PRIVACY POLICY

Pozi Network Zrt. ("Pozi", "we", "us or "our") is committed to protecting the privacy and personal data of users of the Pozi platform, website and related services.

This Privacy Policy explains how we collect, use, store, disclose and otherwise process personal data when you visit our website, create or use a Pozi account, participate in events or communities, use our networking services, communicate with us, subscribe to our communications, or otherwise use our services.

Pozi processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR"), the Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information ("Infotv."), and other applicable data protection and privacy legislation.

1. DATA CONTROLLER

The data controller responsible for the processing of personal data described in this Privacy Policy is:

Pozi Network Zrt.

Registered seat:1053 Budapest, Ferenciek tere 2. fszt. ép., Hungary

Company registration number:01-10-141468

Tax number:HU27188756

Court of registry:Budapest-Capital Regional Court, Hungary

E-mail:hello@pozi.io

Unless expressly stated otherwise, Pozi determines the purposes and means of the processing activities described in this Privacy Policy and therefore acts as the data controller.

Where Pozi provides services to an event organiser, university, company, community or other organisation and processes personal data solely on that organisation's documented instructions, that organisation may act as the data controller and Pozi may act as a data processor. The respective organisation may provide additional privacy information applicable to its processing activities.

2. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to personal data processed in connection with:

the Pozi website;

the Pozi online platform;

Pozi user accounts and profiles;

event discovery, registration and participation;

communities and networking activities;

communication between users where enabled;

recommendations and matching functionality;

newsletters and direct marketing communications;

customer, partner and business communications;

website analytics;

platform usage and technical operations;

other services provided by Pozi.

This Privacy Policy does not apply to third-party websites, applications or services that are operated independently from Pozi. Such third parties are responsible for their own privacy practices.

3. WHAT IS PERSONAL DATA?

For the purposes of this Privacy Policy, "personal data" means any information relating to an identified or identifiable natural person.

This may include information such as a person's name, e-mail address, IP address, professional information, online identifiers, profile information, or information relating to their use of the Pozi platform.

4. DATA PROTECTION PRINCIPLES

Pozi processes personal data in accordance with the principles of the GDPR.

In particular, Pozi aims to ensure that personal data are:

processed lawfully, fairly and transparently;

collected for specified, explicit and legitimate purposes;

adequate, relevant and limited to what is necessary;

accurate and kept up to date where necessary;

retained only for as long as necessary;

processed in a manner ensuring appropriate security;

protected against unauthorised or unlawful processing and against accidental loss, destruction or damage.

Pozi does not intentionally collect personal data that are not reasonably necessary for the relevant purpose of processing.

5. CATEGORIES OF PERSONAL DATA WE MAY PROCESS

Depending on how you use Pozi, we may process the following categories of personal data.

5.1 Account and profile data

When you create or use a Pozi account, we may process:

name;

e-mail address;

authentication information;

account information;

profile picture, where provided;

company or organisation;

professional role or title;

professional interests;

skills and areas of expertise;

professional background;

networking preferences;

information voluntarily added to your profile;

account creation and login information.

5.2 Event and community data

When you register for or participate in an event, community or networking activity through Pozi, we may process:

name;

e-mail address;

company or organisation;

professional role;

professional interests;

areas of expertise;

event participation information;

networking preferences;

information contained in your profile;

interactions and participation within the relevant service.

The information visible to other participants depends on the configuration of the relevant event, community or Pozi service.

5.3 Communication data

When you contact Pozi, we may process:

name;

e-mail address;

company or organisation;

professional role;

contents of your message;

attachments or other information voluntarily provided;

records of our communication.

5.4 Marketing data

Where you subscribe to Pozi newsletters or other marketing communications, we may process:

name;

e-mail address;

subscription status;

consent records;

information relating to your interaction with our communications, where applicable.

5.5 Technical and usage data

When you use our website or platform, certain information may be collected automatically, including:

IP address;

approximate geographical location derived from IP address;

browser type and version;

operating system;

device type;

language settings;

date and time of access;

pages or screens visited;

referring website;

technical logs;

platform interactions;

usage information.

6. PURPOSES AND LEGAL BASES OF PROCESSING

Pozi processes personal data only where a valid legal basis under Article 6 of the GDPR exists.

The applicable legal basis depends on the particular processing activity.

6.1 Provision of the Pozi platform and services

Pozi processes account, registration and service-related information where this is necessary to provide the services requested by you or to take steps at your request before entering into a contract.

Legal basis: Article 6(1)(b) GDPR.

