UBEX.ai Privacy Policy

TechVision Mallorca SL | UBEX.ai

Last Updated: 29 May 2026 | Version: 2.0

Legal Framework

This Privacy Policy has been drafted in full compliance with all applicable European Union, Spanish national, and Balearic Islands regional legislation. TechVision Mallorca SL is committed to the highest standards of data protection and privacy as required by law.

The following legal instruments govern this Privacy Policy:

SECTION 1 — DATA CONTROLLER & CONTACT INFORMATION

1.1 Legal Entity

The Data Controller responsible for your personal data is:

TechVision Mallorca SL Calle Bartomeu Ferra 16, A 07141 Marratxí, Mallorca Balearic Islands, Kingdom of Spain European Union

Company Identification:

CIF (Tax Identification Number): B72772940 Legal Form: Sociedad Limitada (SL) — Spanish Private Limited Company Registered in: Mercantile Registry of Mallorca (Registro Mercantil de Mallorca), Balearic Islands, Spain Operational Product: UBEX.ai — AI Workflow Automation Platform

1.2 Contact Information

For all matters relating to this Privacy Policy, data protection, or the exercise of your rights:

Primary Contact:

📧 adelina@ubex.ai 🌐 https://www.ubex.ai 📬 TechVision Mallorca SL Calle Bartomeu Ferra 16, A 07141 Marratxí, Mallorca Balearic Islands, Spain

We aim to respond to all data protection inquiries within 30 days as required by GDPR Article 12(3). In complex cases, this period may be extended by a further two months, and we will notify you accordingly.

1.3 Data Protection Officer (DPO)

TechVision Mallorca SL has conducted a thorough assessment of its data processing activities in accordance with GDPR Article 37. Given the nature of our AI platform operations — which involve systematic processing of user data through multiple AI model providers at scale — we have designated our Chief Executive Officer as the internal responsible person for all data protection matters.

Internal Data Protection Responsible Person:

Adelina Bolota, Chief Executive Officer TechVision Mallorca SL 📧 adelina@ubex.ai

All data subject requests, privacy inquiries, consent withdrawals, and data protection concerns should be directed to this contact. We treat all such communications with strict confidentiality and in full compliance with GDPR timelines and obligations.

1.4 Competent Supervisory Authority

As a company registered and operating in Spain, TechVision Mallorca SL falls under the jurisdiction of the Spanish data protection supervisory authority:

Agencia Española de Protección de Datos (AEPD) C/ Jorge Juan, 6 28001 Madrid, Spain 🌐 https://www.aepd.es 📧 internacional@aepd.es 📞 +34 901 100 099 / +34 91 266 35 17

You have the right to lodge a complaint with the AEPD at any time if you believe your data protection rights have been violated. See Section 13.10 for full details on how to exercise this right.

SECTION 2 — SCOPE & APPLICATION

2.1 Who This Policy Covers

This Privacy Policy applies to all of the following:

• All visitors to https://www.ubex.ai and all its subdomains, pages, and associated web properties
• All registered users and account holders of the UBEX.ai platform
• All paying customers and subscribers to any UBEX.ai plan, tier, or service package
• All individuals interacting with UBEX.ai AI workflow automation tools and features
• All business representatives, enterprise clients, partners, affiliates, resellers, and vendors
• All individuals who contact us via email, support channels, social media, or any other communication method
• All individuals whose personal data is processed in connection with our services, whether or not they are direct users
• All trial users and individuals using any free or demonstration version of our services
• All API users and developers integrating with the UBEX.ai platform

2.2 Geographic Scope

This Policy applies to:

All data processing activities carried out by TechVision Mallorca SL within the European Union All data processing activities affecting EU residents, regardless of where the processing takes place All services delivered through https://www.ubex.ai globally, with EU data protection standards applied as the baseline In accordance with GDPR Article 3, this Policy applies to any individual located in the European Union who uses our services, even if they access our platform from outside the EU.

2.3 What This Policy Does Not Cover

This Policy does not apply to:

• Third-party websites, platforms, or services linked from UBEX.ai — those are governed by their own independent privacy policies, and we encourage you to review them carefully
• Data processed by business clients using UBEX.ai as a tool on their own behalf, where the client acts as an independent Data Controller — see Section 18 for the applicable Data Processing Agreement framework
• Internal employment and HR data of TechVision Mallorca SL staff and contractors, which is governed by a separate internal HR and employment data policy
• Anonymized or aggregated data that cannot reasonably be used to identify any individual, which is not subject to this Policy or GDPR obligations

2.4 B2B Clients — Dual Role Clarification

When business clients use UBEX.ai to process data belonging to their own customers, employees, or end users, the following role distinction applies:

• TechVision Mallorca SL acts as Data Processor
• The business client acts as Data Controller
• A separate Data Processing Agreement (DPA) governs this relationship in accordance with GDPR Article 28 — see Section 18
• Business clients are responsible for ensuring they have a valid legal basis to process their end users' data through our platform and must ensure their own privacy policies reflect their use of UBEX.ai as a data processor.

SECTION 3 — DEFINITIONS

The following definitions apply throughout this Privacy Policy in accordance with GDPR Article 4 and Spanish LOPDGDD:

SECTION 4 — WHAT PERSONAL DATA WE COLLECT

TechVision Mallorca SL collects personal data through multiple channels in connection with the operation of the UBEX.ai platform at https://www.ubex.ai and https://app.ubex.ai. We collect only the minimum data necessary for the purposes described in this Policy, in accordance with the GDPR principle of data minimisation (GDPR Art. 5(1)(c)).

4.1 Data You Provide Directly

The following personal data is collected directly from you when you register, use, or interact with our platform:

Identity & Account Data:

Business & Professional Data:

Billing & Payment Data:

Important: All payment card data is processed exclusively by Stripe, Inc. (our PCI-DSS Level 1 certified payment processor). TechVision Mallorca SL does not store, process, or have access to your full payment card numbers at any time. Stripe's privacy policy is available at https://stripe.com/privacy.

Communications Data:

4.2 Data We Collect Automatically

When you visit https://www.ubex.ai or use the platform at https://app.ubex.ai, we automatically collect the following data through technical means:

Technical & Device Data:

Usage & Behavioural Data:

Log & Server Data:

Location Data:

Important: We do not collect precise GPS location data or real-time location tracking. Location is approximated from your IP address only.

