Data and Privacy Policy

• Introduction
• 1 Who is the Data Controller?
• 2 Data Protection Officer
• 3 What Personal Data do we collect?
• 4 Recording of Calls
• 5 Special Category Personal Data
• 6 Purpose and Legal Basis of processing your Personal Data
• 7 Who do we share your Personal Data with?
• 8 Data Retention
• 9 Withdrawal of consent
• 10 International Transfer of Personal Data
• 11 Security Measures
• 12 Your Rights
• 13 Links to other websites
• 14 Changes to the Privacy Policy

Introduction

This Privacy Policy describes how BZRK LIMITED, a company registered in Cyprus under registration number HE 185425 ("We") collects, uses, processes, and discloses information, including personal information (the "Personal Data") which identify and relate to you ("You"), in conjunction with your access to and use of the website www.bazaraki.com or the Bazaraki mobile application (hereinafter the "Website", the "Application" or "Bazaraki").

You must carefully read this Privacy Policy, in order to determine whether you wish to provide your Personal Data, or those of third parties, to Bazaraki.

1 Who is the Data Controller?

We act as the Data Controller for your Personal Data collected through the Website or in any other way, as provided herein. Please find our details below:

• Name: BZRK LIMITED, HE 185425
• Address: 121 Prodromou Street, 2064, Nicosia, Cyprus
• Email: info@bazaraki.com

2 Data Protection Officer

Our Data Protection Officer is M. Paraschou & Co LLC (the "DPO"). If you have any questions about this Privacy Policy, wish to exercise any of your legal rights, require clarifications on how your data is used, or to file a complaint, contact the DPO using the contact details below:

• Name: M. Paraschou & Co LLC
• Email: dataprotection@bazaraki.com

3 What Personal Data do we collect?

Website Visitors and Application Users

3.1. When you visit the Website, we automatically collect information from your computer, tablet, phone or other electronic device used to access the Website (the "Device"). This information, which will be collected without your intervention and stored until it is automatically deleted, includes but is not limited to the following:

1. Internet Protocol (IP) address of the requesting Device
2. Device ID or unique identifier, device type, ID for advertising, and unique device token
3. Date and time of access
4. Geo-location information
5. Name and URL of the retrieved file
6. Website from which access is made (referrer URL)
7. The browser used and, if applicable, the operating system of your Device and the name of your access provider.
8. Device and connection information such as statistics on your page views, traffic to and from the sites, ad data, your browsing history, and your web log information.

The Personal Data mentioned above are collected automatically through the use of Cookies, web beacons, and similar technologies. You have the option to restrict the information collected on the Website. For more information about Cookies, see our Cookies Policy below.

3.2. We may collect Personal Data from Third Parties, including technical data from analytics providers such as Google LLC.

3.3. We may also use call-tracking technologies that will allow us and Advertisers (persons who publish an advertisement on Bazaraki) to identify precisely the number of calls received through advertisements on the Website or on the Application. By using such technologies, we might record part of your telephone number during your call with an Advertiser, as well as the duration, date and time of your call. This information is processed without any attempt to identify any individual.

3.4. When you communicate directly with an Advertiser as per Paragraph 3.3. above, please note that your email address or your phone number will be shared with the Advertiser, depending on the means of communication used.

3.5. If you wish to create, maintain and use a Bazaraki account, the following information will be collected:

1. Any identifying information such as your name, telephone number and email address when you register for an account with us.
2. Buying or selling information you provide during a transaction, or other transaction-based content that you generate or is connected to your account as a result of a transaction you are involved in.
3. Financial and billing information (such as credit card or bank account numbers) in connection with a transaction with us, which is held by our trusted payment processing service providers.
4. Information contained in any Ad that you publish on Bazaraki.
5. Your information when you submit a Feedback and/or a Support Form and/or information through your participation in community discussions, chats or when you otherwise correspond with us.

3.6. When using the Website, you may have the option to link one of your social media accounts instead of creating a new account. Such social media sites may automatically grant us access to some of the Personal Data retained by them about you for identification purposes. You may customise what Personal Data is shared with us through the privacy settings on the relevant social media website. By associating a social media account with the Website and authorizing us to have access to this information, you agree that we may collect, use and retain the information provided by these social media sites in accordance with this Privacy Policy.

