1. THE CONTROLLER OF PERSONAL DATA

2. RIGHTS OF DATA SUBJECTS WHOSE DATA ARE PROCESSED BY FACY

In connection with Facy's processing of your personal data, you have the right to request:

• Access to your personal data
• Rectification of your data
• Erasure of your personal data
• Restriction of processing
• Data portability

3. SERVICES FOR GENERATING OR MODIFYING IMAGES OR VIDEOS

If you start using our services, we will process personal data for the purpose and for the duration of providing those services, based on Article 6(1)(b) GDPR. These are primarily your IP numbers and any image or voice contained in the materials you submit as input.

User data such as IP address or ID are shared with Cloudflare, Inc., based in the USA and other countries, for protection against DDoS attacks, based on Article 6(1)(f) GDPR. Information about the use of this website may be transferred to and stored on Cloudflare servers in the USA, on the basis of an adequacy decision under the so-called "EU-US Data Privacy Framework". More information can be found in the Cloudflare Privacy Policy.

If the user uses paid services, their data may be transferred by us to the selected electronic payment service provider, depending on the chosen payment method, based on Article 6(1)(b) GDPR.

Input data (input)

We process uploaded graphics, video, and prompts on servers located in the European Economic Area (EEA). We use European cloud compute providers acting as our processors under Article 28 GDPR. This data is not transferred outside the EEA. If exceptional third-country access is ever required (e.g., to resolve a critical incident), we will apply an approved transfer mechanism (such as Standard Contractual Clauses) and appropriate safeguards.

Output data (output)

Data may be disclosed at the request of authorized authorities, in particular courts and the Police, to the extent required by law, based on Article 6(1)(c) GDPR.

4. USER ACCOUNT REGISTRATION

Facy will process personal data provided by you during account registration and related to your activity on that account. These data will be processed to pursue Facy's legitimate interests consisting of:

• Facilitating your purchases in the online store and providing additional features
• Conducting marketing, analytics and statistical activities on the basis of Article 6(1)(f) GDPR

Your personal data will be processed until the registered account is deleted. A user can delete the account on demand at the website https://facy.ai/profile. After choosing this option, the account can be recovered for 30 days. After 30 days the data are irreversibly anonymized. In addition, data will be processed until your request for erasure of personal data is granted.

Recipients of personal data:

• Your personal data will be shared with entities providing IT services to Facy (hosting and e-mail providers)
• Your personal data may be shared with entities providing accounting services to Facy
• If you choose registration via Google, some of your personal data (login/e-mail address) will be obtained from that provider. Those services will also receive information that you created an account on facy.ai or in the application and about your logins.

5. ELECTRONIC COMMUNICATION

Facy will process your personal data provided via electronic correspondence for communication purposes—primarily to identify the sender, reply to your questions and help resolve the matters raised. The legal basis is Facy's legitimate interest consisting of communication (Article 6(1)(f) GDPR).

Your personal data will be processed no longer than necessary to achieve the communication purposes, e.g., to resolve the matter raised. In addition, data will be processed until your objection to processing is granted.

Your personal data will be shared with entities providing IT services to Facy (hosting and e-mail providers). Your personal data may be shared with entities providing accounting services to Facy. In exceptional cases your personal data may be shared with courier or postal service providers and with legal service providers for Facy, if necessary.

Your personal data will be shared with the provider of the Telegram messenger, i.e. Telegram Messenger Inc. and its partners, if you decide to contact Facy via it.

Social media

Facy becomes the controller of personal data of users interacting with Facy profiles on Facebook, X and Reddit; however, those data are also controlled by the owners of those social networking sites. If you contact Facy via social media, Facy will receive your first and last name and photo as well as other information you provided on social media and set as visible. These data are shared in accordance with the privacy policies of the given site, and Facy has no influence over such sharing.

Facy will exercise your rights to the extent enabled by the operator of the given website. In the case of social media, your personal data will also be processed for as long as you follow the Facy profile. You may delete your comments under posts at any time, stop following Facy's profiles or close your account with the given website.

