PRIVACY POLICY

SYSTEMS4SCALING LTD is the data controller responsible for your personal information.

Our registered office is at 128 City Road, London, EC1V 2NX, United Kingdom. Our services are governed by the laws of the Republic of Ireland.

This Privacy Policy explains how we collect, use, share and protect personal information in connection with our website and services. It applies to all individuals who visit our website or engage with us in any capacity.

We may collect and process the following categories of personal information:

Contact and identity information: your name, email address, telephone number, job title, and company name when you submit an enquiry, book a consultation, or otherwise contact us.

Communications data: the content of messages, emails, or other correspondence you send to us.

Usage and technical data: information about how you access and use our website, including your IP address, browser type, operating system, pages visited, and referring URLs. This information is collected automatically through standard web server logs and, where applicable, analytics technologies.

Business information: information about your company, revenue stage, operational challenges, and business objectives that you voluntarily provide during an engagement or diagnostic process.

We do not knowingly collect special category data (such as health, racial or ethnic origin, or political opinions) and ask that you do not provide such information.

We collect personal information through the following means:

• Directly from you: when you complete a contact or enquiry form, book a diagnostic session, send us an email, or otherwise communicate with us.
• Automatically: through standard web server logs and, where applicable, analytics or tracking technologies when you visit our website.
• From third parties: where you have been referred to us or where we receive information from a third-party platform you have used to contact us.

We use personal information for the following purposes:

• To respond to your enquiries and communicate with you about our services.
• To schedule, prepare for, and deliver The Executive Diagnostic™ and related consulting engagements.
• To send you information about our services, frameworks, and insights where you have consented or where we have a legitimate interest in doing so.
• To improve our website and understand how visitors interact with our content.
• To comply with our legal and regulatory obligations.
• To protect our legitimate business interests and enforce our contractual rights.

Where the General Data Protection Regulation (GDPR) applies, we process personal information on the following legal bases:

• Contractual necessity: where processing is necessary to perform a contract with you or to take steps at your request prior to entering into a contract.
• Legitimate interests: where processing is necessary for our legitimate business interests, such as improving our services, communicating with prospective clients, and protecting our business — provided those interests are not overridden by your rights and interests.
• Consent: where you have given clear and specific consent to processing for a particular purpose, such as receiving marketing communications.
• Legal obligation: where processing is necessary to comply with a legal or regulatory obligation.

We may send you information about our services, frameworks, and insights where you have consented to receive such communications or where we have a legitimate interest in contacting you as a business professional.

You may withdraw consent or opt out of marketing communications at any time by contacting us using the details in Section 16 or by following the unsubscribe instructions included in any marketing message.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

We do not sell your personal information. We may share personal information in the following circumstances:

• Service providers: with trusted third-party service providers who assist us in operating our website and delivering our services, acting as data processors on our behalf and bound by appropriate data processing agreements.
• Legal requirements: where disclosure is required by law, regulation, court order, or other legal process.
• Business transfers: in connection with a merger, acquisition, or sale of all or part of our business, subject to appropriate confidentiality obligations.
• Protection of rights: where disclosure is necessary to protect the rights, property, or safety of Systems4Scaling Ltd, our clients, or others.

Our website may use third-party technologies for purposes such as website hosting, scheduling, analytics, and communications. Where such technologies involve the processing of personal data, we take reasonable steps to ensure appropriate data processing agreements are in place.

We do not represent that any specific third-party service is in use unless expressly stated. This policy will be updated if our technology stack changes in a way that materially affects how personal data is processed.

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies.

Personal information may be transferred to and processed in countries outside the European Economic Area (EEA), including the United Kingdom. Where such transfers occur, we take appropriate steps to ensure that your personal information is protected in accordance with applicable data protection law.

These steps may include relying on adequacy decisions, standard contractual clauses approved by the European Commission, or other lawful transfer mechanisms.

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

In determining the appropriate retention period, we consider the nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process the data, and whether we can achieve those purposes through other means.

When personal information is no longer required, we securely delete or anonymise it.

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, destruction, or damage.

While we take reasonable precautions, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee the absolute security of information transmitted to or from our website.

If you have reason to believe that your interaction with us is no longer secure, please contact us immediately using the details in Section 16.

Depending on the circumstances and applicable law, you may have the following rights in relation to your personal information:

• The right to access the personal information we hold about you.
• The right to request correction of inaccurate or incomplete personal information.
• The right to request erasure of your personal information in certain circumstances.
• The right to object to processing based on legitimate interests or for direct marketing purposes.
• The right to restrict processing in certain circumstances.
• The right to data portability where processing is based on consent or contractual necessity and carried out by automated means.
• The right to withdraw consent at any time where processing is based on consent.
• The right not to be subject to solely automated decision-making that produces legal or similarly significant effects, except in limited circumstances.

To exercise any of these rights, please contact us using the details in Section 16. We will respond within the timeframe required by applicable law. We may need to verify your identity before processing your request.

We will not charge a fee for exercising your rights unless your request is manifestly unfounded or excessive.

We do not currently make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

If this changes, we will update this policy and, where required by law, seek your consent or provide you with the opportunity to request human review.

Our website and services are directed at business professionals and are not intended for individuals under the age of 18.

We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will take steps to delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

We will post the updated policy on this page with a revised 'Last Updated' date. Where changes are material, we will take reasonable steps to notify you.

Your continued use of our website after any changes constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or our handling of your personal information, please contact us at:

SYSTEMS4SCALING LTD 128 City Road London EC1V 2NX United Kingdom

Email: [PRIVACY CONTACT EMAIL — TO BE INSERTED]

If you are not satisfied with our response to a privacy concern, or if you believe we are processing your personal information in a manner that is inconsistent with applicable data protection law, you have the right to lodge a complaint with a supervisory authority.

In Ireland, the relevant supervisory authority is the Data Protection Commission (DPC): www.dataprotection.ie.

In the United Kingdom, the relevant supervisory authority is the Information Commissioner's Office (ICO): www.ico.org.uk.

We would, however, appreciate the opportunity to address your concerns before you approach a supervisory authority and ask that you contact us in the first instance.