ZÁSADY ZPRACOVÁNÍ OSOBNÍCH ÚDAJŮ

Effective Date: Feb 1^st 2026, Version: 2.2

This privacy notice (hereinafter referred to as “Privacy Notice”or “Notice”) describes the manner in which EternyLegacy s.r.o., with its registered seat in Soudní 321, 768 61 Bystřice podHostýnem, registered in the Commercial Register at the Regional Court in Brno (hereinafterreferred to as “Eterny Legacy“ or “we”)collects, processes and safeguards your personal data. Your privacy is important to us, and we arecommitted to protecting your personal data.

This Noticeapplies to the processing of personal data within all services, applicationsand websites operated by Eterny Legacy inwhich the personal data are processed and that contain this Notice, referenceto it or link thereto. It applies to the processing of personal data ofvisitors of our website, users of our services and also representatives of ourbusiness partners and persons who contact us through our website or otherwise,and users of Marketplace (as defined below). This Privacy Notice applies when Eterny Legacy processes personal data as a datacontroller.

In the event ofany conflict between this Privacy Notice and any specific privacy noticeapplicable to any Eterny Legacy productor service, the specific privacy notice shall prevail.

In this Noticewhenever we refer to the GDPR this includes references to the UK DataProtection Act and UK GDPR as well.

The provisionsof this Privacy Notice are effective as of the above effective date.

