will take the following steps:

7.1.1 Investigation. Promptly investigate the basis for the determination that the user is a child under 13, including by considering the parent's communication, the information in the account, and any other reasonably available signals.

7.1.2 Account suspension. Suspend the implicated account pending resolution.

7.1.3 Deletion. Delete the personal information collected from the child from Tanqory's active systems, except where retention is required to (a) respond to the parent's request, (b) comply with a legal obligation, (c) defend a legal claim, or (d) maintain security and integrity records that do not include personal information beyond what is strictly necessary.

7.1.4 Backups. Treat backups in accordance with the Data Retention Policy and the Records Retention Policy (SOX): backups are not used for routine processing, and personal information deleted from active systems is deleted from backups in the next feasible cycle unless a legal hold or other legal obligation applies.

7.1.5 Confirmation to parent. Provide written confirmation to the parent of the steps taken, to the extent the parent has provided contact information sufficient to permit a response.

7.2 Parents who wish to make a request under this Section should contact privacy@tanqory.com, with the subject line "COPPA request". To assist Tanqory in responding, please provide: (i) the name and email address (if known) used to create the account, (ii) the child's name (if known) and age, (iii) a description of the personal information at issue, and (iv) a means by which Tanqory can verify the parent-child relationship and the parent's identity to a degree appropriate to the sensitivity of the request.

8) Liaison with merchants whose product is directed to children

8.1 Where Tanqory has reason to know that a merchant's product is directed to children under 13, Tanqory may engage with the merchant to confirm (i) that the merchant has implemented COPPA-compliant notice and consent processes on its property; (ii) that the merchant's use of Tanqory's platform features is consistent with COPPA; and (iii) the merchant's contact for COPPA matters.

8.2 Tanqory reserves the right under the Acceptable Use Policy and the Merchant Agreement to require additional warranties, to require the use of specific platform configurations, or — in cases of material non-compliance with COPPA — to suspend or terminate service.

9) Coordination with international child-protection laws

9.1 EU GDPR Article 8. Article 8 of the EU General Data Protection Regulation sets the conditions applicable to a child's consent in relation to information society services. The default age threshold under Article 8(1) is 16; Member States may provide for a lower age, but not below 13. Merchants operating in the EU are responsible for determining the applicable Member State threshold and obtaining parental authorization where the child is below the threshold. Tanqory OÜ acts as Tanqory's EU representative under GDPR Article 27.

9.2 UK Age Appropriate Design Code. The UK's Information Commissioner's Office has issued the Children's Code (Age Appropriate Design Code), which applies to information society services likely to be accessed by children. Merchants offering services in the UK should evaluate the Code's standards (including data-minimization, profiling, transparency, and default high-privacy settings for children) and implement them on their properties as appropriate.

9.3 California Age-Appropriate Design Code Act. The California Age-Appropriate Design Code Act imposes obligations on businesses that provide an online service, product, or feature likely to be accessed by children under 18 in California. Merchants whose properties fall within the Act's scope should consider its requirements, including data-protection impact assessments and default high-privacy settings for children.

9.4 Quebec Law 25 (minors). Quebec Law 25 contains provisions on the processing of personal information relating to minors, including a presumption that personal information of a minor under 14 has a serious privacy interest and corresponding consent requirements. Merchants offering services to consumers in Quebec should evaluate Law 25's requirements.

9.5 Other jurisdictions. Merchants are responsible for evaluating and complying with child-protection laws in other jurisdictions in which they operate (including, for example, India's Digital Personal Data Protection Act provisions on children, Singapore's PDPA guidance on children's data, and emerging US state laws).

10) Cross-references

10.1 This Statement should be read together with:

10.1.1 Privacy Policy (apps/legal/tanqory_legal/en/platform/privacy-policy.md) — Tanqory's general privacy notice.

10.1.2 Data Processing Addendum (apps/legal/tanqory_legal/en/data-protection/dpa-master.md) — controller-processor terms.

10.1.3 Acceptable Use Policy (apps/legal/tanqory_legal/en/platform/acceptable-use-policy.md where applicable) — restrictions on merchant use.

10.1.4 Child Safety Policy — Tanqory's existing child-safety policy addressing trust-and-safety matters, including the handling of child sexual exploitation material reports, where in force.

10.1.5 Data Retention Policy (apps/legal/tanqory_legal/en/data-protection/data-retention-policy.md) — retention principles applicable to deletion of children's data.

11) Updates to this Statement

11.1 This Statement is reviewed at least annually and additionally on changes to COPPA, the COPPA Rule, the cross-referenced international child-protection laws, or material changes to Tanqory's services. The controlling version is published at https://legal.tanqory.com/.

12) Contact

12.1 COPPA-related inquiries — including parental requests under Section 7 — should be directed to privacy@tanqory.com, with the subject line "COPPA request". Inquiries that involve broader data-protection matters may also be directed to dpo@tanqory.com. Inquiries that involve legal process should additionally be copied to legal@tanqory.com.

12.2 For US-specific COPPA matters, the US contracting entity is Tanqory Inc., 16192 Coastal Hwy, Lewes, DE 19958. The Lewes, Delaware address is the address of Tanqory Inc.'s registered agent (Harvard Business Services, Inc.) and serves as the address for service of process; Tanqory Inc. has no separate physical office in the United States at the date of this Statement.