Privacy Policy

Contents

1. Who We Are and How to Contact Us
2. Scope of This Privacy Policy
3. Layered Notices and Just-in-Time Disclosures
4. Glossary of Defined Terms
5. Personal Data We Collect 5.1 Account registration and authentication 5.2 Profile and identity data 5.3 Subscription, billing, and payment data 5.4 Mission system data 5.5 Ranking and progression data 5.6 Community and social features 5.7 Map and territory features 5.8 Academy content data 5.9 Dashboard and analytics data 5.10 Customer support and communications 5.11 Marketing data 5.12 Automated technical data 5.13 Cookies and tracking technologies 5.14 Information from third parties 5.15 Special category and sensitive data 5.16 Children’s data
6. Purposes of Processing and Legal Bases
7. Profiling and Automated Decision-Making
8. Recipients of Personal Data and Subprocessors
9. International Data Transfers
10. Data Retention
11. Data Security
12. Data Breach Notification
13. Your Rights as a Data Subject
14. How to Exercise Your Rights
15. Slovak Supervisory Authority and Complaints
16. United Kingdom GDPR
17. California Residents — CCPA/CPRA Notice
18. Other US State Privacy Laws
19. Other Jurisdictions
20. Children’s Privacy
21. Marketing Communications
22. Account Suspension, Closure, and Deletion
23. Government and Law Enforcement Requests
24. Data Protection Impact Assessments
25. Accountability and Governance
26. Third-Party Links and Integrations
27. Changes to This Privacy Policy
28. Language Versions
29. Contact Us

Introduction This Privacy Policy describes how [FULL LEGAL ENTITY NAME OF TQK OPERATOR] (“TQK,” “we,” “us,” or “our”) collects, uses, discloses, transfers, and protects personal data when you visit our website, create an account, use our application, subscribe to our paid services, participate in our community features, contact our support team, attend any event we host, or otherwise interact with TQK or any service operated by us. This Privacy Policy applies to all individuals who interact with TQK, including visitors, registered users, paid subscribers, founders, administrators, prospective customers, and individuals whose personal data we receive from third parties. Capitalised terms not defined here have the meaning given to them in our Terms of Service. We process personal data in accordance with applicable data protection laws, including: Regulation (EU) 2016/679 (General Data Protection Regulation, or “GDPR”); Slovak Act No. 18/2018 Coll. on the Protection of Personal Data, as amended; Directive 2002/58/EC (the e-Privacy Directive) and Slovak Act No. 452/2021 Coll. on Electronic Communications, as amended; The United Kingdom General Data Protection Regulation (“UK GDPR”) and the UK Data Protection Act 2018, where applicable; The California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), where applicable; Other US state, federal, and international privacy laws applicable to our processing.

1. Who We Are and How to Contact Us The data controller responsible for the processing of your personal data under this Privacy Policy is: [FULL LEGAL ENTITY NAME, INCLUDING LEGAL FORM (e.g., s.r.o., a.s., or sole trader name)] [REGISTERED ADDRESS, INCLUDING STREET, CITY, POSTAL CODE, AND COUNTRY] Company Registration Number (IČO): [NUMBER] Tax Identification Number (DIČ): [NUMBER] VAT Identification Number (IC DPH), if applicable: [NUMBER] Commercial Register entry: [SECTION, INSERT NUMBER, COURT] General contact email: [hello@tqk.example] Privacy enquiries email: [privacy@tqk.example] Customer support email: [support@tqk.example] If we have appointed a Data Protection Officer (DPO), their contact details are below. The DPO is responsible for overseeing our data protection compliance and serves as a contact point for data subjects and the Slovak supervisory authority: [DPO NAME / DPO EMAIL — OR REMOVE THIS PARAGRAPH IF NO DPO IS APPOINTED] If we have appointed an EU representative under Article 27 of the GDPR (only required where the controller is established outside the EEA but processes the personal data of EEA residents), their contact details are below: [EU REPRESENTATIVE NAME, ADDRESS, AND CONTACT — OR REMOVE IF NOT APPLICABLE] If we have appointed a UK representative under Article 27 of the UK GDPR, their contact details are: [UK REPRESENTATIVE NAME, ADDRESS, AND CONTACT — OR REMOVE IF NOT APPLICABLE]
2. Scope of This Privacy Policy This Privacy Policy applies to: Our website and any subdomains we operate; Our mobile and desktop applications, regardless of distribution channel; The TQK dashboard, missions system, ranking and progression system, community rooms, academy area, map and territory features, leaderboards, founder programme, and any other features offered through our platform; Communications between you and TQK, including support requests, transactional emails, in-app messages, push notifications, and surveys; Marketing and promotional activities operated by TQK, including newsletters, social media interactions managed by us, and paid advertising where we are the controller; Any in-person events, meetups, or workshops organised or hosted by TQK, where applicable. This Privacy Policy does not apply to the practices of third-party websites, applications, or services that are linked from our platform or that you access independently. Where we operate a presence on a third-party platform (such as social media accounts), the platform operator may also act as a controller for some of your personal data.
