Privacy Policy

This Privacy Policy (hereinafter referred to as the “Policy”) sets out the terms and conditions governing the collection, use, processing, storage, protection, transfer and other processing of personal data by LIMITED LIABILITY COMPANY “MACH GROUP”, Company Identification Code 45164108, operating under the CostCare AI trademark (hereinafter referred to as the “Company”, “we”, “us”), in connection with:

• the use of the CostCare AI website available at costcare.ai (hereinafter referred to as the “Website”);
• the use of the CostCare AI software platform available at app.costcare.ai (hereinafter referred to as the “Platform”);
• the creation and use of an account on the Platform;
• the purchase, activation and use of a subscription to the Platform;
• contacting and interacting with the Company through available communication channels;
• participation in demos, webinars, presentations and other events organised by the Company;
• the conclusion and performance of agreements with the Company;
• the use of other CostCare AI products, services and technological solutions.

CostCare AI is a trademark and/or commercial designation under which the Company offers its products and services, including software based on artificial intelligence technologies, automation tools, communication solutions and other technological solutions.

For the purposes of this Policy, where the GDPR applies, the Ukrainian-law term “personal data owner” shall also encompass the concept of a “controller”, and the term “personal data processor” shall encompass the concept of a “processor”, unless otherwise required by the applicable law or the nature of the relevant processing.

1.1. Company’s Status in Relation to Personal Data Processing

Depending on the nature and purposes of the relevant processing of personal data, the Company may act as:

• a personal data owner (controller) - where the Company independently determines the purposes and means of processing personal data, including when processing enquiries submitted through the Website, administering its own client and contractual relationships, operating user accounts, carrying out marketing communications and complying with its own legal obligations;
• a personal data processor (processor) - where the Company processes personal data on behalf of and in accordance with the documented instructions of the relevant client in connection with the provision of the Platform services.

Where the Company acts as a personal data processor, the relevant client that determines the purposes and means of the processing is responsible for ensuring that there is an appropriate legal basis for the processing and transfer of personal data to the Company, for complying with obligations to inform data subjects and for complying with other requirements of applicable law.

Where the requirements of Article 28 of Regulation (EU) 2016/679 (GDPR) or equivalent requirements under other applicable law apply to such processing, the processing of personal data by the Company as a processor shall additionally be governed by the relevant Data Processing Agreement (DPA).

1.2. Scope of the Policy

This Policy applies to the processing of personal data by the Company, including in connection with:

• visiting and using the Website;
• completing contact forms and submitting requests for a demonstration of the Platform;
• creating, activating and using an account;
• using the Platform and its functionality;
• activating, paying for, renewing, changing or terminating a subscription;
• communicating with representatives of the Company;
• participating in demos, webinars, presentations and other events;
• entering into and performing agreements;
• interacting with the Company as a client, prospective client, supplier, partner or representative of any such person or entity.

This Policy does not govern the independent processing of personal data by third parties through their websites, services or platforms, except where the Company is responsible for such processing under applicable law or participates in determining its purposes and means.

1.3. Principles of Personal Data Processing

The Company processes personal data in accordance with the principles of:

• lawfulness, fairness and transparency;
• purpose limitation to specified, explicit and legitimate purposes;
• data minimisation;
• accuracy and, where necessary, keeping personal data up to date;
• storage limitation;
• integrity and confidentiality;
• ensuring an appropriate level of security of personal data;
• accountability - where and to the extent required by applicable law.

1.4. Applicable Data Protection Law

The Company’s processing of personal data is carried out in accordance with the Law of Ukraine “On Personal Data Protection”, other applicable laws and regulations of Ukraine and, where the relevant processing falls within their territorial or material scope, the requirements of other applicable data protection laws.

In particular, where Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR) applies to specific processing of personal data, the Company carries out such processing in accordance with the applicable requirements of the GDPR.

1.5. Information Provided under this Policy

By using the Website and/or the Platform or otherwise interacting with the Company, a user is provided with an opportunity to review this Policy and the information regarding the processing of personal data contained herein.

Reviewing this Policy does not, in itself, constitute consent to all types of personal data processing. Where a data subject’s consent is required for specific processing under applicable law, the Company obtains such consent separately and in an appropriate form.

The provision of certain personal data may be necessary to use particular features of the Website or the Platform, create an account, receive services, perform an agreement or carry out other actions requested by the user.

1.6. Relationship with Other Documents

This Policy applies together with the Public Offer, the Terms of Use of the Website and Platform, the Cookie Policy and, where applicable, the DPA and other documents governing the relationship between the Company and the relevant client or user.

Where the Company processes personal data as a processor on behalf of a client and the provisions of the relevant DPA or another agreement with the client concerning such processing differ from the provisions of this Policy, the provisions of the relevant DPA or agreement shall apply to such processing.

The categories and scope of personal data processed by the Company depend on the nature of the user’s interaction with the Company, the use of the Website and/or the Platform, the functionality used by the relevant person, and whether the Company acts as a personal data owner (controller) or personal data processor (processor).

2.1. Data Collected through the Website

When using the Website, including when completing the “Request demo”, “Contact us” or other forms, the Company may process:

• first and last name;
• email address;
• telephone number, if provided;
• company name and/or job title;
• company website;
• links to corporate or professional social media profiles;
• information about the source through which the user learned about the Company;
• the content of an enquiry, request or message;
• other data voluntarily provided by the user to the Company.

Such data may be processed for communicating with the user, handling enquiries, arranging a demonstration of the Platform, providing the requested information, and establishing or developing potential business relationships.

2.2. Data Collected Automatically

When using the Website and/or the Platform, the Company and/or service providers engaged by the Company may automatically process certain technical data depending on the relevant resource and the technologies actually used, including:

• IP address;
• browser type, version and language;
• device type and operating system;
• approximate location determined, in particular, based on the IP address;
• date and time of access;
• authentication and session data;
• information about interactions with the Website and/or Platform functionality;
• user preferences and settings;
• technical identifiers, diagnostic information and information about technical events;
• cookie identifiers and information obtained through similar technologies;
• other technical data necessary to ensure the functionality, security and proper operation of the Website and the Platform.

Such data may be used to ensure the operation and security of the Website and the Platform, authenticate and authorise users, manage sessions, retain user preferences, prevent fraud and abuse, perform technical monitoring, diagnose errors and ensure the stability of the relevant resource.

On the Website, technical data may also be processed for analytics and marketing purposes in the cases and in the manner provided for in this Policy and the Cookie Policy.

As of the date of the latest update of this Policy, no third-party analytics or marketing services are used on the Platform.

Where the use of the relevant technologies requires the user’s prior consent under applicable law, such processing is carried out after obtaining the relevant consent.

Further information on the use of cookies and similar technologies is set out in the Company’s Cookie Policy.

