Sensemitter is now Emhance.
Read more
Last updated: 13.10.2026
We recognize the importance of protecting personal data and are committed to ensuring its security and responsible processing. This Privacy Policy explains how Sensemitter Services Limited, trading as Emhance ("Company," "we," "us," or "our"), in its capacity as a Data controller, collects, processes, and protects the personal data of individuals who create an account in the Emhance playtester app and take part in our playtests, research, surveys, studies, or similar activities (collectively, "Study").
This Policy applies to all Playtesters — individuals of legal age (as defined in Section 3) who have created an account in the Emhance mobile application or its companion web page (together, the "App"), or who have been invited by us to take part in a Study ("Playtester", "you," "your"). Please read this Policy carefully to understand our privacy practices and your rights under applicable Data Protection Laws.
This Privacy Policy is available only in English, and all communications regarding data privacy and your rights will be conducted in English, unless otherwise required by mandatory laws in your jurisdiction.
BY CREATING AN ACCOUNT IN THE APP OR PARTICIPATING IN A STUDY YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREED TO THE PROCESSING OF YOUR PERSONAL INFORMATION AS OUTLINED IN THIS POLICY.
BY PARTICIPATING IN A STUDY YOU CONSENT TO THE USE OF AI-BASED TOOLS TO ANALYSE YOUR EMOTIONAL REACTIONS DURING THE STUDY SESSION. YOU UNDERSTAND THAT THIS ANALYSIS IS AUTOMATED AND MAY INCLUDE THE INTERPRETATION OF YOUR OBSERVABLE BEHAVIOURAL CUES AS FURTHER DETAILED IN SECTION 5 BELOW.
1. What categories of personal information we collect and why
We are a research and marketing technology company. We specialize in designing and conducting research into player perception, behavior, and emotional response to games and other digital content. We operate our own panel of Playtesters, who register in the App, receive invitations to Studies, record their sessions and are rewarded for their participation. Our research findings form the basis of the services and analytics we provide to our clients (“Services”), and also support the continuous development of our proprietary research Platform (as defined in our Terms of Service). We collect and process your personal data for the following main purposes:
a. to create and maintain your account and to establish and perform our agreement with you, including matching you to and inviting you to Studies, managing your participation, and rewarding you for it;
b. to conduct our Studies;
c. to keep our panel secure and fair, including preventing fraud and multiple accounts; and
d. to develop, test, and improve our App and Platform, including the functionality of our proprietary AI algorithms (as further explained in Section 5 below).
1.1. Account Data
You create an account by signing in with Google, Apple or Facebook (“Sign-in Provider”). With your permission, the Sign-in Provider shares with us your full name, email address and a unique account identifier. If you use Apple’s “Hide My Email” option, we receive a relay address instead of your email address. We do not receive your password and we never post anything on your behalf. The Sign-in Provider processes your data under its own privacy policy.
1.2. Profile Data
a. Profile information required to take part in Studies: your date of birth, gender, and location;
b. Optional profile information: the gaming platforms and devices you use, your preferred game genres, and whether you wear glasses or contact lenses;
c. Your consent records: which versions of our legal documents you accepted and when.
You can view and edit your profile in the App.
1.3. Device, Security and Usage Data
We collect this data automatically when you use the App:
a. Device and security data: a device identifier, the IP address used at registration, your device’s mobile carrier, device model and operating system;
b. Attribution data: the marketing campaign or link through which you came to the App;
c. Usage data: how you use the App, such as screens opened, actions taken and notifications received;
d. Notification data: the push token that allows us to send notifications to your device, and whether you have allowed notifications.
1.4. Participation Data
We collect only personal data that is relevant and necessary for the specific Study in which you choose to participate:
a. Screening information: your responses to questions regarding your gaming experience, interests, habits, preferences, and the devices you use;
b. Recordings: recordings of your device screen and in-game activity while you play, of your facial expressions through your webcam, and of your voice through your microphone, during interactions with the object of the research (for example, a game, advertisement, video, or other media) (“Recordings”);
c. Survey answers: your answers to questions about the object of the research, including after a session;
d. Derived Coded Data: insights reflecting your principal emotional reactions during engagement with the research object (as defined in Section 5);
e. On-Screen Information: any personal or device-related information that may unintentionally become visible in a Recording, such as notifications, names, photos or file names. Please ensure that no personal data belonging to third parties is visible during your sessions. If any such data is disclosed inadvertently, you may contact us at anonymize@emhance.ai.
