Privacy Policy

1. Who we are and how to contact us

1.1 This policy is issued by SovSec Ltd, a private limited company registered in England and Wales under company number [COMPANY NUMBER], registered office [REGISTERED OFFICE ADDRESS] — and, from the date on which it assumes the contract by written notice, its Austrian subsidiary [SOVSEC FLEXCO NAME], registered in the Austrian commercial register (Firmenbuch) under FN [FN NUMBER], Landesgericht [COURT], seat [ADDRESS, AUSTRIA] (planned 2028) (SovSec, we, us). SovSec provides cyber security and managed IT services under the SovSec brand and software under the Prismara brand. For the processing described in this policy, SovSec is the controller.

1.2 Contact for anything about your personal data: privacy@sovsec.com or by post to SovSec Ltd, [REGISTERED OFFICE ADDRESS], marked “Privacy”. Our founder and director, Jake Gliddon, is responsible for data protection at SovSec. We have not appointed a statutory data protection officer; if we do, we will publish their details here.

1.3 EU representative. SovSec Ltd is established in the United Kingdom and offers services to people in the European Union. Under Article 27 GDPR it has appointed a representative in the EU: [EU REPRESENTATIVE NAME AND ADDRESS], [EMAIL]. You may contact the representative instead of, or as well as, SovSec on any data protection matter. When our Austrian subsidiary ([SOVSEC FLEXCO NAME]) begins operating (planned 2028), it may become the controller for EU customers; we will update this policy and tell affected customers.

2. When this policy applies — and when it does not

2.1 This policy covers people whose personal data SovSec decides how and why to use: visitors to sovsec.com, prismara.eu and their subdomains; prospective clients and people who contact us; the business contacts of our clients, suppliers and partners; users of Prismara Personal (Free and Secure) accounts; job applicants; members of the MSP partner programme; people who follow or interact with us on social media; and security researchers who report vulnerabilities to us.

I F Y O U R E M P L O Y E R O R O R G A N I S AT I O N U S E S S O V S E C O R P R I S M A R A

When a business client uses our managed services, Microsoft tenant management, security monitoring or a Prismara business plan, SovSec processes the personal data in those services (for example your mailbox, files, device telemetry or service desk tickets) as a processor on the client's behalf. The client is the controller, and its own privacy notice applies. Please contact your organisation first. If you contact us, we will pass your request to them. Our obligations as processor are set out in our Data Processing Agreement (SOV-LG-003).

We act as controller for a narrow set of data about business users that we need to run our own services: account and licence records, billing contacts, and security and abuse logs about our platform (for example, failed sign-in attempts against our infrastructure). That processing is covered by this policy.

2.2 Demo sites at <app>-demo.prismara.eu contain fictional data only. Please do not enter real personal data into demo environments.

S O V S E C · P R I VA C Y P O L I C Y SOV-LG-005 · v1.0 · EU

3. What we collect and where it comes from

Who you Personal data Source are

 Website         IP address, browser and device type, pages requested, date and time, referrer; cookie and            Your browser, automatically.
 visitor         local storage settings (see SOV-LG-006).

 Prospect or     Name, company, job title, business email and phone, country, message content, product                You (contact forms, email, events,
 enquirer        interest, record of calls, meetings and proposals.                                                   calls); occasionally public business
                                                                                                                      sources such as your company
                                                                                                                      website or LinkedIn profile; referrals
                                                                                                                      from partners.

 Client,         Name, role, business contact details, contract and order history, invoices and payment               You or your organisation.
 supplier or     status, communications, service desk and escalation contacts.
 partner
 contact

 Prismara        Name or display name, prismara.eu email address, recovery email or phone, date of birth              You; your devices; Stripe (payment
 Personal        confirmation (age check), authentication data (passkey public keys, hashed secrets),                 confirmations, not card numbers).
 user            subscription and payment status, support requests, security logs (sign-ins, IP addresses,
                 device information); for Personal Secure, minimal Prismara ZTNA (personal VPN) connection
                 metadata — never the content or destinations of your browsing — and security telemetry
                 from devices on which you install Prismara Endpoint. Content you store (mail, documents,
                 files, vault items) is processed only to provide the service; vault items in Prismara Prism and
                 sealed mail are end-to-end encrypted and we cannot read them.

 Job applicant   CV, cover letter, contact details, right-to-work information, interview notes, references,           You; recruiters you use; referees you
                 assessment results.                                                                                  name.

