GDPR & COPPA Compliance

Lyvy Stream is committed to respecting user privacy, protecting children, and handling personal information responsibly. This GDPR & COPPA Compliance Policy explains the principles and procedures relevant to the European Union General Data Protection Regulation (GDPR), the United Kingdom data-protection framework where applicable, and the United States Children's Online Privacy Protection Act (COPPA).

This Policy applies to Lyvy Stream's website, mobile applications, live-streaming services, video-on-demand services, short-form video features, creator tools, account systems, monetization features, and other services operated by LyvyStreamCorp, subject to applicable law.

This Policy supplements the Lyvy Stream Privacy Policy, Terms of Service, and Community Guidelines.

**Important:** This document describes compliance principles and intended procedures. Publishing this Policy alone does not establish legal compliance. Lyvy Stream must ensure that its actual data collection, consent mechanisms, age controls, vendors, retention practices, and operational procedures match the commitments made here.

---

The purpose of this Policy is to explain how Lyvy Stream approaches privacy and children's data protection under applicable laws, including:

1. The European Union General Data Protection Regulation (EU GDPR).

2. Applicable national laws implementing or supplementing the GDPR.

3. The United Kingdom GDPR and Data Protection Act 2018, where applicable.

4. The United States Children's Online Privacy Protection Act and applicable implementing regulations.

5. Other applicable privacy, consumer-protection, and children's online safety laws.

This Policy also explains how users, parents, and legal guardians may raise privacy concerns or submit requests concerning personal information.

This Policy applies to personal information processed through Lyvy Stream's services when the relevant privacy laws apply.

Covered activities may include:

Certain third-party services may process information under their own privacy notices and legal responsibilities.

This document should be read together with the Lyvy Stream Privacy Policy, which describes the categories of information the platform may process, the purposes of processing, and relevant sharing and retention practices.

If the Privacy Policy and this document address the same subject differently, Lyvy Stream will interpret them consistently with applicable law and the rights of affected individuals.

Nothing in this Policy limits a privacy right that cannot lawfully be limited or waived.

For purposes of this Policy:

Lyvy Stream is operated by LyvyStreamCorp.

Depending on the service, activity, and applicable law, LyvyStreamCorp may act as a data controller, a processor, or in another legally recognized role.

The exact role must be determined based on the actual processing arrangement rather than the name assigned to it in this Policy.

Lyvy Stream's privacy practices should follow these principles:

1. **Lawfulness, fairness, and transparency:** process personal data on a lawful basis and explain relevant practices clearly.

2. **Purpose limitation:** collect information for specified, explicit, and legitimate purposes.

3. **Data minimization:** collect only information reasonably necessary for the intended purpose.

4. **Accuracy:** take reasonable steps to correct inaccurate personal data.

5. **Storage limitation:** retain personal data only as long as justified by the applicable purpose, legal obligation, or other lawful basis.

6. **Security:** apply appropriate technical and organizational safeguards.

7. **Accountability:** maintain evidence of compliance and procedures for addressing privacy risks.

8. **Children's protection:** apply additional safeguards where children’s personal information is involved.

---

The GDPR may apply when Lyvy Stream processes personal data in the context of an establishment in the European Union or when its processing falls within the GDPR's territorial scope, including certain services offered to people in the EU or monitoring of their behavior there.

The application of the GDPR depends on the relevant circumstances and is not determined solely by a user's nationality.

Where applicable, Lyvy Stream will process personal data in accordance with the GDPR and relevant national requirements.

When the GDPR applies, Lyvy Stream must identify an appropriate lawful basis for each relevant processing purpose.

Depending on the circumstances, lawful bases may include:

Processing may be necessary to provide a service requested by the user or to take steps requested before entering into a contract.

Examples may include account creation, providing video functionality, administering an account, or processing a transaction requested by the user.

Processing may be necessary to comply with applicable legal obligations, such as certain financial recordkeeping, tax, regulatory, or lawful disclosure requirements.

Processing may be based on legitimate interests where permitted by law and where those interests are not overridden by the individual's rights and freedoms.

Potential purposes may include service security, fraud prevention, preventing abuse, protecting platform integrity, and maintaining reliable operations.