2.3. Data Processed during Demos, Webinars and Other Events

In connection with registration for and participation in demos, webinars, presentations or other events, the Company may process:

• first and last name;
• email address;
• telephone number;
• company name and job title;
• information about the company, including the number of employees;
• information about the CRM system or other business systems used;
• information about interests and expectations regarding the event;
• the username used in the service through which the event is conducted;
• the content of questions, messages and other information voluntarily provided during the event;
• image and voice, where the relevant event involves video and/or audio recording.

Where the Company records an event for subsequent use or publication and the participant’s consent is required for such processing under applicable law, the Company obtains such consent before carrying out the relevant processing.

2.4. Data of Clients, Prospective Clients, Suppliers, Partners and Their Representatives

In the course of business relationships, the Company may process:

• first and last name;
• job title and/or role;
• company name;
• business contact details;
• information necessary for entering into and performing agreements;
• business communication history;
• other data necessary to establish and maintain the relevant business relationship.

Such data may be processed for conducting negotiations, entering into and performing agreements, maintaining business relationships, processing payments, complying with legal, accounting and tax obligations, and protecting the Company’s rights and legitimate interests.

2.5. Data of CostCare AI Platform Users

For the creation, activation, administration and use of an account on the Platform, the Company may process:

• user’s first and last name;
• email address;
• telephone number, if provided;
• name of the legal entity or full name of the individual entrepreneur associated with the account;
• user’s job title, role and access permissions;
• information about the sending and acceptance of an invitation to the Platform;
• date of account creation and activation;
• authentication and session data;
• information about the use of Platform functionality;
• technical identifiers, diagnostic information and information about technical events;
• other data provided by the user or the relevant Client for the creation and administration of the account.

Such data is processed, in particular, to identify and authenticate the user, manage access permissions, ensure the operation and security of the Platform, provide support and perform the Company’s obligations to the relevant Client.

2.6. Subscription and Payment Data

In connection with the activation, use, renewal, modification or termination of a paid subscription, the Company may process:

• information about the selected plan, package and/or subscription;
• subscription status;
• date of activation, renewal, modification or termination;
• payment amount and currency;
• payment date and status;
• transaction or payment identifier;
• information about the purchase of additional features, usage volumes and/or AI tokens;
• other information necessary to administer the subscription, confirm payment and comply with accounting and tax requirements.

Payment for subscriptions and other paid features of the Platform may be processed through third-party payment providers and/or a Merchant of Record, including PayPro Global.

Where payment data is entered directly into the payment environment of the relevant payment provider or Merchant of Record, such data is processed by that third party in accordance with its own terms and privacy policy.

The Company does not receive or store the full payment card number, CVV/CVC code, cardholder name or other complete payment credentials entered by the user directly into the payment environment of the relevant payment provider or Merchant of Record.

The Company may receive information necessary to confirm and administer the payment and subscription, including payment status, amount, currency, payment date, transaction identifier and other related information.

2.7. Data Processed within Artificial Intelligence Functionality

The CostCare AI Platform uses artificial intelligence and related technologies to provide certain functionality, including:

• analysis of text, voice and other data;
• automated processing of requests;
• generation of responses, summaries, recommendations or other content;
• classification, structuring and analysis of information;
• automation and optimisation of communication and business processes.

To provide AI functionality, the Platform may use third-party AI providers supported by the Platform, including OpenAI, Anthropic, Google Gemini and DeepSeek. The Client independently selects the relevant AI provider for the relevant AI agent from those available on the Platform.

In order to generate a response, information necessary to process a specific request may be transmitted to the relevant AI provider through an API, including message content, relevant interaction history, context, as well as information from files, documents or other sources to which the Client has provided access, where such information is necessary to generate the response.

Where such information contains personal data, it is processed in accordance with the Company’s role in relation to the relevant processing, this Policy, the Public Offer and, where applicable, the DPA.

The Company does not use personal data processed on behalf of the Client to train or fine-tune its own artificial intelligence models.

When engaging third-party AI providers, the Company uses the relevant APIs and configurations on terms intended to enable the processing of transmitted data without its use by the relevant AI providers to train or fine-tune their models for their own purposes, to the extent provided for under the terms of the relevant provider.

The processing and retention of information by the relevant third-party AI provider are governed by the terms applicable to the relevant API, the configurations used by the Company and applicable law.

2.8. Automated Decision-Making

The Company does not carry out solely automated decision-making based on personal data, including profiling, that produces legal effects concerning a data subject or similarly significantly affects the data subject, except where such processing is permitted by applicable law and is carried out in compliance with the conditions and safeguards provided for by such law.

If such processing is used in circumstances falling within Article 22 of the GDPR or equivalent requirements of other applicable law, the data subject shall be provided with the required information and afforded the rights and safeguards to the extent required by such law.

2.9. Data Processed in Connection with Communications

When using Platform functionality related to telephone calls, messages or other forms of communication, the following data may be processed:

• telephone numbers and other contact details;
• content of text, voice or other communications;
• audio recordings, where the relevant functionality includes recording;
• transcripts of communications;
• communication metadata, including date, time, duration and status;
• results of the analysis or processing of such communications using Platform functionality.

Where the Company provides the relevant functionality to a client and processes such personal data on the client’s behalf, the client determines the purposes for which the functionality is used and is responsible for having an appropriate legal basis for the communication, recording, transcription or other processing of personal data, as well as for properly informing the relevant persons and obtaining their consent where such consent is required under applicable law.

In such cases, the Company processes personal data in accordance with the client’s documented instructions and the terms of the relevant agreement and/or DPA.

2.10. Client Data Processed by the Company as a Processor

When providing the Platform services, a client may transmit or otherwise make available through the Platform personal data relating to third parties.

With respect to such personal data, where the Company acts as a processor:

• the client determines the purposes and means of the relevant processing;
• the Company processes personal data on behalf of the client and in accordance with the client’s documented instructions;
• the Company processes such data only to the extent necessary to provide the Platform and perform the agreement;
• the Company implements appropriate technical and organisational measures to protect such data;
• access to such data is granted only to persons who require access to perform the relevant functions;
• subprocessors are engaged in accordance with the terms of the agreement, the DPA and applicable law.

The client is responsible for the lawfulness of the collection, use and transfer of such personal data to the Company, for ensuring that appropriate legal bases are in place, and for complying with its obligations to inform data subjects.

The detailed terms governing such processing are set out in the agreement with the client and, where required by applicable law, the Data Processing Agreement (DPA).

The Company may obtain personal data directly from the data subject, from clients, partners and other third parties, automatically when the Website and/or the Platform is used, from publicly available sources, and through third-party services and integrations.