1.5. Rewards Data
The points you earn for each Study, the outcome of quality review of your sessions, your withdrawal requests and their status, and the payout details you provide when you withdraw a reward (your PayPal email address).
1.6. Communications
The content of any messages you send us, for example to our support or legal email addresses, and our replies.
2. Sensitive Personal Data
Other than as described below, we generally do not collect or process special categories of personal data, such as information related to your race or ethnicity, religious or philosophical beliefs, sexual life, political opinions, trade union membership, health, or genetic data. However, in order to conduct the Study we do process biometric data — namely facial-geometry and voice characteristics extracted from the Recordings — for the purpose of emotional and behavioural analysis, as described in Sections 5 and 5A. We process this biometric data only on the basis of your explicit consent (Article 9(2)(a) GDPR) and the additional consents required by applicable US state biometric laws.
3. No Minors Data
Our App and Services are intended solely for individuals aged 18 or over. You confirm your date of birth when you create an account, and accounts may not be created for anyone under 18. We do not knowingly collect personal data from individuals under the age of 18. If it comes to our attention that such data has been collected due to misleading or false information provided to us, we will promptly delete it.
4. Use of AI components
To conduct our Study activities, we use both proprietary AI systems (as described in Section 5 below) and third-party AI systems, including large language models developed by OpenAI, LLC (“LLMs”). For example, we may utilize these LLMs to analyze Playtesters’ answers across certain Study sessions in order to generate aggregated analytics as part of our Study outcomes.
We DO NOT use AI systems that infer emotions in workplaces or in educational institutions.
5. Use of Recordings and Derived Data
During the course of the Study, we make Recordings of your participation (clause 1.4(b)). Recordings upload automatically from your devices while you play; you do not handle the recording files yourself. We further process the Recordings to: (a) capture and extract specific data from them (“Captured Video Data”); and (b) interpret this Captured Video Data to produce Derived Coded Data (clause 1.4(d)).
Captured Video Data may include information such as facial expressions and other observable behavioural cues. We use internal and third-party AI systems to analyse this data for the purposes of emotional interpretation. Specifically, the Captured Video Data is processed by proprietary algorithms within our Platform and third-party AI systems, which convert it into coded formats (e.g., numerical or categorical values) representing emotional states or behavioural patterns. We also review Recordings, manually and automatically, to check their quality, which determines the reward you receive for a Study.
Certain versions of the Recordings, Captured Video Data and/or Derived Coded Data may be retained and used by us: (a) to improve the accuracy and functionality of our Platform’s emotion recognition and gameplay analysis algorithms; (b) to enhance the diversity and breadth of our Platform’s datasets; (c) to support advancements in human-computer interaction and usability analysis; (d) to share with our customers as part of the services we provide.
We obtain your consent to the recording and to the biometric processing described in this Section BEFORE any Recording is made, at registration in the App and through the information presented to you at the start of each Study.
You are hereby giving us your explicit consent in accordance with Article 9(2)(a) of the GDPR for the following use of the Recordings:
Participation in the Study (recording face, voice, screen, etc.);
Use of those Recordings and derived data to train and improve our own AI models;
Use of those Recordings for analysis and training by third-party AI systems.
5A. Additional notice and terms for Playtesters in US states with biometric privacy laws
This Section applies if you participate from Illinois, Texas, or Washington, and supplements the rest of this Policy. In the event of a conflict, this Section controls for those Playtesters.
a. What we collect. To analyse your emotional and behavioural reactions, we collect and process biometric identifiers and biometric information within the meaning of the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), and the Washington My Health My Data Act (MHMD Act) — specifically a scan of your facial geometry and voice characteristics (voiceprint), together with the Derived Coded Data generated from them.
b. Purpose. We collect and use this biometric data solely to conduct the Study, to produce the emotional/behavioural analysis and findings we deliver to our clients, and to improve our Platform’s algorithms.