Where required, Lyvy Stream will assess the relevant interests and safeguards.

Where consent is required, Lyvy Stream must obtain valid consent before conducting the relevant processing.

Consent may be relevant to certain cookies, optional marketing activities, or other processing activities where consent is the appropriate lawful basis.

Users must be able to withdraw consent where applicable. Withdrawal does not invalidate processing that lawfully occurred before withdrawal.

These lawful bases will be used only where the relevant legal conditions are satisfied. They will not be treated as general justifications for routine platform operations.

Depending on the features used, Lyvy Stream may process categories such as:

The actual categories collected must correspond to the platform's implementation and the disclosures in the Privacy Policy.

Personal data may be processed for purposes including:

1. Creating and maintaining accounts.

2. Providing video, live-streaming, and creator services.

3. Operating comments, subscriptions, and other interactive features.

4. Processing eligible purchases and creator payments.

5. Providing customer support.

6. Detecting fraud, abuse, and security threats.

7. Enforcing platform rules and legal obligations.

8. Understanding service performance and improving reliability.

9. Delivering advertising or measuring advertising performance where lawfully permitted.

10. Responding to privacy requests and legal claims.

11. Protecting users, creators, and the platform.

Lyvy Stream should not use personal data for materially incompatible purposes without an appropriate legal basis and any notice or consent required by law.

Lyvy Stream should limit the information it collects to what is necessary for the relevant purpose.

Where possible, it should avoid collecting unnecessary identity documents, precise location data, sensitive information, or children's information.

If additional information is required for security, payment verification, legal compliance, or another legitimate purpose, the request should be proportionate to the risk or obligation involved.

Users should be able to correct inaccurate account information through available account settings or an appropriate privacy request.

Lyvy Stream will take reasonable steps to correct or update personal data when required by applicable law.

Some historical records may need to be retained in their original form for security, accounting, dispute resolution, or legal purposes, even if related account details are subsequently corrected.

Personal data should not be retained longer than necessary for the purpose for which it was collected, unless continued retention is justified by applicable law or another lawful basis.

Retention periods may vary depending on the data category, including:

Lyvy Stream should maintain a documented retention schedule and securely delete or anonymize data when retention is no longer justified.

Lyvy Stream should implement technical and organizational measures appropriate to the risks associated with its processing activities.

Depending on the circumstances, these measures may include:

No online service can guarantee absolute security. Lyvy Stream should assess risks regularly and address identified weaknesses within a reasonable period.

Where the GDPR applies, Lyvy Stream should incorporate data-protection considerations into the design, development, and operation of its services.

This may include minimizing default data collection, limiting access to personal data, using appropriate privacy settings, and evaluating whether a new feature creates additional risks.

Where legally required, Lyvy Stream should conduct a Data Protection Impact Assessment before processing that is likely to result in a high risk to individuals' rights and freedoms.

The GDPR imposes additional requirements on certain categories of sensitive personal data, including information concerning health, biometric identification, religious beliefs, political opinions, and other categories specified by law.

Lyvy Stream should not intentionally collect or use such information unless there is an appropriate legal basis and any additional legal condition is satisfied.

Users should avoid submitting sensitive personal information through public videos, comments, live chats, or support channels unless necessary and appropriate.

Lyvy Stream may use automated systems to support security, moderation, recommendations, fraud prevention, advertising, or service personalization, where implemented and legally permitted.

Where applicable law requires it, Lyvy Stream will provide information about relevant automated decision-making and safeguards.

If a decision falls within Article 22 of the GDPR, Lyvy Stream will apply the applicable restrictions and rights, including any required access to human intervention, the opportunity to express a point of view, and the ability to contest the decision.

Not every automated tool constitutes a decision subject to Article 22.

---

Where the GDPR applies, individuals may request confirmation of whether their personal data is being processed and, where applicable, access to that data and information about its processing.

The information provided may include processing purposes, relevant categories of data, recipients, retention information, and applicable rights.

Individuals may request correction of inaccurate personal data and, where applicable, completion of incomplete information.

Lyvy Stream may request reasonable information to identify the relevant account or verify the request.

Individuals may request deletion of personal data in circumstances provided by law.