3.1. Directly from You

The Company obtains personal data that you provide, including when:

• completing forms on the Website, including the “Contact us”, “Request demo” and other forms;
• contacting the Company by email, through messaging services or other communication channels;
• registering for demos, webinars, presentations or other events;
• creating and/or activating an account on the Platform;
• using an account and the functionality of the Platform;
• activating, modifying, renewing or terminating a subscription;
• making payments for the use of the Platform or purchasing additional paid features;
• entering into and performing agreements with the Company;
• providing the Company with other information in connection with the use of the Website, the Platform or other interactions with the Company.

3.2. From Clients, Employers, Partners and Other Third Parties

The Company may obtain personal data from:

• the Company’s clients, including when creating user accounts and using the Platform;
• employers, counterparties or other persons or entities that you represent;
• the Company’s partners, suppliers and contractors;
• other third parties that have an appropriate legal basis for providing the relevant personal data.

Such data may be provided to the Company, including for:

• creating and administering an account;
• providing access to the Platform;
• providing services to the relevant client;
• establishing and maintaining business relationships;
• performing agreements;
• carrying out communications;
• enabling certain functionality of the Platform.

Where the Company receives personal data from a client and processes it as a processor, such processing is governed by the relevant agreement with the client and, where required by applicable law, the DPA.

3.3. Automatically when Using the Website and/or the Platform

Certain data may be collected automatically when using the Website and/or the Platform through cookies, similar technologies and other technical means necessary to ensure their functionality, security and stability.

Depending on the relevant resource and the technologies actually used, such data may include an IP address, browser, device and operating system information, date and time of access, session information, technical identifiers, diagnostic information, technical events and information about the user’s interaction with the Website and/or the Platform.

Analytics and marketing technologies may be used on the Website in accordance with the Company’s Cookie Policy and, where required by applicable law, after obtaining the necessary user consent.

As of the date of the latest update of this Policy, no third-party analytics or marketing services are used on the Platform.

Technical identifiers and diagnostic information necessary for authentication, authorisation, technical monitoring, error diagnostics, stability and security of the Platform may be processed on the Platform.

The use of cookies and similar technologies is additionally governed by the Company’s Cookie Policy.

3.4. From Publicly Available Sources

The Company may obtain personal data from lawfully available public sources, including:

• public registers;
• corporate websites;
• professional social networks, including LinkedIn;
• other publicly available resources.

Such data may be used, in particular, to establish and maintain business contacts, verify information about prospective clients, partners, suppliers or their representatives, and for other legitimate business purposes in accordance with applicable law.

The fact that personal data is available from a public source does not, in itself, mean that such data may be used by the Company without restriction. The Company processes such data only where there is an appropriate legal basis and with due regard to the rights and legitimate interests of data subjects.

3.5. From Third-Party Services and Integrations

The Company may obtain personal data or other related information through third-party services and integrations actually used to support the Company’s operations and the functioning of the Website and the Platform, including:

• CRM and other business tools;
• analytics and marketing services used on the Website;
• email, communication and customer support services;
• platforms used for demos, webinars and other events;
• payment providers and Merchants of Record;
• cloud infrastructure and database providers;
• authentication and authorisation services;
• technical monitoring and error diagnostics services;
• AI providers and APIs, where the relevant integration involves the receipt of data.

The scope of the data obtained depends on the particular service, the nature of the integration, the settings and the functionality actually used.

As of the date of the latest update of this Policy, no third-party analytics or marketing services are used on the Platform.

3.6. Personal Data Provided by Another Person

Where a client, user or other third party provides the Company with personal data relating to another individual, that person or entity must have an appropriate legal basis for providing such data and, where required by applicable law, must properly inform the relevant data subject and/or obtain any required consent.

Where the Company processes such personal data as a processor on behalf of a client, the parties’ responsibilities regarding the lawfulness of the collection, transfer and subsequent processing of the personal data are determined by applicable law, the agreement with the client and the relevant DPA.

3.7. Information Where Personal Data Is Obtained from a Source Other than the Data Subject

Where the Company obtains personal data from a source other than the data subject and Article 14 of the GDPR or equivalent requirements under other applicable law apply to the relevant processing, the Company provides the data subject with the information required by law within the time limits and in the manner prescribed by such law, unless an applicable statutory exemption applies.

Where the Company processes such personal data solely as a processor on behalf of a client, compliance with obligations to provide information to data subjects shall be subject to the allocation of responsibilities between the Company and the client under applicable law, the relevant agreement and the DPA.

The Company processes personal data only for specified, explicit and legitimate purposes. The specific purpose of processing depends on the nature of the interaction with the user, client or other person, as well as on the functionality of the Website and/or the Platform being used.

4.1. Communication and Handling of Enquiries

Personal data may be processed for the purposes of:

• responding to enquiries and requests;
• providing feedback;
• processing requests for a demonstration of the Platform;
• providing information about the Company’s products and services;
• conducting business correspondence;
• establishing and maintaining communication with prospective clients, partners and other persons.

4.2. Organisation and Conduct of Demos, Webinars and Other Events

Personal data may be processed for:

• registering participants;
• creating and providing access to an event;
• sending invitations, reminders and related materials;
• facilitating participation in an event;
• communicating with participants;
• making audio and/or video recordings of an event and subsequently using the relevant materials, where there is an appropriate legal basis and, where required by applicable law, the relevant consent has been obtained.

4.3. Establishment, Conclusion and Performance of Contractual Relationships

The Company may process personal data for:

• conducting negotiations and taking steps prior to entering into an agreement;
• entering into and performing agreements;
• identifying clients, partners, suppliers and their representatives;
• communicating in connection with the performance of contractual obligations;
• providing services;
• processing payments;
• maintaining accounting, tax and other records;
• complying with other contractual and legal obligations.

4.4. Provision and Administration of Access to the CostCare AI Platform

Personal data may be processed for:

• creating, activating and administering an account;
• identifying and authenticating the user;
• managing roles and access permissions;
• providing access to Platform functionality;
• ensuring the proper operation of the Platform;
• providing technical and customer support;
• ensuring account security;
• performing the Company’s obligations to the relevant client.

4.5. Subscription and Payment Administration

The Company may process personal data and related information for:

• activating, renewing, modifying and terminating subscriptions;
• administering plans, packages and additional paid features;
• confirming payment status;
• interacting with payment providers and/or a Merchant of Record;
• recording purchased additional features, usage volumes and/or AI tokens;
• maintaining accounting and tax records;
• complying with other legal and contractual obligations related to payments and subscriptions.

4.6. Provision of the Platform’s AI Functionality

Where Platform functionality based on artificial intelligence technologies is used, data may be processed for:

• analysing information provided through the Platform;
• automated processing of requests;
• generating responses, summaries, recommendations and other content;
• transcribing and analysing communications;
• classifying and structuring information;
• automating work and communication processes;
• providing other AI functionality available within the Platform.