I. Thedata we process, the purposes, and the legal basis for processing

‍

PURPOSE	DESCRIPTION	PROCESSED DATA	LEGAL BASIS
Account registration and its usage and management	When you, as a customer or another authorized user of Eterny Legacy services, create an account of the Eterny Platform, use it and manage your account we process the described data to effectuate the creation and management of your account.	Identification details (name, surname), Log-in data (your e-mail address, password), Telephone number, Information that you are a resident of the Czech Republic, Technical data about your use of the Eterny Platform (records of your events, ID numbers, assigned by systems, etc.), Subscription payment data (subscription type, subscription duration, payment information)	Contract performance between Eterny Legacy and you as a customer.
Ensuring secure storage of documents and information	When you as a user store your documents and information on the Eterny Platform we securely store these documents and information. All data stored on Eterny is encrypted end-to-end, isolated in a separate secure environment, and continuously monitored through audit logs. Our systems undergo regular penetration testing and security reviews to ensure maximum data protection. For more information about our security practices see chapter V. Data security.	Identification data (date of birth, birth number, nationality, data from identity documents, including a photo of the relevant document), Contact data (permanent/transient address, email address, telephone number), Data about your family (e.g. marital status, information about your partner, children, parents or other close persons), Financial data (your bank, investment and pensions accounts, credit cards, investments and other financial services you use; ownership of movable and immovable property, intellectual property, investment and collectibles, ownership of other items such as cars, jewellery, electronics, etc.), Data on liabilities (loan, mortgage, credit card debt), data on digital services (web domains/profiles on social networks such as Facebook, Instagram, LinkedIn, etc., streaming services, subscriber accounts), Digital wallet information (wallet address, wallet ID, private keys, cryptocurrency seed), Information contained in your will and other relevant data (e.g. information about foreclosure proceedings, bankruptcies, personal bankruptcies, personal videos/photo, emergency contacts, personal funeral preferences, etc.), Data relating to health, religion, genetic or biometric data, Other information you upload to the Eterny Platform.	Contract performance between Eterny Legacy and you as a user, Your consent
Crypto wallet	When you link your cryptocurrency wallets with our services we will securely store the information about your cryptocurrency wallet and any associated information for you.	Digital wallet information (digital wallet, wallet ID, etc.), Identification details (name, surname, date of birth, national ID), Contact information (email, phone number, address), Account and wallet data (wallet addresses, transaction history, balances), Authentication and Security Data (Passwords or PINs, authentication codes, IP address, etc.)	Contract performance, Your consent
Bank accounts/Payment accounts	When you link your bank accounts/other payment accounts we process your data to provide you with secure access to information about your bank accounts/payment accounts, such as balances, transactions, and account details, so you can view and manage your finances easily. When you link your bank or payment accounts, your data is accessed securely under Open Banking regulation. In the Czech Republic, access is provided under a PSD2 AISP license regulated by the Czech National Bank (CNB) via Komerční banka / Finbricks. In Ireland and the UK, access is provided through the regulated Open Banking aggregator Plaid. All data are encrypted and processed securely used only to give user an overview of their balances.	Account information (account number, account type, account balance, transaction history, account and bank details, transaction metadata, etc.), Contact details (name, surname, address, email, phone number, tokens), Payment initiation data (payment amount, date and time, payment description etc.), Device ID, IP address [cite: 12]	Your consent
Document analysis and classification through artificial intelligence	Eterny Platform services involve analysing and sorting your documents and information using artificial intelligence. This includes automatically categorizing and organizing documents, identifying key information, facilitating search and access to stored files, and providing data management features based on user needs.	The data we process depends on what information you upload to the Eterny Platform, including contact details (name, date of birth, ID number), contact details (email, phone number, address), financial data (bank account details, loans, mortgages insurance), asset data (real estate, vehicles, investments) and technical document-related data.	Contract performance between Eterny Legacy and you
Eterny AI Wizard, document analysis and insights	When you use our AI assistant, we process only pre-defined data from your documents (such as financial data, dates including contract renewal dates, interest rates, and statutory rates). We compare this against publicly available sources (such as statistical databases, bank statistics, reports from financial regulators), and our internal datasets to generate analytical insights, which may help you assess your financial situation, identify potential financial risks, detect underinsurance, highlight potential savings opportunities and provide insights and suggestions to help you more effectively understand and manage your finances.	Categories of data involved may include, for example, statutory APR rates, loan agreements, consumer credits, mortgage contracts, household loans, insurance coverage for loans and mortgages, real estate subsectors, life and motor vehicle insurance, and household financial statistics.	Contract performance between Eterny Legacy and you
Mobile Application Usage	When you download and use our mobile application on iOS or Android device, we process your personal data to enable push notifications, to improve app stability and performance and to provide you with the best possible user experience.	Device information (device type, operating system version, unique device identifiers), Mobile application usage data (app version, features accessed, session duration), Push notification tokens, Crash reports and diagnostic data.	Contract performance between Eterny Legacy and you as a user, and our legitimate interest
Professional services	The Eterny Platform includes a Marketplace service feature that allows you to connect with independent professionals who offer advisory services. As part of our services, you may, at your own discretion, choose to be referred to an independent professional (such as a lawyer) via our Marketplace. If you decide to engage professional services, please note that these professionals operate independently from Eterny and that you enter into a separate relationship directly with them. In this context, they act as independent controllers with respect to the personal data you provide to them outside of the Eterny Platform.	Your search queries and preferences, Professionals you view or contact, Information you choose to share with professionals (including documents from your Account). For professionals, we process: Profile information (name, qualification, experience, contact details), Service descriptions and pricing.	Contract performance
Trusted contacts	When you designate a Trusted contact, or a independent professional, you may grant them access to your secure storage in Eterny platform either with limited viewing rights or full access, based on your explicit consent. When you share data with a professional (such as a lawyer, etc.) via the Marketplace, that professional becomes an independent data controller for the personal data you provide to them. Please note, that Eterny Legacy acts solely as the provider of the Marketplace platform. When choosing to share data with professional, we recommend reviewing the professional’s privacy practices before sharing your personal data.	Your identification data (first name, last name), Contact data (e-mail address), Information about your relationship with the user	The performance of the contract between Eterny Legacy and you as a user of the Eterny Platform.
Management of our contractual relationships	When you or your organization engage with us as a customer, business partner, advisor, or in a similar capacity, we may process your personal data for the purpose of effectively managing and maintaining our contractual relationship.	Identification details (name, surname), Contact details (address, phone number, e-mail address), Information about the company you work for and your work position.	Contract performance between Eterny Legacy and you as a customer or business partner (if the customer or business partner is an individual), or Our legitimate interest (if the customer or business partner is a legal entity).
Provision of customer service and support	When you use our services or contact our support team for assistance, we process your personal data necessary to provide you with service or handle your request.	The personal data necessary to provide you with service or handle your request, such as contact details (name, email address, phone number, e-mail address), communication content (messages, chat logs, emails or call recording etc.)	Contract performance
Improvement of our services and products	We process your data to improve our services and products and to provide you with the best possible user and customer experience.	Identification details (name, surname), Contact details (address, phone number, e-mail address), Content of your feedback and your ideas shared with us by various means, Information about usage of our services/products, Additional communication between you and us about provided feedback or ideas.	Our legitimate interest to improve our products and services and to provide you with the best customer and user experience, Your consent.
Direct marketing and promotion	We use your contact information and other information as described data for marketing our product to you i.e., if you sign up for our newsletter or other marketing communication. In certain cases, we may use third parties or publicly accessible information to enhance our data for marketing purposes.	Identification details (name, surname), Contact details (address, phone number, e-mail address), Information about newsletters you signed up for and your preferences regarding marketing communication (if any), Information about the company you work for and your work position.	Your consent. In relation to use of third-party data and publicly available information, the legal basis for processing is your consent or our legitimate interest.
Recruitment process and hiring	If you apply for any open job positions at Eterny Legacy, we will process personal data you provide to us for the purposes of evaluating your suitability for any of our open positions. If you are a successful candidate, you will receive a job offer and we will process your personal data to proceed with the hiring process. [cite: 12]	Identification details (name, surname), Contact details (address, phone number, e-mail address), Information from your CV, Cover Letter about your past positions, qualifications, etc., Any further information you share with us during the recruitment process., The salary offer for the position and other relevant job details.	Legitimate interest to find the most suitable candidate for the position, or Pre-contractual relationship with you., Fulfilment of legal obligations
Defending our rights and claims	When you make a legal claim against us, or when we need to protect our rights through legal or other means, we process your data necessary to be able to effectively defend our rights and defend ourselves against a claim.	We process your data necessary to be able to effectively defend our rights and defend ourselves against a claim, such as identification details (name, surname, ID number), account or service data (contracts, service usage records relevant to the claim), communication content (emails, messages, call logs, or correspondence related to the claim).	Our legitimate interest in defending against claims or fulfilling legal obligations or our contractual commitments.
Fulfilment of legal obligation	In some instances, legal regulations impose obligations on us under which we are obliged to process personal data. Such cases are for instance tax and accounting laws, whistleblowing laws, anti-discrimination laws and the provision of some data to public authorities based on applicable legislation.	We process your data within the scope as required by applicable legislation, such as identification details (name, surname), contact details (address, email address, etc.), health information, or other data specifically mentioned in relevant laws.	Fulfilment of legal obligations imposed upon us by the applicable legislation.
Contacting us	If you contact us via our website or by different means we will process your data to reply and provide you with what you have requested.	Identification details (name, surname), Contact details (address, phone number, e-mail address, etc.), Information about the company you work for and your work position, Any further information you share with us.	Your consent or our legitimate interest to conduct business.