This may include:

creating and maintaining your account;

authenticating users;

providing access to platform functionality;

registering you for events;

enabling participation in communities;

enabling networking;

providing requested services.

6.2 Operating and securing the platform

Pozi processes technical and usage information where necessary to:

operate the platform;

maintain system security;

detect and prevent fraud and abuse;

detect unauthorised access;

troubleshoot technical problems;

maintain system reliability;

protect users and the platform.

Legal basis: Article 6(1)(f) GDPR.

Pozi's legitimate interests include operating, securing, maintaining and improving a reliable digital platform and protecting its users, systems and business.

6.3 Improving the Pozi platform

Pozi may process technical, usage and aggregated information to understand how the platform is used and to improve:

platform functionality;

user experience;

event discovery;

networking functionality;

recommendations;

performance;

reliability.

Legal basis: Article 6(1)(f) GDPR where applicable.

Where applicable law requires consent for the use of cookies or similar technologies, the relevant technology will only be used after consent has been obtained.

6.4 Communication and customer support

Pozi processes personal data in order to respond to questions, requests, support enquiries and other communications.

Legal basis: Article 6(1)(b) GDPR where necessary to provide a requested service, or Article 6(1)(f) GDPR where processing is necessary for legitimate business communication and relationship management.

6.5 Legal and regulatory compliance

Pozi may process personal data where necessary to comply with a legal obligation.

Legal basis: Article 6(1)(c) GDPR.

This may include:

accounting and tax obligations;

legal record-keeping;

responding to lawful requests from public authorities;

complying with applicable legislation.

6.6 Establishment, exercise or defence of legal claims

Pozi may process personal data where necessary for the establishment, exercise or defence of legal claims.

Legal basis: Article 6(1)(f) GDPR or another applicable legal basis.

7. EVENT, COMMUNITY AND NETWORKING FUNCTIONALITY

Pozi provides functionality designed to help users discover events, communities and relevant professional connections.

Information contained in a user's profile may therefore be processed to:

facilitate event participation;

identify potentially relevant professional connections;

facilitate networking;

display relevant participant information;

enable communication between participants;

recommend relevant events, people or communities;

improve the relevance of the platform.

The relevant processing may be based on information provided directly by the user, information generated through the user's use of the platform, and information relating to the user's interests, professional background and networking preferences.

Legal basis: Article 6(1)(b) GDPR where processing is necessary to provide a requested service, Article 6(1)(a) GDPR where consent is required, or Article 6(1)(f) GDPR where processing is necessary for Pozi's legitimate interests.

Where a particular event organiser determines the purposes and means of processing, the organiser may act as the controller for that processing.

8. AI MATCHING AND RECOMMENDATION SYSTEMS

Pozi intends to provide AI-supported matching and recommendation functionality as part of the development of the platform.

When such functionality is introduced, Pozi may use automated systems to analyse information available through the platform in order to recommend:

relevant people;

professional connections;

events;

communities;

opportunities;

content;

other relevant services available through Pozi.

The system may take into account information such as:

professional interests;

skills and expertise;

company or organisation;

professional role;

professional background;

event participation;

networking preferences;

profile information;

interactions with the Pozi platform.

The purpose of such processing is to make the Pozi platform more relevant and useful and to facilitate meaningful professional and business connections.

Where this processing constitutes "profiling" within the meaning of the GDPR, Pozi will apply the safeguards and transparency requirements applicable to profiling.

The recommendation and matching functionality is not intended to make decisions producing legal effects or similarly significant effects concerning users.

Pozi will not intentionally use special categories of personal data, as defined by Article 9 GDPR, for AI matching or recommendations unless a valid legal basis and an applicable exception under Article 9 GDPR exist.

Where a third-party AI service provider is used in connection with such functionality, the relevant provider will be selected and contracted in accordance with applicable data protection requirements, and this Privacy Policy will be updated where necessary before the relevant processing begins.

Users may exercise their applicable rights in relation to profiling by contacting Pozi at hello@pozi.io.

9. PUBLIC AND PARTICIPANT PROFILES

Certain Pozi services may allow users to create profiles and make selected information available to other users, event participants or community members.

Users should carefully consider what personal information they choose to make available through their profile.

Where profile information is displayed to other users as part of the functionality of a Pozi service, such disclosure forms part of the requested service.

Users are responsible for ensuring that information they provide is accurate and that they have the right to provide any personal data concerning another person.

Users should not upload special categories of personal data unless the relevant Pozi service expressly supports such information and the applicable legal requirements are satisfied.

10. NEWSLETTERS AND DIRECT MARKETING

Pozi may send newsletters and marketing communications to users who have expressly subscribed to receive them.