Where the Company carries out such processing as a processor on behalf of a client, the purposes of the relevant processing are determined by the client, and the Company processes personal data in accordance with the client’s documented instructions, the relevant agreement and, where applicable, the DPA.

4.7. Product Improvement, Analytics and Development of Functionality

The Company may process personal and technical data to the extent necessary for:

• analysing the use of the Website;
• evaluating the performance of individual features of the Website and the Platform;
• technical monitoring and error diagnostics;
• ensuring the stability and proper operation of the Website and the Platform;
• improving the user experience;
• developing and optimising functionality;
• conducting internal analytics and generating statistics based on data lawfully processed by the Company.

Analytics and marketing technologies may be used on the Website in accordance with this Policy and the Cookie Policy.

As of the date of the latest update of this Policy, no third-party analytics or marketing services are used on the Platform.

Where the relevant processing involves the use of cookies or similar technologies for which prior consent is required by law, such processing is carried out after obtaining the relevant consent.

4.8. Marketing and Promotion

Personal data may be processed for:

• sending informational and marketing communications;
• providing information about the Company’s products, services, updates and events;
• conducting marketing campaigns;
• evaluating the effectiveness of marketing activities;
• personalising marketing communications, to the extent permitted by applicable law.

Marketing communications are carried out on the basis of the data subject’s consent or another appropriate legal basis provided for by applicable law.

The user has the right to opt out of receiving marketing communications at any time, including by using the “unsubscribe” function in the relevant communication or by contacting the Company.

Opting out of marketing communications does not affect the receipt of service, transactional, security or other communications necessary for the performance of an agreement, administration of an account or provision of the Platform.

4.9. Security and Prevention of Abuse

Personal data and technical information may be processed for:

• ensuring information and cybersecurity;
• protecting the Website, the Platform, accounts and information systems;
• preventing fraud, unauthorised access and other abuse;
• detecting, analysing and investigating security incidents;
• technical monitoring, error diagnostics and analysis of technical events;
• ensuring the stability and proper operation of the Website and the Platform;
• protecting the rights and legitimate interests of the Company, its Clients and users.

4.10. Compliance with Legal Requirements

The Company may process personal data for:

• complying with obligations imposed by applicable law;
• maintaining accounting, tax and other mandatory records;
• complying with lawful requests from competent public authorities;
• complying with court decisions and other binding requirements;
• retaining documents and information for periods prescribed by law.

4.11. Protection of Rights and Legitimate Interests

Personal data may be processed for:

• establishing, exercising and defending legal claims;
• resolving claims and disputes;
• protecting the Company’s rights and legitimate interests;
• preserving evidence;
• ensuring the performance and enforcement of agreements;
• protecting the Company, its clients and users against unlawful activities.

4.12. Incompatible Further Processing

The Company does not further process personal data for purposes that are incompatible with the purposes for which such data was originally collected unless there is a separate appropriate legal basis for such further processing.

Where the data subject’s consent is required under applicable law for a new processing purpose, the Company obtains such consent before commencing the relevant processing.

The Company processes personal data only where there is an appropriate legal basis under applicable law.

The applicable legal basis depends on the category of personal data, the purpose and circumstances of the processing, the nature of the relationship with the data subject, and whether the Company acts as a personal data owner (controller) or a personal data processor (processor).

Where the GDPR applies to the relevant processing, the Company processes personal data, in particular, on the legal bases provided for in Article 6 of the GDPR.

5.1. Consent of the Data Subject

The Company may process personal data on the basis of the data subject’s consent where such consent is required under applicable law, including for:

• sending certain marketing and informational communications;
• using analytics, marketing and other non-essential cookies and similar technologies;
• making certain types of audio and/or video recordings;
• using materials containing a person’s image or voice;
• other types of processing for which applicable law requires consent.

Where processing is based on consent, such consent must be freely given, specific, informed and unambiguous, where and to the extent required by applicable law.

The data subject has the right to withdraw consent at any time in a manner that is no more difficult than the manner in which consent was given, unless otherwise required by the nature of the relevant processing.

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

5.2. Necessity for Entering into and Performance of a Contract

The Company may process personal data where such processing is necessary for the performance of a contract to which the relevant individual is a party or in order to take steps at the request of that individual prior to entering into a contract.

In particular, such processing may be carried out for:

• processing a request for services;
• creating and administering an account;
• providing access to the Platform;
• activating and administering a subscription;
• providing the requested services;
• carrying out communications related to the contract;
• performing other contractual obligations.

Where the Company’s client is a legal entity and personal data is processed in relation to its employees, representatives or other Platform users, the legal basis for such processing is determined according to the specific circumstances and may differ from the necessity to perform a contract with the data subject.

5.3. Compliance with a Legal Obligation

The Company may process personal data where such processing is necessary for compliance with a legal obligation to which the Company is subject under applicable law, including for:

• maintaining accounting and tax records;
• retaining documents for periods prescribed by law;
• complying with lawful requests from public, regulatory, law enforcement and other competent authorities;
• complying with court decisions and other binding requirements;
• complying with other obligations imposed by applicable law.

5.4. Legitimate Interests

Where permitted by applicable law, the Company may process personal data where such processing is necessary for the purposes of the legitimate interests pursued by the Company or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.

Such legitimate interests may include:

• ensuring the security of the Website, the Platform, information systems and accounts;
• preventing fraud, abuse and unauthorised access;
• ensuring the proper operation and improvement of products and services;
• conducting internal analytics necessary for the operation and development of the Company’s business;
• maintaining and developing business relationships;
• carrying out direct marketing communications where and to the extent permitted by applicable law;
• establishing, exercising and defending legal claims;
• protecting the rights and legitimate interests of the Company, its clients and users.

Where required by applicable law, before carrying out processing based on legitimate interests, the Company assesses the necessity of such processing and balances the relevant interests against the rights and freedoms of the data subject.

5.5. Other Legal Bases

Where provided for by applicable law, the Company may process personal data on other legal bases, including where such processing is necessary to protect the vital interests of an individual or for another purpose permitted by law.

The Company relies on such a legal basis only where the relevant factual and legal circumstances exist.

5.6. Processing by the Company as a Personal Data Processor

Where the Company processes personal data on behalf of a client as a processor, the Company does not independently determine the legal basis for the processing carried out by the client as the personal data owner (controller).

The relevant client is responsible for determining an appropriate legal basis for the collection and processing of personal data transferred to the Company or processed through the Platform.

In such cases, the Company processes personal data in accordance with the client’s documented instructions, the relevant agreement and, where applicable, the DPA.