I. Cookies and other trackingtechnologies[EL1]

Our websites andservices (jointly “Websites”) use cookies, web beacons, pixels and othersimilar technologies to automatically collect information about individuals whovisit and use our Websites. These are small files that are stored on yourdevice. They help us to operate our Websites, provide important features andfunctionalities and enable us to better understand how you use our Websites.

We use thefollowing types of cookies:

(i) essential(strictly necessary) cookies that are necessary toprovide access to our website and to provide the services you have specificallyrequested, to enable basic website functions such as tagging your data inputs,network management and accessibility. We process your personal data oncontractual basis – to provide you with the services requested by you on ourWebsites and on the basis of our legitimate interest to operate the Websites.It is not possible to disable essential cookies through the Privacy settings asour Websites might not function properly when you disable this type of cookies.

(ii) functionalcookies allow us to remember choices you have madein the past, such as what language and currency you prefer, remember your nameand email, and automatically fill out forms and allow for personalization. Weprocess your personal data based on your consent.

(iiI)analytical (performance) cookies help us analysehow you move around our website and what content is relevant to our users. Theyare used for performance measurement and improvement. We process your personaldata based on your consent.

(iv)advertising cookies that help deliver tailored andpersonalised advertising. We process your personal data based on your consent.

We may collectthe following information through cookies: IP address, type of device, deviceID. gender, time zone, browser settings,operating system, website traffic information including URL, searched terms,information about what you have viewed or searched for on our website, websiteresponse time, download errors, length of visits to certain pages, informationabout how you interact with the website (such as scrolling, clicking andhovering).

