PRIVACY POLICY for the WoSuch Platform (Web & Mobile App) Last updated: September 2026 This Privacy Policy is governed by Austrian law, in particular the General Data Protection Regulation (GDPR/EU Regulation 2016/679), the Austrian Data Protection Act (DSG), and the TKG 2021. If you reside in another country, this policy applies as adapted to the applicable national provisions of that country. 1. Data Controller Mykola Gnylytskyy Gentzgasse 21 1180 Vienna Austria E-mail: kontakt@wosuch.com | Web: wosuch.com For data protection enquiries: kontakt@wosuch.com Data Protection Officer (DPO): Based on the nature and scope of processing, appointment of a DPO is not mandatory under Art. 37 GDPR. The above address handles all enquiries. 2. Data Processing Principles (Art. 5 GDPR) WoSuch processes personal data in accordance with the principles of lawfulness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability. Our core data protection commitments: • B2C data is never sold, rented, or shared with third parties. • Agents and developers receive only anonymised view counts for their own listings — never personal user data. • Basic search functions are available without registration. 3. Categories of Data Processed and Purposes 3.1 Guest Use (without registration) • Text input (AI Chat): forwarded to Anthropic (USA) for real-time processing of search queries; stored on WoSuch servers for 7 days to improve the general query vector quality, then deleted. No personalised analysis, no profiling. • Map data (Mapbox): IP address and map tile requests transmitted to Mapbox (USA) for map display; no persistent GPS raw data stored by WoSuch. • Technical data (logs): IP address, device data, error logs; retained for 7 days then anonymised/deleted; legal basis: Art. 6(1)(f) GDPR (legitimate interest in platform security). 3.2 Registered Users In addition to 3.1: • E-mail address (mandatory): authentication and account management; legal basis: Art. 6(1)(b) GDPR. • Optional profile data (first name, last name, phone number): convenience function for faster completion of enquiry forms to providers; only transmitted to a specific provider when you actively tap "Contact"; legal basis: Art. 6(1)(a) GDPR (consent). • Watchlist (favourites): saved properties; retained until account deletion; legal basis: Art. 6(1)(b) GDPR. • Search agents: filter settings for push notifications; active until deactivated/deleted by the user; legal basis: Art. 6(1)(a) GDPR. • Push notifications (FCM): price drops, status changes, search agent matches; only when function explicitly activated; legal basis: Art. 6(1)(a) GDPR. 3.3 B2B Users (Agents and Developers) Processed under a separate B2B agreement and privacy notice at business.wosuch.at. 4. International Data Transfers and Processors We engage the following service providers: • Supabase Inc. (USA) — hosting provider; data stored in the EU region Frankfurt am Main (Germany). Legal basis: Art. 46 GDPR (SCCs); data does not leave the EU in normal operation. • Mapbox Inc. (USA) — mapping service; IP address and map tile requests transmitted. Legal basis: Art. 49(1)(a) GDPR (explicit consent, as there is no adequacy decision for the USA). Without consent, the map view is disabled. • Anthropic PBC (USA) — AI language model powering the AI search concierge. Text input (chat) is transmitted for real-time processing. Chat histories are stored on WoSuch servers for 7 days to improve the general query vector; no personalised usage profiles are created. Legal basis: Art. 49(1)(a) GDPR (explicit consent for the third-country transfer). Without consent, the AI assistant is disabled. • Google LLC / Firebase Cloud Messaging (USA) — push notifications (only when activated). Legal basis: Art. 6(1)(a) GDPR; Art. 46 GDPR (SCCs). • Apple Inc. (USA) — app distribution (App Store), push notifications (APNs). Legal basis: Apple Developer Agreement; Art. 6(1)(b) GDPR. 5. Cookies and Similar Technologies Please refer to the Cookie Policy (in the app: Settings → Privacy → Cookie Preferences). Summary: • Technically necessary cookies/LocalStorage: always active; legal basis: § 165(3) TKG 2021 / Art. 6(1)(f) GDPR. • Functional (Mapbox, Anthropic): only with your consent. • Analytical: only with your consent. • Marketing/tracking: not currently in use. 6. Automated Decision-Making and AI The platform uses AI (Anthropic model) solely to interpret your search query and display relevant listings. No legally or materially significant scoring or profiling of users is carried out (Art. 22 GDPR is not applicable). 7. Retention Periods • Guest chat histories: 7 days • Registered user accounts: until account deletion, then full cascade deletion • Technical logs: 7 days, then anonymised • Search agents: until deactivated/deleted by the user • Statutory retention obligations (e.g. UGB, BAO): up to 7 years for accounting records 8. Your Rights as a Data Subject (Arts. 15–22 GDPR) You have the right to: access (Art. 15); rectification (Art. 16); erasure (Art. 17) — "right to be forgotten"; in the app via Profile → Delete Account, which triggers full cascade deletion; restriction of processing (Art. 18); data portability (Art. 20); objection (Art. 21) to processing based on legitimate interests; withdrawal of consent (Art. 7(3)) with effect for the future. Please send requests to: kontakt@wosuch.com (response within 30 days). 9. Right to Lodge a Complaint Austrian Data Protection Authority (DSB) Barichgasse 40–42, 1030 Vienna Tel.: +43 1 531 15-202525 | Web: www.dsb.gv.at 10. Data Security Transmission: TLS 1.3. Storage: AES-256. Access control: role-based with least-privilege principle. Supabase Row-Level Security (RLS) on all tables. 11. Changes to this Policy Material changes will be announced in the app. The current version is available at wosuch.com/at/datenschutz. Continued use after changes constitutes acceptance of the updated policy.