5.7. Special Categories of Personal Data

The Company does not intend to collect special categories of personal data unless such processing is necessary for the use of the relevant Platform functionality or the provision of services and is supported by an appropriate legal basis.

Where the GDPR applies and special categories of personal data within the meaning of Article 9 of the GDPR are processed, such processing is carried out only where one of the conditions provided for under the GDPR applies and subject to the relevant safeguards.

The client must not provide special categories of personal data through the Platform unless this is necessary for the lawful use of the relevant functionality and is supported by an appropriate legal basis.

6.1. Use of Cookies and Similar Technologies

The Company may use cookies and similar technologies in connection with the operation of the Website and the Platform.

On the Website, such technologies may be used to ensure the proper and secure operation of the Website, retain user preferences, analyse the use of the Website, improve functionality and user experience, and for analytics and marketing purposes where permitted by applicable law.

On the Platform, cookies and similar technologies may be used, in particular, to ensure its operation, authenticate and authorise users, manage sessions, retain settings and ensure security.

As of the date of the latest update of this Policy, no third-party analytics or marketing services are used on the Platform.

In connection with the use of cookies and similar technologies, the Company may process, in particular, IP addresses, cookie identifiers, browser and device information, session information and information about the user’s interaction with the relevant resource.

6.2. Analytics and Marketing Technologies

Analytics and marketing technologies may be used on the Website to analyse its use, evaluate performance, improve the user experience, measure conversions and the effectiveness of advertising campaigns, and for other related purposes in accordance with applicable law.

Where applicable law requires the user’s consent for the use of such technologies, they are not activated before the relevant consent has been obtained.

As of the date of the latest update of this Policy, no third-party analytics or marketing services are used on the Platform.

6.3. Third-Party Technologies

Third-party technologies may be used to support the operation of the Website and/or the Platform, analytics, marketing and other related purposes.

Depending on the relevant service and the nature of the processing, such third parties may act as personal data processors, independent personal data controllers or, where provided for by applicable law, joint controllers.

The scope of data, purposes and means of processing by such third parties depend on the relevant service and the nature of its use.

6.4. Cookie Policy

Detailed information about the categories of cookies and similar technologies, the purposes for which they are used, the third-party services involved, the procedures for giving, changing and withdrawing consent, and the available methods for managing cookies is set out in the Company’s separate Cookie Policy available on the Website and/or the Platform.

The Company may disclose personal data or provide third parties with access to such data only to the extent necessary to achieve the purposes of processing specified in this Policy, provide and ensure the operation of the Website and the Platform, comply with the Company’s contractual and legal obligations, and in other cases permitted by applicable law.

Depending on the nature of the relevant processing, such third parties may act as personal data processors, sub-processors, independent controllers or, where provided for by applicable law, joint controllers.

7.1. Categories of Recipients of Personal Data

The Company may disclose personal data or provide access to such data to the following categories of recipients:

• providers of hosting, cloud and other technical infrastructure services;
• providers of CRM systems and other business tools;
• providers of email, communication, customer support, demo, webinar and other event-related services;
• providers of analytics and marketing services used in connection with the Website and the Company’s marketing activities;
• providers of AI models, APIs and other technology services necessary to provide the relevant functionality of the Platform;
• payment providers, Merchants of Record and other parties involved in processing and administering payments;
• the Company’s professional advisers, including legal, accounting, audit and tax advisers, where access to the relevant data is necessary for the provision of their services;
• public authorities, courts, law enforcement, regulatory and other competent authorities, where and to the extent required by applicable law;
• other third parties where there is an appropriate legal basis and subject to compliance with applicable law.

7.2. Payment Providers and Merchant of Record

For the processing and administration of payments for the use of the Platform, the Company uses and/or may use third-party payment providers and Merchants of Record, including PayPro Global.

Depending on the model of the relevant service, the payment provider or Merchant of Record may independently process the user’s personal and payment data in accordance with its own legal obligations, terms of use and privacy policy.

Where the user enters payment credentials directly into the payment environment of the relevant payment provider or Merchant of Record, the Company does not receive or store the full payment card number, CVV/CVC code, cardholder name or other complete payment credentials entered by the user directly into the relevant payment environment.

The Company may receive from the relevant provider information necessary to confirm and administer the payment and subscription, including payment status, amount, currency, payment date, transaction identifier and other related information.

7.3. AI and Technology Infrastructure Providers

To ensure the operation of the Platform and certain of its functionality, the Company may engage third-party providers of AI models, APIs, cloud infrastructure, databases, authentication and authorisation, technical monitoring, error diagnostics and other technology services.

Such providers may include, in particular, Amazon Web Services (AWS), MongoDB Atlas, PropelAuth, Sentry, OpenAI, Anthropic, Google Gemini and DeepSeek.

The specific providers engaged in the processing of a particular Client’s data depend on the Platform functionality, the Client’s settings, the selected AI provider, connected integrations and other services actually used.

Where a relevant provider processes personal data on behalf of the Company in connection with the processing of personal data on behalf of the Client, its engagement shall be governed by the DPA and the current Subprocessor List.

The current Subprocessor List is maintained by the Company in electronic form and contains additional information regarding the relevant providers and the nature of their engagement.

7.4. Data Processed on Behalf of Clients

When using the Platform, clients may provide the Company with, or otherwise make available through the Platform, personal data relating to third parties.

Where the Company acts as a processor in relation to such data:

• the client is the personal data owner (controller) or another person or entity lawfully entitled to instruct the Company to process such data;
• the Company processes the relevant personal data on behalf of the client and in accordance with the client’s documented instructions;
• such data is disclosed to sub-processors only to the extent necessary to provide the services;
• the procedure for engaging sub-processors and the applicable safeguards are governed by the agreement, the DPA and applicable law.

7.5. Disclosure of Data in Accordance with Law

The Company may disclose personal data to public authorities, courts, law enforcement, regulatory and other competent authorities where such disclosure is necessary for:

• compliance with a legal obligation;
• compliance with a lawful and binding request from a competent authority;
• compliance with a court decision;
• establishing, exercising or defending legal claims;
• protecting the rights, security and legitimate interests of the Company, its clients, users or other persons, where permitted by applicable law.

7.6. International Transfers of Personal Data

Due to the Company’s use of international technology, cloud, analytics, communication, payment and other services, personal data may be processed in or transferred to countries other than the country in which the relevant data subject is located.

The Company carries out international transfers of personal data in accordance with applicable law.

Where the GDPR applies to the relevant transfer and personal data is transferred outside the European Economic Area to a country for which there is no valid European Commission adequacy decision, the Company uses an appropriate transfer mechanism in accordance with Chapter V of the GDPR, unless otherwise provided for by the GDPR.

Such mechanisms may include, in particular, the European Commission’s Standard Contractual Clauses (SCCs) or another mechanism permitted under applicable law.