Inthe following list we provide you with information about the specific cookiesthat are used by our Websites, who their provider is and how long they arestored on your device:

[EL1]Please note the UK amended its cookielaw and consent is not required in the UK for basic statistical cookies. If youwould wish to leverage this, please let us know and we would update thelanguage here accordingly.

‍

COOKIE TYPE (Name)	PROVIDER	RETENTION PERIOD	COOKIE TYPE (Classification)
_clck	Microsoft (Clarity Analytics)	365 days (1 year)	Analytical / Behavioural
_clsk	Microsoft (Clarity Analytics)	24 hours	Analytical / Behavioural
_fbp	Meta Platforms (Facebook, Instagram Ads)	90 days	Advertising
_ga	Google Analytics	2 years	Analytical
_ga_NBNTYBHPM2	Google Analytics 4	2 years	Analytical
_gcl_au	Google Ads	3 months	Marketing / Advertising
_hjSession_5073778	Hotjar	30 minutes (session)	Analytical / Behavioural
_hjSession_5333851	Hotjar	30 minutes (session)	Analytical / Behavioural
_hjSessionUser_5073778	Hotjar	1 year	Analytical / Behavioural
_hjSessionUser_5333851	Hotjar	1 year	Analytical / Behavioural
CLID	Microsoft (Clarity)	1 year	Analytical
MUID	Microsoft	1 year	Marketing
sid	Seznam.cz (Sklik)	End of session	Advertising
sznlbr	Seznam.cz (Sklik)	1 year	Advertising / Behavioural
udid	Seznam.cz (Sklik)	30 days	Advertising

When you visitour Websites, you will be informed via the cookiebanner located at the bottom of the website that we collect cookies. Thisbanner allows you to manage what cookies EternyLegacy can collect. You can change your settings and withdraw yourconsent at any time via the privacy settings at thebottom of our Websites.

Othertracking technologies

Apart fromcookies, we also use other technologies that help us to operate our Websitesand to analyse your behaviour. We currently use:

• Pixels

• Web beacons

• URL tracking

The abovetechnologies may have access to your device's IP address, device screen size,device type, unique device identifiers, operating system, browser information,geographic location, time stamp, time zone, preferred language used to displayour website, activities and navigation on our website, length of visit.

We also useso-called social plugins on our Websites from (i) facebook.com, (ii) x.com,(iii) linkedin.com, (iv). x.com (“plugins”), which are indicated by their logoson our Websites. When you visit our Websites, your browser establishes a directconnection with the servers on which these plugins run. The content of theplugins is transferred directly by the social networks to your browser, whichthen integrates it into our Websites.

Integration ofthe plugins causes the social networks to receive the information that you haveaccessed on the corresponding page of our Websites, regardless of whether youinteract with the plugin or not. If you are logged in with the social networks,it will be able to assign your visit to your account on these social networks.If you do not want the social networks to gather data about you via ourWebsites, you must log out of them before visiting our Websites. If you wish tolearn about how these social networks process your data, please visit theprivacy policy of the respective social network.

Disablingcookies

If you do not wishcookies to be collected, you can restrict, block or delete them at any time byadjusting your browser configuration.

If you wish toprevent the installation of new cookies or if you wish to delete existingcookies, you can findinstructions at the links below. The exact procedure depends on the browser youare using:

● Internet Explorer: here

● Firefox: here and here

● Google Chrome: here

● Safari: here

For mobile devices, you can limittracking through your device's privacy settings (by turning off the advertisingidentifier), see https://www.networkadvertising.org/mobile-choice/.

In addition, you can use a third-partytool to opt out of targeted advertising. Third party opt-out tools availableinclude Digital Advertising Alliance, Network Advertising Initiative and European Interactive DigitalAdvertising Alliance(Europe only).

To opt out of receiving cross-deviceweb advertising (i.e., tracking a user across devices), you can access yourdevice settings or visit and use the controls described on NAI Mobile Choices.