 Social media    Handle, public profile and interactions with our posts.                                              The social network concerned.
 follower

 Security        Name or alias, contact details, vulnerability report contents.                                       You (security@sovsec.com).
 researcher

We do not intentionally collect special categories of personal data (such as health information) except where you volunteer it — for example, an accessibility need for an interview — or where the law requires it. We do not buy marketing lists.

4. Why we use your data and our lawful bases

 Purpose                                Lawful basis (Art. 6 GDPR)                                            Notes

 Running and securing our               Legitimate interests (Art. 6(1)(f))                                   Our interest in providing secure websites.
 websites; preventing abuse and                                                                               Strictly necessary cookies only by default.
 attacks

 Answering enquiries and preparing      Steps at your request before a contract (6(1)(b)); otherwise          Enquiries are stored in SovSec's own
 quotes and proposals                   legitimate interests (6(1)(f))                                        Prismara CRM, hosted in Vienna.

 Providing, billing and supporting      Contract (6(1)(b)) where you are the contracting party;
 services to clients and partners       otherwise legitimate interests in managing our business
                                        relationship (6(1)(f))

 Providing Prismara Personal            Contract (6(1)(b))                                                    Includes account security, support, service
 accounts                                                                                                     messages and age checks.

 Taking payments for Prismara           Contract (6(1)(b)); legal obligation (6(1)(c)) for tax records        Payments are processed by Stripe.
 Personal Secure

S O V S E C · P R I VA C Y P O L I C Y SOV-LG-005 · v1.0 · EU

 Purpose                               Lawful basis (Art. 6 GDPR)                                             Notes

 Protecting our platforms, detecting   Legitimate interests (6(1)(f)); legal obligation (6(1)(c)) where       Includes processing of security logs about our
 fraud and misuse, investigating       we must report incidents or vulnerabilities                            infrastructure.
 security incidents

 B2B marketing emails and event        Consent, or — for existing customers and similar products or           You can unsubscribe at any time using the link
 invitations                           services — legitimate interests with an opt-out in every               in every email.
                                       message (§ 174 TKG 2021 and Art. 6(1)(f) GDPR).

 Social media presence                 Legitimate interests (6(1)(f))                                         Where a network sets cookies or analyses
                                                                                                              followers, it may act jointly with us; see the
                                                                                                              network's own privacy policy.

 Recruitment                           Steps before a contract (6(1)(b)); legal obligation (6(1)(c)) for      Applications are handled in SovSec's own
                                       right-to-work checks; consent (6(1)(a)) to keep your application       Prismara HR.
                                       for future vacancies

 Handling vulnerability reports        Legitimate interests (6(1)(f)); legal obligation (6(1)(c)) under the   We credit researchers only with their
                                       Cyber Resilience Act                                                   permission.

 Accounting, tax, legal claims and     Legal obligation (6(1)(c)); legitimate interests in establishing or
 regulatory compliance                 defending legal claims (6(1)(f))

4.1 Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details of that assessment. Where we rely on consent, you can withdraw it at any time without affecting processing that took place before.

4.2 If you do not provide data that we need to enter into or perform a contract with you (for example, an email address for a Prismara Personal account), we will not be able to provide the service.

5. Who we share data with

• Service providers acting for us — principally netcup GmbH, which hosts our servers in Vienna, Austria, and Stripe for Prismara Personal payments. See the Sub-processor List (SOV-LG-004) for the full list and status.
• Professional advisers — accountants, auditors, lawyers and insurers, under confidentiality duties.
• MSP partners — where you were referred by, or asked to be served through, a SovSec partner, we share the information needed to manage that relationship.
• Group companies — our planned Austrian subsidiary, [SOVSEC FLEXCO NAME], once it assumes EU contracts (planned 2028).
• Authorities — police, regulators, courts, tax authorities, ENISA and national CSIRTs or the data protection authority, where the law requires it or it is necessary to protect our rights, our clients or others.
• Buyers or investors — in connection with a sale, merger or investment, under confidentiality, and only as necessary.

5.1 We do not sell personal data, and we do not share it with advertising networks or data brokers.

6. International transfers

6.1 Our services are hosted in Vienna, Austria. SovSec Ltd is based in the United Kingdom, so our staff access data from there. The European Commission has recognised the UK as providing an adequate level of protection; that decision was renewed in December 2025 and runs to 27 December 2031.