Where required by applicable law, the Company also implements supplementary technical, organisational and/or contractual safeguards.

Where provided for by applicable law, the data subject may contact the Company using the contact details specified in Section 15 of this Policy to obtain additional information about the mechanisms and safeguards applicable to international transfers of personal data, as well as information on how to obtain a copy of such safeguards.

7.7. Principles Applicable to the Disclosure of Personal Data

When disclosing personal data, the Company, depending on the nature of the relevant processing and its role, takes appropriate measures to ensure that:

• only personal data necessary for the relevant purpose is disclosed;
• access to personal data is limited to persons who require such access;
• recipients process personal data in accordance with the specified purpose and applicable requirements;
• appropriate contractual, organisational and technical safeguards are implemented;
• international transfers are carried out using the required legal mechanisms.

7.8. Independent Processing by Third Parties

Where a third party receives personal data and subsequently processes it as an independent personal data controller, that third party independently determines the purposes and means of such subsequent processing and is responsible for complying with its own obligations under applicable law.

In such cases, the relevant processing may also be governed by that third party’s terms of use and privacy policy.

The Company may use social media and other third-party online platforms to communicate with users, distribute information about CostCare AI, carry out marketing activities and provide certain functionality of the Website.

8.1. Links and Integrations with Social Media

The Website may contain links to the Company’s social media pages and/or certain elements or integrations of third-party online platforms actually used by the Company.

When a user accesses the website, service or platform of the relevant third party, any subsequent processing of personal data by that third party is carried out in accordance with its own terms of use, privacy policy and the user’s settings.

Where any third-party element or integration used on the Website involves the processing of personal data or the use of cookies or similar technologies, such processing shall be carried out in accordance with applicable law and, where required, after obtaining the user’s prior consent.

8.2. Data Transfers through Integrated Elements

Where embedded elements, pixels, widgets, video players or other technologies of third-party platforms are used on the Website, certain technical data may be transmitted to the relevant third party in connection with their use, including the IP address, browser and device information, cookie identifiers and information about interaction with the relevant element.

Where the user’s prior consent is required under applicable law for such technology to be loaded or used, the relevant technology is activated only after such consent has been obtained.

Further information on the use of cookies and similar technologies is set out in the Company’s Cookie Policy.

8.3. Interaction with the Company on Social Media

Where a user interacts with the Company’s page or profile on a social media platform, including by following the page, sending a message, posting a comment, reacting to content or otherwise interacting with published content, the Company may receive and process information made available to the Company by the relevant social media platform.

Depending on the platform and the user’s settings, such information may include:

• name or profile name;
• profile picture;
• content of messages, comments and other communications;
• information about reactions and other interactions with content;
• other information made available by the user through the relevant platform.

The Company processes such data to communicate with the user, respond to enquiries, administer the Company’s pages, analyse interactions with content and for other lawful purposes specified in this Policy.

8.4. Roles of the Company and Social Media Operators

Depending on the relevant service, functionality and nature of the processing, the Company and the operator of the relevant social media platform may act as independent personal data controllers or, where provided for by applicable law, as joint controllers.

Where the Company and the operator of the relevant platform jointly determine the purposes and means of certain processing of personal data, their respective responsibilities in relation to such processing are determined in accordance with applicable law and the relevant arrangements between the parties.

8.5. Independent Processing by Social Media Platforms

Operators of social media platforms and other third-party platforms may independently process users’ personal data for their own purposes, including in accordance with their own privacy policies and user settings.

The Company does not determine the purposes and means of such independent processing by a third party unless the Company participates in determining the relevant purposes and means.

This does not limit or exclude the Company’s obligations in relation to any processing of personal data for which the Company acts as a personal data controller, processor or joint controller under applicable law.

The Company retains personal data for no longer than necessary to achieve the purposes for which it was collected or is otherwise processed, unless a longer retention period is provided for by an agreement, is necessary for the establishment, exercise or defence of legal claims, or is required by applicable law.

When determining the appropriate retention period, the Company takes into account, in particular, the nature and scope of the personal data, the purposes of its processing, the duration of the relationship with the relevant person or client, potential risks to the rights and freedoms of data subjects, applicable limitation periods and mandatory document retention periods.

9.1. Data Obtained through the Website and Communications

Personal data obtained through contact forms, demo requests, email or other communication channels is retained for the period necessary to process the relevant request and conduct subsequent communications, as well as for an additional period where necessary to maintain a record of the interaction, protect the Company’s rights and legitimate interests or comply with legal requirements.

9.2. Data of Clients, Partners, Suppliers and Their Representatives

Personal data processed in connection with entering into and performing agreements or maintaining business relationships may be retained for the duration of the relevant relationship and, following its termination, for the periods necessary to comply with accounting, tax and other applicable legal requirements and to establish, exercise or defend legal claims.

9.3. Platform User Data

User account data is retained for the duration of the relevant account and/or the contractual relationship with the relevant client.

Following termination of the use of the Platform or deactivation or deletion of an account, the relevant personal data is deleted, anonymised or retained for an additional period where necessary to comply with applicable law, ensure security, prevent fraud, resolve disputes or protect legal claims.

9.4. Client Data Processed by the Company as a Processor

Where the Company processes personal data on behalf of a Client as a processor, the retention, return and/or deletion periods for such data are determined by the Client’s documented instructions, the relevant agreement and the DPA, taking into account the requirements of applicable law.

Upon receipt of a valid request to delete Client Data, the relevant data shall be deleted from the primary database without undue delay following completion of the necessary technical operations, unless further retention is required by applicable law.

Data remaining in backups shall be deleted within the standard backup rotation cycle, which does not exceed 30 calendar days, unless a different retention period is required by applicable law. Until deletion from backups, such data shall not be used for ordinary operational purposes and shall be retained solely as part of the relevant backup and recovery procedures.

9.5. Subscription and Payment Data

Information relating to subscriptions, payments and settlements is retained for the period necessary to administer the relevant subscription and perform the agreement and, following termination of the contractual relationship, for the periods required by accounting, tax and other applicable laws, as well as for periods necessary to resolve payment disputes and protect legal claims.

Payment data independently processed by a payment provider or Merchant of Record is retained by the relevant third party in accordance with its own retention periods and legal obligations.

9.6. Marketing Data

Personal data used for marketing communications may be retained for the duration of the relevant business relationship and/or until consent is withdrawn, the user opts out of marketing communications or the right to object to the relevant processing is exercised, depending on the legal basis for the processing.

Following an opt-out from marketing communications, the Company may retain the minimum amount of information necessary to give effect to the opt-out and prevent the relevant communications from being sent again.

9.7. Cookie and Analytics Data

Retention periods for data obtained through cookies and similar technologies depend on the category of the relevant technology and the particular service.