The right to erasure is not absolute. Lyvy Stream may retain information where a lawful exception applies, including when retention is necessary to comply with a legal obligation, establish or defend legal claims, or satisfy another applicable exception.

Deleting an account may not immediately erase every record held in backups, financial systems, security logs, or legally required archives.

Where the GDPR's requirements are met, individuals may request restriction of processing in certain circumstances, such as when the accuracy of personal data is contested or an objection is under consideration.

Restricted information may continue to be stored and processed in other limited circumstances permitted by law.

Where the GDPR provides this right, individuals may request personal data they have provided to Lyvy Stream in a structured, commonly used, machine-readable format.

The right generally applies to qualifying processing based on consent or contract and carried out by automated means. It does not apply to every category of information or every processing activity.

Individuals may object to certain processing based on legitimate interests or the performance of a task in the public interest, where the GDPR applies.

Lyvy Stream must assess such objections according to the applicable legal requirements.

Individuals have an unconditional right to object to processing of their personal data for direct marketing, including related profiling, where that right applies.

Where processing is based on consent, individuals may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Lyvy Stream should provide a practical way to withdraw consent that is no more difficult than giving it, where required by law.

Individuals may lodge a complaint with a competent data-protection supervisory authority if they believe their personal data has been processed unlawfully.

Where the GDPR applies, individuals generally may complain to the supervisory authority in the EU member state of their habitual residence, place of work, or alleged infringement, subject to applicable rules.

Users may also have rights to seek a judicial remedy where provided by law.

A user seeking to exercise a privacy right should contact Lyvy Stream through the available support channels:

A request should identify the relevant account and describe the right being exercised. Users should not include passwords or unnecessary sensitive information.

Lyvy Stream may request additional information reasonably necessary to verify the identity of the requester and protect against unauthorized disclosure.

Where the GDPR applies, Lyvy Stream will respond to valid rights requests within the period required by law.

Under the GDPR, the general response period is one month. It may be extended by up to two additional months where legally permitted due to the complexity or number of requests, with the required notice to the requester.

Requests are generally handled without charge. A reasonable fee or refusal may be permitted for requests that are manifestly unfounded or excessive, subject to the applicable legal requirements.

Lyvy Stream may use proportionate verification procedures to confirm that a request concerns the correct individual or account.

Where applicable law permits an authorized representative to act on behalf of an individual, Lyvy Stream may request evidence of that authorization.

Verification procedures should not require unnecessary information or create unreasonable barriers to exercising privacy rights.

Some privacy rights are subject to legal conditions and exceptions.

Lyvy Stream may refuse or limit a request where an applicable legal exception permits it, but should explain the reason and any available complaint or appeal rights when required by law.

This Policy does not promise deletion, disclosure, portability, or restriction where the applicable law does not provide that right or a valid exception applies.

---

Personal data may be processed or accessed in countries outside the European Economic Area depending on Lyvy Stream's infrastructure and service providers.

Where the GDPR applies, international transfers must comply with the applicable requirements of Chapter V of the GDPR.

Depending on the destination and circumstances, lawful transfer mechanisms may include:

Lyvy Stream should identify the actual countries, providers, and transfer mechanisms relevant to its operations and document compliance as required.

Where required, users may request information about international transfers and the relevant safeguards.

The applicable information will depend on the processing activity, the service provider, and the legal transfer mechanism.

---

Lyvy Stream may use cookies, software development kits, local storage, pixels, or similar technologies where implemented.

These technologies may support essential functions, security, preferences, analytics, advertising, or service performance.

Where applicable law requires consent for non-essential technologies, Lyvy Stream must obtain valid consent before placing or using those technologies.

See the Lyvy Stream Privacy Policy for the platform's applicable privacy disclosures.

Where consent is required, users should be given clear information about the relevant technologies and meaningful choices.

Users should be able to withdraw or change consent through an available privacy or cookie-preference mechanism where required.

Essential technologies may be used without consent only where an applicable legal exemption permits their use.

Where analytics are implemented, Lyvy Stream may process usage and technical information to understand performance, identify errors, improve reliability, and assess how features are used.

The platform should limit the data collected, configure analytics appropriately, and obtain consent where required.

Advertising services may involve the processing of identifiers, device information, viewing activity, or other data depending on the advertising technology used.

