Privacy notice

Last updated 5 May 2026

Draft. This notice was drafted by the engineering team based on the data flows in this application. It has not been reviewed by qualified legal counsel and must be reviewed before public launch. It is not legal advice.

1. Who we are

The Find X9 Ultra Masterclass site is operated by OPPO Benelux B.V. (the “data controller”). For privacy enquiries, write to privacy@oppo-benelux.com.

2. Scope

This notice applies to the public masterclass signup site and to the attendee dashboard. It does not cover the OPPO consumer website or any other OPPO product.

3. What we collect and why

Signup details — full name, email address, phone number, and the IMEI of your Find X9 Ultra device. Used to reserve your seat, authenticate ownership and contact you about the event.
Marketing opt-in — only stored if you tick the opt-in box on the signup form. Used to send you news about future masterclass editions.
Authentication data — short-lived one-time email codes (hashed at rest), and an HttpOnly session cookie that keeps you signed in.
Payment status — the Shopify order ID and whether payment succeeded. We do not see or store your card details; Shopify handles those.
Operational logs — IP address, user-agent and request path, kept transiently for security and debugging.
Analytics & marketing identifiers — only with your consent: a Google Analytics 4 pseudonymous ID, a PostHog distinct ID, and a Meta Pixel _fbp identifier.
Error events — uncaught client errors are sent to PostHog without a persistent identifier so we can fix bugs. See the cookie policy for details on the privacy-safe mode.

4. Legal basis (GDPR Art. 6)

Contract performance (Art. 6(1)(b)) — signup, IMEI verification, payment status.
Legitimate interest (Art. 6(1)(f)) — OTP authentication, abuse prevention, in-memory error capture.
Consent (Art. 6(1)(a)) — marketing email opt-in; analytics and marketing cookies.

5. Recipients and sub-processors

Resend — sends transactional and (with opt-in) marketing email.
Shopify — processes ticket payments.
Google (GA4) — traffic analytics; only with your analytics consent.
Meta Platforms (Pixel) — ad attribution; only with your marketing consent.
PostHog (EU instance) — error capture is essential; full product analytics and session replay only with your analytics consent.
Railway — hosts the API, web app and database.

6. International transfers

Some recipients (Meta, Shopify) may process data outside the EU/EEA. Where they do, we rely on the EU Standard Contractual Clauses or equivalent safeguards.

7. Retention

Signup records: kept until 90 days after the event for refund and dispute handling, then anonymised.
OTP codes: minutes (server-side TTL ≤ 15 minutes).
Operational logs: 30 days.
Analytics data: per provider defaults (GA4 set to 14 months; PostHog reduced from default).

8. Your rights

You can request access, rectification, erasure, restriction, objection or portability of your personal data, and you can withdraw consent at any time without affecting the lawfulness of past processing. Email us at privacy@oppo-benelux.com to exercise any of these rights.

9. Complaints

If you believe we have handled your data unlawfully you may complain to the Dutch DPA (Autoriteit Persoonsgegevens) or the Belgian DPA (Gegevensbeschermingsautoriteit).

10. Changes

We may update this notice. Material changes will be communicated on this page and through the cookie banner so you can review your choices.