4.3 AI Platform-Specific Data

As an AI workflow automation platform, UBEX.ai processes specific categories of data that are unique to our services. This data is collected and processed exclusively through https://app.ubex.ai:

User Prompts & AI Inputs:

AI Outputs & Results:

Workflow Configuration Data:

Integration & Connected Service Data:

4.4 Data Collected from Third Parties

In certain circumstances, we may receive personal data about you from third parties:

4.5 Data We Do NOT Collect

For the avoidance of doubt, TechVision Mallorca SL does not collect the following:

❌ Full payment card numbers (handled exclusively by Stripe) ❌ Government-issued ID numbers (passport, DNI, NIE) unless specifically required for legal compliance ❌ Precise real-time GPS location data ❌ Biometric data (fingerprints, facial recognition data) ❌ Health or medical data ❌ Data from children under the age of 16 (see Section 14) ❌ Special category data as defined under GDPR Article 9, unless explicitly provided by you in the course of using AI workflows (see Section 7)

SECTION 5 — LEGAL BASIS FOR PROCESSING

In accordance with GDPR Article 6 and Spanish LOPDGDD, TechVision Mallorca SL processes personal data only when a valid legal basis exists. We have identified and documented the legal basis for every processing activity we carry out. The following table provides a comprehensive overview:

5.1 Primary Legal Bases

A. Performance of a Contract (GDPR Art. 6(1)(b))

This legal basis applies when processing is necessary to provide you with our services under our Terms of Service:

B. Legitimate Interests (GDPR Art. 6(1)(f))

This legal basis applies where we have a legitimate business interest that is not overridden by your rights and freedoms. We have conducted Legitimate Interests Assessments (LIAs) for each of the following:

| Preventing abuse and misuse of the platform | Protecting platform integrity and all users | Necessary safeguard — minimal privacy impact when proportionate | | Network and information security | Protecting our infrastructure and user data | Fundamental security obligation — outweighs privacy impact | | Maintaining backup systems | Business continuity and data integrity | Technical necessity — backups encrypted and access-controlled |

C. Consent (GDPR Art. 6(1)(a))

This legal basis applies where you have freely given, specific, informed, and unambiguous consent to processing:

Important — Consent Withdrawal: You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal of consent does not affect processing carried out on other legal bases.

D. Legal Obligation (GDPR Art. 6(1)(c))

This legal basis applies where processing is required to comply with a legal obligation under EU or Spanish law:

E. Vital Interests (GDPR Art. 6(1)(d))

In exceptional circumstances, we may process personal data where it is necessary to protect the vital interests of a person — for example, in a medical emergency situation. This basis is used only as a last resort and in genuinely exceptional circumstances.

F. Performance of a Task in the Public Interest (GDPR Art. 6(1)(e))

This basis does not currently apply to TechVision Mallorca SL's processing activities.

5.2 Legal Basis for Special Category Data (GDPR Art. 9)

TechVision Mallorca SL does not intentionally collect or process special category data as defined under GDPR Article 9. However, we acknowledge that users may voluntarily include special category data within their AI workflow inputs and prompts submitted at app.ubex.ai.

In such cases, the following applies:

Our Strong Recommendation: We strongly advise users not to submit special category data, sensitive personal information, or confidential third-party data in AI workflow prompts unless strictly necessary for their intended use case. See Section 7 for full AI-specific data handling disclosures.

5.3 Consequences of Not Providing Personal Data

Where personal data is collected on the basis of contractual necessity, failure to provide the required data will result in our inability to provide the relevant service. Specifically:

Where data is collected on the basis of consent or legitimate interests, you may choose not to provide it without affecting your ability to use the core platform services, though some features may be limited.

5.4 Automated Processing & Profiling Legal Basis

Where we engage in automated processing or profiling activities (see Section 17), the legal basis is:

5.5 Spanish LOPDGDD Supplementary Provisions

In addition to GDPR requirements, Spanish Organic Law 3/2018 (LOPDGDD) provides the following supplementary provisions applicable to TechVision Mallorca SL:

Article 6 LOPDGDD: Consent must be obtained through a clear affirmative act. Pre-ticked boxes or implied consent are not valid under Spanish law. Article 7 LOPDGDD: Consent for each specific processing purpose must be granular and separately obtained — bundled consent is not valid. Article 11 LOPDGDD: Users have the right to receive transparent information about processing in clear and plain language accessible to all users. Article 17 LOPDGDD: The right to erasure under Spanish law supplements GDPR Article 17 and includes specific provisions for digital content removal. Article 94 LOPDGDD: Specific provisions apply to the use of personal data in internet-based services and digital platforms — TechVision Mallorca SL complies with all applicable provisions. Article 95 LOPDGDD: Right to digital disconnection and the right not to be contacted through digital means outside of agreed service communications. Article 97 LOPDGDD: Provisions relating to the use of personal data in artificial intelligence systems — TechVision Mallorca SL applies these provisions to all AI model integrations.

SECTION 6 — HOW WE USE YOUR PERSONAL DATA

TechVision Mallorca SL uses personal data collected through https://www.ubex.ai and https://app.ubex.ai for specific, explicit, and legitimate purposes only, in accordance with the purpose limitation principle under GDPR Article 5(1)(b). We do not use your personal data for any purpose incompatible with those described below.

6.1 Service Delivery & Platform Operation

6.2 Customer Support & Communications

6.3 Platform Improvement & Development

6.4 Security & Fraud Prevention

6.5 Legal & Regulatory Compliance

6.6 Marketing & Business Development

6.7 What We Will NEVER Do With Your Data

TechVision Mallorca SL makes the following absolute commitments regarding your personal data:

❌ We will never sell your personal data to any third party under any circumstances ❌ We will never rent your personal data to any third party ❌ We will never use your personal data for purposes incompatible with those stated in this Policy ❌ We will never use your AI workflow inputs or prompts to train our own AI models without your explicit consent ❌ We will never share your personal data with advertisers for targeted advertising purposes ❌ We will never process your personal data in a way that discriminates against you unlawfully ❌ We will never transfer your data outside the EU/EEA without appropriate safeguards in place ❌ We will never use automated decision-making that produces significant legal effects without human oversight — see Section 17

SECTION 7 — AI-SPECIFIC DATA PROCESSING DISCLOSURES

This section provides full transparency about how personal data is handled specifically in connection with the AI workflow automation features of the UBEX.ai platform at https://app.ubex.ai. This section is required under GDPR, the EU AI Act, and emerging best practices for AI service providers.

7.1 How AI Processing Works at UBEX.ai

The UBEX.ai platform enables users to create, configure, and execute automated workflows powered by multiple large language models (LLMs) and AI systems. When you submit a prompt, input, or file through app.ubex.ai, the following processing sequence occurs:

Input Reception: Your prompt or input is received by UBEX.ai's servers hosted on Google Cloud in Frankfurt, Germany (EU) Workflow Processing: Your input is processed according to your configured workflow settings AI Model Routing: Your input is transmitted to the relevant AI model provider(s) selected for your workflow

AI Model Processing: The selected AI model processes your input and generates a response or output Output Delivery: The AI-generated output is transmitted back to UBEX.ai's servers and delivered to you at app.ubex.ai Storage: Your inputs, outputs, and workflow data are stored on Google Cloud servers in Frankfurt, Germany (EU) in accordance with the retention periods set out in Section 12

7.2 AI Model Providers — Data Transmission Disclosure

When you use UBEX.ai's AI workflow features, your inputs and prompts are transmitted to one or more of the following AI model providers. Each provider processes your data according to their own data processing terms, which are incorporated into our agreements with them:

Important Disclosure: TechVision Mallorca SL has entered into or is in the process of entering into Data Processing Agreements (DPAs) with each AI model provider to ensure your data is handled in compliance with GDPR requirements. Where providers are located outside the EU/EEA, appropriate safeguards including Standard Contractual Clauses (SCCs) are applied — see Section 10 for full details.

