PRIVACY POLICY

Last updated March 21, 2025

This Privacy Statement for the PRIVATE CAPITAL COMPANY DECODE GR (hereinafter referred to as "DECODE GR" or "Company"), describes how and why we may access, collect, store, use and/or share ("process") your personal information when you use our services ("Services"), including when:

• Visit our website at https://www.dikaio.ai/, or any website that links to this Privacy Statement
• Collaborate with us in other relevant ways, including any sales, marketing or events

Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. We are responsible for making decisions about the way your personal information is processed. If you do not agree with the policies and our practices, do not use our Services. If you still have any questions or concerns, please contact us at info@dikaio.ai.

SUMMARY OF KEY POINTS

This summary provides key points of our Privacy Policy, however you can learn more details on any of these topics by clicking on the link provided following each key point or using the table of contents below to find the section you are looking for.

• What personal information do we process? When you visit, use or navigate on our Services, we may process personal information depending on how you interact with, including the Services, the choices you make, and the products and features you use.

• Do we process sensitive personal information? Some of the information may be considered "special" or "sensitive" in some jurisdictions, for example your ethnic origin. We may process sensitive personal information when necessary with your consent or as otherwise permitted by applicable law.

• Do we collect information from third parties? We do not collect information from third parties.

• How do we process your information? We process your information to provide, improve and administer our Services, to communicate with you, for security and fraud prevention and to comply with the law. We may also process your information for other purposes with your consent. We only process your information when we have a valid legal reason to do so.

• In what situations and with what types of third parties do we share personal information? We may share information in certain situations and with certain categories of third parties.

• How do we keep your information secure? We have adequate organizational and technical procedures and processes to protect your personal data. However, no electronic transmission via the internet or information storage technology can be guaranteed to be 100% secure, therefore we cannot promise or guarantee that hackers, criminals or other unauthorized third parties will not be able to defeat our security or inappropriately access, steal or modify your information.

• What are your rights? Depending on where you are geographically located, the applicable privacy legislation may mean that you have certain rights regarding your personal information.

• How do you exercise your rights? The easiest way to exercise your rights is to submit a data subject access request or contact us. We will consider and act upon any request in accordance with applicable data protection legislation.

• Want to learn more about what we do with any information we collect?

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHAT LEGAL BASIS DO WE RELY ON TO PROCESS YOUR INFORMATION?
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
6. DO WE OFFER PRODUCTS BASED ON ARTIFICIAL INTELLIGENCE?
7. HOW DO WE MANAGE YOUR SOCIAL CONNECTIONS?
8. HOW LONG DO WE KEEP YOUR INFORMATION?
9. HOW DO WE KEEP YOUR INFORMATION SECURE?
10. DO WE COLLECT INFORMATION FROM MINORS?
11. WHAT ARE YOUR PRIVACY RIGHTS?
12. CONTROLS FOR "Do not Track" FEATURES
13. DO WE MAKE UPDATES TO THIS STATEMENT?
14. HOW CAN YOU CONTACT US?
15. HOW CAN YOU REVIEW, UPDATE OR DELETE THE DATA YOU DO WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you provide to us

In short: We collect personal information that you voluntarily provide to us during your registration in the Services, when you express interest in receiving information about us or our products and services, when you participate in activities on the Services, or otherwise communicate with us.

Personal information provided by you. The personal information we collect depends on the context of your interactions with us and the Services, the choices you make and the products and features you use. The personal information we collect may include the following:

• Name
• Email addresses
• Language preference
• Profile photo

Sensitive Information. When necessary, with your consent or as otherwise permitted by applicable legislation, we process the following categories of sensitive information such as:

• Legal document and case data
• Financial data & transaction data
• Data related to court decisions and criminal cases
• Legal information containing health data or medical reports
• Data that may reveal racial or ethnic origin, religious beliefs

Payment data. We may collect data that is necessary for the processing of your payment information, if you choose to make purchases, such as your payment method number and security code related to your payment method. To process payments, we work with the third party payment provider Stripe. Stripe is responsible for the secure management of your payment data. All transactions are governed by Stripe's privacy policies, which you can read here: https://stripe.com/en-gr/privacy. We only receive limited information about the completion or failure of a transaction, in order to provide proper service and detect possible fraud.

Social media login data. We may provide you with the option to register with us using your existing social media account details, such as your LinkedIn or other social media account. If you choose to register in this way, we will collect certain profile information about you from the social media provider, as described below in the section "HOW DO WE MANAGE YOUR SOCIAL CONNECTIONS?"