Legal basis: Article 6(1)(a) GDPR.

Subscription is voluntary and is not a condition for using the Pozi platform.

Every marketing communication will provide an appropriate mechanism for unsubscribing.

You may withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Where permitted by applicable law, Pozi may also process professional business contact information for direct marketing based on legitimate interests, subject to applicable marketing and electronic communications legislation.

You may object to direct marketing at any time.

11. CONTACT FORMS

When you submit a contact form or otherwise contact Pozi, we process the information you provide to respond to your enquiry and manage the resulting communication or business relationship.

This may include:

name;

e-mail address;

company or organisation;

professional role;

website;

information about your relationship with the startup, innovation or business community;

contents of your enquiry.

Legal basis: Article 6(1)(b) GDPR where necessary to respond to a request for services, or Article 6(1)(f) GDPR where processing is necessary for legitimate business communication.

Where a particular form requests consent for a separate processing purpose, Article 6(1)(a) GDPR will apply to that purpose.

12. COOKIES AND SIMILAR TECHNOLOGIES

Pozi may use cookies, pixels, local storage and similar technologies.

These technologies may be used for:

essential functionality;

authentication;

security;

remembering preferences;

analytics;

performance measurement;

improving the user experience.

Strictly necessary technologies may be used where permitted by applicable law.

Where consent is legally required, non-essential cookies and similar technologies will only be activated after the user has provided consent.

Users may manage their cookie preferences through the cookie consent mechanism provided on the relevant Pozi website.

13. GOOGLE ANALYTICS 4

Pozi uses Google Analytics 4 (GA4) to analyse website usage and improve the performance and user experience of the Pozi website.

GA4 may process information including:

device information;

browser information;

approximate location;

pages and screens viewed;

interactions with the website;

technical information;

usage information.

Where legally required, analytics cookies and similar technologies will only be activated after the user's consent.

Analytics information is used for statistical and service-improvement purposes.

Pozi does not use Google Analytics as a basis for making decisions producing legal or similarly significant effects concerning individual users.

Google may process personal data in accordance with its applicable contractual and privacy terms.

Where the use of Google Analytics involves an international transfer of personal data, the transfer will be subject to the transfer mechanism applicable under Chapter V of the GDPR.

14. EMAIL COMMUNICATIONS AND SENDGRID

Pozi uses SendGrid, a service provided by Twilio, for the delivery of transactional, service-related and, where applicable, marketing e-mails.

SendGrid may process information necessary to deliver e-mails, including:

recipient e-mail address;

sender information;

message metadata;

delivery status;

bounce information;

technical information;

e-mail interaction information where tracking functionality is enabled.

Pozi uses SendGrid as a technical service provider for the delivery of communications.

SendGrid processes personal data on behalf of Pozi for the relevant services and does not determine the purposes for which Pozi processes user personal data.

Pozi currently uses SendGrid's global infrastructure rather than SendGrid EU Data Residency. Accordingly, Pozi does not represent that all personal data processed through SendGrid remain exclusively within the European Economic Area.

Where SendGrid processes or accesses personal data outside the EEA, Pozi relies on the international transfer mechanism applicable under Chapter V of the GDPR and the contractual data protection arrangements applicable to the SendGrid service.

15. HOSTING AND CLOUD INFRASTRUCTURE

Pozi's platform and cloud infrastructure are hosted through DigitalOcean.

The primary Pozi production infrastructure is currently located in Frankfurt, Germany (DigitalOcean FRA1).

DigitalOcean processes technical and platform data as necessary to provide hosting and infrastructure services to Pozi.

DigitalOcean acts as a technical service provider and, where it processes personal data on Pozi's behalf, as a data processor.

Pozi applies appropriate contractual and technical measures to protect personal data processed through its cloud infrastructure.

Where DigitalOcean processes or accesses personal data outside the EEA, Pozi relies on the international transfer mechanism applicable under Chapter V of the GDPR and the contractual data protection arrangements applicable to the DigitalOcean service.

16. DATA PROCESSORS AND SERVICE PROVIDERS

Pozi uses selected third-party service providers to operate and maintain the platform.

The principal service providers currently used by Pozi include:

Service provider

Purpose

Categories of personal data potentially processed

DigitalOcean

Cloud hosting and infrastructure

Account, platform, technical and usage data

Twilio / SendGrid

E-mail delivery

E-mail addresses, message and delivery metadata, technical and interaction data

Google LLC / Google Analytics

Website analytics

Technical and usage data

Pozi requires processors to process personal data only in accordance with applicable contractual arrangements and data protection law.