c. Consent and written release. We obtain your informed consent before collecting any biometric identifier. If you participate from Illinois, we additionally obtain your written release (as required by BIPA Section 15(b)) before collection, which states the biometric data being collected, the purpose, and the length of time for which it will be stored and used. If you participate from Washington, we obtain your separate consent for collection and a separate, distinct authorization before any sharing of your biometric/consumer health data, as required by the MHMD Act.
d. Retention and destruction schedule. We retain your biometric identifiers, biometric information, and the Derived Coded Data generated from them only for as long as needed to fulfil the purpose for which they were collected, and in any event we permanently destroy them no later than one (1) year after your last interaction with us (or sooner where required by applicable law). This is our publicly available retention schedule and destruction guideline for biometric data for the purposes of BIPA Section 15(a) and the destruction requirements of CUBI and the MHMD Act. The raw audiovisual Recording (as distinct from the biometric identifiers extracted from it) may be retained for longer as described in Section 6, on the basis of your explicit consent and solely as evidence of our analysis; we do not perform further biometric extraction on Recordings retained for that evidentiary purpose.
e. No sale; no profit; limited disclosure. We do not sell, lease, trade, or otherwise profit from your biometric identifiers or biometric information. We do not disclose them to any third party except: with your consent (or separate authorization where required); to our processors who act on our behalf under written confidentiality and data-protection obligations; or as required by law. We protect biometric data using the reasonable standard of care and security measures described in Section 10.
f. Your rights. You may withdraw your consent and request deletion of your biometric data at any time by contacting us at legal@emhance.ai. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
6. Summary of purposes and legal bases of your personal data processing
The legal bases under which we process your personal data include:
a. Consent: We process your personal data based on your consent, which is obtained in the App at registration, through your device’s permission dialogs (for example, for notifications, camera and microphone), through consent steps at the start of a Study, or by email. Your consent is documented and securely stored in our systems. You may withdraw your consent at any time by contacting us at legal@emhance.ai or, for device permissions, in your device settings.
b. Contractual necessity: Processing of your personal data may be necessary for the performance of our agreement with you (our Terms of Use) or to take pre-contractual steps at your request.
c. Legitimate interest: We may process your personal data where it is necessary for our legitimate interests, such as keeping our panel secure and fair, preventing fraud, understanding how Playtesters find us, and improving our App and Services. When relying on legitimate interest, we always conduct a balancing test to ensure that our interests do not override your fundamental rights and freedoms.
d. Legal obligation: We process your personal data when it is necessary to comply with our legal and regulatory obligations, including tax, accounting, anti-money laundering (AML), and data protection laws.
e. Vital interests and other legal bases: In exceptional cases, we may process your personal data to protect your vital interests or those of another person, or when processing is otherwise permitted under Article 6 of the GDPR.
We DO NOT sell, rent, or trade your personal data to third parties under any circumstances.
We DO NOT use your personal data for advertising.
Summary Table of Processing Purposes and Legal Bases
Category of Personal Data
Purpose of Processing
Lawful Basis (GDPR, Article 6)
Retention period
Account Data and Profile Data (clauses 1.1 and 1.2)
(a) to create and maintain your account; (b) to confirm you meet the age requirement; (c) to match you to and invite you to Studies; (d) to communicate with you about your account and participation; (e) to respond to your inquiries.
Art. 6(1)(b) Performance of a contract.
For as long as you have an account with us. Deleted when you delete your account (see Section 11A), unless a longer retention period is required by law.
Consent records (clause 1.2(c))
To document the consents you have given.
Art. 6(1)(c) Legal obligation; Art. 6(1)(f) Legitimate interest.
For as long as you have an account and for the limitation period applicable to related claims.
Device and security data (clause 1.3(a))
To prevent fraud and the creation of multiple accounts, to keep the panel secure, and to determine the country from which you take part.
Art. 6(1)(f) Legitimate interest (security and fraud prevention).
For as long as you have an account with us, and up to 12 months after account deletion where necessary to prevent repeated fraudulent registrations.
Attribution and usage data (clauses 1.3(b) and 1.3(c))
To understand how Playtesters find us and how the App is used, and to improve the App.
Art. 6(1)(f) Legitimate interest (product improvement).