Lyvy Stream must determine the applicable legal basis and consent requirements before implementing advertising or tracking technologies.

Where consent is required for personalized advertising or associated tracking, Lyvy Stream must not treat continued use of the platform as automatic consent.

Lyvy Stream must not knowingly use children's personal information for advertising or tracking in a manner prohibited by COPPA or other applicable law.

Where the law requires parental consent or restricts targeted advertising, profiling, or other processing involving children, Lyvy Stream must apply the relevant safeguards.

Age-appropriate advertising controls should be based on the actual services, user population, applicable legal requirements, and advertising systems in use.

---

The Children's Online Privacy Protection Act and its implementing regulations impose requirements on covered operators of websites and online services that collect personal information from children under 13, including certain operators that have actual knowledge that they are collecting such information.

COPPA may require a clear privacy notice, direct notice to parents, verifiable parental consent before certain collection or use, parental access and deletion rights, reasonable data-security measures, and limits on retention.

The precise obligations depend on the service, the information collected, the purposes of processing, and applicable exceptions.

Lyvy Stream must establish and publish an age policy that accurately reflects its intended audience, product design, and legal obligations.

Where Lyvy Stream does not permit children under 13 to use a service independently, it must communicate that restriction clearly and apply reasonable procedures consistent with applicable law.

A minimum-age statement alone does not eliminate COPPA obligations if the service is directed to children or the operator has actual knowledge that it is collecting personal information from children under 13.

If Lyvy Stream operates a service directed to children under 13, or a relevant portion of its service is directed to that audience, it must evaluate and implement the COPPA requirements applicable to that service.

These may include:

1. Providing a compliant privacy notice.

2. Giving direct notice to parents before collecting children's personal information where required.

3. Obtaining verifiable parental consent before collection, use, or disclosure where required.

4. Giving parents access to the child's personal information.

5. Providing a way for parents to request deletion and refuse further collection or use.

6. Maintaining reasonable security procedures.

7. Limiting retention to what is reasonably necessary for the purpose.

8. Complying with restrictions applicable to disclosures and third-party operators.

Lyvy Stream must not claim to offer a COPPA-compliant children's service unless the relevant safeguards are actually implemented.

Depending on the applicable law and service, personal information may include a child's name, online contact information, persistent identifiers, images, voice recordings, geolocation information, or other information defined by the relevant rules.

Video uploads, live broadcasts, chats, and account activity may expose personal information even when a user does not enter it into a registration form.

Lyvy Stream should assess the collection risks associated with live streaming, uploaded media, analytics, advertising, and third-party software.

Where COPPA requires verifiable parental consent, Lyvy Stream must use an approved or legally appropriate method designed to reasonably establish that the parent or legal guardian has authorized the relevant processing.

The method must be appropriate to the type of information collected, how it will be used, and whether it will be disclosed to third parties.

A checkbox or a child's assertion that a parent has given permission does not automatically satisfy the legal standard.

Consent must be obtained before the relevant collection, use, or disclosure unless a specific legal exception applies.

Where required by COPPA, Lyvy Stream must provide parents with direct notice explaining the relevant collection and use of the child's personal information.

The notice should explain, as applicable:

The notice must accurately reflect the service's actual practices.

Where COPPA applies, a parent or legal guardian may have rights to review personal information collected from the child, request deletion, and refuse further collection or use, subject to applicable law.

Lyvy Stream should provide a practical process for handling these requests and verifying the parent's authority without collecting unnecessary additional information.

A parent may submit a request through the available support channels:

If Lyvy Stream collects age information, it should use that information only for disclosed and lawful purposes, including age eligibility, safety, consent, or compliance.

Age-verification methods should be proportionate to the risks and should avoid collecting more personal information than necessary.

Lyvy Stream should not use age information to create misleading assurances that a child is protected if the actual product lacks the necessary safeguards.

Children may disclose personal information through video, audio, screen sharing, usernames, backgrounds, location clues, live chat, or comments.

Where children may access relevant features, Lyvy Stream should assess whether additional restrictions or safeguards are necessary.

Depending on the applicable service and law, safeguards may include age restrictions, chat controls, moderation, limits on public exposure, reporting tools, and restrictions on sharing personal information.

