Privacy Policy

Privacy Policy · GENERAL PROVISIONS

1. This Privacy Policy (hereinafter the Privacy Policy) sets out how the Provider, UAB Isira, legal entity code: 303044987 (hereinafter the Provider, we or the Data Controller), collects, uses, stores, transfers and otherwise processes personal data when a user uses the artificial intelligence-based emotional well-being and self-help platform “Control let go” operated by the Company (Provider) (hereinafter the Platform), available on the internet website https://controlletgo.ai, https://controlletgo.com https://ctrlletgo.ai.

2. The Privacy Policy applies to all Platform Users, regardless of whether they use the free (Platform version, the limited-functionality version or the paid (subscription) version of the Platform Services.

3. By using the Platform Services, the User confirms that they have read this Privacy Policy.

4. Given the nature of the Platform and the fact that users may, at their own initiative, provide sensitive information about their emotional state, psychological experiences or other personal aspects of their lives, the Provider pays particular attention to the protection of personal data.

5. This Privacy Policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, hereinafter the GDPR), the legislation of the Republic of Lithuania and other legislation governing the protection of personal data. Where certain Platform functionalities are governed by additional legislation or subject to additional requirements, the Provider ensures that personal data are processed in compliance with the requirements of such legislation as well.

6. The Provider is established and operates in the European Union (hereinafter the EU); therefore, irrespective of the User’s place of residence (registered office), this Privacy Policy is a document prepared on the basis of the GDPR and applies to the relationship with any citizen of any country in the world using the Platform services.

7. When processing personal data, the Provider follows these principles:

7.1. collects only the personal data that are necessary for the operation of the Platform and the provision of its services;

7.2. by default, the Platform does not collect or retain the User’s conversation history for long-term memory and starts each new conversation without the context of previous conversations context, except where the User expressly chooses otherwise, i.e. to collect and retain such data.

7.3. The artificial intelligence used on the Platform to provide the Services (i.e. an agent/LLM (artificial intelligence system)) does not under any circumstances collect or retain the User’s data; it only processes the data in order to provide a response, after which the data are automatically deleted immediately. This functionality does not change regardless of the User’s choice;

7.4. provides the User with the opportunity to decide whether the User wishes the Platform to improve the User’s experience (“user experience”) by retaining and subsequently using information from previous conversations in subsequent conversations;

7.5. ensures that the User can change their choice regarding the use of the artificial intelligence memory function at any time;

7.6. enables the User to delete the accumulated conversation history or other information that has been retained through the use of the artificial intelligence memory function, except where its retention is required by applicable law ;

7.7. processes personal data in accordance with the principles of lawfulness, fairness, transparency, data minimisation, purpose limitation, accuracy, storage limitation, and integrity and confidentiality established by the General Data Protection Regulation.

8. The use of the Platform Services is systematically linked to and governed not as a separate document, but together with the Platform Terms of Use, Consent to the Processing of Special Categories of Personal Data (Explicit Consent), Medical and Psychological Liability Disclaimer, Payment (Subscription) Policy and other legal documents published on the Platform, where such documents are published.

9. In the event of any conflict between this Privacy Policy and the requirements of mandatory legislation, the provisions of the legislation shall prevail.

Privacy Policy · USER PRIVACY CHOICES AND SPECIFIC FEATURES OF INFORMATION STORAGE

10. The Platform is designed to ensure continuity of conversations, Platform functionality, personalisation of Services and an improved User experience (“user experience”) when the User uses the standard conversation mode. For these purposes, by default, the User’s Conversation History is stored and Memories are created and stored.

11. Conversation History – the content of a specific conversation between the User and the Platform saved in the User’s account. Individual conversations saved in the Conversation History are accessible to the User in their account and may be viewed at a later time (hereinafter the Conversation History).

12. Memories – data or facts about the User extracted from information provided by the User during conversations and stored separately, which may be used in subsequent conversations to ensure continuity of conversations, personalise the Platform’s responses and improve the User experience (hereinafter Memories).