For as long as you have an account with us.
Notification data (clause 1.3(d))
To send you Study invitations, reminders, quality feedback and reward updates.
Art. 6(1)(b) Performance of a contract; Art. 6(1)(a) Consent (push notifications, given through your device’s permission dialog).
Until you delete your account or disable notifications.
Screening information and survey answers (clauses 1.4(a) and 1.4(c))
(a) to assess your eligibility for a specific Study; (b) to collect your feedback on the research object as part of the Study.
Art. 6(1)(a) Consent; Art. 6(1)(b) Performance of a contract.
Up to 12 months after the end of the relevant Study project; aggregated and anonymised findings (which no longer identify you) may be retained without time limit.
Recordings — biometric components (the facial-geometry scan / voiceprint extracted from the Recordings)
To conduct the Study and process Captured Video Data into Derived Coded Data, as described in Sections 5 and 5A.
Art. 6(1)(a) and Art. 9(2)(a) Explicit consent; plus consents required under BIPA/CUBI/MHMD.
Up to 10 (ten) years from the date of the Study session, for as long as needed for the purposes listed here, after which it is destroyed. For Playtesters in Illinois, Texas and Washington, the shorter schedule in Section 5A(d) applies.
Raw Recordings — audiovisual file (clause 1.4(b))
To conduct the Study, check session quality, deliver results to our customers, retain the recording as evidence of our analysis and findings, and validate and train our analysis models.
Art. 6(1)(a) and Art. 9(2)(a) Explicit consent.
Up to 10 (ten) years from the date of the Study session, for as long as the Recording is used for the purposes listed here, after which it is deleted. You may withdraw consent and request deletion at any time (see Sections 5A and 11).
Captured Video Data and Derived Coded Data (clause 1.4(d))
To analyse your reactions and behaviours as part of the Study objectives.
Art. 6(1)(a) and Art. 9(2)(a) Explicit consent.
Up to 10 (ten) years from the date of the Study session, unless retained in fully anonymised form that no longer identifies you. For Playtesters in Illinois, Texas and Washington, the shorter schedule in Section 5A(d) applies.
On-Screen Information (clause 1.4(e))
This data is not processed separately from the Recordings.
Art. 6(1)(a) Consent.
Same retention as the Recording in which it appears; promptly redacted or deleted where it is not necessary for the Study.
Rewards Data (clause 1.5)
To calculate your points, process your withdrawals and pay out your rewards.
Art. 6(1)(b) Performance of a contract; Art. 6(1)(c) Legal obligation (tax and accounting).
For as long as you have an account with us; payment records for the period required by tax and accounting law.
Communications (clause 1.6)
To respond to your inquiries and requests.
Art. 6(1)(b) Performance of a contract; Art. 6(1)(f) Legitimate interest.
Up to 12 months after your inquiry is resolved, unless a longer period is required by law.
7. Sharing of your personal data
We only share your personal data with third parties when it is necessary to achieve the purposes described in this Policy and always in compliance with applicable data protection laws. We ensure that any such sharing is subject to appropriate contractual, technical, and organizational safeguards.
Your personal data may be shared with the following categories of recipients:
a. Customers: the game studios and other customers who commission a Study may receive research insights and, as part of the services we provide, Recordings or excerpts from them, your survey answers, in-game behavior and general profile information such as age, gender, location and gaming habits. We do not share your name, email address or contact details with customers. Where any shared material contains biometric identifiers and you participate from Illinois, Texas, or Washington, we share it only with your consent or, for Washington, your separate authorization, as described in Section 5A.
b. Sign-in and payment providers: Google, Apple and Meta (Facebook), to the extent necessary to let you sign in to the App; and PayPal, to send you your rewards. These providers process your data under their own privacy policies.
c. Service Providers and Subcontractors: carefully selected third-party vendors that support our operations, including product analytics (Amplitude), push notifications and email (Pushwoosh), and third-party AI systems. These third parties act as data processors on our behalf and are contractually bound by strict confidentiality and data protection obligations under Article 28 GDPR.
d. Hosting and Infrastructure Providers: We rely on trusted infrastructure services, such as Google Cloud and Google Workspace, to securely host and manage our systems and your personal data.
e. Prospective Investors and Professional Advisors: in the context of financing, due diligence, or potential mergers/acquisitions, we may disclose your data to investors or their advisors, provided they are subject to strict confidentiality obligations.
f. Compliance with legal obligations: We may disclose your personal data when required to comply with legal obligations, including responding to subpoenas, court orders, or lawful requests from governmental or regulatory bodies.
g. Legal rights and safety: Your personal data may also be shared if it is necessary to establish, exercise, or defend our legal rights, protect our property, enforce our agreements, or prevent fraud or other illegal activities.