These controls must be implemented and maintained before being represented as available protections.

Lyvy Stream must evaluate third-party analytics, advertising, hosting, moderation, and other service providers that may collect personal information from children.

Where COPPA applies, Lyvy Stream must ensure that disclosures and processing satisfy applicable requirements and that service providers are subject to appropriate contractual and operational safeguards.

A third-party provider's privacy policy does not automatically remove Lyvy Stream's own legal responsibilities.

Personal information collected from children must be protected through reasonable security procedures appropriate to its sensitivity and the risks involved.

Where COPPA applies, Lyvy Stream must maintain a written data-retention policy addressing the purpose for collecting children's information and the period for which it is retained.

Children's personal information should be securely deleted when it is no longer reasonably necessary for the purpose for which it was collected, subject to applicable law.

If Lyvy Stream discovers that it has collected personal information from a child in circumstances that require parental consent and consent was not obtained, it must assess the situation promptly.

Depending on the facts and applicable law, appropriate action may include:

1. Restricting further collection or disclosure.

2. Providing the required parental notice.

3. Seeking valid parental consent where legally appropriate.

4. Deleting the information when required.

5. Reviewing the relevant feature or process.

6. Documenting the incident and corrective measures.

Lyvy Stream should not retain or continue using information merely because it has already been collected.

---

Under Article 8 of the GDPR, where an information society service is offered directly to a child and processing is based on consent, special rules apply to the child's consent.

The GDPR establishes 16 as the default age for this specific rule, but EU member states may lower it to no less than 13.

The applicable age therefore depends on the member state and the circumstances of the service. This rule does not mean that every person under 16 is automatically prohibited from using every online service.

Where the GDPR requires parental authorization for a child's consent, Lyvy Stream must make reasonable efforts to verify that authorization, taking available technology into account.

The applicable procedure must reflect the member state's rules and the type of processing involved.

A child's use of a service does not automatically establish valid consent for every optional processing purpose.

Children may have GDPR rights concerning access, correction, deletion, restriction, portability, and other matters where the relevant legal conditions are met.

Lyvy Stream should provide privacy information in clear, accessible language appropriate to the intended audience.

Where a parent or guardian makes a request on behalf of a child, Lyvy Stream should assess the request under the applicable law and verify authority where reasonably necessary.

Where children are likely to access a service, Lyvy Stream should take reasonable steps to ensure that relevant privacy explanations and choices are understandable to them.

This may include plain-language notices, age-appropriate explanations, clear consent choices, and settings designed to minimize unnecessary exposure of personal information.

These design measures should reflect the actual service and should not be presented as implemented until they are available.

---

Lyvy Stream may rely on third-party providers to operate aspects of its services, where implemented.

Such providers may include hosting, storage, video delivery, analytics, security, customer support, payment processing, and other technical service providers.

Where a provider processes personal data on Lyvy Stream's behalf, the parties must comply with applicable legal requirements, including required processor agreements and security obligations.

Some third parties may process personal data as independent controllers under their own legal responsibilities.

Examples may include payment services, app stores, or other services with their own accounts and terms.

Users should review the relevant third party's privacy information when interacting with those services.

Lyvy Stream may disclose personal information when required by law or when otherwise legally permitted, including in response to valid legal process or to protect rights, safety, security, or the integrity of the service.

Any disclosure must comply with applicable law and should be limited to what is legally justified.

Lyvy Stream must accurately disclose whether it sells or shares personal information as those terms are defined by the applicable privacy laws.

The meaning of “sale” or “sharing” can differ from ordinary commercial usage and may include certain advertising-related disclosures.

Lyvy Stream should assess its actual data flows, advertising technology, analytics providers, and contractual arrangements before making a categorical statement that it does or does not sell or share personal information.

---

A personal data breach may involve accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.

Examples may include compromised accounts, exposed databases, unauthorized access to payment information, or improper disclosure of personal information.

Not every technical incident constitutes a legally reportable personal data breach. Lyvy Stream must assess the facts and applicable legal requirements.

Lyvy Stream should maintain a process for identifying, investigating, documenting, and responding to suspected data breaches.

