This Privacy Policy ("Policy") explains how Cykel AI PLC ("Cykel", "we", "our", or "us") processes Personal Data (defined below) of individuals who use our services, including our platform, websites (e.g., cykel.ai), applications, and other online services (jointly, the "Services"). This Policy also explains your rights and choices about how we use your Personal Data, including how you can access or update certain information about you.

In this Policy, "Personal Data" means any information relating to an identified or identifiable individual, such as an individual's name, address, telephone number, or email address. In certain jurisdictions, this may also be referred to as "Personal Information."

This Policy applies to instances in which we offer our Services, products, and platforms to individual users. For these relationships, Cykel acts as a data controller and is governed by this Policy.

This Policy does not apply when we offer our Services and process Personal Data on behalf of enterprise/business customers. We act as a service provider/data processor for those relationships and our use of that data is governed by our customer agreements.

1. Categories of Personal Data We Collect:

(a) Personal Data You Provide to Us

Contact Details. When you set up an account to use our Services, we ask you to provide your contact details such as your name, email address, phone number, address, and contact preferences.

Text Inputs. We process any text or other content that you choose to share with us or input into our Services to generate outputs for our digital workers (Lucy, Eve, Samson), as well as any Personal Data that you may decide to include in your text.

ATS and CRM Data. If you connect your Applicant Tracking System (ATS) or Customer Relationship Management (CRM) system, we may collect candidate, job and sales data from these systems to enable our digital workers to function effectively.

Profile Information and User Content. When you sign up for our Services, you may indicate how you intend to use the Services (e.g., professional use). We collect other information you may input when you use the Services, upload files or leave feedback.

Feedback/Communications. If you contact us directly or express interest in using our Services, we collect Personal Data including your name, email address, the contents of a message or attachments that you may send to us, and other information you choose to provide. If you subscribe to our newsletter, then we will collect Personal Data from you, such as your name and email address. When we send you emails, we may track whether you open them to learn how to deliver a better customer experience and improve our Services. If you respond to a survey, we will capture your responses and any other Personal Data you provide.

Payment Details. When you register to use any of our paid Services, our third-party payment processor, Stripe, collects and processes your payment-related information, such as your name, email, billing address, credit/debit card or banking information or other financial information. Please consult Stripe's privacy policy for more information.

Verification Information. As permissible by applicable law, we may ask you to provide verification of your identity to use our Services. This may include, for example, proof of address, copy of a personal identification card or passport.

Other Information You Provide. We may collect other information you may provide to us, such as when you use our alpha or beta products and services, attend events hosted by us, interact with us online or offline, or confirm your identity. Some of these services may have additional terms.

(b) Personal Data We Collect Automatically From You and/or Your Device

Information from Cookies and Similar Technologies. We and our third-party partners may collect information about you using cookies, pixel tags, SDKs, or similar technologies. Categories of information that we may collect using cookies includes:

Location Information. When you use our Services, we infer your general location information, for example by using your internet protocol (IP) address. In some jurisdictions, we will ask for your permission before doing so.

Device Information. We receive information about the device and software you use to access our Services, including IP address, web browser type, operating system version, phone carrier and manufacturer, application installations and versions, device identifiers, mobile advertising identifiers, and push notification tokens.

Usage Information. We receive information about your interactions with our Services, such as the content you view, the actions you take or the features with which you interact when you are using the Services and the dates and times of your visits.

(c) Personal Data We Collect from Third Parties

Information from Third Parties. For our digital worker Lucy, we collect publicly available candidate data for sourcing purposes. For Samson, we collect public web data and data from user-connected sources for research and analysis purposes. Where permitted by applicable laws, we collect this information to provide our Services.

Third-Party Logins. If you choose to register or log in to our Services using your account with third parties, we receive Personal Data about you from such third parties, such as your name, email address, username, and profile picture.

Information from Service Providers. We may receive information that you have shared with certain third-party service providers, for example in relation to our verification / background checks, such as 'Know Your Customer' (KYC) and 'Anti-Money Laundering' (AML) checks.

In some cases, we need to collect your Personal Data to provide you with our Services. In these cases, if you choose not to provide the requested Personal Data, you may not be able to use our Services. We will tell you if providing Personal Data is required by law or under a contract and what are the consequences of failing to provide it.