We require all third parties with whom we share your data to maintain appropriate security measures and comply with applicable data protection laws. Third parties are only permitted to process your personal data for specified purposes in accordance with our instructions.
8. Analytics, attribution and notifications in the App
The App does not use cookies. It contains software development kits (SDKs) from our service providers that store and read identifiers on your device in order to: (a) measure how the App is used (product analytics); (b) identify the marketing campaign through which you came to the App (attribution); and (c) deliver push notifications to your device.
You can disable push notifications at any time in your device settings. If you do, you may learn about new Studies later or not at all. On iOS, where any such technology is considered tracking under Apple’s rules, we will ask for your permission before it is used.
Cookies used on our website https://emhance.ai are described in our Privacy Notice published on the website.
9. Where we process and transfer your information
We host and process your data in Europe (and the hosting services are purchased by us from Google Cloud). We may transfer personal data to jurisdictions outside of your home country and outside of the European Economic Area (EEA) as necessary for the purposes of processing, including where our service providers process data outside the EEA. You are entitled to learn about the legal basis of data transfers to a country outside the EU and about the security measures we take to safeguard your information. If we transfer personal data originating from the EEA to countries without an adequate level of data protection, we use one of the following legal bases: (i) Standard Contractual Clauses approved by the European Commission, or (ii) the European Commission adequacy decisions about certain countries. We take all steps necessary to provide suitable safeguards to protect your personal data during the cross-border transfer and to ensure that your data is treated in accordance with this Privacy Policy.
10. How we protect your information
We are committed to safeguarding your personal and confidential information (“PCI”) through robust technical and organizational measures. Our security framework is designed to protect PCI from unauthorized access, use, disclosure, copying, modification, destruction, and accidental loss or misuse.
10.1. Security Measures in Place. We implement industry-standard security controls, including but not limited to:
a. Access Controls: we enforce strict access controls to ensure that only authorized personnel and contractors can access your PCI, based on the principle of least privilege.
b. Separation of identity data: your Account Data is stored separately from your Recordings and gameplay data.
c. Data Encryption: (i) in transit: 256-bit SSL/TLS 1.2 encryption; (ii) at rest: AES-256; (iii) backups: regular encrypted backups.
d. Secure Infrastructure: all our Services’ infrastructure is hosted within Google Cloud. Google Cloud is ISO/IEC 27001, SOC 1/2/3, and GDPR-compliant.
e. Regular Security Audits: we conduct regular penetration testing, vulnerability assessments, and security audits.
f. Antivirus and Intrusion Prevention Systems (IPS): deployed to monitor and prevent unauthorized access and potential threats in real-time.
g. Incident Response: we have established protocols to promptly address any suspected data breaches and will notify you and applicable regulators within legally required timeframes if a breach occurs.
10.2. Privacy Commitment. We are fully dedicated to compliance with the GDPR and other applicable data protection laws. Our privacy measures include: (a) mandatory Non-Disclosure Agreements for all employees and contractors handling your PCI; and (b) regular employee training on data protection best practices and GDPR compliance.
11. How you can control your information
11.1. If you reside in one of the EEA jurisdictions, you have the following rights in relation to the processing of your information:
a. Right to request access.
b. Right to request correction. You can correct most of your Profile Data directly in the App.
c. Right to request erasure, including by deleting your account in the App (see Section 11A).
d. Right to object to processing.
e. Right to request restriction of processing.
f. Right to request the transfer of your personal data to you or to a third party (data portability).
g. Right to withdraw consent. If you have previously provided us with your consent to collect and process your personal data, you can change your mind and withdraw such consent at any time. However, this will not affect the lawfulness of any processing carried out before withdrawal.
h. Right to complain to a supervisory authority — in Cyprus, the Office of the Commissioner for Personal Data Protection, or the data protection authority in your country of residence.