Detailed information on the duration and retention periods of the relevant cookies is set out in the Cookie Policy and/or the settings of the relevant cookie management mechanism.

Where processing is based on consent, withdrawal of consent terminates further processing on that basis, except where another appropriate legal basis exists for the continued retention of the relevant data.

9.8. Data Related to Demos, Webinars and Other Events

Personal data of participants in demos, webinars, presentations and other events is retained for the period necessary to organise, conduct and follow up on the relevant event, as well as for an additional period where necessary for the Company’s lawful purposes and permitted by applicable law.

Where an event is audio or video recorded, the retention period and use of the recording are determined by the relevant purpose of processing, the information provided to the data subject and/or the data subject’s consent, where consent is the legal basis for the processing.

9.9. Technical Logs and Security Data

Technical logs, authentication logs, information about security events and other technical data may be retained for the period necessary to ensure the security of the Website and the Platform, diagnose technical issues, prevent abuse, investigate incidents and protect the rights of the Company and its users.

9.10. Deletion and Anonymisation

Upon expiry of the relevant retention period, personal data is deleted or anonymised unless its continued retention is required by applicable law or is based on another appropriate legal basis.

Information that has been properly anonymised in such a manner that the relevant individual can no longer be identified may be retained and used by the Company without the restrictions applicable to personal data.

Depending on applicable law and the nature of the relevant processing, a data subject has rights in relation to their personal data, including those provided for by the Law of Ukraine “On Personal Data Protection” and, where the GDPR applies, the rights provided for under the GDPR.

10.1. Right to Information and Access

The data subject has the right to obtain information about the processing of their personal data and, where provided for by applicable law, confirmation as to whether the Company processes their personal data and access to such data.

In particular, the data subject may have the right to obtain information about:

• the purposes of the processing;
• the categories of personal data;
• the categories of recipients to whom the data has been or may be disclosed;
• the applicable retention periods or the criteria used to determine them;
• the source of the personal data, where the data was not obtained directly from the data subject;
• the existence of automated decision-making, where provided for by applicable law;
• international transfers of personal data and applicable safeguards, where provided for by applicable law.

10.2. Right to Rectification

The data subject has the right to request the rectification of inaccurate personal data concerning them and, taking into account the purposes of the processing, the completion of incomplete personal data, where provided for by applicable law.

10.3. Right to Erasure of Personal Data

Where provided for by applicable law, the data subject may request the erasure of their personal data, including where:

• the personal data is no longer necessary for the purposes for which it was collected;
• the consent on which the processing was based has been withdrawn and there is no other legal basis for the processing;
• the data subject has validly objected to the processing;
• the personal data has been unlawfully processed;
• erasure is necessary for compliance with a legal obligation.

The right to erasure is not absolute. The Company may continue to retain the relevant personal data where such retention is necessary or permitted under applicable law, including for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.

10.4. Right to Restriction of Processing

Where provided for by applicable law, the data subject has the right to request restriction of the processing of their personal data, including for the period required to verify the accuracy of the data, the lawfulness of the processing or an objection to the processing.

10.5. Right to Object to Processing

Where provided for by applicable law, the data subject has the right to object to the processing of personal data carried out on the basis of the legitimate interests of the Company or a third party.

Where personal data is processed for direct marketing purposes, the data subject has the right to object to such processing at any time. Upon receiving such an objection, the Company ceases processing the personal data for the relevant direct marketing purposes.

10.6. Right to Withdraw Consent

Where the processing of personal data is based on consent, the data subject has the right to withdraw their consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

Following the withdrawal of consent, the Company ceases the relevant processing unless there is another appropriate legal basis for continuing such processing.

10.7. Right to Data Portability

Where the GDPR applies and the conditions of Article 20 of the GDPR are met, the data subject has the right to receive the personal data they have provided to the Company in a structured, commonly used and machine-readable format and to transmit such data to another controller or, where technically feasible, to request that the data be transmitted directly to another controller.

10.8. Rights in Relation to Automated Decision-Making

Where Article 22 of the GDPR or equivalent provisions of other applicable law apply, the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, where such decision produces legal effects concerning them or similarly significantly affects them, except where permitted by applicable law.

Where such processing is permitted by law, the Company provides the safeguards required by law, including the right to obtain human intervention, express the data subject’s point of view and contest the decision, where such safeguards apply.

10.9. Right to Lodge a Complaint

The data subject has the right to lodge a complaint regarding the processing of their personal data with the competent data protection authority.

In Ukraine, the data subject has the right to lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights and/or apply to a court in accordance with Ukrainian law.

Where the GDPR applies to the relevant processing, the data subject also has the right to lodge a complaint with a competent supervisory authority in accordance with Article 77 of the GDPR.

10.10. Exercising Data Subject Rights

To exercise their rights, the data subject may contact the Company using the contact details specified in Section 15 of this Policy.

The request must contain sufficient information to identify the applicant and determine the personal data or processing to which the relevant request relates.

To protect personal data against unauthorised access, the Company may request additional information necessary to verify the identity of the applicant. The scope of such information must be proportionate to the purpose of the verification.

The Company reviews requests and provides responses within the time limits established by applicable law.

Where the GDPR applies to the relevant request, the Company provides information on the action taken without undue delay and, as a rule, within one month of receipt of the request. This period may be extended in the cases and in accordance with the procedure provided for by the GDPR, with the data subject being informed of such extension and the reasons for it.

10.11. Requests Concerning Data Processed by the Company on Behalf of a Client

Where a request concerns personal data processed by the Company as a processor on behalf of a client, the relevant client, as the personal data owner (controller), is generally responsible for handling the request.

In such cases, the Company assists the client in fulfilling its obligations regarding the exercise of data subject rights in accordance with applicable law, the relevant agreement and the DPA and, where necessary, forwards the request received to the relevant client.

The Company implements appropriate technical and organisational measures to ensure a level of protection of personal data appropriate to the nature of the processing, the categories of personal data and the risks to the rights and freedoms of data subjects.

11.1. Security Measures

Depending on the nature and circumstances of the relevant processing, the Company implements measures aimed at:

• preventing unauthorised or unlawful access to personal data;
• preventing accidental or unlawful destruction, loss, alteration, disclosure or other unlawful processing of personal data;
• restricting and controlling access to personal data;
• ensuring the confidentiality of personal data;
• protecting information systems, the Website and the Platform;
• detecting, analysing and responding to information security incidents;
• regularly reviewing and, where necessary, improving the security measures implemented.

Access to personal data is granted only to employees, contractors and other authorised persons who require such access to perform their relevant functions and who are required to comply with confidentiality and personal data protection requirements.