7.3 What Data is Transmitted to AI Model Providers

When your workflow is executed, the following data may be transmitted to AI model providers:

What is NOT transmitted to AI model providers:

❌ Your name or personal identity information (unless you include it in your prompt) ❌ Your payment or billing information ❌ Your account credentials or authentication data ❌ Technical data or device information ❌ Data from other users or workflows

7.4 AI Model Training — Your Data and Model Training

This is one of the most important disclosures in this Privacy Policy. We want to be completely transparent about whether your data is used to train AI models:

TechVision Mallorca SL's Position:

✅ TechVision Mallorca SL does not use your personal data or AI workflow inputs to train its own AI models ✅ We do not sell or license your prompts or outputs to any AI training datasets Third-Party AI Provider Training Policies:

Our Commitment: We are committed to ensuring that none of your data submitted through app.ubex.ai is used to train any AI model without your explicit, informed consent. We will update this Policy immediately if any provider changes their training data policies.

7.5 Special Category Data in AI Workflows

As noted in Section 4.5, we strongly advise users not to submit special category data in AI workflow prompts. However, we acknowledge that users may do so voluntarily. In such cases:

• Special category data submitted in prompts is processed solely to execute your requested workflow
• Such data is transmitted to the relevant AI model provider as part of your prompt
• Such data is subject to the same retention periods as all other workflow data — see Section 12
• You may request deletion of such data at any time by contacting adelina@ubex.ai Categories of special data users should avoid submitting unless necessary:

🚫 Health or medical information about yourself or others 🚫 Financial account details beyond what is needed for your workflow 🚫 Government-issued ID numbers (passport, DNI, NIE, Social Security numbers) 🚫 Biometric data 🚫 Information about minors 🚫 Third-party personal data without that person's knowledge and consent 🚫 Confidential business information subject to separate legal protections

7.6 User Responsibility for Data Submitted to AI Workflows

When using UBEX.ai's AI workflow features, you as the user are responsible for:

• Ensuring you have the legal right to submit any data you input into AI workflows
• Ensuring that any third-party personal data you submit has been collected lawfully and with appropriate consent
• Complying with applicable data protection laws when using UBEX.ai to process data relating to other individuals
• Not submitting data that violates any applicable law, regulation, or third-party rights
• Ensuring that outputs generated by AI workflows are used responsibly and in compliance with applicable laws TechVision Mallorca SL is not responsible for the content of data submitted by users to AI workflows, provided we have fulfilled our obligations as Data Processor under GDPR Article 28.

7.7 AI Output Disclaimer

AI-generated outputs produced through the UBEX.ai platform are generated by third-party AI models and may not always be accurate, complete, or appropriate. Users should:

• Always review and verify AI-generated outputs before relying on them
• Not rely solely on AI outputs for legal, medical, financial, or other professional advice
• Be aware that AI outputs may reflect biases present in the underlying training data of third-party models
• Use AI outputs responsibly and in compliance with applicable laws and regulations

SECTION 8 — EU AI ACT COMPLIANCE

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689), which entered into force on 1 August 2024 and is being phased in through 2025–2026, establishes a comprehensive regulatory framework for AI systems in the European Union. As an AI platform provider operating within the EU, TechVision Mallorca SL is committed to full compliance with all applicable provisions.

8.1 Our Role Under the EU AI Act

TechVision Mallorca SL operates in the following capacities under the EU AI Act:

8.2 Risk Classification of UBEX.ai Systems

Under the EU AI Act's risk-based classification framework, we have assessed our AI systems as follows:

Important: UBEX.ai does not operate any High-Risk AI systems as defined under EU AI Act Annex III, which includes AI systems used in critical infrastructure, education, employment, essential services, law enforcement, migration, or administration of justice. If our services expand into any high-risk category in the future, we will update this Policy and implement all required compliance measures immediately.

8.3 Transparency Obligations (EU AI Act Art. 50)

In accordance with EU AI Act Article 50 transparency obligations, TechVision Mallorca SL makes the following disclosures:

AI-Generated Content Disclosure:

All content generated through UBEX.ai's AI workflow features is produced by AI systems Users are aware they are interacting with AI systems when using the app.ubex.ai platform Where AI-generated content is produced, users are responsible for labelling it appropriately when required by law or professional standards Chatbot & AI Interaction Disclosure:

Any automated conversational AI features within the UBEX.ai platform are clearly identified as AI systems Users are not deceived into believing they are interacting with a human when interacting with AI features Deep Fake & Synthetic Media:

UBEX.ai does not provide deep fake generation capabilities Any image or media generation features clearly identify outputs as AI-generated

8.4 General Purpose AI (GPAI) Models

The AI models integrated into UBEX.ai (GPT, Claude, Gemini, Grok) are classified as General Purpose AI (GPAI) models under EU AI Act Article 51. TechVision Mallorca SL, as a deployer of these models, fulfils the following obligations:

8.5 Prohibited AI Practices

TechVision Mallorca SL confirms that UBEX.ai does not engage in any AI practices prohibited under EU AI Act Article 5, including:

❌ Subliminal manipulation of users' behaviour ❌ Exploitation of vulnerabilities of specific groups ❌ Social scoring of individuals by public authorities ❌ Real-time remote biometric identification in public spaces ❌ Emotion recognition in workplace or educational settings ❌ Biometric categorisation systems based on sensitive characteristics ❌ Predictive policing based on profiling ❌ Scraping of facial images for recognition databases

8.6 Human Oversight & Control

In accordance with EU AI Act principles and GDPR Article 22, TechVision Mallorca SL ensures that:

• All AI workflow outputs are subject to human review before any consequential action is taken
• Users retain full control over whether and how to use AI-generated outputs
• No AI system within UBEX.ai makes fully autonomous decisions with significant legal or similarly significant effects on users without human oversight
• Users can at any time choose not to use AI-generated outputs and seek human assistance instead

8.7 AI Act Compliance Timeline

SECTION 9 — DATA SHARING & THIRD-PARTY PROCESSORS

TechVision Mallorca SL does not sell, rent, or trade your personal data. We share personal data with third parties only in the specific circumstances described in this section, and only to the extent necessary for the stated purpose. All third-party processors are bound by Data Processing Agreements (DPAs) in accordance with GDPR Article 28.

9.1 Categories of Third-Party Recipients

9.2 Named Third-Party Processors — Full Disclosure

A. Google Cloud Platform (Infrastructure Provider)

B. Stripe, Inc. (Payment Processor)

C. OpenAI, LLC (AI Model Provider — GPT)

D. Anthropic, PBC (AI Model Provider — Claude)

E. Google LLC / Google DeepMind (AI Model Provider — Gemini)

F. xAI, LLC (AI Model Provider — Grok)

Note Regarding xAI / Grok: TechVision Mallorca SL is actively working to establish a fully GDPR-compliant Data Processing Agreement with xAI. In the interim, we apply additional technical safeguards when routing data through Grok models and will update this Policy as soon as a full DPA is in place. Users who have concerns about this integration may contact us at adelina@ubex.ai.