I. How long will we process your data?

In general,personal data shall be retained for as long as necessary for the purpose forwhich they were processed. The period for which EternyLegacy will retain your personal data also depends on the legal basis onwhich your data are processed. If the processing is based on a legitimateinterest, your data will be processed for the duration of that legitimateinterest of Eterny Legacy. In the case of dataretained on the basis of legal obligations, the retention period is determinedby applicable legal regulations. For data processed on the basis of theperformance of a contract, the data are processed for the duration of thecontractual relationship and for the relevant limitation period. If theprocessing is based on your consent, your personal data will be deleted after thewithdrawal of consent. You can withdraw your consent to the processing of yourpersonal data at any time by sending a message to hello@theeterny.com. Please note that the same data may also be processed on more thanone legal basis, in which case your withdrawal of consent or request forerasure of personal data may not result in the complete erasure of yourpersonal data. Withdrawal of consent does not affect the lawfulness ofprocessing based on consent given before its withdrawal.

If you create anaccount on our website or application, we will process your personal data forthe duration of that registration. You can request deletion of your account atany time.

II. Data sharing, processors and transfers to thirdcountries

Your personaldata will not be shared with any third party except in the followingsituations:

● data arenecessary for the provision of Eterny Legacy services,

● sharing datawith professionals you choose to connect with via our Eterny Marketplace (whereyou grant them access to your account on Eterny Platform),

● based onyour consent (e.g. to Notaries of the Notarial Chamber in cases of inheritance proceedings),

● entrustingpersonal data to processors who process personal data on behalf of EternyLegacy,

● Eterny Legacy is obliged to provide personaldata based on the law or order of a public authority.

Categories ofProcessors

We may share your data with the following categories ofprocessors:

● datacentre, hosting

● marketingproviders

● mobileapplication infrastructure and push notification service providers

● analyticsand recording providers

● businessmanagement, task management, communication and other IT tools

● ourcontractors and other partners who assist us in providing our services

● legalservices, tax, accounting, and audit services

● recruitmentand applicant verification providers

● informationsecurity providers

Transfers tothird countries

In some cases, Eterny Legacy may transfer yourdata to countries outside the EU/European Economic Area. Such a transfer can only take place if itcomplies with the GDPR. This means, for example, that the provider is based ina country for which the European Commission and/or UK Secretary of State hasissued a decision that it provides an adequate level of protection for personaldata, or that standard contractual clauses issued by the European Commissionand/or other transfer mechanisms are in place that provide adequate safeguardswith respect to the protection of your personal data. It may be necessary toapply additional measures to provide the data subject with a level ofprotection substantially equivalent to that guaranteed by the GDPR. You mayrequest a copy of the relevant safeguards at hello@eterny.io.

III. Data security

Data security is our top priority. Eterny Legacy implements measures to ensure that your personal data is storedsecurely, that personal and financial data is processed strictly on aneed-to-know basis, encrypted in transit and at rest, isolated in a separatesecure environment, and continuously monitored through audit logs.

Eterny Legacy has taken appropriatetechnical and organizational measures to secure the personal data processed by Eterny Legacy, including, for example:

● Encryption:All sensitive data is encrypted both in transit and at rest while usingquantum-resistant cryptography endorsed by NIST.

● AccessControls: Access to personal data is restricted to authorized personnel only,based on the principle of least privilege only and logged.

● SecureHosting: We store data on secure servers with robust firewalls and intrusiondetection systems and monitoring.

● PasswordProtection: All systems and databases are protected by strong password policiesand multi-factor authentication, with the banking-level trust semantics.

● EmployeeTraining: Our team undergoes regular training to understand and comply withdata security best practices.

● RegularUpdates: Our software, systems, and hardware are regularly updated to addresspotential security vulnerabilities.

● Regularpenetration testing, security reviews and vulnerability assessments: Weregularly test our systems to identify and mitigate security risks and ensuremaximum data protection.

● Regulatorycompliance: Security measures comply with PSD2 SCA and PSD3/PSR1 standards toensure financial-grade protection.

These measuresdo not relieve you of the obligation to take appropriate measures to secureyour personal data. You should, among other things, change your passwordsregularly. On the other hand, you should not, among other things, usepredictable usernames and/or passwords, share your passwords with others orprovide access to your administrator account and/or disclose your personalinformation to others. Eterny Legacy willnever ask you for your password in any unsolicited communication. Immediatelynotify us of any unauthorized use of your administrator account or any othersuspected breach of security.

