General Data Protection Regulation (GDPR) Notice

Last Updated: August 31, 2026

1. Introduction

This GDPR Notice supplements the Privacy Policy of Ohh BeeHave, LLC d/b/a Stinger Industries ("Stinger Industries," "we," "us," or "our") and applies to individuals located in the European Union and European Economic Area ("EU/EEA"). This notice is provided pursuant to Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), and describes how we collect, use, store, and protect your personal data when you use the Stinger Industries Command Center platform.

Stinger Industries operates an AI-powered Command Center platform designed for service businesses, accessible at stingerindustriesai.com.

2. Data Controller Information

The data controller responsible for your personal data is:

Ohh BeeHave, LLC d/b/a Stinger Industries
Port St. Lucie, Florida, United States
Email: ohhbeehave35@gmail.com
Phone: (772) 529-4144
Website: stingerindustriesai.com

3. Legal Bases for Processing

We process your personal data only where we have a valid legal basis to do so under Article 6 of the GDPR. The legal bases on which we rely include:

Contract Performance (Article 6(1)(b))

Processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract. This includes creating and managing your account, providing the Command Center platform and its features, processing payments and managing subscriptions, and delivering customer support.

Legitimate Interests (Article 6(1)(f))

Processing is necessary for our legitimate interests, provided those interests are not overridden by your fundamental rights and freedoms. Our legitimate interests include improving and optimizing our services and platform, ensuring the security and integrity of our systems, conducting analytics to understand usage patterns and improve user experience, preventing fraud and abuse, and communicating with you about service updates and changes.

Consent (Article 6(1)(a))

Where we rely on your consent, you have the right to withdraw it at any time. We rely on consent for sending marketing communications and promotional materials, placing non-essential cookies and similar tracking technologies, and processing data for purposes beyond what is necessary for the contract or our legitimate interests.

Legal Obligation (Article 6(1)(c))

Processing is necessary for compliance with a legal obligation to which we are subject. This includes maintaining tax and accounting records, responding to lawful requests from public authorities, and complying with applicable data protection laws and regulations.

4. Categories of Personal Data

We collect and process the following categories of personal data:

• Identifiers: Name, email address, phone number, IP address, account username, and other account registration details
• Commercial data: Subscription tier, payment history, transaction records, billing address, and service usage records
• Usage data: Log data, device information, browser type, operating system, feature usage patterns, session duration, and interaction data within the platform
• Communication content: Messages sent through the platform, customer support correspondence, and feedback provided through the service
• Call recordings and transcriptions: Voice recordings and AI-generated transcriptions of calls processed through the platform, where applicable to your use of the service
• Professional information: Business name, job title, industry, company size, and role within your organization

5. Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Our specific retention periods are:

• Account data: Retained for the duration of your active account. If you delete your own account under "Right to Erasure" below, your login, sessions, personal settings, and chat history are removed immediately -- there is no reactivation window.
• Financial and transaction records: Retained for seven (7) years in compliance with tax, accounting, and regulatory obligations.
• Server logs: Retained for ninety (90) days for security monitoring, troubleshooting, and incident response purposes.
• Communication records: Retained for twelve (12) months following the communication, unless a longer retention period is required for legal or compliance purposes.
• Call recordings and transcriptions: Retained for the duration of your active account. You may request deletion of specific recordings at any time.
• AI interaction data: Retained for the duration of your active account to support ongoing service functionality and personalization.
• Marketing consent records: Retained for the duration of your account plus three (3) years to demonstrate compliance with consent requirements.

6. Your Rights Under the GDPR

Under the GDPR, you have the following rights in relation to your personal data:

Right of Access (Article 15)

You have the right to obtain confirmation as to whether or not we process your personal data and, where we do, to obtain access to that data together with information about the purposes of processing, the categories of data concerned, the recipients or categories of recipients, the retention periods, and the existence of your other rights. You may request a copy of your personal data free of charge.

Right to Rectification (Article 16)

You have the right to obtain the rectification of inaccurate personal data concerning you without undue delay. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by providing a supplementary statement.

Right to Erasure (Article 17)

You have the right to obtain the erasure of your personal data without undue delay where the data is no longer necessary for the purposes for which it was collected, you withdraw consent on which the processing is based, you object to the processing and there are no overriding legitimate grounds, the data has been unlawfully processed, or the data must be erased for compliance with a legal obligation. This right is subject to exceptions, including where processing is necessary for compliance with a legal obligation or for the establishment, exercise, or defense of legal claims.

You can exercise this right yourself, immediately, from Settings: re-enter your current password to confirm, and your login, sessions on all devices, personal account preferences, and your own chat history are deleted at once. Your name is also removed from your own existing audit-log entries, replaced with "deleted user" -- the security events themselves are retained as required for compliance and security purposes. If you are the sole owner of a business account that has other members, you will be asked to promote another member to owner first. Deleting your own account does not delete business records (customers, invoices, proposals, jobs, photos, documents, etc.) that belong to the business account as a whole; those can be requested separately using the contact information below, subject to the exceptions above.

