EU/EEA GDPR Privacy Addendum

1. Scope

This addendum applies to users located in the European Economic Area.

2. Controller

Controller: Subjective Technologies™ (trade name and technology stack operating WorkTwins™ and related services) Contact: [email protected] EU representative, if applicable: Not currently appointed unless required by applicable law; will be designated upon incorporation of the operating entity.

3. Purposes and Legal Bases

WorkTwins processes personal data for:

| Purpose | Example data | Legal basis | |---|---|---| | Account creation | email, login identifiers | contract | | WorkFootPrint creation | work-context signals | consent / contract / legitimate interests, as reviewed | | Matching | derived features, compatibility vectors | consent / contract / legitimate interests, as reviewed | | Chat/collaboration | messages, shared cards | contract / consent | | Security | logs, device info | legitimate interests / legal obligation | | Billing | company billing data | contract / legal obligation | | Legal compliance | required records | legal obligation |

Final lawful basis must be confirmed by counsel for each feature and deployment.

4. Special Category Data

WorkTwins is designed to avoid processing special-category data. Non-work private activity is filtered and excluded where possible.

WorkTwins does not intentionally use adult content, sex life, health, religion, politics, or other sensitive non-work data for matching.

5. Automated Decision-Making

WorkTwins provides compatibility recommendations. It should not be used as the sole basis for decisions that produce legal or similarly significant effects.

6. User Rights

EEA users may have rights to:

• access;
• rectification;
• erasure;
• restriction;
• portability;
• objection;
• withdraw consent;
• lodge a complaint with a supervisory authority.

7. International Transfers

Where personal data is transferred outside the EEA, WorkTwins will use appropriate safeguards, such as Standard Contractual Clauses where required.

8. Retention

WorkTwins retains data only as long as necessary for the purposes described, unless longer retention is legally required.

9. DPIA

WorkTwins should conduct a DPIA for high-risk deployments, including company/workplace deployments and AR/visual-context processing.

10. Contact

Privacy contact: [email protected]