This Privacy Policy (“Policy”) is meant to inform you about the processing of your personal data (“Personal Data”) by DEITY B.V. (“Deity”, also referred to as “us”, or “we”, or “our”) and applies to the use of the services, products, software, and offerings (the “Services”) we provide to you. When you enter into an agreement with us regarding the use of our Services, you agree to this Policy.

1. Introduction

We respect your privacy. Therefore, we process, handle and protect your Personal Data with the utmost care. While processing Personal Data, we comply with requirements imposed by laws and regulations, such as the General Data Protection Regulation (“GDPR”). In this Policy, we will give a detailed explanation on how we collect data, why we do so and what your rights and obligations are. Please read this Policy carefully prior to using Deity Services and/or submitting any information on or through Deity Services.

DEITY B.V. is a company incorporated in The Netherlands, registered at the Chambers of Commerce under the registration number 70208859 and whose registered office is located at the Achtseweg Zuid 153F, 5651GW in Eindhoven.

2. Information we collect from you

We collect information that you give us or that we get from your use of our sites and Services, including without limitation, the following:

• Contact details, including, but not limited to, your name, address, place of residence, postal code, (mobile) phone number and email address;

• Financial data, including, but not limited to, your bank account number;

• Login credentials, including, but not limited to, username and password;

• Information about your use of our Services, including details of your visits to our sites, pages viewed and the resources that you accessed. Examples of information include, but are not limited to, device, IP address, browser information, cookie information, geographic location, and traffic data.

3. How we use your information

Deity may therefore process your Personal Data for the following purposes:

1. To provide our products and/or services to you and/or your company (Performance of a contract, Legitimate interest)

2. To execute marketing and related activities (Consent, Legitimate interest)

3. To send you (electronic) commercial messages (newsletters) with information about our products and/or services (Consent, Legitimate interest)

4. To update, analyze, maintain, secure and optimize our Services and associated technologies and services (Performance of a contract, Legitimate interest)

5. To comply with relevant laws and regulations (Compliance with legal obligations, Legitimate interest)

6. To inform you of any changes, offers, updates or other announcements about our Services (Performance of a contract, Legitimate interest)

7. To provide customer support (Performance of a contract)

8. To detect, prevent, and address technical issues (Performance of a contract)

4. Legitimate interest

Legitimate interests of Deity are, inter alia, improving and providing our products, services and Websites and informing you about the use of (new) products and services, marketing and sales activities.

If and in so far as Deity relies on the legitimate interest legal basis, Deity has undertaken a balancing test between the legitimate interests pursued by Deity as a controller and your interests and fundamental rights and freedoms, which require protection of Personal Data, to justify our reliance on this legal basis.

5. Information we share

Deity respects the privacy of all its users and ensures that the confidential nature of the Personal Data you provide us will be maintained. Deity will not make your Personal Data available to third parties, except when necessary as in the following circumstances:

• Third-party service providers to perform necessary actions on our behalf. We may share personal information with third-party service providers who need access such as to process emails;

• Compliance with laws. We diligently comply with the applicable laws regarding data protection and privacy. In case of legal obligation, we will present data from users to third parties, such as to report criminal acts or threats to public security to a competent authority.

6. Data security and compliance obligations

In accordance with the applicable laws and regulations, Deity has taken adequate technical and organizational measures to safeguard the security of your Personal Data. Deity stores Personal Data on a secure database that is protected by technical access controls and periodically reviews the information collection, storage and processing practices, including physical security measures, to guard against unauthorized access to our systems. All data we store is fully encrypted and cannot be used to send unauthorized messages when stolen or otherwise unlawfully obtained. However, please bear in mind that we cannot fully guarantee the safety of Personal Data as we cannot 100% prevent unauthorized access or use of Personal Data.

7. Data breaches

We will report any unlawful data breach of databases of our Services or the database(s) of our third-party data processors to any and all relevant persons and authorities within 72 hours of the breach if it is reasonably apparent that personal information stored in an identifiable manner has been accessed. Should you have any complaint about a breach, or the way in which we will handle a breach, please contact us.

8. Retention periods

Deity keeps your Personal Data, or other data that you provide to us, as long as necessary for the purposes indicated above, or to comply with our legal obligations such as (statutory) retention periods. After expiry of such a retention period, Deity will destroy all copies containing Personal Data or anonymize such data. Following anonymization, we might process the data in a non-identifiable, fully encrypted form for archival, statistical and/or other legitimate purposes.

9. International safeguards

Deity may transfer your Personal Data to countries outside the European Economic Area (“EEA”). Whenever Deity transfers your Personal Data to countries outside the EEA that are so-called non adequate countries, such transfer will be covered by appropriate safeguards, i.e. standard contractual clauses.

10. Your rights and choices

In line with our commitments and the applicable laws, data subjects have the following rights:The right of access;

• The right to rectification or correction of your Personal Data if it is inaccurate or incomplete;

• The right to erasure of the Personal Data that relates to you. Please note that there may be circumstances in which we are required to retain your Personal Data in order to meet our legal and regulatory obligations;

• The right to restrict the processing;

• The right to object the processing;

• The right to data portability;

• The right to object to profiling;

• The right to lodge a complaint with a supervisory authority.

If you wish to exercise (one of) these rights, please send an e-mail to info@deity.io (Subject: Privacy). Please note that to complete any of these requests, Deity might need to identify you.

Deity will respond within four weeks to your request. A further extension of this period up to three months may apply; depending on the circumstances. If Deity denies your request, Deity will explain why and inform you on your rights.

If you are not satisfied with the way your request has been handled or the way Deity processes your Personal Data, you can raise a complaint with the Dutch Data Protection Authority: https://autoriteitpersoonsgegevens.nl/en

11. Children

Our services and products are not directed to Children under the age of 18. We do not knowingly collect and/or process any personal information directly from children. If we discover we have received personal information from a child without parental or legal consent, in violation of this Policy, and/or the local applicable laws, we will take reasonable steps to delete that information as quickly as possible. If you believe we have any of such information from or about a child, please contact us at info@deity.io (Subject: Privacy [Children]).

12. Links, third party websites and social networking websites

Our Services and communications may embed hyperlinks to other websites which are not owned nor controlled by Deity. We are not responsible for the privacy practices, policies, notices or content of any third party websites, even if you link to them from our Services. Our Policy does not apply to any third party websites. We have no control over the collection, user tracking or any (mis)use of information or data on any third party website. We encourage you to read and understand the privacy practices, policies, notices, and content of any third party website that you visit.

13. Changes in our privacy policy

Please note that this policy might be subject to change from time to time. Deity reserves the right to change, update, modify, or remove any part of this Policy. If any modifications substantially affect your rights under this policy, we will send you an email where possible. Users will be always duly informed and may decide whether to continue to use our services or not in accordance with the new terms.

14. Disputes

If you have any dispute with us relating to our privacy practices, please contact our legal team at info@deity.com (Subject: Privacy [Dispute]). Most disputes can be resolved that way.