6.2 A small number of providers are based in, or may transfer data to, the United States — for example Stripe (payments), GitHub (source code, no customer data intended) and Buffer (our social media scheduling, which

S O V S E C · P R I VA C Y P O L I C Y SOV-LG-005 · v1.0 · EU

processes only our own posts and the public profiles of people who interact with them). Where such a transfer takes place, it relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the recipient is certified, or on the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914).

6.3 You can ask for a copy of the relevant safeguards by writing to privacy@sovsec.com.

7. How long we keep data

Data Retention

Website server logs 14 days, then deleted (security incident logs: up to 12 months)

Enquiries and prospect 24 months after our last contact, then deleted records with no contract

Marketing preferences and Until you unsubscribe, then a suppression record (email only) for as long as needed to respect your unsubscribe records choice

Client, supplier and partner 7 years after the contract ends; longer where a claim is pending contracts and correspondence

Invoices and accounting 7 years (UK law and § 132 BAO); records for EU VAT One-Stop-Shop sales to consumers: 10 years records

Prismara Personal account For the life of the account. After you close it, content remains available for export (and the account data and content can be reopened) for 30 days, is then deleted from live systems within a further 30 days and from backups within a further 35 days; billing records are kept as for invoices

Inactive Prismara Personal May be closed after 12 months without sign-in, after at least 30 days' email notice (see the Prismara Free accounts Personal Terms, SOV-LG-010)

Platform security logs 12 months

Prismara ZTNA (personal [N] days (no content or destinations are logged) VPN) connection metadata

Prismara Endpoint device [N] days, or until the device is removed from your account if sooner telemetry (Personal Secure)

Job applications 7 months after the decision (to cover the claims period under the Austrian Equal Treatment Act); (unsuccessful) longer only with your consent (up to 24 months)

Vulnerability reports 5 years, or the support period of the affected product if longer

8. Your rights

8.1 Subject to conditions and exceptions in the law, you have the right to: access your personal data and receive a copy; have inaccurate data rectified; have data erased; restrict processing; data portability for data you gave us under a contract or consent; object to processing based on legitimate interests; object at any time to direct marketing (we will then stop); and withdraw consent at any time.

8.2 To exercise a right, write to privacy@sovsec.com or, for Prismara Personal, use the settings in your account (export and deletion are self-service). We may ask you to confirm your identity. We respond within one month; we may extend this by up to two further months for complex requests and will tell you if we do. There is no fee unless a request is manifestly unfounded or excessive.

S O V S E C · P R I VA C Y P O L I C Y SOV-LG-005 · v1.0 · EU

8.3 Complaints. You have the right to lodge a complaint with a supervisory authority — in Austria, the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at — or the supervisory authority of your habitual residence, place of work or place of the alleged infringement. We would appreciate the chance to deal with your concern first at privacy@sovsec.com, but you do not need to contact us before complaining to an authority.

9. Automated decision-making

9.1 We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. Our platforms use automated security controls — for example spam filtering, blocking of known-malicious traffic and rate limiting of sign-in attempts. These protect the service; if you think a control has wrongly affected you, contact support@sovsec.com and a person will review it.

10. Cookies and similar technologies

10.1 Our websites use only strictly necessary cookies by default. We do not use third-party advertising or analytics cookies. Details, including how to change your choices, are in our Cookie Policy (SOV-LG-006).

11. Security

11.1 We protect personal data with measures appropriate to the risk, including TLS 1.3 with hybrid post-quantum key exchange, encryption at rest, end-to-end encryption with keys we do not hold for Prismara Prism vaults and sealed mail, phishing-resistant multi-factor authentication for all staff, strict tenant isolation, logging and monitoring, and hosting in the EU. Our information security management system is aligned to ISO/IEC 27001; we are not currently certified. No system is completely secure; if we suffer a breach that is likely to result in a high risk to you, we will tell you without undue delay.

12. Children

12.1 Our websites and business services are intended for adults acting in a business capacity and are not directed at children.

12.2 You must be at least 16 years old to create a Prismara Personal account. To buy a Prismara Personal Secure subscription, you must be 18 or have a parent or guardian purchase it for you.

12.3 We have chosen 16 deliberately. In Austria a child may consent to information society services from the age of 14 (§ 4(4) DSG), but the age varies between 13 and 16 across EU Member States (Art. 8 GDPR). A single minimum age of 16 — the default under Art. 8(1) GDPR — works in every Member State in which we offer the service and avoids the need to collect and verify parental consent.