All personal information you provide us must be true, complete and accurate and you must inform us of any changes.

Information collected automatically

In short: Certain information -- such as your Internet Protocol (IP) address and/or characteristics of your browser and device -- is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use or navigate the Services. This information does not reveal your specific identity (such as your name or contact information), but may include device and usage information, such as the IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily necessary to maintain the security and operation of our Services, as well as for our internal analysis and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies. The information we collect includes:

• Log and usage data. Log and usage data is information that relates to services, diagnostic information, usage and performance our servers collect automatically when you access or use our Services and which we record in log files. Depending on how you interact with us, this data may include IP address, device information, type of browser and settings and information about your activity on the Services (such as date/time stamps associated with your usage, pages, and files viewed, searches and other actions you perform, such as which features you are using), device event information (such as system activity, error reports (sometimes called "error proofs") and hardware settings).

• Device Data. We collect device data, such as information about your computer, phone, tablet or other device you use to access the Services. Depending on the device used, this device data may include information such as the IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile operator, operating system and system configuration information.

• Location data. We collect location data, such as information about the location of your device, which may be either accurate or inaccurate. How much information we collect depends on the type and settings of the device you use to access the Services. For example, we may use GPS and other technologies to collect geolocation cookies that tell us your current location (based on your IP address). You can opt out of allowing us to collect this information by either denying access to the information or by turning off the Location setting on your device. However, if you choose to opt out, you may not be able to use certain aspects of the Services.

Google API

The use of information we receive from Google APIs will comply with the Policy Google API Services user data, including limited access requirements use.

2. HOW WE PROCESS YOUR INFORMATION?

In short: We process your information to provide, improve and manage our Services, to communicate with you, for security and fraud prevention, and to comply with the law. We may also process your information for others purposes with your consent.

We process your personal information for various reasons, depending on how you interact with our Services, such as:

• To facilitate account creation and authentication and to manage other user accounts. We may process your information so that you can create and log in to your account, as well as maintain your account in operating status.

• To provide and facilitate the delivery of services to the user. It may We process your information to provide you with the service you requested.

• To ask for feedback. We may process your information when necessary to ask for feedback and communicate with you regarding your use of our Services.

• For marketing and product promotion purposes. We may process your personal data

information you send us for marketing purposes, if this is in line with your preferences. You can opt out of this information at any time . For more information, please see the "WHAT ARE YOUR PRIVACY RIGHTS?" section below.

• To deliver targeted advertising to you. We may process your information to develop and display personalized content and advertisements tailored to interests your name, your location and more.

• To protect our Services. We may process your information as part of our efforts to keep our Services secure, including monitoring and fraud prevention.

• To determine how it is used. We may process information about how it is used. which you use our Services to better understand how you use them, so that we can We can improve them .

• To determine the effectiveness of marketing and promotional campaigns. We may we process your information to better understand how to provide marketing campaigns and promotions that are most relevant to you.

• To save or protect the vital interests of an individual. We may process the your information when necessary to save or protect the vital interests of a of the person, such as to avoid harm.

3. WHAT LEGAL BASIS DO WE RELY ON TO PROCESS YOUR INFORMATION?

In short: We process your personal information only when we believe it is necessary, having a legitimate reason (i.e., legal basis) to do so in accordance with applicable law, such as your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, protect your rights, or fulfill our our legitimate business interests.

The General Data Protection Regulation (GDPR) and the corresponding Data Protection Regulation of the United Kingdom (UK GDPR) impose an obligation to clarify the valid legal bases on which the processing of your personal data is based. Therefore, you may We rely on the following legal bases for the processing of your personal data:

• Consent. We may process your information if you have given us permission (i.e. consent) to use your personal information for a specific purpose. You can You can withdraw your consent at any time . Learn more about withdrawing your consent. your consent.

• Performance of a Contract. We may process your personal information when we believe that it is necessary to fulfill our contractual obligations to you, including provision of our Services or at your request prior to any transaction with you.

• Intended interests. We may process your information when we believe it is reasonably necessary for the achievement of our legitimate business interests and those interests do not override your interests and your fundamental rights and freedoms. For example , We may process your personal information for some of the purposes listed below. are described in order to: - Send users information about special offers and discounts on products and our services

• We develop and display personalized and relevant advertising content for our users

• Analyze how our Services are used so we can improve them for our users. our users.