3. Layered Notices and Just-in-Time Disclosures This Privacy Policy is the comprehensive description of our personal data processing activities. In addition, we may provide you with shorter, just-in-time notices at the moment we collect specific personal data, for example when you: Register an account or upgrade to a paid plan; Submit a mission, post in a community room, or participate in the map or territory features; Provide identity verification or payment information; Contact customer support. Just-in-time notices supplement but do not replace this Privacy Policy. Where there is a conflict between a just-in-time notice and this Privacy Policy in respect of a specific processing activity, the more specific notice will prevail for that activity.
4. Glossary of Defined Terms The following definitions apply throughout this Privacy Policy. Where capitalised terms are used but not defined in this glossary, they have the meaning given to them in the GDPR or in our Terms of Service. “Anonymisation” means the irreversible process by which personal data is rendered such that a data subject is no longer identifiable, so that the resulting data is no longer personal data. “Binding Corporate Rules” means internal rules adopted by a multinational group of undertakings that have been approved by a competent supervisory authority and that govern transfers of personal data within that group. “CCPA/CPRA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 and any implementing regulations. “Consent” means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she signifies agreement to the processing of personal data, by a statement or by a clear affirmative action. “Controller” means the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data. “Cookie” means a small text file placed on your device by a website or app that may store information about your activity. See our Cookie Policy for further detail. “Data Subject” means an identified or identifiable natural person to whom personal data relates. “EEA” means the European Economic Area, comprising the EU Member States together with Iceland, Liechtenstein, and Norway. “e-Privacy Rules” means Directive 2002/58/EC and any national legislation transposing or implementing it, including Slovak Act No. 452/2021 Coll. on Electronic Communications, as amended. “Founder” means a user who holds a founder-tier subscription or access designation within TQK as offered from time to time. “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. “Joint Controllers” means two or more controllers that jointly determine the purposes and means of processing under Article 26 of the GDPR. “Personal Data” means any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the GDPR. “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed. “Processing” means any operation or set of operations performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction. “Processor” means a natural or legal person which processes personal data on behalf of the controller. “Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person’s performance, behaviour, interests, or location. “Pseudonymisation” means the processing of personal data in such a manner that the data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures. “Schrems II” means the judgment of the Court of Justice of the European Union of 16 July 2020 in Case C-311/18, which set out conditions for international transfers of personal data outside the EEA. “Special Category Data” means the categories of personal data listed in Article 9(1) of the GDPR, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a natural person’s sex life or sexual orientation. “Standard Contractual Clauses (SCCs)” means the standard contractual clauses for the transfer of personal data to third countries, as adopted by the European Commission in Decision (EU) 2021/914 of 4 June 2021. “Subprocessor” means a third party engaged by a processor to process personal data on behalf of the controller. “Supervisory Authority” means an independent public authority established by a Member State pursuant to Article 51 of the GDPR. The Slovak supervisory authority is the Office for Personal Data Protection of the Slovak Republic. “Supplementary Measures” means additional technical, contractual, or organisational measures applied to international transfers of personal data following the Schrems II judgment, where the laws of the destination country may not provide an adequate level of protection. “Third Country” means a country outside the EEA. “UK GDPR” means the United Kingdom General Data Protection Regulation, being the GDPR as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, together with the UK Data Protection Act 2018. “User” means any individual who accesses or uses the TQK platform, whether on a free, founder, paid, or any other access basis.