12.4 If we learn that we hold data about a child below the minimum age without the required authority, we will close the account and delete the data. Parents or guardians can contact privacy@sovsec.com.

13. Changes to this policy

13.1 We will update this policy when our processing changes. The version and date are shown on the cover. If we make a material change that affects Prismara Personal users or clients, we will notify them by email or in the service at least 30 days in advance, unless the change is required sooner by law.

S O V S E C · P R I VA C Y P O L I C Y SOV-LG-005 · v1.0 · EU

Drafting notes — remove before publication

• Placeholders: [REGISTERED OFFICE ADDRESS], [COMPANY NUMBER], [EU REPRESENTATIVE NAME AND ADDRESS], [EMAIL], [SOVSEC FLEXCO NAME].
• DPO: assess whether Art. 37 GDPR requires a DPO — SovSec's MXDR/SOC services involve regular and systematic monitoring on a large scale as processor once client numbers grow. Review at launch and annually.
• Retention periods are proposals: confirm with accountant and solicitor/Rechtsanwalt; align with the Records Retention schedule in the IMS document suite. ZTNA connection-metadata and Endpoint telemetry periods ([N] days) are placeholders — Prismara Personal Terms (SOV-LG-010) clauses 8.2–8.3 and the AUP refer to them here.
• Art. 27 GDPR representative: required while SovSec Ltd (no EU establishment) offers Prismara Personal to EU consumers (Art. 3(2)(a)). Appoint before EU go-live (October 2027) and before any EU invitation-only alpha users; the exemption in Art. 27(2)(a) is unlikely to apply given scale and security-data processing.
• Verified 2 Nov 2026: Austrian age of digital consent is 14 (§ 4(4) DSG); UK adequacy decision renewed December 2025 to 27 December 2031. Rechtsanwalt to confirm 18+/parental purchase rule under ABGB for paid subscriptions.
• Rechtsanwalt to confirm B2B marketing email basis under § 174 TKG 2021 (consent also required for business recipients, existing-customer exception) and the 7-month retention for unsuccessful applicants (GlBG claims period).
• Rechtsanwalt to confirm the 10-year retention for EU VAT OSS records (Art. 63c Implementing Regulation (EU) 282/2011) applies to SovSec Ltd's Prismara Personal sales.

End of SOV-LG-005 Privacy Policy v1.0 (EU edition). SovSec Ltd · Company no. [COMPANY NUMBER] (England and Wales) · VAT no. [UK VAT] · EU OSS / UID [NUMBER]; from 2028: [SOVSEC FLEXCO NAME], FN [FN NUMBER], UID ATU[NUMBER].

1. Who we are and how to contact us

1.1 This policy is issued by SovSec Ltd, a private limited company registered in England and Wales under company number [COMPANY NUMBER], whose registered office is at [REGISTERED OFFICE ADDRESS] (SovSec, we, us). SovSec provides cyber security and managed IT services under the SovSec brand and software under the Prismara brand. For the processing described in this policy, SovSec is the controller.

1.2 Contact for anything about your personal data: privacy@sovsec.com or by post to SovSec Ltd, [REGISTERED OFFICE ADDRESS], marked “Privacy”. Our founder and director, Jake Gliddon, is responsible for data protection at SovSec. We have not appointed a statutory data protection officer; if we do, we will publish their details here.

1.3 SovSec Ltd is registered with the Information Commissioner's Office under number [ICO REGISTRATION NUMBER].

2. When this policy applies — and when it does not

2.1 This policy covers people whose personal data SovSec decides how and why to use: visitors to sovsec.com, sovsec.co.uk, prismara.eu and their subdomains; prospective clients and people who contact us; the business contacts of our clients, suppliers and partners; users of Prismara Personal (Free and Secure) accounts; job applicants; members of the MSP partner programme; people who follow or interact with us on social media; and security researchers who report vulnerabilities to us.

I F Y O U R E M P L O Y E R O R O R G A N I S AT I O N U S E S S O V S E C O R P R I S M A R A

When a business client uses our managed services, Microsoft tenant management, security monitoring or a Prismara business plan, SovSec processes the personal data in those services (for example your mailbox, files, device telemetry or service desk tickets) as a processor on the client's behalf. The client is the controller, and its own privacy notice applies. Please contact your organisation first. If you contact us, we will pass your request to them. Our obligations as processor are set out in our Data Processing Agreement (SOV-LG-003).