3.7. In all cases, we will only use your Personal Data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use any Personal Data for an unrelated purpose, we will notify you to explain the legal basis for such use and ask for your consent (where we will need to rely on your consent for such additional processing).

3.8. Bazaraki will maintain copies of Personal Data and Bazaraki Account Information of individuals who undergo the Age Verification Process through the Yoti Platform (to enable them to post Ads in the categories "Erotic massage & Adult Services (18+)" and/or "Adult Products (18+)", as per Clause 5.2(Verification of Bazaraki Account) of the Terms and Conditions) (the "Bazaraki Adult Accounts") for the prevention of offenses under the Prevention and Combating of Trafficking and Exploitation of Persons and the Protection of Victims Law 60(I) of 2014 (Law 60(I)/2014).

4 Recording of Calls

4.1. All calls made to and from Bazaraki are recorded for training purposes and to ensure the quality of our services. All calls made by users to professional Bazaraki Accounts are also recorded for training and quality assurance purposes.

4.2. When recording your telephone communications, we may rely on any of the following legal bases:

1. You have explicitly asked us to communicate with you via phone.
2. To perform our obligations under a contract or to provide our services to you.
3. For purposes of training and maintaining the quality of our services.
4. Resolving complaints or disputes.
5. To safeguard our legitimate interests and to establish, exercise or defend legal claims.

4.3. When you communicate with us over the telephone, call recordings will be saved for a period of 46 days. After such a period, call recordings will be deleted automatically.

4.4. When you communicate with Bazaraki business clients as per Paragraph 4.1. above, call recordings will be saved for a period of 12 months.

4.5. We may retain call recordings for longer periods of time under some circumstances, such as in case of an unresolved complaint or dispute, or when we consider it possible that such call recordings may be required to establish, exercise or defend legal claims and there is no reason to assume that you have a predominantly legitimate interest in not disclosing your data.

4.6. For any clarifications on how such data is used, contact our DPO.

4.7. If you do not consent to the recording of your call with us, you may contact us via email.

5 Special Category Personal Data

Depending on the category of Bazaraki Account that you maintain, we may collect Special Category Personal Data about you (such as a copy of your Passport or ID for identification purposes, which may contain details about your race or ethnicity). We do not collect any information about criminal convictions and offences.

6 Purpose and Legal Basis of processing your Personal Data

6.1. When processing your Personal Data, we may rely on one or more of the following Legal Bases:

1. Processing is necessary for the provision of our Services. This includes providing customer service and support, updating, improving, securing and personalising our Services. If your Personal Data are not provided or not provided correctly, we will be unable to provide our Services.
2. To personalise our advertising and marketing communications. For marketing purposes and promotional actions regarding our clients, we consider that we have a legitimate interest in promoting our business.
3. To comply with applicable legal requirements.
4. For the safeguarding of our legitimate interests.
5. Processing is necessary to protect the vital interests of a third party.
6. Processing is necessary for the performance of a task carried out in the public interest.
7. You have consented to the processing of your Personal Data for the specific purpose.
8. When contacting you via telephone, we may use auto-dialled or pre-recorded calls to ensure efficiency, if you have consented to such contact.

6.2. If we collect Special Category Personal Data about you, we may rely on any of the following additional Legal Bases:

1. Processing relates to Personal Data which are manifestly made public by you.
2. Processing is necessary for the establishment, exercise or defence of legal claims.
3. You have explicitly given your consent for the processing of your Personal Data.

7 Who do we share your Personal Data with?

We may disclose your personal data to service providers, including financial institutions or other service providers, to facilitate the provision of their services as well as to law enforcement bodies, credit agencies or bureaus as required by applicable national laws.

