PRIVACY POLICY

Effective Date: 2 September 2026

DATA CONTROLLER DETAILS

1. Introduction and Scope

ExactFlow p.s.a. ('ExactFlow', 'we', 'us', or 'our') is committed to protecting the privacy and personal data of all individuals who interact with our platform, website, and services. This Privacy Policy explains how we collect, use, store, share, and protect personal data in accordance with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR)

• Act of 10 May 2018 on the Protection of Personal Data (Dz.U. 2018 poz. 1000, as amended)

• Act of 18 July 2002 on Providing Services by Electronic Means (Dz.U. 2002 Nr 144, poz. 1204, as amended)

• Act of 16 July 2004 – Telecommunications Law (Dz.U. 2004 Nr 171, poz. 1800, as amended)

• Any other applicable national and EU data protection legislation

This Privacy Policy applies to all users of the ExactFlow platform, including registered business clients, their authorized users, visitors to our website, prospective clients, and third parties whose data we may process in the course of providing our services. By accessing or using our services, you acknowledge that you have read and understood this Privacy Policy.

2. Categories of Personal Data We Collect

2.1 Data Provided Directly by You

When you register, subscribe, or interact with ExactFlow, we collect:

• Identity data: full name, job title, role within your organization

• Contact data: business email address, telephone number, postal address

• Account credentials: username, hashed password, authentication tokens

• Billing and payment data: company name, VAT identification number (NIP), billing address, payment method details (processed via certified payment processors)

• Communication data: messages, support tickets, feedback, and correspondence with our team

2.2 Data Collected Automatically

When you access our platform or website, we may automatically collect:

• Technical data: IP address, browser type and version, operating system, device identifiers

• Usage data: pages visited, features accessed, session duration, click-stream data, error logs

• Cookie and tracking data: as described in our separate Cookie Policy

• Log data: server logs, access records, and diagnostic information

2.3 Data from Third-Party Integrations

Where you connect ExactFlow to third-party marketplaces, ERP systems, logistics providers, or other platforms, we may receive data necessary to perform the integration, including order data, product listings, inventory figures, customer details from your marketplace accounts, and shipping information. You are responsible for ensuring you have appropriate authority and a lawful basis to share such data with us.

2.4 Data We Receive About Prospective Customers (Indirect Collection)

Where our advertising or lead-generation integrations are enabled (see Sections 5.5 and 5.6), we may receive personal data about individuals who have expressed interest in our products or services without ever visiting our website directly — for example, by submitting a lead form on Facebook or Instagram, registering for a webinar, or through a business-contact enrichment or verification service.

Source of the data: such data originates from the advertising platform on which the individual submitted their details (for example, Meta), from event-registration tools, or from third-party business-data providers. The categories typically include name, business email address, telephone number, employer and job title.

Where we obtain personal data other than directly from you, we will, in accordance with GDPR Article 14, provide you with this Privacy Policy and information about its source within a reasonable period, and at the latest at the time of first communication with you. You may object to this processing at any time (see Section 8, Right to Object).

3. Purposes and Legal Bases for Processing

4. Artificial Intelligence and Automated Processing

ExactFlow's platform incorporates AI agents (Axel, Zane, Tesa, Raya, Nia, and Kai) that perform automated data processing to deliver core service functionality. We inform you of the following:

4.1 Nature of Automated Processing

Our AI agents process business operational data including order histories, inventory records, financial data, sales patterns, and HR-related records to generate insights, recommendations, and automated actions on your behalf. This processing is undertaken at your direction and under your instructions as data controller for your clients' data.

4.2 No Solely Automated Individual Decisions with Legal Effects

ExactFlow does not subject natural persons to solely automated decision-making that produces legal or similarly significant effects within the meaning of Article 22 GDPR, without human review. All material AI-generated recommendations require human confirmation before execution, unless explicitly configured otherwise by the Account Administrator with appropriate safeguards.