We act as controller for a narrow set of data about business users that we need to run our own services: account and licence records, billing contacts, and security and abuse logs about our platform (for example, failed sign-in attempts against our infrastructure). That processing is covered by this policy.

2.2 Demo sites at <app>-demo.prismara.eu contain fictional data only. Please do not enter real personal data into demo environments.

3. What we collect and where it comes from

Who you Personal data Source are

 Website         IP address, browser and device type, pages requested, date and time, referrer; cookie and   Your browser, automatically.
 visitor         local storage settings (see SOV-LG-006).

 Prospect or     Name, company, job title, business email and phone, country, message content, product       You (contact forms, email, events,
 enquirer        interest, record of calls, meetings and proposals.                                          calls); occasionally public business
                                                                                                             sources such as your company
                                                                                                             website or LinkedIn profile; referrals
                                                                                                             from partners.

S O V S E C · P R I VA C Y P O L I C Y SOV-LG-005 · v1.0 · UK

Who you Personal data Source are

 Client,         Name, role, business contact details, contract and order history, invoices and payment                 You or your organisation.
 supplier or     status, communications, service desk and escalation contacts.
 partner
 contact

 Prismara        Name or display name, prismara.eu email address, recovery email or phone, date of birth                You; your devices; Stripe (payment
 Personal        confirmation (age check), authentication data (passkey public keys, hashed secrets),                   confirmations, not card numbers).
 user            subscription and payment status, support requests, security logs (sign-ins, IP addresses,
                 device information); for Personal Secure, minimal Prismara ZTNA (personal VPN) connection
                 metadata — never the content or destinations of your browsing — and security telemetry
                 from devices on which you install Prismara Endpoint. Content you store (mail, documents,
                 files, vault items) is processed only to provide the service; vault items in Prismara Prism and
                 sealed mail are end-to-end encrypted and we cannot read them.

 Job applicant   CV, cover letter, contact details, right-to-work information, interview notes, references,             You; recruiters you use; referees you
                 assessment results.                                                                                    name.

 Social media    Handle, public profile and interactions with our posts.                                                The social network concerned.
 follower

 Security        Name or alias, contact details, vulnerability report contents.                                         You (security@sovsec.com).
 researcher

We do not intentionally collect special categories of personal data (such as health information) except where you volunteer it — for example, an accessibility need for an interview — or where the law requires it. We do not buy marketing lists.

4. Why we use your data and our lawful bases

 Purpose                               Lawful basis (Art. 6 UK GDPR)                                              Notes

 Running and securing our              Legitimate interests (Art. 6(1)(f))                                        Our interest in providing secure websites.
 websites; preventing abuse and                                                                                   Strictly necessary cookies only by default.
 attacks

 Answering enquiries and               Steps at your request before a contract (6(1)(b)); otherwise               Enquiries are stored in SovSec's own
 preparing quotes and proposals        legitimate interests (6(1)(f))                                             Prismara CRM, hosted in Vienna.

 Providing, billing and supporting     Contract (6(1)(b)) where you are the contracting party; otherwise
 services to clients and partners      legitimate interests in managing our business relationship (6(1)(f))

 Providing Prismara Personal           Contract (6(1)(b))                                                         Includes account security, support, service
 accounts                                                                                                         messages and age checks.

 Taking payments for Prismara          Contract (6(1)(b)); legal obligation (6(1)(c)) for tax records             Payments are processed by Stripe.
 Personal Secure

 Protecting our platforms,             Legitimate interests (6(1)(f)); legal obligation (6(1)(c)) where we        Includes processing of security logs about
 detecting fraud and misuse,           must report incidents or vulnerabilities                                   our infrastructure.
 investigating security incidents

 B2B marketing emails and event        Legitimate interests for business contacts at companies (PECR              You can unsubscribe at any time using the
 invitations                           permits email to corporate subscribers with an opt-out); consent           link in every email.
                                       for sole traders and partnerships unless the soft opt-in applies.

 Social media presence                 Legitimate interests (6(1)(f))                                             Where a network sets cookies or analyses
                                                                                                                  followers, it may act jointly with us; see the
                                                                                                                  network's own privacy policy.