7.1. We may disclose your Personal Data to third parties if:

1. Disclosure to companies in the Bazaraki Group of Companies, Bazaraki-controlled affiliates and subsidiaries or to third parties, where such disclosure is necessary is for the performance of the intended purposes (such as the provision of our Services).
2. You complete and submit a form on the Website requesting assistance to find a real estate property. In such cases, Bazaraki may share the contact details provided by you for this purpose with independent, third-party real estate agents who may contact you to assist you in finding a property (as per your request). By completing and submitting such a request, you consent and agree to any personal data provided by you to be shared with the said real estate agents and for them to contact you directly to assist you in relation to your request. You acknowledge that Bazaraki has no control or responsibility over how the real estate agents process the contact details which you choose to share for this purpose. These will be governed by the real estate agents' Privacy Policy and/or Terms of Use.
3. Either you complete and submit a form requesting that we share the contact details which you indicate with the Advertiser of a specific Ad or via BZRK chat where you share your contact details directly with a specific Advertiser in order to enable them to contact you directly about that Ad when they are available. By completing and submitting such a request, you consent and agree to the contact information provided by you to be shared with the said Advertiser and for them to contact you directly in relation to that Ad. You acknowledge that Bazaraki has no control or responsibility over how the Advertiser processes the contact details which you choose to share with them. These will be governed by the Advertiser's Privacy Policy and/or Terms of Use.
4. You communicate with us via the Live Chat on the Website.
5. Disclosure is necessary to assert, exercise or defend legal claims and there is no reason to assume that you have a predominantly legitimate interest in not disclosing your data.
6. You have expressly consented to this.
7. We are legally required to disclose such data, for example to prevent the commitment of an offense or to assist competent authorities in investigations in relation to offenses committed.

7.2. When disclosure of your Personal Data is permitted or necessary, we try to restrict the Personal Data disclosed to what is directly relevant and necessary for the accomplishment of the specified purpose. Apart from the above, we do not transfer your personal information to any other third party without your prior approval.

7.3. Receiving parties are bound by appropriate confidentiality and data processing agreements.

8 Data Retention

8.1. We will retain your Personal Data as long as it is necessary and relevant for our operations. This period will usually not exceed 6 months.

8.2. Irrespective of any other contrary provisions in this Privacy Policy, we will retain your Personal Data for as long as you maintain an account on the Website. We may retain your Personal Data even after your account has been deleted (whether this has been requested by you or has been deleted by us for not complying with the Website Terms of Use) to comply with national laws, prevent fraud, collect any fees owed, resolve disputes, troubleshoot problems, assist with any investigation and take other actions permitted or required by applicable national laws. Specifically, Bazaraki may maintain Personal Data and Bazaraki Account Information in relation to Bazaraki Adult Accounts for a period of up to 5 years following the closure of such an account.

8.3 If you maintain a Bazaraki Account or you otherwise transact with us, we will maintain necessary data in relation to the transaction (such as billing information) to comply with any statutes of limitation or other applicable laws.

8.4. After the Data Retention Period or when we have no legal basis to process your data, we will delete all copies of your Personal Data in a secure manner in accordance with our Data Retention Policy.

8.5. Please refer to Clause 4. to find more information on how Call Recordings are processed.

9 Withdrawal of consent

9.1. When you use the Website, contact us through the Contact or Help Forms, the Live Chat on the Website or via email, you consent to the processing of your Personal Data in accordance with this Privacy Policy. To revoke such consent, you may inform our Data Protection Officer accordingly by email.

9.2. When you receive our promotional emails or newsletters, you have the option to opt out of our marketing mailing list by unsubscribing at any time through the instructions at the end of each of our emails.

9.3. In the event that you withdraw your consent, the legality of the processing carried out prior to your withdrawal of consent will not be affected.

10 International Transfer of Personal Data

10.1. Your Personal Data may be transferred out of the European Economic Area for storage purposes and be processed by third party companies.

10.2. In such case, third party companies will be under a contractual duty to protect your Personal Data by employing appropriate safeguards. To this effect, we employ standard contractual clauses approved by the European Commission, in line with GDPR requirements.

