PRIVACY POLICY

Hu:toma AI (or “we/us”) is committed to protecting the privacy of all the visitors of the website using
our Services (“You/r”). This Privacy Policy is part of the Hu:toma AI Terms of Use and explains our
practices regarding the use of personal data collected and processed through our website. Defined
terms set out herein shall have the same meaning as in Hu:toma AI Terms of Use of which it forms
part.

Summary

Hu:toma AI collects and processes (1) data related to your identity like your first name and your last
name, (2) data related to your contact, including your email address and (3) data related to your
profile, such as your password.

Those data will be used by us for the purposes of contacting you, managing any service you are
asking us and to send you newsletters, event announcements, product notices including those
announcing changes to our terms or policies, promotional offers and surveys.

We maintain the security and confidentiality of your data in accordance with applicable law and will
not make your personal data public.

By completing and submitting your personal data to Hu:toma AI, via any online registration or other
forms presented on our website, you declare to have read and accepted the terms of this Policy.
Without prejudice to the foregoing, you expressly and unequivocally consent to the collection and
processing of your personal data (as identified below) by us in accordance with the indicated
purposes and this Policy.

You may revoke consent at any time by writing to hello@hutoma.ai.

Please read the text below carefully for the full details of this Privacy Policy.

Commercial Communications
If you tick the corresponding box, you also consent to receiving commercial communications from us
regarding our and other services (see below). If later you do not wish to receive commercial
information about Hu:toma AI and other services (defined below), you can expressly opt out by
sending a notification to hello@hutoma.ai or by clicking the unsubscribe link in our email
communications.

1. Data Controller/s
The entity responsible for your registration data is Hu:toma AI, located at Carrer de Consell de Cent
341, Pral 1a, 08007, Barcelona, Spain. All communications regarding the processing of your personal
data shall be directed to our Data Protection Responsible indicated below.
Contact person: Maurizio Cibelli (maurizio@hutoma.ai)

2. Personal information we collect about you and how we use it

2.1. Data collected

We collect and process the following data:

a) Registration (Registration Data). On registering to our website, we will collect the following
personal data:

• Identity Data includes your first name and last name.

• Contact Data includes your email address.
• Profile Data includes your password.

b) Webform Data. If you submit any webform to us (e.g. Notify me when Hu:toma AI lists jobs), we
will collect the following:
• Contact Data includes your email address.

These data are mandatory and if they are not provided, an account cannot be created, and we cannot
contact you.

Prohibited data. In all events, it is forbidden to submit to us or upload to the Website any data that
contains sensitive personal data that is relative to identifiable persons such as: racial origin,
membership in a trade union, religion, ideology and sexual life, your and or third party’s health; or
your and or third party’s relative to the commission of criminal offences or proceedings and associated
penalties or fines.

It is important that the personal data we hold about you is accurate and current. You are responsible
for the accuracy of the information you provide to us and you are expected to update any information
you provide us with.

2.2. Data use

We use your personal data to:

• Contact you.
• Send you newsletters event announcements, product notices including those announcing
changes to our terms or policies, promotional offers and surveys.
• Manage any request you are asking us.

3. Legal basis

The legal basis of this processing is your consent, as well as our legitimate interest to contact you and
respond to your requests. If you opt-in, we will also send our newsletters, notification emails or
commercial communications in general about us and our products and any new features, offers or
promotions offered by us.

4. Data Retention

We will retain the personal data submitted through registration and collected during the course of
your use of the website until deactivation of your Account either by you or us. Once such personal data
is no longer used for the purpose mentioned above, it will be deleted.

Note that we will retain the data collected from you in an anonymised and aggregated format.
We may retain personal data beyond the aforementioned periods for legal or administrative reasons,
such as defending our responsibility and complying with mandatory legal obligations, subject to
applicable law.

5. Security Measures

We implement security measures and personal data protection schemes as required by law to
maintain the confidentiality and integrity of your data and protection against unauthorised access,
modification or destruction.