 Recruitment                           Steps before a contract (6(1)(b)); legal obligation (6(1)(c)) for right-   Applications are handled in SovSec's own
                                       to-work checks; consent (6(1)(a)) to keep your application for             Prismara HR.
                                       future vacancies

S O V S E C · P R I VA C Y P O L I C Y SOV-LG-005 · v1.0 · UK

 Purpose                             Lawful basis (Art. 6 UK GDPR)                                          Notes

 Handling vulnerability reports      Legitimate interests (6(1)(f)); legal obligation (6(1)(c)) under the   We credit researchers only with their
                                     Cyber Resilience Act                                                   permission.

 Accounting, tax, legal claims and   Legal obligation (6(1)(c)); legitimate interests in establishing or
 regulatory compliance               defending legal claims (6(1)(f))

4.1 Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details of that assessment. Where we rely on consent, you can withdraw it at any time without affecting processing that took place before.

4.2 If you do not provide data that we need to enter into or perform a contract with you (for example, an email address for a Prismara Personal account), we will not be able to provide the service.

5. Who we share data with

• Service providers acting for us — principally netcup GmbH, which hosts our servers in Vienna, Austria, and Stripe for Prismara Personal payments. See the Sub-processor List (SOV-LG-004) for the full list and status.
• Professional advisers — accountants, auditors, lawyers and insurers, under confidentiality duties.
• MSP partners — where you were referred by, or asked to be served through, a SovSec partner, we share the information needed to manage that relationship.
• Group companies — our planned Austrian subsidiary, if it takes over EU contracts.
• Authorities — police, regulators, courts, tax authorities, the National Cyber Security Centre or the data protection authority, where the law requires it or it is necessary to protect our rights, our clients or others.
• Buyers or investors — in connection with a sale, merger or investment, under confidentiality, and only as necessary.

5.1 We do not sell personal data, and we do not share it with advertising networks or data brokers.

6. International transfers

6.1 SovSec Ltd is based in the United Kingdom, and our services are hosted in Austria (EEA). Transfers from the UK to the EEA are permitted under UK adequacy regulations.

6.2 A small number of providers are based in, or may transfer data to, the United States — for example Stripe (payments), GitHub (source code, no customer data intended) and Buffer (our social media scheduling, which processes only our own posts and the public profiles of people who interact with them). Where such a transfer takes place, it relies on the UK Extension to the EU–US Data Privacy Framework where the recipient is certified, or on the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses.

6.3 You can ask for a copy of the relevant safeguards by writing to privacy@sovsec.com.

7. How long we keep data

Data Retention

Website server logs 14 days, then deleted (security incident logs: up to 12 months)

Enquiries and prospect 24 months after our last contact, then deleted records with no contract

S O V S E C · P R I VA C Y P O L I C Y SOV-LG-005 · v1.0 · UK

Data Retention

Marketing preferences and Until you unsubscribe, then a suppression record (email only) for as long as needed to respect your unsubscribe records choice

Client, supplier and partner 6 years after the contract ends (limitation period under the Limitation Act 1980) contracts and correspondence

Invoices and accounting 6 years from the end of the financial year (HMRC requirements) records

Prismara Personal account For the life of the account. After you close it, content remains available for export (and the account data and content can be reopened) for 30 days, is then deleted from live systems within a further 30 days and from backups within a further 35 days; billing records are kept as for invoices

Inactive Prismara Personal May be closed after 12 months without sign-in, after at least 30 days' email notice (see the Prismara Free accounts Personal Terms, SOV-LG-010)

Platform security logs 12 months

Prismara ZTNA (personal [N] days (no content or destinations are logged) VPN) connection metadata

Prismara Endpoint device [N] days, or until the device is removed from your account if sooner telemetry (Personal Secure)

Job applications 6 months after the decision; longer only with your consent (up to 24 months) (unsuccessful)

Vulnerability reports 5 years, or the support period of the affected product if longer

8. Your rights

8.1 Subject to conditions and exceptions in the law, you have the right to: access your personal data and receive a copy; have inaccurate data rectified; have data erased; restrict processing; data portability for data you gave us under a contract or consent; object to processing based on legitimate interests; object at any time to direct marketing (we will then stop); and withdraw consent at any time.

8.2 To exercise a right, write to privacy@sovsec.com or, for Prismara Personal, use the settings in your account (export and deletion are self-service). We may ask you to confirm your identity. We respond within one month; we may extend this by up to two further months for complex requests and will tell you if we do. There is no fee unless a request is manifestly unfounded or excessive.

