1. General Provisions 1.1. This Privacy Policy (the “Policy”) describes how FINDPROEASY SERVICES LIMITED, registered in the Republic of Cyprus (the “Company”, “we”), processes the personal data of users of the FindPro platform — the website www.findpro.com.cy and the mobile applications (the “Platform”). 1.2. The Company acts as the data controller within the meaning of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Cyprus Law 125(I)/2018. 1.3. The Policy applies to two categories of users: Customers (persons placing orders for services) and Specialists (individuals and companies providing services). Differences in the data collected are set out in Section 2. 1.4. This Policy should be read together with the Platform’s Terms and Conditions. 2. What Personal Data We Process 2.1. Customer data: first and last name, e-mail address, phone number, password (in encrypted form); the content and details of the order; profile data the Customer adds voluntarily; device geolocation (where permission is granted); technical device data. 2.2. Specialist data (in addition to the basic name, e-mail, phone): information on specialisation and qualifications, and licences, certificates, diplomas and other documents uploaded by the Specialist (copies are not published; only the document’s title and issue date become public); an official identity document; for companies — registration and tax data (country of registration, registration number, registered address, name, tax number, VAT number) and the representative’s data. The Specialist’s payment card data for paying the Company’s fees is entered and processed directly by the payment provider Stripe; the Company does not receive or store full card details. 2.3. Technical data (both categories): IP address, device and operating-system type, device identifiers and push token, connection type, data on interaction with the Platform. 3. Purposes and Legal Bases of Processing We process personal data only where there is a legal basis under Article 6 GDPR. Each purpose has its own basis: • provision and operation of the Platform, registration and account management, placing orders and connecting the parties — performance of a contract (Art. 6(1)(b)); • collecting the Company’s fees via Stripe — performance of a contract (Art. 6(1)(b)); • verification of Specialists, Platform security, fraud prevention, dispute resolution — the Company’s legitimate interest (Art. 6(1)(f)); • compliance with tax, accounting and other obligations — compliance with a legal obligation (Art. 6(1)(c)); • marketing communications — consent (Art. 6(1)(a)), which may be withdrawn at any time. 3.1. We do not rely on the “public interest” or “exercise of official authority” bases — they are not applicable to a private company. 4. With Whom We Share Data 4.1. We do not share personal data with third parties except in the following cases and where there is a legal basis: • Stripe — the payment provider (collecting the Company’s fees); payment details are transmitted directly to Stripe and are governed by its terms; • between the Customer and the Specialist: upon confirmation of the Transaction, the parties receive each other’s contact details in order to interact outside the Platform. After such transfer, each party processes the received data as an independent controller; • infrastructure and service providers (hosting, database, communications, analytics), including Firebase (a Google service) — under data-processing agreements (Art. 28 GDPR); • law-enforcement and public authorities — where required by law. 5. Server Location and International Transfers 5.1. Hosting of the Platform is provided by H & S Cloudtech Ltd (Republic of Cyprus). The servers are physically located in London, United Kingdom. Protective measures are applied, including a firewall and Cloudflare protection, data encryption, encryption in transit (SSL/TLS), access control and backups. 5.2. As the servers are located in the United Kingdom, outside the European Economic Area, transfers are carried out on the basis of the European Commission’s adequacy decision for the United Kingdom. Where services process data outside the EEA without an adequacy decision (for example, certain Google services), the European Commission’s Standard Contractual Clauses (SCC) apply. 6. Retention Periods 6.1. We retain personal data no longer than necessary for the purposes of processing, unless a longer period is required by law. • account data — for the duration of the account. After deletion of the account, directly identifying data (first and last name, phone number, e-mail address) is replaced within 24 hours by an internal identifier (anonymisation), except for data we are required to retain by law. Backup copies are overwritten within the ordinary backup cycle; • accounting and tax documents — for the period established by the tax and accounting legislation of the Republic of Cyprus (6 years); • data necessary for defence against claims and dispute resolution — until the expiry of the applicable limitation periods; • records of acceptance of the terms (version, date, confirmation) — to the extent necessary for accountability. 7. Automated Processing and AI Support 7.1. Where a decision is taken solely by automated means and produces legal or similarly significant effects for the user, the user has the right to request human intervention, express their point of view and contest the decision (Art. 22 GDPR). 7.2. User support may be provided with the assistance of an AI assistant. The user is informed when they are interacting with artificial intelligence. The AI assistant provides informational support and does not take decisions producing significant effects for the user; decisions, disputes and claims are handled by the Company’s staff. The user may request to be served by a human at any time. The use of artificial-intelligence systems complies with applicable EU law, in particular the transparency requirements of Regulation (EU) 2024/1689. 8. Rights of the Data Subject In accordance with the GDPR and Law 125(I)/2018, the user has the right: • to access their personal data and supplementary information; • to rectification of inaccurate, or completion of incomplete, data; • to erasure (“the right to be forgotten”) in certain circumstances; • to restriction of processing in certain circumstances; • to data portability; • to object to processing in certain circumstances; • to withdraw consent at any time (where processing is based on consent), without affecting the lawfulness of prior processing; • to lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (www.dataprotection.gov.cy). To exercise these rights, send a request to [email protected]. 9. Security 9.1. The Company and its hosting provider apply reasonable technical and organisational measures to protect personal data: data encryption and encryption in transit (SSL/TLS), a firewall and Cloudflare protection, access control, backups, and measures to prevent unauthorised access. 9.2. In the event of a personal-data breach that poses a risk to users’ rights, the Company notifies the supervisory authority and, where necessary, the affected individuals within the prescribed time limits. 10. Cookies and Messages 10.1. The use of cookies is governed by a separate Cookie Policy published on the website. 10.2. Messages between the Customer and the Specialist are temporarily stored to enable their interaction; their content is not analysed, except when handling complaints and for the security of the Platform. 11. Amendment of the Policy 11.1. The Company may amend this Policy where there is a valid reason. The current version, stating the effective date, is published on the website. 11.2. The Company informs users of material changes (new processing purposes, new categories of data or recipients) by publishing the updated Policy with a new date and, where required or appropriate, by other available means. Non-material changes take effect upon publication. 12. Contact and Supervisory Authority 12.1. Controller: FINDPROEASY SERVICES LIMITED, Republic of Cyprus. Data-related contact: [email protected]. 12.2. Supervisory authority: Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, www.dataprotection.gov.cy. Effective date: 8 July 2026