11 Security Measures

We will process your Personal Data at all times in a confidential way and maintain the mandatory duty to secrecy and confidence, in accordance with applicable regulations. For this purpose, we adopt measures of a technical and organizational nature required to guarantee the security and integrity of your Personal Data, depending on the state of the technology, the nature of the stored data and the risks to which they are exposed. Some of the safeguards we employ include:

• Firewalls and data encryption
• Physical access controls to our data centres, and information access authorization controls
• Limitation of the data we use for you in a way that your identity cannot be revealed by them
• Measures of pseudonymisation and encryption of personal data
• Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services
• Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident
• Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing
• Measures for user identification and authorisation
• Measures for the protection of data during transmission
• Measures for the protection of data during storage
• Measures for ensuring physical security of locations at which personal data are processed
• Measures for ensuring events logging
• Measures for ensuring system configuration, including default configuration
• Measures for internal IT and IT security governance and management
• Measures for certification/assurance of processes and products
• Measures for ensuring data minimisation
• Measures for ensuring data quality
• Measures for ensuring limited data retention
• Measures for ensuring accountability
• Measures for allowing data portability and ensuring erasure

12 Your Rights

12.1. Notwithstanding the purpose or legal basis we rely on to process your data, under certain circumstances, under applicable legislation you have the following rights:

• Request Access: You have the right to request access to your Personal Data.
• Request to Rectify Personal Data: You may request that we correct any incomplete or inaccurate data we hold about you, though we may need to verify the accuracy of the new data you provide to us.
• Request to Erase Personal Data: You may request that we delete or remove any Personal Data where there is no valid legal basis for us continuing to process it. We may not always be able to comply with your request due to legal requirements that will be notified to you at the relevant time.
• Object to Processing of Personal Data: Where there is something about your particular situation which makes you want to object to processing because it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your Personal Data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information.
• Request Restriction of Processing: This enables you to ask us to suspend the processing of your Personal Data if you want us to establish the data's accuracy or where the use of such data is unlawful but you do not want us to erase it or where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims or you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Request the Transfer of Personal Data: You may request that we provide you, or a third party of your choice, your Personal Data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used to perform a contract with you.
• Withdraw Consent: You may withdraw your consent to the processing of your Personal Data by emailing our DPO, at any time where we are relying on consent to process your Personal Data.
• Right Not to be Subject to a Decision Based Solely on Automated Processing: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
• Right to lodge a Complaint: You have the right to lodge a complaint at any time to a data protection regulator. The relevant supervising authority in Cyprus is the Office of the Commissioner for Personal Data Protection (further information can be found at www.dataprotection.gov.cy).

12.2. We do not normally charge any fees for access to your Personal Data (or to exercise any of the above rights). We may charge a reasonable fee if a request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with a request in these circumstances.

12.3. We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it.

12.4. We try to respond to all legitimate requests within one (1) month of receipt. It may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

12.5. We do not warrant, undertake and/or represent error-free performance under this Privacy Policy. We will use all reasonable efforts to comply with this Privacy Policy and shall take immediate rectification actions in the event of a breach of this Privacy Policy. We shall not be liable for any incidental, consequential or punitive damages relating to a breach of this Privacy Policy. If you wish to exercise any of the rights set out above, contact our DPO via email.

13 Links to other websites

The Website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy policies and/or procedures. Bazaraki has no control or responsibility over how the Personal Data collected automatically either by, or which you may share with, third-party websites, or by means of third-party plug-ins and applications, or which you may share through them. These will be governed by such third-party's own Privacy Policy and/or Terms of Use. When you leave our Website, we encourage you to read the privacy notice and Terms of Use of every website you visit before sharing any Personal Data.

14 Changes to the Privacy Policy

14.1. We may amend the information contained in this Privacy Policy when we consider this appropriate or as required due to changes in applicable legislation. Should we do so, we will notify you through the Website, but are not obliged to send you an email to inform you of the changes effected. You may assess such changes and, as the case may be, object or unsubscribe from any service or functionality.

14.2. We recommend that you review this Privacy Policy at frequent intervals to be kept up to date with any amendments introduced. We will update the "Last Updated" date at the beginning of this Privacy Policy. Any changes make to this Privacy Policy are effective as of this Last Updated date and replace any prior Privacy Policy versions.

14.3. In case you need any clarifications about the processing of your Personal Data, contact our DPO at dataprotection@bazaraki.com.