6. SENDING MARKETING INFORMATION

Facy may become the controller of e-mail addresses you provide to subscribe to the newsletter or other marketing communications containing information on promotions, products and services for sale or events, as well as for distributing customer satisfaction surveys.

The legal basis for processing these data is Facy's legitimate interest (Article 6(1)(f) GDPR) in promoting its own business. Personal data will be processed for this purpose until you unsubscribe from the newsletter.

Such information will be sent to you if you give consent required by law. Giving consent is voluntary. For the newsletter, consent is given by providing your e-mail address to receive the newsletter. In other cases, consent is expressed by ticking the relevant statement. You can withdraw your consent by unsubscribing from the newsletter. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Your personal data will be shared with entities providing IT and telecommunications services to Facy (hosting and e-mail providers).

7. CONCLUSION AND PERFORMANCE OF CONTRACTS WITH BUSINESS PARTNERS

Personal data will be processed by Facy for the term of the contract, and after it ends – for the period of limitation of claims arising from that contract and for the period required by law, in particular tax law.

Personal data may be transferred and disclosed to entities cooperating with Facy in achieving the purposes of data processing, in particular to providers of IT, telecommunications, accounting and legal services.

For persons involved in the conclusion and performance of a contract

Facy processes contact details, primarily first name, last name, position, business phone number, business e-mail address. The data were made available to Facy by the business partner (counterparty) because they are necessary to perform the contract concluded between those entities. Data of shareholders and persons representing the business partner (counterparty) may also be obtained (verified) from public sources (e.g. public registers).

Personal data are processed under Article 6(1)(f) GDPR to pursue Facy's legitimate interests consisting of:

• Communication with persons involved in performance of the contract on the part of the business partner (counterparty) to ensure proper performance of the contract
• Verification of correctness of the contract conclusion procedure
• Establishing, pursuing or defending possible claims arising from the contract

For business partners (counterparties) who are natural persons

Their personal data are processed under Article 6(1)(b) GDPR to perform the contract or to take steps at the request of the counterparty prior to entering into the contract. The data will be disclosed to entities providing accounting services to Facy and may also be disclosed to entities providing legal services to Facy.

8. ANALYSIS OF WEBSITE AND INTERNET TRAFFIC

As the data controller, Facy uses analytical tools provided by other entities to analyze user traffic and behavior on websites and to deliver tailored advertising. These tools and their providers are listed and described below.

Analytical tools used on Facy's website are activated after you give voluntary consent upon entering the website, based on Article 6(1)(a) GDPR.

You can give or withdraw consent at any time, including by:

• The cookie banner displayed on Facy's website
• Enabling, blocking or deleting cookies in your browser settings
• Using browser plugins designed for that purpose
• The website of European Interactive Digital Advertising Alliance ("opt-out") at the address https://www.youronlinechoices.com/pl/twojewybory

Providing data (giving consent) is voluntary. If you do not give consent, we will not take your store-usage preferences into account in our development work and we will not present you with tailored ads.

Google Analytics and Tag Manager

This website uses Google Analytics provided by Google Ireland Ltd. for analytical purposes. Google Analytics uses cookies installed on your device, which enable analysis of how you use our website. Facy uses Google Analytics to improve this website and the services provided by Facy. In addition, Facy obtains information on the functionality of this website, e.g., to diagnose and remove problems with its use. Google Tag Manager enables management of analytics using tags.

Google Analytics collects the following information about Users: unique advertising identifier, IP address, location, online activity (e.g., where the Facy User came from and which subpages they used). You can block data collection by Google Analytics at any time, e.g., by installing the browser add-on made available by Google.

Data collected via Google Analytics and Tag Manager are shared with Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland and its partners. Information generated by the cookie about your use of this website may be transferred to and stored on a Google server in the USA, on the basis of an adequacy decision under the so-called "EU-US Data Privacy Framework".