9.3 Analytics Providers

TechVision Mallorca SL uses analytics tools to understand how users interact with https://www.ubex.ai and https://app.ubex.ai. The following analytics processing takes place:

9.4 Disclosure to Public Authorities

TechVision Mallorca SL may be required to disclose personal data to public authorities in the following circumstances:

Our Commitment Regarding Authority Requests:

We will always verify the legal validity of any request before disclosing data We will notify you of any request for your data where we are legally permitted to do so We will disclose only the minimum data necessary to satisfy the lawful request We will maintain a record of all authority requests received and our responses We will challenge any request we believe to be unlawful or disproportionate

9.5 Business Transfers

In the event of a merger, acquisition, reorganisation, sale of assets, or insolvency proceedings involving TechVision Mallorca SL, personal data held by us may be transferred to a successor entity. In such circumstances:

• We will notify affected users as soon as practicable and in accordance with GDPR requirements
• Any successor entity will be required to honour the commitments made in this Privacy Policy
• Users will be given the opportunity to exercise their data rights before any transfer takes place
• The transfer will be conducted in full compliance with GDPR Article 6 and applicable Spanish law
• A new privacy policy will be published by any successor entity before processing begins under new ownership

9.6 Sub-Processors

TechVision Mallorca SL maintains a current list of all sub-processors engaged in processing personal data on our behalf. Users may request an up-to-date list of sub-processors at any time by contacting adelina@ubex.ai. We will notify users of any material changes to our sub-processor arrangements with reasonable advance notice, providing the opportunity to object to such changes.

SECTION 10 — INTERNATIONAL DATA TRANSFERS

10.1 Overview of Data Transfer Landscape

TechVision Mallorca SL's primary infrastructure is hosted on Google Cloud in Frankfurt, Germany — meaning your data is stored within the European Union and the European Economic Area (EEA). However, certain data transfers to third-party service providers located outside the EU/EEA do occur in connection with our AI model integrations

in connection with our AI model integrations and other service providers. TechVision Mallorca SL ensures that all such international transfers are conducted with appropriate safeguards in full compliance with GDPR Chapter V (Articles 44–49) and the guidance of the European Data Protection Board (EDPB).

10.2 Legal Framework for International Transfers

Under GDPR Chapter V, personal data may only be transferred outside the EU/EEA where one of the following conditions is met:

10.3 Transfer Map — Where Your Data Goes

The following table provides a complete overview of all international data transfers carried out by TechVision Mallorca SL:

Key Point: The majority of your personal data — including your account information, billing data, and stored workflow data — never leaves the European Union, as it is stored exclusively on Google Cloud's Frankfurt, Germany infrastructure. International transfers occur only when your AI workflow prompts are processed by AI model providers, which is necessary for the core functionality of the service you have requested.

10.4 Standard Contractual Clauses — Detailed Explanation

Standard Contractual Clauses (SCCs) are contractual terms approved by the European Commission under GDPR Article 46(2)(c) that provide legally binding data protection guarantees for international transfers. The current applicable SCCs were adopted by the European Commission on 4 June 2021 (Commission Implementing Decision (EU) 2021/914).

TechVision Mallorca SL uses the following SCC modules for international transfers:

For all transfers to US-based AI model providers, Module 2 (Controller to Processor) SCCs are the primary transfer mechanism, as TechVision Mallorca SL acts as Data Controller and the AI model providers act as Data Processors for the purpose of executing AI workflow requests.

10.5 Transfer Impact Assessments (TIAs)

In accordance with EDPB Recommendations 01/2020 on measures supplementing transfer tools, TechVision Mallorca SL conducts Transfer Impact Assessments (TIAs) for all transfers to third countries. Our TIAs assess:

Step 1 — Know Your Transfer:

What personal data is being transferred Who the recipient is and their location The purpose and necessity of the transfer

Step 2 — Identify the Transfer Tool:

Which GDPR Chapter V mechanism applies Whether SCCs, BCRs, or other mechanisms are in place

Step 3 — Assess the Third Country Legal Framework:

Whether the destination country's laws impinge on the effectiveness of the transfer tool Specifically, whether US surveillance laws (FISA 702, EO 12333) may affect data transferred to US providers

Step 4 — Identify and Adopt Supplementary Measures:

Step 5 — Re-evaluate Periodically:

• TechVision Mallorca SL reviews all TIAs annually and whenever there is a material change in the legal framework of any destination country
• We monitor developments in EU-US data transfer law including the EU-US Data Privacy Framework

10.6 EU-US Data Privacy Framework

The EU-US Data Privacy Framework (DPF), adopted by the European Commission on 10 July 2023 (Adequacy Decision C(2023) 4745), provides a new adequacy mechanism for transfers to certified US organisations.

Note: TechVision Mallorca SL continues to maintain SCCs with all US providers regardless of DPF certification status, as an additional layer of protection in the event the DPF is challenged or invalidated (as occurred with its predecessors Safe Harbor and Privacy Shield).

10.6 Supplementary Technical Safeguards for International Transfers

In addition to the legal mechanisms described above, TechVision Mallorca SL implements the following technical and organisational measures to protect data transferred internationally:

10.7 Your Rights Regarding International Transfers

You have the right to:

Request information about the specific safeguards applied to transfers of your personal data to third countries by contacting adelina@ubex.ai Obtain a copy of the Standard Contractual Clauses or other transfer mechanisms we rely upon for international transfers Lodge a complaint with the AEPD if you believe your data has been transferred internationally without adequate safeguards Withdraw consent for processing activities that involve international transfers where consent is the legal basis — noting this may affect your ability to use certain AI workflow features To exercise any of these rights in connection with international transfers, please contact us at adelina@ubex.ai with the subject line "International Transfer Inquiry" and we will respond within 30 days.

10.8 Monitoring & Review of Transfer Mechanisms

TechVision Mallorca SL commits to the following ongoing monitoring obligations in respect of international transfers:

Annual review of all Transfer Impact Assessments to ensure continued adequacy Immediate review upon any material change in the legal framework of a destination country Continuous monitoring of EU Commission adequacy decisions and DPF certification status of our providers Prompt update of this Privacy Policy upon any material change to our transfer mechanisms or safeguards EDPB guidance monitoring — we actively monitor guidance issued by the European Data Protection Board regarding international transfers and implement recommendations promptly Provider compliance monitoring — we regularly review our sub-processors' compliance with their DPA obligations and update our agreements as required

SECTION 11 — COOKIES & TRACKING TECHNOLOGIES

This section constitutes the full Cookie Policy of TechVision Mallorca SL and applies to all cookies and tracking technologies used on https://www.ubex.ai and https://app.ubex.ai. This Cookie Policy complies with the ePrivacy Directive 2002/58/EC, GDPR, Spanish Law 34/2002 (LSSI-CE), and the AEPD Cookie Guidelines (updated January 2024).

11.1 What Are Cookies?

Cookies are small text files placed on your device (computer, tablet, or mobile phone) when you visit a website. They are widely used to make websites work efficiently, to remember your preferences, and to provide analytical information to website operators. Cookies may be:

First-party cookies — set directly by TechVision Mallorca SL on our domains (ubex.ai and app.ubex.ai) Third-party cookies — set by third-party services we use, such as analytics providers and payment processors Session cookies — temporary cookies that are deleted when you close your browser Persistent cookies — cookies that remain on your device for a defined period or until you delete them

11.2 Other Tracking Technologies

In addition to cookies, we may use the following tracking technologies on our platform:

11.3 Cookie Categories & Full Cookie Register

In accordance with AEPD guidelines and the ePrivacy Directive, we classify all cookies into the following categories:

CATEGORY 1 — STRICTLY NECESSARY COOKIES

These cookies are essential for the operation of our platform. They cannot be disabled as they are required for the website and application to function. No consent is required for strictly necessary cookies under the ePrivacy Directive and LSSI-CE.

