European Privacy Notice (GDPR/UK GDPR)

This European Privacy Notice (the "Notice") is issued in compliance with Regulation (EU) 2016/679 (the General Data Protection Regulation, or "EU GDPR") and the equivalent United Kingdom regime (the "UK GDPR" together with the Data Protection Act 2018). It applies to individuals located in the European Economic Area (EEA) and the United Kingdom ("EEA/UK Users") whose personal data is processed by IcloneU.

This Notice supplements the IcloneU general Privacy Policy available at https://icloneu.ai/PrivacyPolicy. In case of conflict between this Notice and the general Privacy Policy regarding EEA/UK Users, this Notice shall prevail.

1. Introduction and Scope

This Notice describes how IcloneU collects, uses, discloses and protects the personal data of individuals located in the EEA and the UK, and the rights those individuals have under the EU GDPR and the UK GDPR. It applies to your use of the IcloneU platform, website and related services.

Where this Notice refers to the "GDPR," the reference should be read as applying to both the EU GDPR (for individuals in the EEA) and the UK GDPR (for individuals in the United Kingdom), except where a distinction is expressly drawn. This Notice does not replace the general Privacy Policy; rather, it adds the specific disclosures and rights required for EEA/UK Users and prevails over the general Privacy Policy to the extent of any inconsistency for those users.

2. Data Controller and Contact

The controller responsible for the processing of your personal data is:

• Controller: Hermes AI, S.A.P.I. de C.V., commercially IcloneU
• Address: Calle Corbeta 21, Colonia Lomas del Chamizal, Cuajimalpa de Morelos, C.P. 05129, Mexico City, Mexico
• Data Protection Officer (DPO): wecare@icloneu.ai

EU/UK Representative (Article 27). Where required under Article 27 of the EU GDPR and/or the UK GDPR, IcloneU will designate a representative established in the Union and/or the United Kingdom to act as a point of contact for supervisory authorities and data subjects on matters relating to processing.

3. Categories of Personal Data and Sources

Depending on how you use the Services, we collect the following categories of personal data. We do not intentionally collect special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health data or biometric data used to uniquely identify a person).

Data shared with processors such as Stripe (payment processing) and our AI provider (response generation) is disclosed exclusively to provide the Services you have contracted and under contractual data-protection safeguards. Such disclosures are not a "sale" of personal data.

4. Purposes of Processing and Legal Bases

We process your personal data only where we have a valid legal basis under Article 6 of the GDPR. The table below maps each purpose to its legal basis.

We do not use your personal data, connected social-platform data, or Google user data to develop, improve or train generalized or foundation artificial intelligence models. Your content is used only to operate the Services you have contracted, including training your own Digital Clone.

5. Your Rights Under the GDPR

As an EEA/UK User, you have the following rights in relation to your personal data:

• Right of access — to obtain confirmation of whether we process your personal data and a copy of that data.
• Right to rectification — to have inaccurate personal data corrected and incomplete data completed.
• Right to erasure ("right to be forgotten") — to have your personal data deleted where one of the grounds in the GDPR applies.
• Right to restriction of processing — to limit how we process your data in certain circumstances.
• Right to data portability — to receive the personal data you provided to us in a structured, commonly used, machine-readable format and, where technically feasible, to have it transmitted to another controller.
• Right to object — to object to processing based on our legitimate interests and, at any time, to processing for direct marketing purposes.
• Right not to be subject to solely automated decisions — not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you.
• Right to withdraw consent — where processing is based on consent, to withdraw that consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

6. How to Exercise Your Rights

To exercise any of the rights described in Section 5, please contact our Data Protection Officer by email at wecare@icloneu.ai with the subject "GDPR Rights Request."

We will respond to your request without undue delay and in any event within one (1) month of receipt. Where a request is complex or you have made a number of requests, we may extend this period by up to two further months, in which case we will inform you of the extension and the reasons for it within the first month.

Exercising your rights is free of charge, except where a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act. To protect your privacy, we will verify your identity before processing your request and may ask you to provide sufficient information to confirm that you are the person to whom the personal data relates or an authorized representative.

7. International Data Transfers

IcloneU is based in Mexico, and your personal data is processed in Mexico and the United States, which are located outside the EEA and the UK. When we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards recognized under the GDPR, including the European Commission's Standard Contractual Clauses (SCCs) and, for transfers from the UK, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the SCCs, as well as adequacy decisions where applicable.

For further detail on our cross-border transfers and the safeguards we apply, please see the international transfers section of the general Privacy Policy at https://icloneu.ai/PrivacyPolicy and our Data Protection Policy. You may request a copy of the relevant safeguards by contacting our DPO.

8. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including to provide the Services, comply with our legal, tax and accounting obligations, resolve disputes and enforce our agreements. Our retention periods follow the retention rules described in the general Privacy Policy, after which personal data is securely deleted or anonymized.

9. Right to Lodge a Complaint

If you believe our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. In the EEA, you may complain to the supervisory authority of the Member State where you live, work, or where the alleged infringement occurred. In the United Kingdom, you may complain to the Information Commissioner's Office (ICO) at ico.org.uk.

We encourage you to contact our Data Protection Officer first so that we can try to resolve your concern directly.

10. Automated Decision-Making and Profiling

IcloneU does not make decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing, including profiling. While the Services use artificial intelligence to generate responses on your behalf, these outputs operate under your configuration and control and do not constitute solely automated decisions with legal or similarly significant effects on you. If this were to change, we would inform you, identify the applicable legal basis, and implement suitable safeguards, including your right to obtain human intervention, to express your point of view, and to contest the decision.

11. Changes to this Notice and Contact

We may update this Notice periodically. When we do, we will post the updated version and update the effective date. For material changes, we will notify you by email at least 30 days in advance.

For any queries related to this Notice or to exercise your rights:

• Data Protection Officer / rights requests: wecare@icloneu.ai
• Legal matters: legal@icloneu.ai
• Postal address: Calle Corbeta 21, Colonia Lomas del Chamizal, Cuajimalpa de Morelos, C.P. 05129, Mexico City, Mexico
• Website: https://icloneu.ai/PrivacyPolicy