11.2. Data Protection when Engaging Third Parties

Where the Company engages processors, sub-processors or other service providers to process personal data, the Company takes the measures required by applicable law to ensure an appropriate level of protection of the relevant personal data.

Where the Company acts as a processor on behalf of a client, sub-processors are engaged in accordance with the relevant agreement, the DPA and applicable law.

11.3. Account Security

The user is required to take reasonable measures to ensure the security of their account, including by not disclosing account credentials or authentication methods to unauthorised persons and by promptly notifying the Company of any known or suspected unauthorised access to the account.

The user’s obligation to maintain the confidentiality of their account credentials does not limit the Company’s own obligations to ensure appropriate protection of personal data and the Platform.

11.4. Personal Data Security Incidents and Breaches

Where a personal data breach is identified, the Company assesses the nature and potential consequences of the breach and takes appropriate measures to contain and remedy the breach and minimise its potential adverse consequences.

Where the Company is required under applicable law to notify a competent authority and/or data subjects of a personal data breach, the Company provides such notification in accordance with the procedures and within the time limits prescribed by the relevant law.

Where the Company acts as a processor and the GDPR applies to the relevant processing, in the event of a personal data breach, the Company notifies the relevant client-controller without undue delay after becoming aware of the breach, in accordance with Article 33 of the GDPR and the terms of the DPA.

Where the Company acts as a controller and the GDPR applies to the relevant breach, the Company notifies the competent supervisory authority and, where required under the GDPR, the affected data subjects in accordance with the procedures and within the time limits set out in Articles 33 and 34 of the GDPR.

11.5. No Absolute Guarantee of Security

Despite the Company’s implementation of appropriate security measures, no method of transmitting or storing information can guarantee absolute security.

This provision does not limit or exclude the Company’s responsibility for complying with its personal data protection obligations under applicable law.

The CostCare AI Website and Platform are intended for professional and commercial use and are not intended for persons under the age of 18.

The Company does not knowingly collect personal data relating to persons under the age of 18 without an appropriate legal basis.

If the Company becomes aware that personal data relating to a person under the age of 18 has been provided or obtained through the Website or the Platform without an appropriate legal basis, the Company will take appropriate measures to cease such processing and delete the relevant personal data, unless its continued retention is required by applicable law.

If a person believes that the Company is processing personal data relating to a person under the age of 18, they may notify the Company using the contact details specified in Section 15 of this Policy.

The Website and/or the Platform may contain links to third-party websites, platforms, services or other online resources that are not owned or controlled by the Company.

13.1. Accessing Third-Party Resources

When a user follows a link to a third-party website, platform or service, that third party may independently collect and otherwise process personal data in accordance with its own terms of use, privacy policy and other applicable documents.

The Company recommends that users review the relevant third party’s privacy policy and other terms before providing personal data to that third party.

13.2. Independent Processing by Third Parties

Where a third party independently determines the purposes and means of processing personal data, that third party acts as an independent personal data controller and is independently responsible for compliance with applicable law in relation to such processing.

The Company does not determine or control the purposes and means of such independent processing by the third party.

13.3. Company’s Responsibility

The inclusion of a link to a third-party resource on the Website and/or the Platform does not, in itself, mean that the Company controls, endorses or is responsible for the privacy policy, content or independent activities of the relevant third party.

However, this provision does not limit or exclude the Company’s obligations or responsibility in relation to any processing of personal data for which the Company acts as a personal data controller, processor or joint controller under applicable law.

13.4. Integrated Third-Party Services

Where a third-party service is not merely accessible through an external link but is integrated directly into the Website or the Platform and is used by the Company to provide the relevant functionality, the processing of personal data within such integration is carried out in accordance with this Policy, the relevant contractual terms and applicable law.

14.1. Updates to the Policy

The Company may periodically amend and supplement this Policy, including in connection with changes to:

• applicable law;
• the functionality of the Website and/or the Platform;
• the methods and purposes of personal data processing;
• the providers and technology services engaged by the Company;
• the Company’s organisational or technical processes.

The current version of the Policy is made available on the Website and/or the Platform, indicating the version number and the date of the last update.

14.2. Material Changes

Where changes to this Policy materially affect the nature of personal data processing, the rights of data subjects or other information in respect of which applicable law requires a separate notice, the Company notifies the relevant persons of such changes in a manner appropriate to the nature of the interaction with such persons and the requirements of applicable law.

Such notice may be provided, in particular, by posting a notice on the Website and/or the Platform, sending a notice by email or by other appropriate means.

14.3. Changes Requiring Consent

Where a change in the purposes, methods or other conditions of personal data processing requires new or additional consent from the data subject under applicable law, the Company obtains such consent before commencing the relevant processing.

The mere continued use of the Website and/or the Platform does not constitute consent to new types of personal data processing where applicable law requires separate consent.

14.4. Previous Versions

The Company may retain previous versions of this Policy to demonstrate the content of the personal data processing rules applicable during the relevant period.

The date of the last update and the number of the current version are specified at the beginning of this Policy.

14.5. Applicable Law

This Policy applies subject to the data protection laws of Ukraine and any other laws applicable to the relevant processing of personal data.

Where the relevant processing falls within the scope of the GDPR, the provisions of this Policy apply subject to the mandatory requirements of the GDPR.

Where mandatory requirements of other laws apply to specific processing of personal data, nothing in this Policy shall be interpreted as limiting the rights of the data subject or the obligations of the Company established by such mandatory requirements.

If you have any questions regarding this Policy or the processing of your personal data, or if you wish to exercise your rights as a data subject, you may contact the Company using the following details:

LIMITED LIABILITY COMPANY “MACH GROUP”
Company Identification Code: 45164108
Registered Address: Premises 1, 6/1 Stelmakha Street, Kyiv, 03040, Ukraine
Email: wahtel@costcare.ai
Telephone: +380 67 565 27 27

15.1. Contact Person for Personal Data Protection Matters

For matters relating to personal data protection, the exercise of data subject rights, withdrawal of consent, objections to processing, rectification or erasure of personal data, you may contact:

Person Responsible for Personal Data Protection:
Paul WAHTEL
Email: wahtel@costcare.ai
Telephone: +380 67 565 27 27

15.2. Requests to Exercise Rights

A request should include sufficient information to identify the applicant and understand the nature of the request, including the applicant’s name, contact details and a description of the right the applicant wishes to exercise.

The Company may request additional information only to the extent necessary to properly verify the applicant’s identity and protect personal data against unauthorised access or disclosure.

The Company reviews requests and provides responses in accordance with the procedures and within the time limits prescribed by applicable law.

Where a request concerns personal data processed by the Company as a processor on behalf of a client, the Company may forward the relevant request to the client-controller and/or assist the client in handling such request in accordance with applicable law, the relevant agreement and the DPA.