More information is available at the following websites:

• "How Google uses the data collected when using our partners' sites and apps" that can be found under the address https://policies.google.com/technologies/partner-sites
• General overview of Google Analytics security and privacy policies: https://support.google.com/analytics/answer/6004245?hl=en
• Google Privacy Policy: https://policies.google.com/privacy?hl=en

Hotjar

This website uses the Hotjar Ltd. analytics tool, with its registered office in Malta.

Hotjar is an analytics tool that helps Facy understand user behavior on this website. To this end, Hotjar collects mouse-movement data, records user sessions, conducts surveys and collects feedback, analyzes forms, content and multimedia content, and much more. A detailed list of the categories of personal data processed by Hotjar is available here.

This tool uses cookies, as described in Section 10 of this Policy.

Hotjar discloses personal data to the entities whose list is available here.

All information about Hotjar's collection and processing of data is set out in the Hotjar Privacy Policy.

9. WEBSITE BOT-PROTECTION MECHANISM (GOOGLE RECAPTCHA)

When you send information via forms used on facy.ai, we use the Google reCAPTCHA service.

Google reCAPTCHA operates via code embedded in the page (JavaScript) and by analyzing cookies saved on your device by other Google services. In this way it analyzes use of our site to identify bots and protect the site against abuses that may result, based on Article 6(1)(f) GDPR. The following information is analyzed: the website from which you arrived at our site, search terms used on that site if it has a search engine, your IP address to determine origin and operator, browser and its language settings, operating system, installed plug-ins and screen resolution, time spent on pages.

Data collected via Google reCAPTCHA are shared with Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland and its partners. Information about your use of this website, including your IP address, may be transferred to and stored on a Google server in the USA, on the basis of an adequacy decision under the so-called "EU-US Data Privacy Framework".

Data are deleted as soon as the purpose of collection is achieved, at the latest after 24 months.

More information on this topic can be found on the sites:

• "How Google uses the data collected when using our partners' sites and apps" that can be found under the address https://policies.google.com/technologies/partner-sites
• Google Privacy Policy: https://policies.google.com/privacy?hl=en

Facy becomes the controller of your personal data processed via Google reCAPTCHA; however, those data are also controlled by Google. Facy will exercise your rights to the extent allowed by Google.

You can also prevent collection of data related to your use of our site on your own by blocking JavaScript and cookies in your browser settings. This may, however, limit the functionality of our website, e.g., the ability to use forms.

10. COOKIES USED BY THE WEBSITE

This website uses cookies – text files containing IT data. Cookies are stored on the User's device. Cookies usually contain the name of the website they come from, the time of storage on the user's device and a unique number.

There are two types of cookies: session and persistent. Session cookies are temporary files stored on the User's device until they log out, leave the website or close the browser. Persistent cookies are stored on the User's device for the time specified in the cookie parameters or until the User deletes them.

The web browser usually allows cookies to be stored on the User's device by default. Users can change these settings. The web browser lets you delete cookies. It is also possible to automatically block cookies. Detailed information on this can be found in the help section of your browser. Disabling support for some cookies may hinder or prevent the use of this service.

The following cookies are used on the website:

11. IP NUMBERS AND SERVER LOGS USED BY THE WEBSITE

When using this website, information such as: IP address, request URL address, domain name, device identifier, browser type, browser language, number of clicks, time spent on specific pages, date and time of website use, operating system type and version, screen resolution, data collected in server logs and other similar information are collected. Resources viewed are identified by URL addresses. In addition, data such as: time of request arrival; time the response was sent; user station name – identified via the https protocol; information on errors that occurred during https transactions; URL address of the previously visited page if the transition to our website occurred via a link; information about the user's browser; information about the IP address may be recorded.

The above information is necessary for the operation of the website and may constitute personal data. They are processed based on Facy's legitimate interest (Article 6(1)(f) GDPR) consisting of communication and ensuring the proper functioning of this website.

Personal data will be processed by Facy for the period necessary to achieve these purposes. Logs are deleted 60 days after their creation.

Personal data may be transferred and disclosed to entities providing IT services for Facy, in particular hosting.

---