13. Incognito Conversation – a separate conversation mode initiated at the User’s choice, during which the Platform does not use previously stored Memories about the User, the conversation is not saved in the Conversation History, and information provided during the conversation is not used to create new Memories or supplement existing Memories (hereinafter the Incognito Conversation).

14. Memories are not a copy of the entire Conversation History or of a specific conversation. They are separate items of information that the Platform stores and may use in subsequent conversations with the same User for the purposes specified in point 3 of this section.

15. The User is informed and is aware that, when using the standard conversation mode, the storage of the Conversation History and the Memories functionality form part of the operation of the Platform and cannot be disabled separately. A User who wishes to communicate with the Platform without using previously stored Memories about them and without saving a specific conversation in the Conversation History is provided with the option to select an Incognito Conversation.

16. The User may view the Conversation History in their account and use the means provided by the Platform to delete individual previous conversations.

17. The User is also provided with the option to manage the Memories stored about them – to view and delete them individually or to delete all Memories at once.

18. The Conversation History and Memories are separately managed categories of information. Therefore, deleting a specific conversation from the Conversation History does not in itself mean that the Memories previously created from that conversation are also deleted, while deleting a specific Memory does not in itself mean that the conversation from which the relevant information was obtained is deleted from the Conversation History. To remove the relevant information from both categories, the User must delete it separately from each category, unless the Platform interface expressly indicates otherwise.

19. The User may initiate an Incognito Conversation at any time at their own initiative.

20. An Incognito Conversation is initiated without the context of previous conversations stored in Memories. During an Incognito Conversation, the Platform does not use previously stored Memories about the User to generate responses.

21. The content of an Incognito Conversation is not saved in the User’s Conversation History, and information provided by the User during an Incognito Conversation is not used to create new Memories or supplement existing Memories. Once an Incognito Conversation has ended, its content is not used to ensure continuity or personalisation of future conversations with the User.

22. Selecting an Incognito Conversation does not affect the Conversation History or Memories saved in the User’s account before the Incognito Conversation was initiated. After the Incognito Conversation has ended and the User returns to the standard conversation mode, the Platform may continue to use Memories stored before the Incognito Conversation was initiated for the purposes and in accordance with the procedures set out in this Privacy Policy.

23. Before initiating an Incognito Conversation, the User is informed through the Platform interface of the key operating conditions of this mode and its differences from the standard conversation mode.

24. If the User chooses to delete an individual conversation saved in the Conversation History, an individual Memory or all Memories, the relevant information is removed from the Platform functions available to the User and, taking into account the Platform’s technical architecture, from the systems actively used by the Provider within the period specified in this Privacy Policy or otherwise reasonably determined in compliance with applicable legislation. Certain data may be retained for longer where such retention is required by applicable legislation or where there is another lawful basis for retaining it, including where the data are necessary for the Provider to establish, exercise or defend legal claims. Such data are no longer used for the purposes of personalising the User’s conversations or the Memories functionality, except where there is a separate lawful basis for processing them for such purposes.

25. The specific purposes of processing, legal bases, retention periods and other conditions for processing personal data processed in the Conversation History, Memories and Incognito Conversations are set out in other relevant sections of this Privacy Policy and its annexes.

Privacy Policy · PERSONAL DATA PROCESSED

26. The Provider processes only the personal data that are necessary for the following purposes: the operation of the Platform and the Services, ensuring the functionality of the Platform, performing contractual obligations, fulfilling obligations established by law, or processing information that the User voluntarily provides when using the Platform and its Services.

27. Depending on which Platform functions and Services the User uses and which privacy preferences they have selected, the scope of personal data processed may vary.

28. The following data may be processed when creating a User account: (i) name or pseudonym chosen by the User; (ii) email address provided by the User; (iii) password (stored in encrypted form); (iv) confirmation that the User is at least 18 years old; (v) date and time of creation of the User account; (vi) status of the User account and selected service plan; (vii) language selected by the User for using the Platform; (viii) User’s country.