The process should include, where appropriate:

1. Identifying affected systems and information.

2. Containing the incident.

3. Assessing risks to individuals.

4. Preserving relevant evidence.

5. Notifying responsible personnel and service providers.

6. Determining legal reporting and notification obligations.

7. Taking corrective action to reduce future risks.

Where the GDPR applies, Lyvy Stream must notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to individuals' rights and freedoms.

Where the required notification is made after that period, the reasons for the delay must be provided as required by law.

Where a breach is likely to result in a high risk to individuals' rights and freedoms, Lyvy Stream must communicate the breach to affected individuals without undue delay unless a legally recognized exception applies.

An incident involving children's personal information requires particular attention because of the potential risks to children.

Lyvy Stream should assess whether the incident triggers COPPA, GDPR, contractual, or other legal notification requirements and take appropriate protective measures.

Where legally required, Lyvy Stream must notify affected parents, guardians, regulators, or other relevant parties within the applicable timeframe.

---

Users, parents, and legal guardians may submit privacy complaints through the available Lyvy Stream support channels.

Complaints should identify the relevant account or activity and explain the concern. Users should avoid sending passwords or unnecessary sensitive information.

Lyvy Stream should review complaints fairly, document relevant findings, and take corrective action where appropriate.

A Data Protection Officer (DPO) must be appointed where required by applicable law.

Whether Lyvy Stream is legally required to appoint a DPO depends on its processing activities and the relevant legal criteria.

If a DPO is appointed, Lyvy Stream should publish the required contact details and communicate them to the appropriate supervisory authority where required.

This Policy does not designate a DPO or establish a dedicated DPO contact unless Lyvy Stream has formally appointed one.

Where required by the GDPR, Lyvy Stream must maintain records of processing activities.

Those records may include processing purposes, categories of individuals and personal data, recipients, international transfers, retention periods, and a general description of security measures.

Applicable exemptions should be assessed according to the law and Lyvy Stream's actual circumstances.

Where Lyvy Stream uses processors and the GDPR requires a written data-processing agreement, that agreement must contain the required contractual terms.

These may include processing instructions, confidentiality, security, assistance with data-subject requests, breach reporting, deletion or return of data, and audit or compliance obligations.

Lyvy Stream should periodically assess whether its vendors and agreements remain appropriate.

Where processing is likely to result in a high risk to individuals' rights and freedoms, Lyvy Stream must conduct a Data Protection Impact Assessment before the processing begins, as required by the GDPR.

This may be relevant to certain forms of systematic monitoring, large-scale sensitive-data processing, or other high-risk activities.

A DPIA should identify risks and appropriate measures to address them. Where required, Lyvy Stream must consult the supervisory authority before proceeding with processing that remains high risk.

Access to personal data should be limited to individuals who need it for an authorized purpose.

Where appropriate, personnel should receive privacy and security training and be subject to confidentiality obligations.

Lyvy Stream should review access permissions and revoke access when it is no longer necessary.

Lyvy Stream should periodically review its privacy practices, children's safeguards, vendor arrangements, consent systems, retention schedules, and incident-response procedures.

Reviews should consider changes to products, new monetization features, mobile applications, advertising integrations, and relevant legal requirements.

Where a review identifies a compliance gap, Lyvy Stream should document and implement reasonable corrective measures.

---

Lyvy Stream may update this Policy to reflect changes in law, products, technology, data-processing practices, or compliance requirements.

The revised version will be published with an updated date.

Where required by law, Lyvy Stream will provide notice of material changes and obtain new consent when necessary.

Users should periodically review this Policy to remain informed about relevant privacy and children's protection practices.

For privacy questions, data requests, parental concerns, or suspected violations of this Policy, users may begin through the available Lyvy Stream channels:

Lyvy Stream should publish a dedicated privacy contact method and any required DPO contact details if applicable. The platform should ensure that submitted requests reach personnel authorized to handle privacy matters.

Do not send passwords, full payment credentials, or unnecessary identity documents through public comments or other public-facing features.

Lyvy Stream recognizes that privacy and children's data protection require ongoing attention to legal obligations, product design, security, and operational practices.

By using Lyvy Stream, users remain entitled to the privacy rights provided by applicable law. Nothing in this Policy removes or limits any right that cannot lawfully be excluded.