Pozi may engage additional processors as its services and technical infrastructure develop.

Where required by law, appropriate data processing agreements will be concluded with such processors.

17. INTERNATIONAL DATA TRANSFERS

Pozi operates its principal platform infrastructure in the European Economic Area, including its primary production infrastructure in Frankfurt, Germany.

However, some third-party service providers used by Pozi may operate or provide services through infrastructure located outside the EEA.

Pozi does not sell, rent or otherwise disclose personal data to third parties for their own independent marketing, profiling or commercial purposes.

Pozi's operation in the United States does not by itself mean that Pozi transfers user personal data to U.S. entities or makes user databases available to its U.S. operations.

Where personal data are transferred to, or accessed from, a country outside the EEA, Pozi will ensure that the transfer is based on a lawful mechanism under Chapter V of the GDPR.

Depending on the circumstances, this may include:

an adequacy decision adopted by the European Commission;

the EU Standard Contractual Clauses;

an applicable certification or other recognised transfer mechanism;

another appropriate safeguard permitted by the GDPR.

Pozi will not knowingly transfer personal data to a third country without an applicable legal basis for the transfer.

18. DISCLOSURE OF PERSONAL DATA

Pozi may disclose or provide access to personal data:

to authorised employees and contractors where necessary;

to technical service providers and data processors;

to event organisers or other organisations where necessary to provide a requested service;

to professional advisers where necessary;

to competent public authorities where legally required;

where necessary for the establishment, exercise or defence of legal claims;

where the user has expressly requested or authorised such disclosure.

Pozi does not sell personal data.

Pozi does not provide personal data to third parties for their own independent advertising or commercial profiling.

19. DATA RETENTION

Pozi retains personal data only for as long as necessary for the purposes for which they were collected, unless a longer retention period is required or permitted by law.

The applicable retention period depends on the type of data and the purpose of processing.

Indicative retention periods are:

Category of data

Retention period

User account and profile data

For the duration of the account and for a reasonable period thereafter where necessary

Event participation data

For the duration of the relevant service and thereafter where necessary for legitimate business or legal purposes

Contact enquiries

For as long as necessary to handle the enquiry and related relationship

Newsletter subscription data

Until withdrawal of consent or unsubscribe, subject to limited suppression records where necessary

Transactional and accounting records

For the period required by applicable law

Security and technical logs

For a limited period appropriate to the relevant security purpose

Analytics data

According to the configured analytics retention settings and applicable law

Consent records

For as long as necessary to demonstrate compliance with applicable legal obligations

When personal data are no longer required, Pozi will delete or anonymise them in accordance with applicable law and its internal data retention procedures.

20. DATA SECURITY

Pozi implements appropriate technical and organisational measures designed to protect personal data against:

accidental or unlawful destruction;

accidental loss;

alteration;

unauthorised disclosure;

unauthorised access;

unlawful processing.

Depending on the nature of the processing, security measures may include:

access controls;

authentication mechanisms;

encryption where appropriate;

restricted access to production systems;

secure cloud infrastructure;

logging and monitoring;

backup and recovery procedures;

internal access management;

security monitoring and incident response procedures.

Access to personal data is limited to persons who require such access for legitimate business or operational purposes.

No method of transmission or storage can be guaranteed to be completely secure. Pozi nevertheless continuously seeks to maintain an appropriate level of security proportionate to the risks associated with the processing.

21. YOUR DATA PROTECTION RIGHTS

Subject to the conditions and limitations established by applicable law, you may have the following rights.

21.1 Right of access

You may request confirmation as to whether Pozi processes personal data concerning you and, where applicable, request access to those personal data.

You may also request additional information concerning the processing.

21.2 Right to rectification

You may request the correction of inaccurate personal data.

You may also request completion of incomplete personal data where appropriate.

21.3 Right to erasure

You may request deletion of your personal data where the applicable requirements of the GDPR are met.

The right to erasure is not absolute and may be limited where continued processing is required or permitted by law.

21.4 Right to restriction of processing

You may request restriction of processing in circumstances provided by the GDPR.

21.5 Right to object

You may object to processing based on Article 6(1)(e) or Article 6(1)(f) GDPR on grounds relating to your particular situation, subject to the conditions established by the GDPR.

You may object to direct marketing at any time.

Where personal data are processed for direct marketing purposes, including profiling related to such direct marketing, Pozi will cease the relevant processing following a valid objection, subject to applicable law.

21.6 Right to data portability

Where the requirements of the GDPR are met, you may request to receive personal data you have provided to Pozi in a structured, commonly used and machine-readable format.