Right to Restriction of Processing (Article 18)

You have the right to obtain the restriction of processing where you contest the accuracy of your personal data (for a period enabling us to verify accuracy), where the processing is unlawful and you oppose erasure, where we no longer need the data but you require it for legal claims, or where you have objected to processing pending verification of whether our legitimate grounds override yours.

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance, where the processing is based on consent or contract performance and is carried out by automated means.

Right to Object (Article 21)

You have the right to object, on grounds relating to your particular situation, to processing based on our legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims. Where personal data is processed for direct marketing purposes, you have the right to object at any time, and we will cease processing for that purpose.

Rights Related to Automated Decision-Making (Article 22)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Our AI assistant, Annabelle, and other AI-powered features within the Command Center platform provide recommendations, insights, and suggestions to assist your business operations. These AI features do not make fully automated decisions that produce legal effects or similarly significantly affect individuals. Human oversight is maintained in all decision-making processes facilitated by the platform.

Right to Withdraw Consent

Where we rely on your consent as the legal basis for processing your personal data, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. You may withdraw consent by contacting us at the email address listed below, or by using the unsubscribe mechanism provided in marketing communications.

7. International Data Transfers

Stinger Industries is based in the United States. If you are located in the EU/EEA, your personal data will be transferred to and processed in the United States, which may not provide the same level of data protection as your home jurisdiction.

To ensure adequate protection of your personal data when transferred outside the EU/EEA, we rely on the following safeguards:

• Standard Contractual Clauses (SCCs): We use the European Commission's Standard Contractual Clauses as the primary mechanism for lawful data transfers to the United States and other countries outside the EU/EEA.
• Data Processing Agreements (DPAs): We maintain Data Processing Agreements with our sub-processors that include appropriate data transfer mechanisms and security commitments. A copy of our DPA is available upon request.
• Supplementary measures: Where necessary, we implement additional technical and organizational measures to ensure a level of protection essentially equivalent to that guaranteed within the EU/EEA, including encryption of data in transit and at rest.

8. Sub-Processors

We engage the following sub-processors who may process personal data on our behalf in the course of providing our services:

We maintain Data Processing Agreements with each sub-processor that include Standard Contractual Clauses where required. We will notify you of any intended changes concerning the addition or replacement of sub-processors, giving you the opportunity to object to such changes.

9. Data Protection Officer

As a small business, Stinger Industries is not required to appoint a Data Protection Officer under Article 37 of the GDPR. However, we have designated a privacy contact to handle all data protection inquiries and requests from EU/EEA individuals:

Privacy Contact
Email: ohhbeehave35@gmail.com
Phone: (772) 529-4144

You may contact our privacy contact with any questions, concerns, or requests related to the processing of your personal data or the exercise of your rights under the GDPR.

10. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, we will:

• Notify the relevant supervisory authority without undue delay and, where feasible, no later than seventy-two (72) hours after becoming aware of the breach, in accordance with Article 33 of the GDPR. Where notification is not made within 72 hours, we will provide a reasoned justification for the delay.
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, in accordance with Article 34 of the GDPR. The notification will describe the nature of the breach, the likely consequences, the measures taken or proposed to address the breach, and the contact details of our privacy contact.
• Document the breach including the facts relating to the breach, its effects, and the remedial action taken, in accordance with Article 33(5) of the GDPR.

11. Supervisory Authority

If you are located in the EU/EEA and believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. You may lodge a complaint with the supervisory authority in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement. A list of EU/EEA data protection authorities and their contact information is available at: European Data Protection Board - Members.

We encourage you to contact us first so that we may attempt to resolve any concerns before you file a complaint with a supervisory authority.

12. Children

The Stinger Industries Command Center platform and its services are designed for business use and are not directed at children under the age of sixteen (16). We do not knowingly collect personal data from children under the age of 16 in the EU/EEA. If we become aware that we have collected personal data from a child under 16 without verification of parental consent, we will take steps to delete that information promptly. If you believe we may have collected information from a child under 16, please contact us at ohhbeehave35@gmail.com.

13. Changes to This Notice

We may update this GDPR Notice from time to time to reflect changes in our processing activities, legal requirements, or business practices. When we make material changes, we will notify you by posting the updated notice on our website with a new "Last Updated" date. Where required by law, we will obtain your consent to material changes that affect the processing of your personal data. We encourage you to review this notice periodically to stay informed about how we protect your data.

14. Contact Information

If you have any questions about this GDPR Notice, wish to exercise your rights, or have concerns about how we process your personal data, please contact us at:

Ohh BeeHave, LLC d/b/a Stinger Industries
Port St. Lucie, Florida, United States
Email: ohhbeehave35@gmail.com
Phone: (772) 529-4144
Website: stingerindustriesai.com

We aim to respond to all data protection inquiries within thirty (30) days of receipt. Complex or numerous requests may require an additional sixty (60) days, in which case we will notify you of the extension and the reasons for it within the initial thirty (30) day period.