2. Purposes of Processing Personal Data and Legal Basis:

(a) Purpose and Legal Basis

The table below describes the purposes for which we process your Personal Data when acting as a data controller and the legal bases for such processing. When we rely on legitimate interest as the legal grounds to process your Personal Data, you have the right to object to that processing. Please note that where the legal bases specified are not applicable in your country, we will rely on consent or other available grounds to process your Personal Data.

‍

We only rely on our or a third party's legitimate interests to process your Personal Data when we determine that these interests are not overridden by your rights and interests. When we use your information because we or a third party have a legitimate interest to do so, you may have the right to object to that use.

(b) Content Moderation and User Suspension

Cykel does not undertake to review all Content and expressly disclaims any duty or obligation to monitor or review content. However, to maintain the integrity and security of your data, and for fraud prevention purposes, Cykel reserves the right to moderate all data input into Cykel tools and outputs. In certain circumstances, Cykel may share your inputs or outputs, which may include Personal Data, with third parties to support the content moderation and safety initiatives. Users found to have engaged in activity that violates the Prohibited Use Policy may be subject to termination or suspension under the applicable Terms of Service.

3. Data Recipients:

Your Personal Data may be shared with:

Affiliates. We may share any Personal Data we receive with our current or future affiliates for any of the purposes described in this Privacy Policy.

Vendors and Service Providers. We may share your Personal Data with third-party vendors and service providers who provide services such as verification/background checks, content moderation, website hosting, data analysis, advertising, information technology and related infrastructure provision, customer service, email delivery, auditing, and payment processing.

Other Users. We may share your Personal Data with other users if you instruct us to do so. Certain services and features may allow you to display or share information directly with other users. For example, you may share files or outputs or send information to users outside of our tool. Be sure you trust any user with whom you share information.

Third Parties. We may jointly develop, promote or offer products and features with other companies or partners which may require providing access to your Personal Data for the purpose of (a) providing, maintaining or supporting the services you requested, (b) analyzing and improving our services, and (c) marketing, advertising and other promotional activities. Certain services and features may allow you to display or share information with third parties. For example, you may share files or outputs or send information to third-party applications. Be sure you trust any third party with whom you share information.

As Required By Law and Similar Disclosures. We may access, preserve, and disclose your Personal Data with law enforcement agencies, regulatory bodies, and public authorities or pursuant to the exercise of legal proceedings if we believe doing so is required or appropriate to (a) comply with law enforcement requests and legal process, such as a court order or subpoena; or (b) protect your, our, or others' rights, property, or safety. For the avoidance of doubt, the disclosure of your Personal Data may occur if you use our Services to create any objectionable content.

Merger, Sale, or Other Asset Transfers. We may disclose your Personal Data to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company, or we sell, liquidate, or transfer all or a portion of our assets.

Other Data Recipients. We may also disclose your information with other parties only where we have received your consent to do so.

4. International Data Transfers:

Our Services are hosted in the European Union and the United States. This means we may transfer your Personal Data outside your country, state or province of residence, depending on your location at that time.

The data will be transferred for the time required to fulfill the purpose for which it is processed. It can be shared with our service providers and Cykel's affiliates for the purposes listed in Section 2. In such cases, Cykel is the controller of the data, and the service providers are processors or joint controllers, as the case may be.

We may transfer personal data to the following categories of recipients:

Depending on where you are, we apply appropriate protections when we transfer your Personal Data to such countries. These protections may include:

• Transferring Personal Data to countries which have been found to provide adequate protection by the competent authorities, as appropriate (if you live in Europe, see the list of countries subject to an adequacy decision by the European Commission);
• Using contractual protections (i.e., EU Standard Contractual Clauses, Brazil Standard Contractual Clauses, or, if you live in Japan, contracts containing safeguards equal to Japanese data protection law) for the transfer of Personal Data;
• If you live in Europe, transferring to recipients who have certified to participate in the EU-U.S. Data Privacy Framework, or adopted binding corporate rules; or
• Obtaining your express consent.