Legal Basis: Strictly necessary — no consent required (ePrivacy Directive Art. 5(3) exemption; LSSI-CE Art. 22(2))

CATEGORY 2 — FUNCTIONAL / PREFERENCE COOKIES

These cookies enhance the functionality of our platform by remembering your choices and preferences. They are not strictly necessary but improve your experience. Consent is required.

Legal Basis: Consent (GDPR Art. 6(1)(a); ePrivacy Directive Art. 5(3))

CATEGORY 3 — ANALYTICS & PERFORMANCE COOKIES

These cookies collect information about how visitors use our website and platform. All data collected is aggregated and used solely to improve our services. Consent is required.

Legal Basis: Consent (GDPR Art. 6(1)(a); ePrivacy Directive Art. 5(3))

IP Anonymisation: Google Analytics is configured with IP anonymisation enabled. Full IP addresses are never stored by Google Analytics in connection with our platform.

CATEGORY 4 — MARKETING & TARGETING COOKIES

These cookies are used to deliver relevant content and, where applicable, track the effectiveness of our marketing campaigns. Consent is required. We do not currently use third-party advertising networks for behavioural advertising.

Legal Basis: Consent (GDPR Art. 6(1)(a); ePrivacy Directive Art. 5(3))

Note: Marketing cookies from Meta/Facebook are only active if you have consented to marketing cookies via our cookie consent banner. We do not engage in cross-site behavioural advertising without your explicit

Note: Marketing cookies from Meta/Facebook are only active if you have consented to marketing cookies via our cookie consent banner. We do not engage in cross-site behavioural advertising without your explicit prior consent. You may withdraw consent at any time through our cookie preference centre.

11.4 Cookie Consent Management

TechVision Mallorca SL implements a fully GDPR and LSSI-CE compliant cookie consent mechanism on https://www.ubex.ai and https://app.ubex.ai:

How We Obtain Cookie Consent:

Cookie Consent Banner Requirements (AEPD Compliance):

In accordance with the AEPD's updated Cookie Guidelines (January 2024), our cookie consent banner:

✅ Displays a clear "Accept All," "Reject All," and "Manage Preferences" option at the first layer ✅ Does not use deceptive design or dark patterns to nudge users toward acceptance ✅ Provides equal prominence to accept and reject options ✅ Does not set non-essential cookies before consent is obtained ✅ Allows users to change their preferences at any time ✅ Re-requests consent after 12 months or upon material change in cookie usage ✅ Records and stores consent decisions with timestamp for compliance audit purposes

11.5 How to Manage and Control Cookies

In addition to our cookie preference centre, you can manage cookies through the following methods:

Browser-Level Cookie Controls:

Important: Disabling all cookies through your browser settings may affect the functionality of https://app.ubex.ai, including your ability to log in and use the platform. Strictly necessary cookies are required for the platform to function.

Opt-Out Tools for Specific Providers:

11.6 Cookies in the app.ubex.ai Application

The application platform at https://app.ubex.ai uses additional technical cookies and local storage mechanisms that are strictly necessary for platform functionality. These include:

Authentication tokens — required to maintain your logged-in session securely CSRF protection tokens — required to protect against cross-site request forgery attacks Workflow state storage — used to maintain the state of active workflow editors and prevent data loss API rate limiting tokens — used to manage API request rates and prevent service abuse Feature flag storage — used to deliver the correct feature set based on your subscription tier UI state storage — used to remember interface states such as open panels, collapsed menus, and active tabs All of the above are strictly necessary for the operation of the app.ubex.ai platform and do not require consent under the ePrivacy Directive strictly necessary exemption.

11.7 Do Not Track (DNT) Signals

Some browsers include a "Do Not Track" (DNT) feature that sends a signal to websites requesting that your browsing not be tracked. At present, there is no legally binding standard or EU regulatory requirement governing how websites must respond to DNT signals. TechVision Mallorca SL currently does not alter its data collection practices in response to DNT signals. However, we respect your privacy preferences and encourage you to use our cookie preference centre to control tracking on our platform.

11.8 Updates to Our Cookie Policy

• We review and update our Cookie Policy regularly to reflect changes in our cookie usage, applicable law, and AEPD guidance. When we make material changes:

• We will update the "Last Updated" date at the top of this Policy

• We will re-display the cookie consent banner to obtain fresh consent where required

• We will notify registered users of material changes via email where appropriate

SECTION 12 — DATA RETENTION PERIODS

TechVision Mallorca SL retains personal data only for as long as necessary to fulfil the purposes for which it was collected, in accordance with the storage limitation principle under GDPR Article 5(1)(e) and applicable Spanish law retention obligations. This section sets out our complete data retention schedule.

12.1 Principles Governing Retention

Our data retention practices are governed by the following principles:

Purpose limitation: Data is retained only for as long as the original purpose requires Legal obligation compliance: Where Spanish or EU law mandates minimum retention periods, we comply fully Data minimisation: We regularly review retained data and delete or anonymise data that is no longer necessary Proportionality: Retention periods are proportionate to the sensitivity of the data and the purpose of processing Security during retention: All retained data is subject to the same security measures as actively used data Documented justification: Every retention period in this schedule has a documented legal or business justification

12.2 Complete Data Retention Schedule

A. Account & Identity Data

B. Billing & Financial Data

C. AI Workflow & Platform Data

D. Technical & Log Data

E. Communications & Support Data

F. Analytics & Usage Data

G. Legal & Compliance Data

12.3 Retention Periods for Specific User Scenarios

Scenario A — Active User Account:

All data categories are retained for the duration of the active account relationship plus the applicable retention period specified in Section 12.2.

Scenario B — User Requests Account Deletion:

Scenario C — Account Suspended for Terms of Service Violation:

Scenario D — Inactive Account (No Login for 24 Months):

12.4 Data Deletion & Anonymisation Methods

When personal data reaches the end of its retention period, TechVision Mallorca SL applies the following deletion and anonymisation methods:

12.5 Retention Review Process

TechVision Mallorca SL conducts the following retention management activities:

Annual retention audit — all data categories are reviewed annually to confirm retention periods remain appropriate and legally justified Automated deletion — where technically feasible, automated deletion processes are implemented to enforce retention schedules Deletion logging — all data deletion activities are logged for compliance audit purposes Third-party processor review — we annually verify that all third-party processors are applying retention periods consistent with our instructions and their DPAs

SECTION 13 — YOUR RIGHTS UNDER GDPR AND SPANISH LAW

As a data subject under the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), you have comprehensive rights regarding your personal data. TechVision Mallorca SL is committed to facilitating the exercise of all your data subject rights promptly, transparently, and free of charge.