5. Personal Data We Collect We collect personal data from three principal sources: (i) information you provide directly to us; (ii) information we collect automatically when you interact with TQK; and (iii) information we receive from third parties. We organise the categories below by the feature or context in which the data is collected, so that you can see exactly what is processed and when. 5.1 Account registration and authentication When you create or access an account, we collect: Full name or display name; username or player handle; Email address; Password (stored only as a salted hash; we never store passwords in plain text); Authentication tokens, session identifiers, and “remember me” tokens; Multi-factor authentication credentials, if you enable them, including phone numbers used for SMS-based MFA or recovery; Account recovery information (such as security questions or backup email addresses); Account creation timestamp, login history, login source IP address, and login device fingerprint. 5.2 Profile and identity data To populate your TQK profile, you may provide: Profile photo or avatar; Biographical text, goals, interests, hobbies, and self-description; Country, region, city, and time zone; Pronouns or other identifiers, if you choose to provide them; Social or external links you choose to add to your profile; Your visibility preferences and any custom display settings. Profile data is, by design, visible to other users to varying degrees depending on the relevant feature and your settings. See Section 8.2. 5.3 Subscription, billing, and payment data If you purchase a subscription, we and our payment processor collect: Billing name and billing address; Country, currency, language, and tax residency information necessary to apply correct VAT or other taxes; Partial payment card details, including the last four digits, card brand, expiry date, and country of issuance; Subscription tier (including founder, paid, or free), start date, renewal date, payment status, and transaction history; Invoice records, refund records, and chargeback or dispute records; Fraud signals returned by our payment processor. We do not store full payment card numbers or card verification values. Full card data is processed and stored by our payment processor under their own controllership for fraud prevention purposes and under processorship for transaction completion on our behalf. 5.4 Mission system data As part of the missions feature, we process: Missions you start, complete, abandon, or repeat; Mission completion timestamps and any associated metadata; Mission proofs, submissions, photos, text reflections, audio, video, or files you submit; Mission reviews, ratings, comments, or peer-feedback you provide or receive; Streaks, completion counts, and other derived performance signals. Where missions invite you to record information about your habits, goals, or self-improvement activities, the content you submit may be sensitive in nature. We do not categorise this content as special category data within the meaning of Article 9 of the GDPR by default; however, you should not include special category data (such as health information or political beliefs) in mission submissions unless you are comfortable doing so. If you do, we rely on Article 9(2)(a) GDPR (your explicit consent inferred from voluntary submission for the purpose of using the relevant feature) and process such data only for that purpose. 5.5 Ranking and progression data To operate the ranking, levelling, and progression system, we process: Your current rank, level, points, achievements, and badges; Historical rank progression and performance signals; Leaderboard placement and visibility; Comparative performance data within community spaces, if those features are enabled. This processing constitutes profiling within the meaning of Article 4(4) of the GDPR. See Section 7. 5.6 Community and social features In community rooms, forums, chats, and other social features, we process: Posts, comments, replies, and reactions; Direct messages and group messages; Membership of rooms, groups, or sub-communities; Reports, flags, blocks, and moderation actions you submit or are subject to; Mentions, tags, and references to or by other users. Content you post in community spaces is visible to other users in those spaces in accordance with the privacy settings of each space. Some content (for example public mission completions or leaderboard entries) may be visible to all users by default. 5.7 Map and territory features If TQK includes map or territory features that involve geographic location: We may collect approximate location derived from IP address; If a feature requires precise location, we will request the relevant operating-system permission and collect device-level location only while that permission is granted and the feature is in use; We may process territory or region designations you choose, claim, or are assigned within the platform; We may process metadata about your participation in territory-based features, including timestamps and territory-level activity counts. [REVIEWER NOTE: If TQK does not collect precise GPS or device-level location at all, this section should be reduced to clarify that only approximate IP-derived location is processed. If TQK does collect precise location, the section must be expanded to specify retention, sharing, and how to revoke permission.] 