For more information about how we transfer Personal Data, or to obtain a copy of the contractual safeguards we use for such transfers, you may contact us using the contact details indicated in the "Contact Us" section below.

Please note that the data protection laws in the locations where we transfer or process data may differ from those in your area. While the data is in another jurisdiction, it may be accessed by the courts, law enforcement and national security authorities.

5. Data Retention:

We take measures to delete your Personal Data or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it unless we are required or permitted by law to keep this information for a longer period. When determining the specific retention period, we consider various factors, such as the type of service provided to you, the nature and length of our relationship with you, and mandatory retention periods provided by law and any relevant statute of limitations. Cykel will not keep data it generates about you longer than 4 years after your last interaction with us, except as required by law.

6. Your Cookie Choices

Cookies, pixel tags, SDKs, or similar technologies ("Cookies") are technologies used to collect information about users and their activities on a website. We and our third-party partners, such as analytics and advertising partners, may collect information about you using Cookies to collect information about your online activities over time and across different services.

The information collected via Cookies may include information such as unique identifiers, system information, IP address, web browser, device type, and the web pages that you visit just before or just after you use the Services, as well as information about your interactions with the Services, such as the date and time of your visit, and where you have clicked. More information about the data categories and elements collected using Cookies can be found in Section 1b.

Types of Cookies

We may use both session cookies and persistent cookies. A session cookie disappears after you close your browser. A persistent cookie remains after you close your browser and may be used by your browser on subsequent visits to our Services. Cookies we or our third-party partners place may fall under one of the following purposes:

• Strictly Necessary Cookies. Cookies that are essential to make our Services available to you, for example, to provide login functionality or to identify bots who try to access our website. These cookies cannot be disabled as we cannot provide you with the Services without this type of Cookie.
• Performing & Analytics Cookies. Cookies for website and app analytics purposes to support operation, maintenance, and improvement of our Services. We may use our own analytics Cookies or third-party analytics providers, such as Google Analytics, Mixpanel, and Clarity, to collect and process certain analytics data on our behalf and understand how you engage with our Services.
• Targeting & Marketing Cookies. Cookies that may be ours or our third-party partners and support us and our advertisers in serving relevant advertising on our sites as well as sites that are not owned or operated by us to promote our services, articles, or events. The Cookies are used to make advertising messages more relevant to you and your interests or prevent the same ad from continuously re-appearing.

Depending on the country in which you are located, you may be asked to provide your consent for our use of Cookies (except for strictly necessary Cookies). In addition, you have the following choices concerning the use of Cookies.

• Browser Settings. Certain web browsers allow you to manage your preferences relating to Cookies. You can set your browser to refuse Cookies or delete certain Cookies. Please note that if you choose to block all Cookies, doing so may impair the use of our Services.
• Google Analytics Opt-out. To opt out from Google Analytics' use of information collected on the Services through Cookies, you can download the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/gaoptout.
• Third Party Advertising Companies' Opt-Out. We work with third party advertising partners to show you ads that we think may interest you. Some of our advertising partners are members of the Network Advertising Initiative or the Digital Advertising Alliance. If you do not wish to receive personalized ads, please visit their opt-out pages to learn about how you may opt out of receiving web-based personalized ads from member companies. You can access any settings offered by your mobile operating system to limit ad tracking, or you can install the AppChoices mobile app to learn more about how you may opt out of personalized ads in mobile apps.

7. Your Rights

(a) Data Subject Rights

Depending on where you are located or reside, you may have certain rights regarding the Personal Data we maintain about you and certain choices about what Personal Data we collect from you, how we use it, and how we communicate with you.