29. The following technical data may be processed automatically when using the Platform, where necessary to achieve the specified purposes: (i) IP address; (ii) date and time of logins; (iii) technical information about the device used; (iv) operating system and browser data; (v) session identifiers; (vi) technical operation logs (“log files”); (vii) information about the use of Platform functions. These data are used to ensure the security of the Platform, detect and resolve technical issues, prevent fraud and improve the quality of the Services.

30. Data provided during Conversations generated in the User account: when using the Platform, the User may voluntarily provide various types of information, including: (i) questions and requests; (ii) descriptions of life situations; (iii) emotional experiences; (iv) personal insights and opinions; (v) information about relationships, family, work, finances or other aspects of the life of the User or the individuals involved in the story told by the User; (vi) other information that the User decides to provide to the Platform in their account during a conversation.

31. The Provider does not require the User to provide more personal data than are necessary to use the Platform and its Services; however, the Provider objectively cannot restrict the information that the User voluntarily chooses to disclose during a conversation, regardless of whether the User provides accurate or inaccurate data.

32. Given the purpose of the Platform and the Services provided through it, the User may voluntarily provide information that is considered special categories of personal data under the GDPR. Such data may include, but are not limited to: (i) data concerning physical or mental health; (ii) information about emotional state; (iii) information about addictions, illnesses or other conditions; (iv) data concerning sexual life or sexual orientation and other related aspects or experiences; (v) religious or philosophical beliefs; (vi) other data subject to special protection under applicable legislation.

33. Special categories of personal data are processed only to the extent necessary to ensure the functionality of the Platform and only with the User’s explicit consent to the processing of such data, as set out in a separate Consent to the Processing of Special Categories of Personal Data.

34. If the User selects a paid subscription to the Platform Services, the following data may be processed: (i) subscription plan selected in the User’s account; (ii) subscription start and end dates; (iii) payment status; (iv) invoice data; (v) payment identifiers; (vi) other information necessary for subscription administration and the collection of payments.

35. Where payments are processed through a third-party payment service provider, the Provider does not process the full payment card number, card security code (CVV/CVC) or other authentication data provided by the User, except where such data are lawfully transferred to the Provider and to the extent necessary to administer a specific payment.

36. If the User contacts the Provider by email or other means of communication, the Provider may process: (i) User’s contact details; (ii) content of the correspondence; (iii) information about the enquiry submitted; (iv) other information necessary to provide a response or resolve the issue.

Privacy Policy · USE OF ARTIFICIAL INTELLIGENCE IN THE PROCESSING OF PERSONAL DATA

37. The artificial intelligence used on the Platform helps generate responses to enquiries submitted by the User, analyse the context of conversations and, where the User selects the Conversation Continuity function, ensure more consistent communication. However, neither the Platform itself nor the Artificial Intelligence is an independent data controller and neither determines the purposes or means of processing personal data.

38. The Platform’s Artificial Intelligence processes only the information that is necessary to generate a response during the relevant conversation session or that the User has chosen to save by activating the Conversation Continuity function. If the Conversation Continuity function is not activated, previous conversations are not used to generate new responses to the questions or situations submitted by the User.

39. Responses generated by the Artificial Intelligence are automatically generated informational content and are not works created by the Provider or by any third-party persons or specialists engaged by the Provider.

40. The Provider does not use artificial intelligence to make automated decisions concerning the User’s rights or obligations. The Provider also does not make decisions that produce legal effects concerning the User or similarly significantly affect the User based solely on automated processing of data, as understood under Article 22 of the GDPR.

41. The User’s conversation data are not used to train or improve artificial intelligence models, except where: (i) the User provides separate and explicit consent to such use; (ii) or such data are irreversibly anonymised before use so that they can no longer be linked to any specific natural person.

42. If, in the future, the Provider decides to use personal data for training artificial intelligence models on other legal bases, the User will be informed in advance and, where necessary, additional consent from the User will be requested.

43. The Provider seeks to ensure that the User is always aware when they are communicating with an artificial intelligence system rather than a real person, the Provider or a specialist, as well as which User data are used during such communication and what privacy choices are available to them.