IV. Your rights

Under the GDPR,you are entitled to the following rights:

Right of access

You have theright to be informed about, among other things, what personal data Eterny Legacy about you, forwhat purposes and who the recipients of your personal data are.

If you are a UKresident, when handling your access request, Eterny will conduct a reasonableand proportionate search, to identify and provide you with the personal data itholds in accordance with the UK GDPR. Eterny will respond to your accessrequest without undue delay and with the applicable time period.

If your requestis incomplete and requires clarification, we may contact you to obtain furtherdetails to facilitate the exercise of your rights. Please note, that periodbeginning with the day on which we make the request and ending with the day onwhich we receive the information from you does not count towards the applicabletime period.

Right torectification

You have theright to have any of your incomplete, inaccurate or outdated personal datarectified.

Right toerasure

You are entitledto the erasure of certain personal data that we have collected and processedabout you.

Right torestriction of processing

In given casessuch as when we process inaccurate personal data about you, or you deem theprocessing as no longer necessary, you may ask for a restriction of theprocessing.

Right to dataportability

You have theright to obtain the personal data you provide to us in a structured, commonlyused and machine-readable format and to request that it be transferred toanother controller, if technically feasible. Please note that the right to dataportability only applies to data that you have provided to us and that weprocess as controller on the basis of your consent or the performance of acontract.

Right toobject

You have theright to object, on grounds relating to your particular situation, at any timeto processing of personal data concerning you that is carried out in the publicinterest or for the purposes of Eterny Legacy'slegitimate interests, including profiling.

Right towithdraw consent

If your data isprocessed based on your consent, you are entitled to withdraw such consent atany time. Kindly note that the withdrawal of your consent will not affect thelawfulness of processing based on your consent before its withdrawal.

Right toopt-out from marketing communication

You are entitledto opt out from receiving marketing communication. You can exercise this rightin accordance with the opt-out rules described in each marketing e-mail orother form of communication via the unsubscribe option in the footer of everye-mail or by directly contacting Eterny Legacy.

Right not tobe subject to the automated individual decision-making

You have theright not to be subject to a decision based solely on automated processing,including profiling, which produces legal effects concerning you or similarlysignificantly affects you. This shall not apply if the decision:

● isnecessary for entering into, or performance of, a contract between you and EternyLegacy;

● isauthorised by the law and the law lays down suitable measures to safeguard yourrights and freedoms and legitimate interests; or

● is based on your explicit consent.

Eterny Legacy does not makedecisions based solely on automated processing that would have significanteffects on its users. For the sake of completeness, we note that Eterny Legacy uses cookies and similar technologies,the use of which may constitute profiling. Information on how to withdraw yourconsent to the use of cookies or disable cookies can be found in the chapterabout cookies of this Privacy Notice.

Right tolodge a complaint

If you believethat your data has been processed unlawfully, please contact us and we will tryto resolve the issue. Under the GDPR, you have the right to file a complaintwith the Office for Personal Data Protection, which is located at Pplk. Sochora27, 170 00 Prague 7, Czech Republic. Your ability to exercise your rights maybe limited if Eterny Legacy is required to retain your personal data for legalobligations, legal claims or other reasons as set out in the relevant dataprotection law.

If you are a UKresident and believe that your personal data has been processed unlawfully, youhave the right under the UK GDPR to file a complaint via email address:hello@eterny.io.

V. Contact details

If you wish toexercise any of your rights set out above, please contact us at hello@eterny.io.

If you wouldlike to learn more about EternyLegacy. its privacy protection or this Privacy Notice, you may contact Eterny Legacy at hello@eterny.io.

Please help Eterny Legacy to keep yourinformation up to date. If you believe that any data processed by Eterny Legacy is incorrect, orif you believe that EternyLegacy is not complying with this Privacy Notice, please contact Eterny Legacy at hello@eterny.io.

VI. Final provisions

The English-language version of this Noticeshall be controlling in all respects and shall prevail in case of anyinconsistencies with translated versions EternyLegacy may provide, if any.

This Privacy Noticemay be amended by Eterny Legacy at any time.If we make any material/substantial changes to this Privacy Notice, we willpost the updated version of the Privacy Notice to our website and/or otherplaces we deem appropriate. We may notify you of the change via sending you anemail or providing other notice of the update, however you should check this PrivacyNotice from time to time for any significant changes to its text.

‍