Where technically feasible and legally applicable, you may request that such data be transmitted directly to another controller.

21.7 Right to withdraw consent

Where processing is based on your consent, you may withdraw your consent at any time.

You may withdraw consent by:

using the unsubscribe mechanism in a marketing communication;

changing the relevant consent settings where available;

contacting Pozi at hello@pozi.io.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

21.8 Rights relating to automated decision-making and profiling

Where applicable under the GDPR, you may have rights concerning solely automated decision-making, including profiling.

Pozi's intended AI matching and recommendation functionality is designed to provide recommendations and facilitate networking and is not intended to produce legal effects or similarly significant effects concerning users.

22. HOW TO EXERCISE YOUR RIGHTS

To exercise your rights or ask questions concerning the processing of your personal data, please contact:

Pozi Network Zrt.

E-mail:hello@pozi.io

Postal address:1053 Budapest, Ferenciek tere 2. fszt. ép., Hungary

Pozi may request additional information necessary to verify your identity where reasonably necessary to protect your personal data and prevent unauthorised disclosure.

Requests are generally free of charge.

Pozi will respond to a valid request without undue delay and, in any event, within one month of receiving the request.

Where permitted by the GDPR, this period may be extended by up to two additional months where necessary due to the complexity or number of requests.

If an extension is required, Pozi will inform you within the initial one-month period and provide the reasons for the delay.

23. RIGHT TO LODGE A COMPLAINT

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

In Hungary, the competent supervisory authority is:

National Authority for Data Protection and Freedom of Information (NAIH)

Address:1125 Budapest, Szilágyi Erzsébet fasor 22/C., Hungary

Postal address:1530 Budapest, Pf. 5.

Telephone:+36 (1) 391-1400

E-mail:ugyfelszolgalat@naih.hu

Website:www.naih.hu

You may also have the right to lodge a complaint with the supervisory authority in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement.

24. DATA PROTECTION OFFICER

Pozi Network Zrt. has not appointed a separate Data Protection Officer (DPO).

Where Pozi becomes legally required to appoint a DPO, or voluntarily appoints one, the relevant contact information will be added to this Privacy Policy.

For all data protection matters, users may currently contact Pozi directly at:

hello@pozi.io

25. CHILDREN

The Pozi platform is primarily intended for adults and professional users.

Pozi does not intentionally target children under the age of 16.

Where applicable law requires parental or guardian consent for processing personal data relating to a child, Pozi will apply the relevant legal requirements.

If you believe that a child has provided personal data to Pozi in circumstances where such processing was not permitted, please contact us at hello@pozi.io.

26. DATA RECEIVED FROM THIRD PARTIES

Pozi may receive personal data from:

event organisers;

universities;

companies;

community operators;

partners;

other organisations using Pozi services.

Where Pozi receives personal data from a third party and acts as a controller, Pozi will provide the information required by Article 14 GDPR where applicable.

Where another organisation remains the controller of the relevant processing, that organisation is responsible for providing the applicable privacy information to data subjects.

27. DATA PROTECTION INCIDENTS

Pozi maintains procedures for identifying, assessing and responding to personal data breaches.

Where required by Article 33 GDPR, Pozi will notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours after becoming aware of the breach.

Where the breach is likely to result in a high risk to the rights and freedoms of natural persons, Pozi will communicate the breach to the affected individuals without undue delay where required by Article 34 GDPR.

28. THIRD-PARTY WEBSITES AND SERVICES

The Pozi website and platform may contain links to websites, applications or services operated by third parties.

Pozi is not responsible for the privacy practices, security or content of third-party services.

Users should review the relevant third party's privacy policy before providing personal data to that service.

29. CHANGES TO THIS PRIVACY POLICY

Pozi may update this Privacy Policy from time to time to reflect:

changes to the Pozi platform;

new functionality;

changes to our data processing activities;

changes to technology;

changes to service providers;

changes to applicable legislation.

The latest version will be made available on the Pozi website and/or platform.

Where a material change significantly affects the way Pozi processes personal data, Pozi will provide additional information where required by law.

Where new processing activities require additional information or consent under applicable law, Pozi will provide the relevant information or obtain the required consent before commencing such processing.

30. CONTACT

For any questions concerning this Privacy Policy or Pozi's processing of personal data, please contact:

Pozi Network Zrt.

Registered seat:1053 Budapest, Ferenciek tere 2. fszt. ép.Hungary

E-mail:hello@pozi.io

Effective date: 2 September 2026

Last updated: 2 September 2026