8.3 Complaints. If you are unhappy with how we have used your data, please complain to us first at privacy@sovsec.com (or by post). We will acknowledge your complaint within 30 days, investigate it without undue delay and tell you the outcome, as required by section 164A of the Data Protection Act 2018 (in force from 19 June 2026). You also have the right to complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk, 0303 123 1113. The ICO will normally expect you to have raised your complaint with us first.

9. Automated decision-making

9.1 We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. Our platforms use automated security controls — for example spam filtering,

S O V S E C · P R I VA C Y P O L I C Y SOV-LG-005 · v1.0 · UK

blocking of known-malicious traffic and rate limiting of sign-in attempts. These protect the service; if you think a control has wrongly affected you, contact support@sovsec.com and a person will review it.

10. Cookies and similar technologies

10.1 Our websites use only strictly necessary cookies by default. We do not use third-party advertising or analytics cookies. Details, including how to change your choices, are in our Cookie Policy (SOV-LG-006).

11. Security

11.1 We protect personal data with measures appropriate to the risk, including TLS 1.3 with hybrid post-quantum key exchange, encryption at rest, end-to-end encryption with keys we do not hold for Prismara Prism vaults and sealed mail, phishing-resistant multi-factor authentication for all staff, strict tenant isolation, logging and monitoring, and hosting in the EU. Our information security management system is aligned to ISO/IEC 27001; we are not currently certified. No system is completely secure; if we suffer a breach that is likely to result in a high risk to you, we will tell you without undue delay.

12. Children

12.1 Our websites and business services are intended for adults acting in a business capacity and are not directed at children.

12.2 You must be at least 16 years old to create a Prismara Personal account. To buy a Prismara Personal Secure subscription, you must be 18 or have a parent or guardian purchase it for you.

12.3 We have chosen 16 deliberately. UK law allows children aged 13 or over to consent to information society services themselves (Data Protection Act 2018, section 9), but Prismara Personal includes email, file storage and communications services, and we serve users across the UK and EU. A single minimum age of 16 avoids collecting parental consent, works in every country where we offer the service, and reflects the ICO's Age Appropriate Design Code expectation that services likely to be accessed by children are designed for them — which Prismara Personal is not.

12.4 If we learn that we hold data about a child below the minimum age without the required authority, we will close the account and delete the data. Parents or guardians can contact privacy@sovsec.com.

13. Changes to this policy

13.1 We will update this policy when our processing changes. The version and date are shown on the cover. If we make a material change that affects Prismara Personal users or clients, we will notify them by email or in the service at least 30 days in advance, unless the change is required sooner by law.

S O V S E C · P R I VA C Y P O L I C Y SOV-LG-005 · v1.0 · UK

Drafting notes — remove before publication

• Placeholders: [REGISTERED OFFICE ADDRESS], [COMPANY NUMBER], [ICO REGISTRATION NUMBER].
• DPO: assess whether Art. 37 UK GDPR requires a DPO — SovSec's MXDR/SOC services involve regular and systematic monitoring on a large scale as processor once client numbers grow. Review at launch and annually.
• Retention periods are proposals: confirm with accountant and solicitor/Rechtsanwalt; align with the Records Retention schedule in the IMS document suite. ZTNA connection-metadata and Endpoint telemetry periods ([N] days) are placeholders — Prismara Personal Terms (SOV-LG-010) clauses 8.2–8.3 and the AUP refer to them here.
• Verified 2 Nov 2026: DUAA 2025 s.103 (new s.164A DPA 2018, complaints to controllers) commenced 19 June 2026 by SI 2026/82 reg. 3; s.70 (recognised legitimate interests), s.80 (automated decision-making) and s.112 (PECR cookie exemptions) commenced 5 February 2026 by SI 2026/82 reg. 2. Solicitor to confirm the complaint-handling wording and set up an electronic complaint form.
• Verified: age of digital consent in the UK is 13 (DPA 2018 s.9). Minimum age 16 for Prismara Personal is a policy choice; solicitor to confirm the 18+/parental purchase rule for paid subscriptions and whether the Age Appropriate Design Code applies.
• Solicitor to confirm the PECR position for B2B marketing (corporate vs individual subscribers) and the soft opt-in wording.

End of SOV-LG-005 Privacy Policy v1.0 (UK edition). Company no. [COMPANY NUMBER] · Registered office: [REGISTERED OFFICE ADDRESS] · VAT no. [VAT NUMBER].