13.1 Overview of Your Rights

13.2 Right of Access (GDPR Art. 15)

What this right means:

You have the right to obtain from TechVision Mallorca SL confirmation of whether or not we are processing personal data about you, and where we are, to receive a copy of that personal data together with the following supplementary information:

The purposes of the processing The categories of personal data being processed The recipients or categories of recipients to whom the data has been or will be disclosed The envisaged retention period or the criteria used to determine it The existence of your rights to rectification, erasure, restriction, and objection The right to lodge a complaint with the AEPD Any available information about the source of data not collected directly from you The existence of automated decision-making including profiling and meaningful information about the logic involved Where data is transferred to a third country, the safeguards in place How to exercise this right:

Submit a written request to adelina@ubex.ai with the subject line "Data Access Request" including:

Your full name and email address associated with your UBEX.ai account Specific description of the data or processing activities you wish to access (or confirmation that you request all data) Copy of identity verification document if required (see Section 13.11) Our response commitment:

We will respond within 30 calendar days of receiving your request This period may be extended by a further 60 days where requests are complex or numerous — we will notify you within the initial 30-day period if an extension is required We will provide the requested information free of charge for the first copy For subsequent copies or manifestly unfounded or excessive requests, we may charge a reasonable administrative fee Format of response:

We will provide your data in a commonly used electronic format (PDF or JSON) unless you request otherwise Where you have submitted your request electronically, we will provide the information electronically where possible

13.3 Right to Rectification (GDPR Art. 16)

What this right means:

You have the right to obtain from TechVision Mallorca SL the correction of inaccurate personal data about you without undue delay. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

How to exercise this right:

Self-service: Many personal data fields (name, email, billing address) can be updated directly through your account settings at app.ubex.ai Request: For data that cannot be updated through account settings, submit a request to adelina@ubex.ai with the subject line "Data Rectification Request" specifying: The data that is inaccurate or incomplete The correct data you wish to substitute Supporting evidence of the correct data where appropriate Our response commitment:

We will action your rectification request within 30 calendar days We will notify all third-party processors to whom the inaccurate data was disclosed of the rectification, unless this proves impossible or involves disproportionate effort We will confirm completion of the rectification to you in writing

13.4 Right to Erasure — "Right to Be Forgotten" (GDPR Art. 17 & LOPDGDD Art. 17)

What this right means:

You have the right to obtain from TechVision Mallorca SL the erasure of personal data about you without undue delay where one of the following grounds applies:

Limitations on the right to erasure:

The right to erasure does not apply where processing is necessary for:

Compliance with a legal obligation requiring processing under EU or Spanish law The establishment, exercise, or defence of legal claims Archiving purposes in the public interest, scientific research, or statistical purposes Exercise of the right of freedom of expression and information How to exercise this right:

Submit a request to adelina@ubex.ai with the subject line "Erasure Request" specifying:

The specific data or categories of data you wish to have erased The ground on which you are relying from the list above Your account email address for verification purposes Our response commitment:

We will respond within 30 calendar days confirming either completion of erasure or the reason why erasure cannot be carried out Where erasure is carried out, we will notify all third-party processors and recipients of the erasure request We will confirm which data has been deleted and which data is being retained under a legal obligation exemption, with full explanation Spanish LOPDGDD Supplementary Right (Art. 17): Under Spanish law, the right to erasure includes the right to request that search engines and online platforms remove links to content containing your personal data. Where applicable to UBEX.ai's services, we will cooperate fully with such requests.

13.5 Right to Restriction of Processing (GDPR Art. 18)

What this right means:

You have the right to obtain from TechVision Mallorca SL restriction of processing where one of the following applies:

Effect of restriction:

During a period of restricted processing, TechVision Mallorca SL will:

Store the restricted data securely Not process the data for any purpose other than storage Not share the restricted data with third parties except with your consent or for legal claims Notify you before lifting any restriction How to exercise this right:

Submit a request to adelina@ubex.ai with the subject line "Restriction Request" specifying the ground for restriction and the specific data to be restricted.

Our response commitment:

We will confirm restriction within 30 calendar days We will notify you in writing before lifting any restriction so you may object

13.6 Right to Data Portability (GDPR Art. 20)

What this right means:

You have the right to receive personal data you have provided to TechVision Mallorca SL in a structured, commonly used, and machine-readable format, and to transmit that data to another controller, where:

The processing is based on consent or contract performance; and The processing is carried out by automated means Data covered by portability right:

How to exercise this right:

Self-service export: Where technically available, you may export your data directly from your account settings at app.ubex.ai using the "Export My Data" feature Manual request: Submit a request to adelina@ubex.ai with the subject line "Data Portability Request" specifying: The categories of data you wish to export Your preferred format (JSON, CSV, PDF, TXT) Whether you wish the data sent directly to you or transmitted to another controller (provide controller details if applicable) Our response commitment:

We will provide your portable data within 30 calendar days of receiving your request Data will be provided in the format you request where technically feasible Where you request direct transmission to another controller, we will do so where technically feasible and will confirm completion This service is provided free of charge Important limitations:

The right to portability applies only to data you have actively provided to us — it does not extend to data derived or inferred from your data by our systems Portability of AI workflow outputs is subject to the intellectual property terms in our Terms of Service Transmission to another controller is subject to that controller's own data protection obligations

13.7 Right to Object (GDPR Art. 21 & LOPDGDD Art. 18)

What this right means:

You have the right to object, on grounds relating to your particular situation, to processing of your personal data where the legal basis for processing is:

Legitimate interests (Art. 6(1)(f)); or Public interest (Art. 6(1)(e)) Upon receiving an objection, TechVision Mallorca SL must cease processing unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defence of legal claims.

Absolute right to object to direct marketing:

You have an absolute and unconditional right to object to processing of your personal data for direct marketing purposes at any time, with no requirement to provide justification. This includes profiling to the extent it is related to direct marketing. Upon receipt of such an objection, we will immediately cease all direct marketing processing.

How to exercise this right:

Marketing opt-out: Use the unsubscribe link in any marketing email, or update your communication preferences in your account settings at app.ubex.ai Legitimate interests objection: Submit a request to adelina@ubex.ai with the subject line "Objection to Processing" specifying: The specific processing activity you are objecting to The grounds relating to your particular situation that justify the objection Our response commitment:

For direct marketing objections — we will action your request immediately and within no more than 5 business days For legitimate interests objections — we will respond within 30 calendar days confirming either that we have ceased processing or providing our compelling legitimate grounds for continuing We will update all relevant third-party processors of your objection where applicable Spanish LOPDGDD Supplementary Provision (Art. 18): Under Spanish law, you have the right to object to processing in the context of automated decisions including profiling. This right supplements and reinforces the rights under GDPR Article 22 described in Section 13.8 below.

13.8 Rights Related to Automated Decision-Making & Profiling (GDPR Art. 22)

What this right means:

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Current automated processing at UBEX.ai:

Safeguards for automated decisions with significant effects:

Where automated processing does produce significant effects (fraud detection, payment screening), TechVision Mallorca SL implements the following safeguards in compliance with GDPR Art. 22(2)(b):

✅ Human review: Any automated decision resulting in account suspension or payment decline is subject to human review upon request ✅ Right to contest: You may contest any automated decision affecting you by contacting adelina@ubex.ai ✅ Right to human intervention: You may request that any automated decision be reviewed by a human member of our team ✅ Right to express your view: You may provide additional context or information before a final decision is made ✅ Transparency: We will explain the logic behind any automated decision affecting you upon request ✅ Prompt review: Human review of contested automated decisions will be completed within 15 business days How to exercise this right:

Submit a request to adelina@ubex.ai with the subject line "Automated Decision Review" specifying:

The automated decision you wish to contest Any additional context or information you wish us to consider Whether you are requesting human intervention or a full review of the decision

13.9 Right to Withdraw Consent (GDPR Art. 7(3))

What this right means:

Where TechVision Mallorca SL processes your personal data on the basis of your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Processing activities based on consent:

Effect of withdrawal:

Withdrawal of consent for marketing emails will result in immediate cessation of all marketing communications — you will continue to receive essential service emails (account notifications, billing receipts, security alerts) which are sent on the basis of contract performance, not consent Withdrawal of consent for analytics cookies will result in immediate cessation of analytics tracking on your device — historical analytics data already collected may be retained in anonymised form Withdrawal of consent for marketing cookies will result in immediate removal of marketing cookies from your device and cessation of any associated tracking Withdrawal of consent does not affect the validity of any processing carried out during the period when consent was in place Withdrawal of consent will not affect your ability to use the core features of the UBEX.ai platform, except where the specific feature requires consent as its legal basis How quickly we action consent withdrawal:

Cookie consent withdrawal — immediate (cookies removed within current browsing session) Marketing email opt-out — within 5 business days of request (you may receive one further communication if already scheduled at time of withdrawal) All other consent withdrawals — within 15 calendar days of request

13.10 Right to Lodge a Complaint (GDPR Art. 77)

What this right means:

• Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes the GDPR or applicable Spanish data protection law. This right exists regardless of whether you have first raised the matter directly with TechVision Mallorca SL.

Primary Supervisory Authority — Spain:

Alternative Supervisory Authorities:

As a resident of any EU/EEA member state, you also have the right to lodge a complaint with the supervisory authority of your country of habitual residence, place of work, or the place of the alleged infringement:

Our strong preference:

While you have an unconditional right to contact the AEPD or any supervisory authority at any time, we strongly encourage you to contact us first at adelina@ubex.ai so that we have the opportunity to address your concern directly and promptly. We are committed to resolving all data protection concerns fairly, transparently, and without requiring formal regulatory intervention wherever possible.

13.11 Right to Digital Disconnection (LOPDGDD Art. 88 & Art. 95)

What this right means:

Under Spanish Organic Law 3/2018 (LOPDGDD), users have the right to digital disconnection — the right not to receive communications through digital means outside of agreed service interactions. In the context of UBEX.ai, this means:

You have the right to restrict the channels through which we contact you You have the right to set boundaries on the frequency and timing of communications You have the right to receive only essential service communications if you choose to opt out of all non-essential digital contact How to exercise this right:

Update your communication preferences in your account settings at app.ubex.ai, or contact adelina@ubex.ai with the subject line "Digital Disconnection Request" specifying your preferred communication restrictions.

13.12 How to Submit a Data Subject Request — Full Process

Step 1 — Prepare Your Request:

Identify which right you wish to exercise and prepare the following information:

Your full name as registered on your UBEX.ai account Your email address associated with your UBEX.ai account The specific right you wish to exercise A clear description of your request Any supporting information relevant to your request

Step 2 — Submit Your Request:

Step 3 — Identity Verification:

To protect your personal data from unauthorised access, we may need to verify your identity before processing your request. Identity verification may involve:

Important: We will never ask for more identity verification than is necessary and proportionate to the risk of the request. We will not use identity verification as a mechanism to discourage or delay the exercise of your rights.

Step 4 — Processing Your Request:

Step 5 — If You Are Unsatisfied:

If you are not satisfied with our response to your data subject request, you have the right to:

Request an internal review by contacting adelina@ubex.ai with the subject line "Data Rights Review Request" Lodge a complaint directly with the AEPD — see Section 13.10 for full contact details Seek judicial remedy before the competent Spanish courts under GDPR Art. 79

13.13 Exercising Rights on Behalf of Another Person

You may exercise data subject rights on behalf of another person in the following circumstances:

All third-party requests will be subject to enhanced identity verification to protect data subjects from unauthorised access to their personal data.

13.14 Fees for Data Subject Requests

In accordance with GDPR Article 12(5), TechVision Mallorca SL provides responses to data subject requests free of charge as a general rule. However, we reserve the right to charge a reasonable administrative fee or refuse to act on requests that are manifestly unfounded or excessive, particularly where they are repetitive in nature.

Where we determine that a fee is appropriate, we will notify you in writing with full justification before charging any fee, giving you the opportunity to withdraw or modify your request.

SECTION 14 — CHILDREN'S PRIVACY

14.1 Age Restrictions and Eligibility

TechVision Mallorca SL's UBEX.ai platform is an AI workflow automation tool designed exclusively for business and professional use. The platform is not directed at, designed for, or intended to be used by children or minors.

Our Policy: Given the professional and business nature of the UBEX.ai platform, we set our minimum age requirement at 18 years. We do not knowingly collect personal data from individuals under the age of 18. If you are under 18, please do not register for or use the UBEX.ai platform.

14.2 Measures to Prevent Under-Age Registration

TechVision Mallorca SL implements the following measures to prevent registration by minors:

14.3 Discovery and Deletion of Minor's Data

If TechVision Mallorca SL discovers or is notified that personal data of a person under the age of 18 has been collected without appropriate parental consent, we will:

To report suspected minor account:

If you believe a minor is using the UBEX.ai platform, or if you are a parent or guardian who believes your child has registered, please contact us immediately at adelina@ubex.ai with the subject line "Minor Account Report". We will investigate and act promptly.

14.4 Spanish LOPDGDD Specific Provisions for Minors

Under LOPDGDD Article 7, the following specific provisions apply to the processing of minors' data in Spain:

Children aged 14 and over may consent to processing of their personal data under Spanish law Children under 14 require verifiable parental or guardian consent for any data processing TechVision Mallorca SL applies a higher standard of 18 years given the professional nature of the platform Where parental consent would be required under LOPDGDD Art. 7, we will make every reasonable effort to verify such consent before processing

14.5 AI Interactions and Minors

Given that UBEX.ai's platform involves AI model interactions, we apply additional caution regarding minors:

AI workflow features are not designed or optimised for use by minors No AI features within UBEX.ai are directed at children as defined under applicable law We do not create profiles of minors for any purpose If a minor's data is submitted within an AI workflow by an adult user (e.g., processing data about a child in a professional context), such processing must comply with all applicable child data protection requirements and the adult user bears responsibility for ensuring lawful processing

SECTION 15 — DATA SECURITY

15.1 Our Commitment to Data Security

TechVision Mallorca SL takes the security of your personal data extremely seriously. We implement comprehensive technical and organisational security measures in accordance with:

GDPR Article 32 — Security of processing LOPDGDD — Spanish data protection security requirements ENS (Esquema Nacional de Seguridad) — Spanish National Security Framework ISO/IEC 27001 principles — Information security management best practices NIST Cybersecurity Framework — Risk-based cybersecurity approach ENISA guidelines — European Union Agency for Cybersecurity recommendations Our security measures are designed to ensure a level of security appropriate to the risk, taking into account the state of the art, costs of implementation, and the nature, scope, context, and purposes of processing.