6. Your Rights

You have rights under data protection laws in relation to your personal data. You have the right to:

• Request access to your personal data (commonly known as a "data subject access request").
This enables you to receive a copy of the personal data we hold about you and to check that
we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any
incomplete or inaccurate data we hold about you corrected, though we may need to verify the
accuracy of the new data you provide to us.
• Request erasure of your personal data. This enables you to ask us to delete or remove
personal data where there is no good reason for us continuing to process it. You also have the
right to ask us to delete or remove your personal data where you have successfully exercised
your right to object to processing (see below), where we may have processed your information
unlawfully or where we are required to erase your personal data to comply with local law.
Note, however, that we may not always be able to comply with your request of erasure for
specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or
those of a third party) and there is something about your particular situation which makes you
want to object to processing on this ground as you feel it impacts on your fundamental rights
and freedoms. You also have the right to object where we are processing your personal data
for direct marketing purposes. In some cases, we may demonstrate that we have compelling
legitimate grounds to process your information which override your rights and freedoms.
• Request restriction of processing of your personal data. This enables you to ask us to suspend
the processing of your personal data in the following scenarios: (a) if you want us to establish
the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase
it; (c) where you need us to hold the data even if we no longer require it as you need it to
establish, exercise or defend legal claims; or (d) you have objected to our use of your data but
we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your personal data to you or to a third party (right to data portability).
We will provide to you, or a third party you have chosen, your personal data in a structured,
commonly used, machine-readable format. Note that this right only applies to automated
information which you initially provided consent for us to use or where we used the
information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal data.
However, this will not affect the lawfulness of any processing carried out before you withdraw
your consent. If you withdraw your consent, we may not be able to provide certain products
or services to you. We will advise you if this is the case at the time you withdraw your consent.

The aforementioned rights may be effective by contacting us at hello@hutoma.ai or at Hu:toma AI,

Carrer Consell de Cent 341, Pral 1a, 08007, Barcelona, Spain.
You also have the right to make any complaint to the competent authority, in this case the Spanish
Data Protection Agency (Agencia Española de Protección de Datos), C/. Jorge Juan, 6, 28001 Madrid,
Spain.

7. Disclosure

We treat your personal data with strict confidentiality in accordance with applicable law. However, we
shall disclose any personal or other data you provide us in compliance with a legal obligation or in
order to correctly deliver our Services or perform other obligations in accordance to the applicable
regulations and rules set forth in the website Terms.

Hu:toma AI will ensure that your identity will be kept strictly confidential and will not be passed to a
third party outside of what has been stated and agreed herein and in the Hu:toma AI Terms of Use.

8. International Transfers (third-party service providers)

We use several third-party services to provide our Services, some of which are located in the US, a
country that does not provide adequate general guarantees for the protection of personal data.
However, these companies are part of the shield of privacy "EU-US Privacy Shield" (that you can check
here https://www.privacyshield.gov/welcome).

In addition Hu:toma AI ensures that, for all companies outside the EEA that are not under the EU-US
Privacy Shield, an agreement requiring with the contractual guarantees required by law was signed.
You can contact us to consult or obtain a copy of these agreements.

9. General

This Website contains links to other websites that are not owned or controlled by Hu:toma AI. Please
be aware that we are not responsible for the privacy practices of such other websites.

We reserve the right to amend the terms of this Privacy Policy and will notify you by providing a clear
notice of these changes by email or on our Website, and in this Privacy Policy. If you continue to use
our Services after such update, you will be deemed to accept the new terms. If you do not accept the
update, please notify us and we will terminate your Account and remove any of your personal data
(except as required to be maintained for legal purposes), and you will not be able to continue to use
our Services.

Unless a specific local regulation sets forth to the contrary, the Privacy Policy is governed by the laws
of Spain.

Version 1: 30/10/2018