Privacy Policy · PERSONAL DATA PROCESSING PURPOSES AND LEGAL BASES

44. The Provider processes the User’s personal data only for clearly defined purposes and on the legal bases established by the applicable GDPR provisions and, in the relationship with the User, in accordance with any additional applicable legal requirements.

45. A detailed description of the data processing operations, their purposes, legal bases, data categories, use of artificial intelligence and retention periods is provided in Part 1 of Annex No. 1 to this Privacy Policy, which forms an integral part of this Privacy Policy.

46. When processing personal data, the Provider follows these principles: (i) each data processing purpose has a clear and defined legal basis; (ii) special categories of personal data are processed only with the User’s explicit consent; (iii) artificial intelligence is used only to the extent necessary for the functionality of the Platform and within the scope of the User’s choices; (iv) data retention periods are determined according to the specific processing purpose and the functions selected by the User or in accordance with the procedure established by law.

47. The User is provided with clear and easily understandable information about the purposes for which their data are processed, the circumstances in which their data may be used for artificial intelligence functionality and the privacy controls available to them.

Privacy Policy · PERSONAL DATA RETENTION PERIODS

48. The Provider retains the User’s personal data for no longer than is necessary to achieve the purposes for which the data were collected, except where longer retention is required by applicable legislation.

49. The retention periods for different types of data depend on their nature and the Platform functions selected by the User.

50. If the User has activated the Conversation Continuity function, their conversation history may be stored for up to 12 (twelve) months from the User’s last interaction with the Platform (for the avoidance of doubt, the 12 (twelve)-month period specified in this Privacy Policy means a period of 365 calendar days, inclusive).

51. Each new interaction between the User and the Platform extends the retention period by a further 12 (twelve) months.

52. If the User disables the Conversation Continuity function, previous conversations are no longer included in the artificial intelligence context and are no longer used to generate responses. The User may be given the option to choose whether such data are to be deleted or retained only in the account history without being used.

53. Account data are retained for as long as the User’s account remains active. Upon deletion of the account, the data are deleted or anonymised within a reasonable period, except where their retention is necessary to comply with legal requirements or to establish, exercise or defend legal claims.

54. Payment and accounting data are retained for the period prescribed by law, as necessary for financial accounting, tax administration and the fulfilment of other mandatory obligations.

55. Technical data (including “log files”) are retained for as long as necessary to ensure the security of the Platform, analyse incidents and maintain service stability, but no longer than is proportionate to these purposes.

56. The User has the right to request the deletion of their personal data at any time.

57. Upon receiving such a request, the Provider deletes or anonymises the data within a reasonable period, except where their retention is required by law or necessary to establish, exercise or defend legal claims.

Privacy Policy · TRANSFER OF PERSONAL DATA

58. The Provider may transfer the User’s personal data only to the extent necessary for the operation of the Platform, to ensure its functionality, to fulfil legal obligations or to pursue legitimate interests.

59. User data may be processed by third-party service providers that help ensure the operation of the Platform, including: (i) cloud infrastructure services; (ii) payment processing services; (iii) email and communications services; (iv) analytics and security solutions; (v) artificial intelligence technology providers.

60. The service providers listed above act as data processors or independent data controllers, depending on the functions they perform.

61. When providing artificial intelligence functionality, certain data provided by the User may be transferred to specialised artificial intelligence technology providers, which process the data only to the extent necessary to generate responses. Such providers are not entitled to use the User’s data for their own purposes, except where this is expressly provided for in their privacy policy and separate consent has been obtained from the User.

62. The User’s personal data may be disclosed to public authorities or other law enforcement authorities where this is required by applicable legislation.

63. When providing the Platform Services, the Provider may engage service providers, partners or other data recipients operating within or outside the European Economic Area (hereinafter the EEA).

64. In certain cases, the User’s personal data may be transferred to and/or otherwise processed outside the EEA. Where the User’s personal data are transferred outside the EEA, the Provider ensures that such transfer is carried out in compliance with Chapter V of the GDPR and other GDPR requirements, using appropriate safeguards, including standard contractual clauses or other lawful transfer mechanisms.