15.2 Technical Security Measures

A. Encryption

B. Access Controls

C. Infrastructure Security

D. Application Security

15.3 Organisational Security Measures

15.4 Data Breach Response Procedure

In the event of a personal data breach, TechVision Mallorca SL will follow the following response procedure in full compliance with GDPR Articles 33 and 34 and LOPDGDD:

Phase 1 — Detection & Containment (0–24 hours):

Phase 2 — Assessment & Notification (24–72 hours):

Phase 3 — Data Subject Notification (where required):

Phase 4 — Remediation & Review:

15.5 Reporting a Security Vulnerability

TechVision Mallorca SL welcomes responsible disclosure of security vulnerabilities in our platform. If you discover a security vulnerability, please report it to us immediately:

Please include in your report:

Description of the vulnerability Steps to reproduce the vulnerability Potential impact assessment Any proof-of-concept code or screenshots (where safe to provide) Your contact details for follow-up

SECTION 16 — LEGAL BASIS SUMMARY TABLE

This section provides a consolidated reference of all processing activities carried out by TechVision Mallorca SL and the corresponding legal basis under GDPR Article 6 and, where applicable, Article 9. This table is provided to ensure full transparency and to serve as a complete record of our lawful processing activities.

16.1 Complete Processing Activity Register

A. Account & Registration Processing

B. Payment & Billing Processing

C. AI Workflow & Platform Processing

D. Communications Processing

E. Analytics & Performance Processing

F. Security & Compliance Processing

G. Cookie & Tracking Processing

16.2 Legitimate Interests Assessment Summary

Where TechVision Mallorca SL relies on legitimate interests (GDPR Art. 6(1)(f)) as the legal basis for processing, we have conducted Legitimate Interests Assessments (LIAs) confirming that:

• Full LIA documentation is available to data subjects and the AEPD upon request. Contact adelina@ubex.ai with the subject line "LIA Documentation Request".

SECTION 17 — CHANGES TO THIS PRIVACY POLICY

17.1 Our Commitment to Keeping This Policy Current

TechVision Mallorca SL is committed to maintaining this Privacy Policy as an accurate, current, and complete reflection of our data processing practices. The digital and regulatory landscape — particularly in the fields of AI, data protection, and ePrivacy — evolves rapidly, and we will update this Policy promptly to reflect any material changes.

17.2 Circumstances That Will Trigger a Policy Update

We will review and update this Privacy Policy in the following circumstances:

17.3 How We Will Notify You of Changes

17.4 Version History

TechVision Mallorca SL maintains a version history of this Privacy Policy. Previous versions are available upon request by contacting adelina@ubex.ai with the subject line "Privacy Policy Version Request".

17.5 Your Continued Use

• Your continued use of https://www.ubex.ai or https://app.ubex.ai following notification of material changes to this Privacy Policy constitutes acknowledgement of the updated Policy. Where a change requires fresh consent, we will obtain that consent before the change takes effect and will not rely on continued use as a substitute for explicit consent where consent is required by law.

SECTION 18 — CONTACT INFORMATION & DATA CONTROLLER DETAILS

18.1 Data Controller Identity

The data controller responsible for the processing of your personal data in connection with https://www.ubex.ai and https://app.ubex.ai is:

18.2 Primary Privacy Contact

For all data protection enquiries, data subject rights requests, and privacy-related matters, please contact:

18.3 Data Protection Officer (DPO)

Under GDPR Article 37, the appointment of a Data Protection Officer is mandatory where:

Processing is carried out by a public authority or body Core activities consist of processing operations which require regular and systematic monitoring of data subjects on a large scale Core activities consist of processing special categories of data or personal data relating to criminal convictions on a large scale TechVision Mallorca SL's DPO Assessment:

Note: While a formal DPO is not currently required, TechVision Mallorca SL takes data protection governance seriously. Adelina Bolota serves as the primary privacy contact and is responsible for overseeing data protection compliance. As UBEX.ai grows, we will reassess the need for a dedicated DPO appointment and will appoint one if and when required by GDPR Article 37. If a DPO is appointed in the future, their contact details will be published in this Policy and registered with the AEPD.

18.4 EU Representative

As TechVision Mallorca SL is established within the European Union (Spain), we are not required to appoint an EU representative under GDPR Article 27. Our registered address in Mallorca, Spain serves as our EU establishment for all GDPR purposes.

18.5 Supervisory Authority

The lead supervisory authority for TechVision Mallorca SL is:

18.6 How to Contact Us — Quick Reference

SECTION 19 — GOVERNING LAW & JURISDICTION

19.1 Applicable Law

This Privacy Policy and all data processing activities of TechVision Mallorca SL are governed by and construed in accordance with the following legal framework:

European Union Law:

Spanish National Law:

19.2 Jurisdiction

19.3 Alternative Dispute Resolution

TechVision Mallorca SL is committed to resolving all privacy disputes amicably and without the need for formal legal proceedings. In the event of a dispute regarding this Privacy Policy or our data processing practices:

First step: Contact us directly at adelina@ubex.ai — we will endeavour to resolve all disputes within 30 calendar days Second step: If unresolved, you may refer the matter to the AEPD for mediation or investigation Third step: You retain the right to seek judicial remedy before the competent Spanish courts at any stage

19.4 Language

This Privacy Policy is published in English as the primary language. Where a Spanish language version is published, in the event of any conflict or inconsistency between the English and Spanish versions, the English version shall prevail unless otherwise required by applicable Spanish law.

SECTION 20 — DEFINITIONS & GLOSSARY

The following definitions apply throughout this Privacy Policy and are provided to ensure full clarity and legal precision:

20.1 Key Defined Terms

SECTION 21 — FINAL DECLARATIONS & POLICY CERTIFICATION

21.1 Accuracy Declaration

TechVision Mallorca SL declares that this Privacy Policy:

✅ Accurately reflects all personal data processing activities carried out by TechVision Mallorca SL as of the date of publication ✅ Has been prepared with reference to GDPR, LOPDGDD, LSSI-CE, the ePrivacy Directive, the EU AI Act, and all other applicable EU and Spanish data protection laws ✅ Complies with the transparency requirements of GDPR Articles 13 and 14 ✅ Complies with the AEPD's Cookie Guidelines (January 2024 edition) ✅ Complies with EDPB guidelines on consent, transparency, data portability, breach notification, and international transfers ✅ Has been reviewed against the requirements of the EU AI Act for AI system transparency and user rights ✅ Provides data subjects with all information required to exercise their rights under GDPR Chapter III ✅ Will be reviewed and updated at minimum annually and upon any material change in processing activities or applicable law

21.2 Policy Metadata

PUBLICATION GUIDE — HOW TO PUBLISH THIS PRIVACY POLICY

Step 1 — Pre-Publication Checklist

Before publishing this Privacy Policy at https://ubex.ai/en/privacy, complete the following checklist:

Step 2 — Website Implementation

Step 3 — Ongoing Compliance Actions

✅ PRIVACY POLICY — COMPLETE The complete UBEX.ai Privacy Policy for TechVision Mallorca SL now comprises:

Total Coverage:

✅ 21 comprehensive sections ✅ Full GDPR compliance (all Articles addressed) ✅ Full LOPDGDD compliance (Spanish national law) ✅ Full LSSI-CE compliance (cookies and eCommerce) ✅ ePrivacy Directive compliance (cookies and tracking) ✅ EU AI Act compliance (AI transparency and obligations) ✅ All third-party processors documented (Stripe, Google Cloud, OpenAI, Anthropic, Google/Gemini, xAI/Grok) ✅ All international transfers documented with safeguards ✅ Complete cookie register with consent mechanism ✅ Complete data retention schedule ✅ All 10 data subject rights fully detailed ✅ Children's privacy protection ✅ Full security measures documentation ✅ Complete definitions glossary ✅ Publication guide and pre-publication checklist