• Support our marketing activities

• Diagnose problems and/or prevent fraudulent activities

• Understand how our users use our products and services so we can let's improve our users' experience

• Legal Obligations. We may process your information where we believe it is necessary to comply with our legal obligations, such as cooperating with an enforcement agency of the law or regulatory authority, the exercise or defense of our legal rights or the disclosure of your information as evidence in a legal dispute in which the Company is involved

• Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of third parties, such as situations that pose potential threats to the safety of any person.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In short: We may share information in specific circumstances described in this section and/or with the following categories of third parties.

Vendors, Consultants and Other Third Party Service Providers. We may share your data with third parties - including but not limited to suppliers, service providers, contractors or others ("third parties") who perform services for us or on our behalf and require access to this information for the provision of their services to the Company. We have entered into contracts with third parties, which aim to ensure the protection of your personal data. These contracts stipulate that third parties are not allowed to process your personal data. information without specific instructions from us. In addition, they undertake not to transmit personal your data to other entities outside the Company. Finally, they are obliged to ensure the integrity and security of the data they hold on our behalf and to retain it only for the a period of time that we define .

Authentication Services Provider. For account creation and authentication purposes, we use Clerk, Inc. ("Clerk") as our third-party authentication service provider. When you register or log in to our Services, your authentication data is processed according to Clerk's privacy policy, which you can review at https://clerk.com/legal/privacy. Clerk processes personal information as described in their privacy policy, which includes information such as email addresses, social login details, and authentication-related data.

The categories of third parties with whom we may share personal information are as follows: - AI platforms - Advertising networks

• Data analysis services
• Cloud Computing Services - Data Storage Service Providers
• Payment processors
• Performance monitoring tools
• Product Technology & Design Tools
• Web hosting service providers
• Affiliate marketing programs

You may also need to share your personal information with us in the following cases:

Business Transfers. We may share or transfer your information in connection with or during negotiations for any merger, sale of corporate assets information, financing or acquisition of all or part of the Company to another company.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In short: We may use cookies and other tracking technologies to collection and storage of your information.

We may use cookies and similar tracking technologies (such as web beacons and pixels) to collect information when you interact with our Services. Certain technologies online monitoring helps us maintain the security of our Services and the your account, to prevent errors, to correct errors, to save preferences and help us with the basic functions of the website.

We also allow third parties and service providers to use web technologies tracking on our Services for analytics and advertising, including managing and displaying advertisements, tailoring advertisements to your interests, or sending abandoned cart reminders (depending on your communication preferences).

Third parties and service providers use their technology to deliver advertisements about products and services tailored to your interests, which may They appear either on our Services or on other websites.

Specific information about how we use such technologies and how You can refuse certain cookies listed in our Cookie Statement .

6. DO WE OFFER PRODUCTS BASED ON ARTIFICIAL INTELLIGENCE?

In short: We offer products, capabilities or tools powered by artificial intelligence, machine learning or similar technologies. The answers provided through our Services are generated exclusively by artificial intelligence. intelligence (AI), without human intervention or control. Users should be aware that the information provided is for guidance purposes only and does not constitute legal advice advice from a professional.

As part of our Services, we offer products, features or tools that are supported by artificial intelligence, machine learning or similar technologies (collectively, " AI Products"). These tools are designed to improve your experience and offer you innovative solutions. The terms of this Privacy Statement govern the use of AI Products within our Services.

Use of AI technologies

We provide the Artificial Intelligence Products through third party service providers (" AI Service Providers"). As described in this Privacy Statement, the Your login, logout and personal information will be shared and submitted to processing by these artificial intelligence service providers to enable the use of our artificial intelligence products by you for purposes described in "TO WHOM LEGAL BASES WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION You must not use the AI Products in any way that violates the terms or conditions of this Privacy Policy. policies of any AI service provider .

All the artificial intelligence models we use do not perform a training process (training) with user data, thus ensuring the privacy and security of your information. In addition, the models we use are located within the European Union and fully compliant with the General Data Protection Regulation (GDPR).

Our AI products

Our AI products are designed for the following functions:

• AI bots

• AI document creation

• Image analysis

• Natural language processing

How we process your data using AI

All personal information processed by the AI Products is treated as in accordance with our Privacy Statement and our agreement with third parties. This ensures a high level of security and protection of your personal data throughout the processing process, providing you with certainty about the integrity and security of your information.

How to opt out

To opt out, you can contact us using the contact details provided. are provided.