• Access Your Personal Data: Receive confirmation of processing and request access the Personal Data we maintain about you. Most of your Personal Data can be accessed and exported by logging into your account. Where provided by applicable law, you may request that we include a description of the purpose of the processing of your personal data, third parties with which your data has been shared, and information regarding the safeguards for international data transfer.
• Correct Your Personal Data: Request to update and correct inaccuracies in your Personal Data. Most of your Personal Data can be accessed and corrected by logging into your account and accessing your account settings.
• Delete Your Account: Request to close your account.
• Delete Your Personal Data: Request that Cykel delete all Personal Data we maintain about you including your account. This deletion also includes the personal data processed under the legal basis of consent. Where provided by applicable law, you may request that your Personal Data be anonymized rather than deleted.
• Restrict or Object To Processing of Your Personal Data: Restrict or object to the processing of your Personal Data, where applicable.
• Request Portability of Your Personal Data: Request to transfer your Personal Data to another authorized organization.
• Withdraw Consent: You may withdraw any consent you previously provided to us regarding the processing of your Personal Data at any time. We will apply your preferences going forward and this will not affect the lawfulness of the processing before you withdraw your consent.
• Deactivate Push Notifications: If you use one of our mobile applications, with your permission, we may send push notifications to your mobile device. You can deactivate these notifications at any time by changing the notification settings on your mobile device.
• Unsubscribe from Marketing Communications: You may unsubscribe from receiving marketing communications at any time by following the instructions contained within the email. Please be aware that if you opt out of receiving commercial emails from us or otherwise modify the nature or frequency of promotional communications you receive from us, it may take some time for us to process your request and you may receive promotional communications from us that you have opted out from during that period, to the extent permitted by applicable law. Additionally, even after you opt-out from receiving commercial messages from us, you will continue to receive administrative messages from us regarding our Services.

You may exercise these rights by contacting us at hello@cykel.ai. Before fulfilling your request, we may ask you to provide reasonable information to verify your identity. Please note that applicable law may provide for exceptions and limitations to each of these rights.

In addition to the rights listed above, you may also have the right to lodge a complaint with a supervisory authority, including in your country of residence, place of work, or where an incident took place.

(b) United States Residents

Residents of certain U.S. states, including California, Connecticut, Colorado, Utah, Virginia, Oregon, Montana, or Texas, have additional privacy rights disclosures regarding their Personal Information, as described below. In certain U.S. states, you have the following rights in addition to those listed in Section 7a:

Sale of Personal Information, Sharing for Cross-Context Behavioral Advertising, and Targeted Advertising

When we share Personal Information through our targeting cookies or with vendors that provide advertising services to us, that is considered a sale or sharing for cross-context behavioral advertising or targeted advertising under certain U.S. state privacy laws. You can opt out of the sale of your Personal Information, including the sharing of your Personal Information for targeted or cross-contextual behavioral advertising by contacting us at hello@cykel.ai.

The following types of Personal Information may be processed for purposes of targeted advertising, and may have been "shared" or "sold" in the 12 months prior to the last modified date of the privacy policy:

Online Identifiers: IP address; unique identifier.

Each category of Personal Information listed above may be "shared" with or "sold" to the following third parties in connection with our marketing activities:

• Advertising vendors (e.g., affiliate marketing companies, tracking technology providers).
• Parties to a corporate transaction (e.g., if we are involved in the purchase, sale, lease, or other acquisition of our systems containing personal information).

Due to the fact that our services are intended for users age 18 or over, we do not knowingly "sell" or "share" Personal Information of individuals under the age of 18.

Do Not Track. Our websites and apps are not designed to respond to "do not track" requests from browsers.

Authorized Agents. In those states where it is applicable, your authorized agent may submit a request to exercise any of the above rights on your behalf. Cykel may request additional information to verify their authority to act on your behalf before processing any requests.

8. Third Parties:

Our Services may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this Privacy Policy does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.

9. Security:

We implement reasonable security measures to secure and protect your Personal Data. We note that, as no electronic transmission or storage of information can be entirely secure, we can make no guarantees as to the security or privacy of your information, to the extent permitted by applicable law.

10. Children's Privacy:

Our Services are not intended for or directed at children under the age of 18 and Cykel does not knowingly collect, store, or process Personal Data from children under the age of 18.

If you are under the age of 18, you are not permitted to submit any Personal Data to us. If we become aware that we have inadvertently received Personal Data from a child under the age of 18, we will delete that information from our records.

11. Updates to this Policy:

We may periodically update this Policy. If there are significant changes, we will notify you as required by law.

12. Contact Us:

For any questions regarding this Policy, our processing of your Personal Data, or to exercise your rights, please contact us at hello@cykel.ai or write us at:

Cykel AI PLC 16 Great Queen St London WC2B 5DG United Kingdom