11.2. If you reside in the United States of America (USA), you have rights under certain USA state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include: access; rectification; erasure; the right to opt out of sale and sharing; the right to limit use and disclosure of sensitive personal information; withdrawing your consent; and non-discrimination.
For Playtesters located in US states with biometric privacy laws — including BIPA, CUBI and the MHMD Act — additional terms apply, as set out in Section 5A.
Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf, subject to verification. If we decline to take action regarding your request, you may appeal by emailing us; if your appeal is denied, you may submit a complaint to your state attorney general.
If you wish to exercise any of the rights set out above, please contact us at legal@emhance.ai from the email address linked to your account. We will process your request free of charge and as early as possible, but always within one month, subject to identity verification.
11A. Deleting your account
You can delete your account at any time:
In the App, go to Profile → Settings → Delete account and confirm the deletion.
If you cannot access the App, email support@emhance.ai from the email address linked to your account and ask us to delete it.
When you delete your account:
a. We delete your Account Data (full name, email address, Sign-in Provider identifier), your payout details and your notification data, and you can no longer sign in, receive invitations or take part in Studies.
b. Your Recordings, survey answers and Derived Coded Data, together with the gaming preferences and devices attached to them, are not deleted when you delete your account. They are unlinked from your account and continue to be retained and used as described in Sections 5, 5A and 6.
c. Points that have not been withdrawn are forfeited. Withdrawal requests submitted before deletion are processed as usual.
d. We may retain certain data where required by law (for example, payment records for tax purposes) or where necessary to prevent repeated fraudulent registrations, as set out in Section 6.
If you signed in with Facebook, you can also remove the App’s access to your Facebook account under Settings & privacy → Settings → Apps and websites. If you signed in with Apple or Google, you can do the same in your Apple ID or Google Account settings.
12. How long we keep your information
We keep your information for as long as it is necessary for the purposes outlined in Section 6 above, and no longer than the retention periods stated in the table in Section 6 and the biometric destruction schedule in Section 5A. We may retain your information if required to do so by law or upon an order of a state authority.
13. Links to third-party websites
The App and our website may contain links to third-party websites and services that are not administered by us and are not governed by this Privacy Policy. We encourage you to familiarize yourself with the privacy policies and security practices of the linked third-party websites before providing them any personal data.
14. Changes to the Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our data processing practices or regulatory requirements. Any changes will be published on this page, and we will revise the “Last updated” date at the top of this policy. If we make any material changes in the way we collect, use or share your information, we will notify you in the App before the changes take effect, and if required by applicable law we will request your consent for such changes.
15. Contact Information
If you have questions or comments regarding this Privacy Policy and our privacy practices, or you have any requests to exercise your legal rights, please contact us at: legal@emhance.ai
Registered address: Spyrou Araouzou, 2, FAYSA HOUSE, 2nd floor, Flat/Office 201, 3036, Limassol, Cyprus
Main Definitions
App: the Emhance mobile application for iOS and Android and its companion web page used to connect a second device during a Study.
Applicable Data Protection Laws: the GDPR, the CCPA, and all other data protection and privacy laws applicable to the processing described in this Policy, including, where relevant to a Playtester, BIPA, CUBI and the MHMD Act.
BIPA: the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq.
CUBI: the Texas Capture or Use of Biometric Identifier Act, Tex. Bus. & Com. Code § 503.001.
MHMD Act: the Washington My Health My Data Act, RCW 19.373.
CCPA 2018: the California Consumer Privacy Act 2018 and legislation supplementing this Act.
Data controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Unless stated otherwise, for purposes of this Privacy Policy – Sensemitter Services Limited.
GDPR: the General Data Protection Regulation ((EU) 2016/679) and all legislation implementing or supplementing this Regulation.
Personal data, personal information: any information relating to an identified or identifiable natural person.
Processing of personal data: any operation or set of operations which is performed on personal data, whether or not by automated means. For the purposes of CCPA 2018 “sharing” of personal data shall not be read or mean “sale” of personal data.