7. HOW DO WE MANAGE YOUR SOCIAL CONNECTIONS?

In short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you. You.

Our Services offer you the ability to register and log in using the your third-party social media account details (such as your login details on Google, Microsoft or LinkedIn). Wherever you choose to do this, we will receive certain profile information about you from the social media provider. The profile information that The information we collect may vary depending on the social media provider in question, but often includes your name, email address and profile picture, as well as other information you choose to make public on such a social media platform.

We will use the information we receive only for the purposes described in this Privacy Statement or otherwise made clear to you in the relevant Services. Please note that we do not control and are not responsible for other uses of your personal information. data from the third-party social media provider. We recommend that you read the notice their privacy policy to understand how they collect, use and share your personal information. information and how you can set privacy preferences on their websites and applications.

8. HOW LONG DO WE KEEP YOUR INFORMATION?

In short: We retain your information for as long as necessary to fulfill our purposes described in this Privacy Statement, unless otherwise required by the legislation.

We will retain your personal information only for as long as is necessary for the purposes for which it was coll are set out in this Privacy Statement, unless a longer period is required or permitted retention by law (such as tax, accounting or other legal requirements). None of the purposes of this notice does not impose an obligation to retain your personal information data beyond the period of time during which you maintain an account with the company. When there is no longer a legitimate business need to process your personal data data, we will either delete or anonymize it. If this is not possible (e.g. due to storing your data in backup files), then your data will be stored securely and will be isolated from any further processing until final disposition is possible. their deletion.

9. HOW DO WE KEEP YOUR INFORMATION SECURE?

In short: Our goal is to protect your personal information through a system organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed the protection of the security of any personal information we process. Despite the appropriate safeguards and our efforts to protect your data, any electronic transmission via the Internet or information storage technology cannot guarantee absolute security. Therefore, we cannot promise or guarantee that malicious actors, cybercriminals or other unauthorized third parties will not be able to overcome the security measures and to obtain or modify your data. Although we pay every every effort to protect your personal data, the transmission of which to and from Our Services are at your own risk. It is recommended that you access the Services only in a safe environment.

All services we use for data retention are fully compliant with the applicable European Union legislation and hold the following certifications:

• SOC 2 Type II Certified (Evaluation of data security, availability, and privacy by independent organization )
• HIPAA Compliant (Compliance with health data security standards to protect sensitive information)
• GDPR Compliant (Compliance with European Union regulations for the protection of personal data) personal data)
• ISO 27001 Certified (Certification for the implementation and management of Information Security Systems
• PCI DSS Certified (Compliance with security standards for the protection of credit card data) cards)
• Data Encryption at Rest and In Transit storage for maximum security)
• Role-Based Access Control (Role-Based Access Control to restrict rights according to with the responsibilities)

The above measures we take to protect data include encryption, access restriction and regular security checks, however in the event of a data breach affecting users' personal information, the company will notify affected users within 72 hours of the incident being detected, in accordance with the General Data Protection Regulation Data (GDPR).

10. DO WE COLLECT INFORMATION FROM MINORS?

In short: We do not knowingly collect, solicit data from, or target our services to, or knowingly sell our services to, minors under the age of 18. With By using our Services, you represent that you are at least 18 years of age or that you are the parent or legal guardian of a m minor and you consent to his/her use of the Services. In the event that we determine that personal data has been collected from individuals under the age of 18 , we will deactivate the relevant account and we will take reasonable steps to promptly delete such information from our our records. If you find that we may have collected data from minors under the age of 18 , please contact us at info@dikaio.ai.

11. WHAT ARE YOUR PRIVACY RIGHTS?

In short: In some areas, such as the European Economic Area (EEA), the United Kingdom (United Kingdom) and Switzerland, you have rights that allow you greater access and control of your personal data, in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. You can review, modify, or delete your account at any time , depending on your country, province or state of residence your.

In some regions (such as the EEA, the United Kingdom and Switzerland), you have certain rights under of applicable personal data protection legislation. These may include the right (i) to request access to and receive a copy of your personal data, (ii) to request rectification or erasure (iii) to restrict the processing of your personal data (iv) where applicable, data portability and (v) not to be subject to automated decision-making. In some cases, you may also have the right to object to the processing of your personal data. your personal data. You can submit such a request using the details or communication form provided in Section 15 below .