65. If the European Commission has recognised the relevant country, territory, sector or international organisation as ensuring an adequate level of protection of personal data, the transfer of data may be carried out on the basis of the relevant European Commission adequacy decision. Where no such European Commission adequacy decision applies, the Provider applies the appropriate safeguards provided for by the GDPR, including, where applicable, the standard contractual clauses approved by the European Commission (Standard Contractual Clauses – SCCs) or another lawful data transfer mechanism and, where necessary having regard to the circumstances of the specific transfer, additional technical, organisational and/or contractual data protection measures.

66. In the latter case, the User has the right to contact the Provider using the contact details specified in the Privacy Policy and obtain additional information about the safeguards applicable to the transfer of their personal data outside the EEA.

Privacy Policy · APPLICATION OF THE PRIVACY POLICY IN DIFFERENT COUNTRIES

67. The Platform Services may be provided to Users in different countries around the world. Accordingly, this Privacy Policy establishes the general principles applied by the Provider for the processing and protection of Users’ personal data, irrespective of the User’s nationality or place of residence, to the extent that the applicable legislation does not provide otherwise in a particular case.

68. The Provider processes Users’ personal data in accordance with the principles and requirements established by the GDPR to the extent that the GDPR applies to the relevant personal data processing activities carried out by the Provider. The User’s physical presence or place of residence (registered office) or address outside the EU/EEA Member States does not, in itself, preclude the application of the GDPR to the processing of personal data carried out by the Provider.

69. Depending on the country or territory in which the Platform Services are provided to the User, the User’s place of residence or location and other criteria relevant under the applicable legislation, the Provider may also be subject to the legislation of other countries or territories governing the protection of personal data and privacy. In such cases, the Provider complies with the relevant mandatory requirements to the extent that they apply to the Provider, the Platform or the specific processing of personal data.

70. If the mandatory personal data or privacy protection legislation applicable to the User grants the User additional or broader rights or imposes additional obligations on the Provider that are not expressly set out in this Privacy Policy, such rights and obligations shall apply to the extent prescribed by the relevant legislation. No provision of this Privacy Policy may be construed as restricting any rights of the User that cannot be restricted by agreement under applicable mandatory legislation.

71. The User may contact the Provider using the contact details specified in this Privacy Policy if they wish to obtain additional information about the rights applicable to the processing of their personal data or the procedure for exercising such rights.

Privacy Policy · USER RIGHTS AND PRIVACY CONTROLS

72. The User has all the rights provided for under the GDPR, including the right to: (i) access their personal data being processed; (ii) request their rectification; (iii) request their erasure; (iv) restrict their processing; (v) object to certain processing of their data; (vi) withdraw consent given; (vii) receive data in a portable format.

73. The User may at any time: (i) enable or disable the Conversation Continuity function; (ii) delete the accumulated conversation history; (iii) choose whether, when the function is disabled, the history is to be deleted or retained in the account without being used for artificial intelligence functions.

74. Where data processing is based on the User’s consent, the User has the right to withdraw such consent at any time, without affecting the lawfulness of processing carried out prior to the withdrawal of consent.

75. The User has the right to lodge a complaint with the State Data Protection Inspectorate or another competent supervisory authority in the event of a specific breach of personal data protection.

Privacy Policy · FINAL PROVISIONS

76. The Provider may periodically update this Privacy Policy to reflect changes in the Services, legislation or technological solutions. Users will be informed of material changes through the Platform or by other appropriate means.

77. This Privacy Policy forms an integral part of the Platform’s legal documentation and shall be interpreted together with the other Platform documents.

78. If any provision of this Privacy Policy is found to be invalid, this shall not affect the validity of the other provisions.

CONTROL LET GO ARTIFICIAL INTELLIGENCE

PRIVACY POLICY

ANNEX NO. 1 TO THE PRIVACY POLICY

79. The Provider processes personal data only to the extent necessary for clearly defined and lawful purposes. Depending on the specific purpose of the data processing, the Provider relies on one or more legal bases established by the GDPR.