4.3 AI Training

We do not use your specific business data or client personal data to train our general AI models without your explicit written consent. Aggregated, anonymized performance statistics may be used to improve system performance in accordance with our legitimate interests.

4.4 Sales and Marketing Automation

Our CRM module may use automated processing to support sales and marketing, including: scoring or prioritising leads based on profile and engagement data; generating draft outreach messages and social media content; and classifying replies. These features assist our sales and marketing team; they do not make decisions producing legal or similarly significant effects about an individual without human review, consistent with Section 4.2.

Outbound marketing communications are sent only where we have a lawful basis to do so; we always identify the sender and always offer a simple means to opt out. Individuals can object to direct marketing at any time, which we honour immediately (see Section 8, Right to Object).

5. Data Sharing and Recipients

We share personal data only where necessary and with appropriate safeguards:

5.1 Service Providers (Processors)

We engage carefully vetted sub-processors to support our operations, including cloud infrastructure providers (EU-based or with appropriate transfer mechanisms), payment processors certified to PCI-DSS standards, email delivery services, customer support platforms, and analytics providers. All sub-processors are bound by Data Processing Agreements (DPAs) complying with GDPR Article 28.

5.2 Third-Party Integrations

Where you activate marketplace or platform integrations (e.g., Amazon, eBay, Shopify, Allegro), data is exchanged with those platforms pursuant to your instructions. ExactFlow acts as your data processor in respect of such exchanges.

5.3 Legal and Regulatory Disclosure

We may disclose personal data where required by law, court order, or at the request of Polish or EU regulatory authorities, including the Urząd Ochrony Danych Osobowych (UODO). We will notify you of any such requests unless legally prohibited from doing so.

5.4 Corporate Transactions

In the event of a merger, acquisition, or sale of all or part of ExactFlow's business, personal data may be transferred to the successor entity, subject to the same level of protection as provided under this Policy and applicable law.

5.5 Social Media, Advertising and Content-Publishing Integrations

Where you or we activate social media, advertising or content-automation features, personal data is exchanged through the official Application Programming Interfaces (APIs) of the relevant providers, strictly to deliver the requested functionality. Depending on the features enabled, these providers may include:

• Meta Platforms Ireland Ltd. — Facebook, Instagram, Messenger and WhatsApp Business (Page management and engagement, content publishing, and, where enabled, advertising and lead-form capture);

• LinkedIn, X (Twitter), Google (including YouTube and Google Ads) and TikTok — content publishing and, where enabled, advertising and lead capture;

• Google Workspace and Google Drive — storage of content assets, drafts and reports, and email-based approval workflows;

• Lead validation, enrichment and AI content-generation providers used to verify contact details and generate or enrich outreach content.

Each such provider that processes personal data on our behalf is bound by a Data Processing Agreement compliant with GDPR Article 28. Some of these providers are established outside the EEA. Where a provider also acts in its own right as an independent controller (for example, when you interact directly with its platform), it processes data under its own privacy policy; where it acts as our processor, any transfer of personal data to it outside the EEA is governed by the mechanisms described in Section 6 (International Data Transfers).

5.6 Meta / Facebook Platform Integration

Our platform integrates with the Meta platform (Facebook, Instagram, Messenger and WhatsApp Business) using Meta's official APIs, in accordance with the Meta Platform Terms and Developer Policies. Depending on the features you or we enable, this integration may involve:

• publishing content to, and managing engagement on, Facebook and Instagram Pages you authorise, including replying to comments and messages;

• running Facebook and Instagram advertising campaigns, including Meta Lead Ads;

• receiving the information an individual submits through a Meta Lead Ads form (typically name, email address, telephone number and company) for the purpose of following up on their enquiry;

• sending and receiving messages through Messenger and WhatsApp Business in connection with customer or prospect communications.

We process data obtained through Meta only for the purposes described in this Policy. We do not sell Meta Platform Data, we do not transfer it to data brokers, and we do not use it for any purpose incompatible with the basis on which it was collected.