Withdrawing your consent

If we have received your consent to process your personal data, you have the right to withdraw your consent at any time by contacting us using the contact details provided in the "HOW TO CONTACT US" section below WITH US" or by updating your preferences.

However, please note that this will not affect the lawfulness of the processing prior to the withdrawal nor will it affect the processing of your personal information that is carried out on the basis of lawful grounds for processing other than consent.

Opt-out from marketing and promotional communications

You can unsubscribe from marketing and promotional communications at any time. by clicking "unsubscribe" or by contacting us. After completing the process, you will be removed from marketing lists. However, we may still we communicate with you for service-related reasons, such as sending updates necessary to manage and use your account, respond to service requests or for other purposes not related to marketing.

Account information & deletion

If you would like to review, modify, or delete your account at any time , you can either log in to your account settings and edit your details, either by contacting together.

Upon your request to delete your account, we will deactivate or delete it. your account and your data from our active databases. However, you may retain certain data for legal, tax or security reasons (e.g. to prevent fraud, investigations or regulatory compliance). This retention is limited to what is strictly necessary time provided for by law .

Cookies & tracking technologies

Most web browsers are set to accept cookies by default. If You can either manage cookies through your browser settings,

or disable specific categories of cookies via the website's privacy banner . Disabling cookies may affect the functionality of some of our services.

Complaint Rights & Data Protection Principles

If you believe that your data is being processed unlawfully, you have the right to submit a complaint to the competent authorities: - For users in the EEA: You can file a complaint with the Data Protection Authority of your Member State. - For users in the United Kingdom: The competent authority is the UK Information Commissioner's Office (ICO). - For users in Switzerland: You can contact the Federal Data Protection Commissioner Data and Information (FDPIC).

12. CONTROLS FOR "Do not Track" FEATURES

Most web browsers and some mobile operating systems and applications mobile applications include a Do-Not-Track ("DNT") feature or setting that you can enable for indicate your "Do Not Track" privacy preference regarding your browsing activities your online presence. At this stage, no single technological standard has been finalized for recognition and implementation of DNT signals. Therefore, we do not currently respond to DNT browser signals or any other mechanism that automatically notifies the your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about this practice in a revised version of this Privacy Statement.

13. DO WE MAKE UPDATES TO THIS STATEMENT?

In short: Yes, we will update this Statement as needed to remain compliant with applicable law. The revised version will be identified by the updated "Revision" date which will be appears at the top of this Privacy Statement. In the event of material changes to this Privacy Statement, we may notify you either by clearly published notice of these changes or by contacting you directly. It is recommended that Please review this Privacy Statement regularly to stay informed of our practices. protection of your data.

14. HOW CAN YOU CONTACT US?

If you have any questions or comments about this Statement, you can email us at info@dikaio.ai or contact us by mail at: DECODE GR PRIVATE COMPANY 96 Dimitri Gounari Street , Maroussi Athens, Attica 15124 Greece

15. HOW CAN YOU REVIEW, UPDATE OR DELETE THE DATA YOU DO WE COLLECT FROM YOU?

According to the General Data Protection Regulation (GDPR), all EU users have the following rights regarding the processing of their personal data:

• Right of access – You can request information about the data we hold about you. about you and how they are processed.

• Right to rectification – If your data is inaccurate or incomplete, you can request its correction

• Right to erasure ("right to be forgotten") – You can request the deletion of your data if it is no longer necessary for the purposes for which it was collected or if you wish to either withdraw your consent. - Right to object – You have the right to object to the processing of your data, if it is based on our legitimate interest. - Right to restriction of processing – In certain cases, you can request the restriction of the processing of your data, for example , if you dispute the accuracy of the

• ** Right to portability** – You can request the transfer of your data to you or a third party carrier, in a structured, machine-readable format.

• Right to withdraw consent – If the processing of your data is based on your consent, you can withdraw it at any time , without affecting its legality processing carried out before revocation.

Response Deadline: The company will respond to your requests within 30 days from the date their submission, in accordance with the provisions of the GDPR. In case the request is complex or require additional processing, the deadline may be extended by an additional 60 days, but you will be informed about.

How to apply: To exercise any of the above rights, you can: - Send an email to info@dikaio.ai with your request and contact details. - Submit a written request via the special form at https://www.dikaio.ai/contact-us.

If you are located outside the EU, you may have additional or different rights under applicable law. legislation of your country. If you have any questions about your rights, you can contact let's at info@dikaio.ai.

We may ask you to verify your identity before processing your request to ensure that third party personal data is not compromised.