80. Where multiple processing purposes apply to the same set of personal data, the Provider ensures that each such purpose has a separate and lawful legal basis for processing.

PURPOSE OF DATA PROCESSING: Creation and administration of the User account; DATA PROCESSED: Registration data; LEGAL BASIS: Performance of the contract (Article 6(1)(b) of the GDPR); IS ARTIFICIAL INTELLIGENCE USED: No

PURPOSE OF DATA PROCESSING: User identification and login administration; DATA PROCESSED: Login and account data; LEGAL BASIS: Performance of the contract; IS ARTIFICIAL INTELLIGENCE USED: No

PURPOSE OF DATA PROCESSING: Ensuring the functionality of the Platform; DATA PROCESSED: Platform usage data; LEGAL BASIS: Performance of the contract; IS ARTIFICIAL INTELLIGENCE USED: Partly

PURPOSE OF DATA PROCESSING: Generation of artificial intelligence responses; DATA PROCESSED: Data provided during conversations; LEGAL BASIS: Performance of the contract; IS ARTIFICIAL INTELLIGENCE USED: Yes

PURPOSE OF DATA PROCESSING: Ensuring the Conversation Continuity function (if activated by the User); DATA PROCESSED: Conversation history and related data; LEGAL BASIS: User consent and performance of the contract; IS ARTIFICIAL INTELLIGENCE USED: Yes

PURPOSE OF DATA PROCESSING: Processing of special categories of personal data; DATA PROCESSED: Special categories of personal data voluntarily provided by the User; LEGAL BASIS: Explicit User consent (Article 9(2)(a) of the GDPR); IS ARTIFICIAL INTELLIGENCE USED: Yes

PURPOSE OF DATA PROCESSING: Payment and subscription administration; DATA PROCESSED: Subscription and payment data; LEGAL BASIS: Performance of the contract and fulfilment of obligations established by law; IS ARTIFICIAL INTELLIGENCE USED: No

PURPOSE OF DATA PROCESSING: Issuing invoices and maintaining accounting records; DATA PROCESSED: Payment and accounting data; LEGAL BASIS: Legal obligation; IS ARTIFICIAL INTELLIGENCE USED: No

PURPOSE OF DATA PROCESSING: Customer support and handling enquiries; DATA PROCESSED: Correspondence data; LEGAL BASIS: Legitimate interest or performance of the contract; IS ARTIFICIAL INTELLIGENCE USED: No

PURPOSE OF DATA PROCESSING: Ensuring Platform security, fraud prevention and detection of technical failures; DATA PROCESSED: Technical and usage data; LEGAL BASIS: Legitimate interest; IS ARTIFICIAL INTELLIGENCE USED: No

PURPOSE OF DATA PROCESSING: Establishment, exercise or defence of legal claims; DATA PROCESSED: Relevant data required in the specific case; LEGAL BASIS: Legitimate interest; IS ARTIFICIAL INTELLIGENCE USED: No

Special-Category Consent · GENERAL PROVISIONS

1. This consent to the processing of special categories of personal data (hereinafter the Consent) sets out the conditions under which the User voluntarily consents to the Provider processing special categories of personal data voluntarily provided by the User, as understood under Article 9 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, hereinafter GDPR).

2. The Consent applies only to personal data that the User voluntarily chooses to provide when using the Platform and its Services. The Provider expressly states that it does not require the User to provide special categories of personal data; however, given the purpose of the Platform and Services, the User may choose to disclose such information during conversations with the artificial intelligence.

3. The Consent shall be read together with the Platform’s Privacy Policy and Terms of Use and other Provider documents applicable to the use of the Platform and Services.

Special-Category Consent · SPECIAL CATEGORIES OF DATA AND PURPOSE OF THEIR PROCESSING

4. When using the Platform, the User may voluntarily provide information that constitutes special categories of personal data under the GDPR. Such data may include, but are not limited to: (i) information about physical or mental health; (ii) information about emotional or psychological state; (iii) information about stress, anxiety, depressive experiences, burnout or other emotional difficulties experienced by the User; (iv) information about addictions, diseases or other conditions; (v) information about sexual life or sexual orientation and other circumstances relating to sexual life; (vi) religious or philosophical beliefs; (vii) other information classified as special categories of personal data under the GDPR.

5. The Provider does not ask the User to disclose more information than is necessary for the communication selected by the User with the Platform and for the use of the Platform Services, but cannot restrict the information that the User chooses to provide voluntarily.

6. Special categories of personal data voluntarily provided by the User shall be processed only to the extent necessary to ensure the functionality of the Platform and Services and to generate artificial intelligence responses based on the User’s enquiries.

7. If the User activates the Conversation Continuity function, such data may also be used to ensure more consistent conversational context and an improved User experience, subject to the conditions and retention periods set out in the Privacy Policy.

8. Special categories of personal data shall not be processed for any other purposes except those expressly specified in this Consent, the Privacy Policy or where required by applicable legislation.

9. The artificial intelligence analyses only the information provided by the User during a specific conversation and uses it to generate a response; therefore:

9.1. If the User has not activated the Conversation Continuity function, the content of previous conversations is not used to generate new responses;

9.2. If the User activates the Conversation Continuity function, the artificial intelligence may use previously saved conversation information only to the extent necessary to ensure more consistent communication.

10. The Provider ensures that special categories of personal data are not used for automated decision-making that produces legal effects concerning the User or similarly significantly affects the User, as understood under Article 22 of the GDPR.

11. The Provider also does not use the User’s special categories of personal data to train or improve artificial intelligence models unless the User has provided separate, explicit and voluntary consent for such use.

Special-Category Consent · USER PRIVACY CHOICES

12. By providing this Consent, the User confirms and declares that:

i) understands that the Platform is an artificial intelligence-based system whose operation may require the processing of special categories of personal data voluntarily provided by the User;

ii) understands that the decision to provide such data is made independently, freely and at the User’s own initiative;

iii) has read the Privacy Policy and understands the purposes, legal basis and scope of the Provider’s processing of their personal data;

iv) understands that they may use the Platform without providing more special categories of personal data than they consider necessary for discussing a particular situation;

v) understands that, when the Conversation Continuity function is activated, information from previous conversations may be used to ensure more consistent communication, whereas, if this function is not activated, previous conversations will not be used to generate new responses;

vi) understands that this Consent does not grant the Provider the right to use the User’s special categories of personal data to train or improve artificial intelligence models unless separate consent has been obtained from the User for such use;

vii) understands that the Provider applies organisational and technical measures to ensure the security of the User’s personal data, but that no information technology system can guarantee absolute data security.

13. The User must not confirm this Consent if they do not agree with and/or do not understand at least one of the terms of this Consent. For clarification, the User must contact the Provider; otherwise, it shall be deemed that the User understands all the terms and voluntarily and expressly agrees to them.

Special-Category Consent · VOLUNTARY NATURE AND WITHDRAWAL OF CONSENT

14. This Consent is given freely by the User.

15. The User has the right to withdraw this Consent at any time by contacting the Provider or using the privacy management tools provided on the Platform, which are available.

16. Withdrawal of the Consent shall not affect the lawfulness of the processing of personal data carried out before the withdrawal of the Consent.

17. Upon withdrawal of this Consent by the User, the Provider shall no longer process special categories of personal data for the purposes for which this Consent was required, except where such processing is required by applicable legislation or is based on another lawful basis.

18. The User understands that withdrawal of this Consent may make it impossible to use the full range of the Platform’s functionality or certain of its functions and Services, i.e. by withdrawing the Consent, the User also waives the right to use the Platform Services in such circumstances.

Special-Category Consent · FINAL PROVISIONS

19. The Consent shall take effect from the moment it is confirmed and shall remain in force until withdrawn by the User or until the purposes of processing the personal data cease to apply.

20. If any provision of this Consent is held to be invalid or unenforceable, this shall not affect the validity of the remaining provisions of this Consent.

21. The Consent shall be interpreted together with the Privacy Policy, Terms of Use and other legal documents of the Platform.