You can ask us to delete data associated with your Facebook, Instagram or WhatsApp account at any time — see Section 13 ("How to Request Deletion of Your Data") and our Data Deletion Instructions page at www.exactflow.com/en/data-deletion.

6. International Data Transfers

ExactFlow is established in Poland and primarily processes data within the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure adequate protection through one or more of the following mechanisms:

• European Commission Adequacy Decisions

• Standard Contractual Clauses (SCCs) as approved by the European Commission (Commission Implementing Decision (EU) 2021/914)

• Binding Corporate Rules where applicable

• Specific derogations under GDPR Article 49 where permitted

You may request a copy of the applicable transfer mechanism by contacting privacy@exactflow.com.

7. Data Security

ExactFlow implements enterprise-grade technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction, including:

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256)

• Role-based access control and least-privilege principles

• Multi-factor authentication for platform access

• Regular penetration testing and vulnerability assessments

• ISO 27001-aligned information security management practices

• Comprehensive employee data protection training

• Business continuity and disaster recovery planning

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you without undue delay and, where required, notify the UODO within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33.

8. Your Rights as a Data Subject

Under the GDPR and applicable Polish law, you have the following rights in relation to your personal data:

To exercise any of your rights, please contact us at privacy@exactflow.com. We will respond within one calendar month of receiving your request. In complex cases, we may extend this period by a further two months, informing you accordingly. We may verify your identity before processing your request.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our website and platform. Detailed information about the cookies we use, their purposes, and how to manage your preferences is set out in our separate Cookie Policy, available at www.exactflow.com/en/cookie. In summary:

• Strictly necessary cookies are used to enable core functionality and cannot be disabled.

• Analytical/performance cookies help us understand how visitors use our platform (requires consent).

• Marketing/targeting cookies may be used to deliver relevant advertising (requires consent).

You may manage your cookie preferences at any time via our Cookie Consent Manager or your browser settings.

10. Children's Data

ExactFlow's services are directed exclusively at business clients (B2B) and are not intended for, nor directed at, individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact privacy@exactflow.com and we will promptly delete it.

11. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for legal, accounting, or reporting requirements. The specific retention periods applicable to each category of processing are set out in Section 3. Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with our Data Retention Policy.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities, applicable law, or best practice. We will notify registered account holders of any material changes by email at least 30 days before they take effect. The updated Policy will also be published on our website with the revised effective date. Continued use of our services after the effective date of changes constitutes acceptance of the updated Policy.

13. How to Request Deletion of Your Data

In addition to the general right to erasure described in Section 8 (Right to Erasure, Art. 17 GDPR), we provide the following specific routes for requesting deletion of data associated with our social media and advertising integrations:

• Via Facebook, Instagram or WhatsApp: if you connected with us through one of these Meta services, you may remove the ExactFlow app from your account (Facebook/Instagram: Settings & Privacy → Settings → Apps and Websites → Active → ExactFlow → Remove; for WhatsApp, contact us using the details below). Removing the app automatically triggers a deletion request that we process as described below.

• Via our website: visit our Data Deletion Instructions page at www.exactflow.com/en/data-deletion and follow the steps described there.

• By email: contact privacy@exactflow.com with the subject line "Data Deletion Request", telling us the email address, phone number, or Facebook/Instagram name associated with your data so that we can locate it.

On receiving a request, we verify the requester's identity, then delete or irreversibly anonymise the associated personal data across our systems and instruct our sub-processors to do the same, and confirm completion to you — normally within one calendar month (extendable by a further two months for complex requests, in which case we will notify you). We may retain a minimal one-way hashed identifier solely to ensure you are not re-contacted, and we retain any data we are legally required to keep (for example, invoicing records under Polish tax law).

14. Contact and Complaints

For any questions, concerns, or requests relating to this Privacy Policy or our data processing activities, please contact: