PRIVACY POLICY

Last Updated: September 21, 2026

1. DATA CONTROLLER AND CONTACT INFORMATION

This Privacy Policy governs the processing of personal data carried out in connection with the mobile application Ethos (hereinafter referred to as the "Application").

• Data Controller: ETHOS-TECH LTD

• Registered Office: 56 Leman Street, London

• Privacy / DPO Contact: privacy@ethosconsulting.it

(Hereinafter referred to as the "Data Controller" or "Ethos").

2. CATEGORIES OF PERSONAL DATA COLLECTED

Ethos collects and processes exclusively the data strictly necessary for the provision of the Application's services, in compliance with the data minimization principle. The categories of data may include:

1. Data Provided Voluntarily by the User: First name, last name, email address, authentication credentials, and any information provided directly by the data subject.

2. Technical and Usage Data (Automatically Collected): IP address, unique device identifiers (e.g., Android ID, IMEI within permitted limits), operating system type, system logs, and Application interaction data.

3. Permissions and Sensitive/Relevant Data (Android/Google Play): Should the Application request access to device features (e.g., Camera, Location, Calendar, Contacts, or Storage), such access will be requested exclusively via runtime permissions and subject to the user's explicit prior consent.

3. PURPOSES AND LEGAL BASES OF PROCESSING

The User’s personal data are processed for the following purposes:

• Provision of the Service: To enable the use of the Application's features (Legal basis: Performance of a contract or pre-contractual measures - Art. 6(1)(b) GDPR).

• Compliance with Legal Obligations: To fulfill regulatory, tax, and accounting duties prescribed by applicable national and European laws (Legal basis: Legal obligation - Art. 6(1)(c) GDPR).

• Application Security: To prevent fraud, unauthorized access, or unlawful activity, and to ensure system stability (Legal basis: Legitimate interest of the Data Controller - Art. 6(1)(f) GDPR).

4. GUARANTEE OF NON-DISCLOSURE AND PROHIBITION OF UNLAWFUL PROCESSING

The Data Controller formally represents and warrants as follows:

• No Sale or Disclosure to Third Parties: The User’s personal data shall not be sold, rented, leased, licensed, exchanged, or transferred to third parties for commercial, marketing, or independent profiling purposes.

• Prohibition of Unlawful Processing: The User’s data shall not be processed for purposes other than those explicitly stated herein, nor subjected to any processing operations that violate applicable laws, confidentiality, human dignity, or the legal rights of the data subject.

• Third-Party Service Providers (Data Processors): Any communication of data to third-party service providers (e.g., cloud hosting services or server infrastructure) shall occur strictly pursuant to formal Data Processing Agreements (Art. 28 GDPR), limiting data usage solely to supporting Ethos’s operational functionality.

5. DATA SECURITY AND SECURE TRANSMISSION

Ethos implements appropriate technical and organizational security measures to prevent data loss, unlawful or improper use, and unauthorized access.

In compliance with the guidelines set forth in the Google Play Developer Program Policy:

• All personal and sensitive data transmitted by the Application to external servers are protected during transit using modern encryption protocols (e.g., HTTPS/TLS protocol).

• Storage procedures comply with applicable information security standards.

6. DATA RETENTION AND ACCOUNT DELETION

1. Retention Period: Personal data shall be retained only for as long as strictly necessary to achieve the purposes for which they were collected, or until consent is revoked/a deletion request is made by the User, subject to any retention obligations mandated by law.

2. Account and Data Deletion: The User has the right to request the permanent deletion of their account and associated data. Such request may be initiated within the Application under "Account Settings" -> "Delete Account", or by sending an email to privacy@ethosconsulting.it. Upon receipt of the request, all personal data belonging to the User will be permanently removed from Ethos’s systems, except for information required to be retained by imperative legal provisions.

7. RIGHTS OF THE DATA SUBJECT

Pursuant to the General Data Protection Regulation (GDPR - Regulation EU 2016/679) and applicable privacy laws, the User may exercise the following rights:

• Right of Access: Obtain confirmation as to whether personal data concerning them are being processed, and access such data.

• Right to Rectification: Request the correction or completion of inaccurate or incomplete personal data.

• Right to Erasure ("Right to be Forgotten"): Request the erasure of personal data under statutory grounds.

• Right to Restriction of Processing: Request the temporary restriction of processing where statutory conditions apply.

• Right to Data Portability: Receive the personal data in a structured, commonly used, and machine-readable format.

• Right to Object and Revoke Consent: Object at any time to the processing of data or withdraw previously given consent without affecting the lawfulness of processing based on consent prior to withdrawal.

To exercise these rights, the User may contact the Data Controller via email at: privacy@ethosconsulting.it. The User also retains the right to lodge a complaint with the competent Data Protection Supervisory Authority.

8. AMENDMENTS TO THIS PRIVACY POLICY

The Data Controller reserves the right to amend or update this Privacy Policy at any time. Any changes will be communicated to Users within the Application or published at the dedicated URL prior to taking effect. Users are encouraged to review this policy periodically to remain informed about data protection practices.