5.8 Academy content data In connection with the academy area, we process: Lessons, modules, or courses you access, start, or complete; Time spent on lessons, content interactions, and quiz or assessment results; Notes, bookmarks, or highlights you create. 5.9 Dashboard and analytics data Your dashboard may aggregate and display: Activity and progression summaries derived from the data above; Personal trends, streaks, and milestones; Notifications and reminders you have configured. 5.10 Customer support and communications When you contact us or we contact you, we process: The contents of your communications, including emails, support tickets, in-app messages, and any attachments; Records of telephone calls or video calls, where applicable and disclosed at the time; Survey responses and feedback; Communication metadata such as timestamps, channels, and case identifiers. 5.11 Marketing data If you opt in to marketing communications or otherwise interact with our marketing, we may process: Marketing consent records, including timestamps, sources, and the specific consent given; Email engagement signals such as opens and clicks; Campaign and referral source attribution; Information you provide to enter promotions or contests. 5.12 Automated technical data When you use TQK, we and our service providers automatically collect: IP address (truncated where feasible for analytics purposes); Device type, model, operating system, and version; Browser type and version, language, and time zone; Screen resolution and viewport size; Mobile network operator (where relevant); Pages and screens viewed, sequence of navigation, and feature interactions; Click and tap events, scroll events, and form completion patterns; Session start and end timestamps and session duration; Referring URL or installation source; Diagnostic data, error reports, and crash logs. 5.13 Cookies and tracking technologies We use cookies, pixels, local storage, software development kits, and similar technologies. The full description of these technologies, their purposes, durations, and providers, is set out in our separate Cookie Policy, which forms an integral part of this Privacy Policy. 5.14 Information from third parties We may receive personal data about you from: Payment processors (such as Stripe), who provide transaction confirmations, subscription status, fraud signals, and dispute information; Authentication providers, where you choose to log in via a third-party identity service; Analytics, performance monitoring, and error tracking providers; Hosting and infrastructure providers, in the form of operational logs; Email and notification providers, in the form of delivery and engagement metadata; Customer support and ticketing tools; Marketing and advertising partners, where you have consented; Other users who refer you to TQK or who tag, mention, or report you; Public sources, where lawful (for example, where we receive a chargeback notice from a card scheme that includes information about you); Government, regulatory, or law-enforcement authorities, where applicable. 5.15 Special category and sensitive data TQK does not deliberately request, collect, or process special category data (Article 9 GDPR) or sensitive personal information (CPRA) for the operation of the platform. We strongly recommend that you do not include special category data in your profile, mission submissions, posts, or messages. If you voluntarily share special category data through user-generated content or communications, you do so on your own initiative. To the extent we then host or otherwise process that data for the purpose of operating the feature you used, we rely on Article 9(2)(a) of the GDPR (your explicit consent inferred from your voluntary submission and continued use of the feature) or, where applicable, Article 9(2)(e) (data manifestly made public by you). You may withdraw consent at any time by deleting the relevant content or your account. Biometric data. We do not collect, process, or store biometric identifiers or biometric information for the purpose of uniquely identifying a natural person within the meaning of Article 9(1) GDPR or under sectoral US laws such as the Illinois Biometric Information Privacy Act (BIPA), the Texas CUBI, or the Washington Biometric Privacy Act. Where you upload photographs, audio, or video through profile, mission, or community features, we process those media solely for the purpose of operating the relevant feature; we do not run facial recognition, voiceprint analysis, fingerprint matching, gait analysis, or any other biometric identification or biometric profiling on that content. If we ever introduce a feature that would involve biometric processing, we will update this Privacy Policy, obtain your explicit consent under Article 9(2)(a) GDPR (and any specific consent required under applicable US biometric laws) before that processing begins, and provide a separate notice describing the purpose, retention, and your rights in respect of the biometric data. 5.16 Children’s data TQK is not directed at and is not intended for use by children under the age of 16. We do not knowingly collect personal data from children under 16. See Section 20 for further detail.
6. Purposes of Processing and Legal Bases We process personal data only where we have a lawful basis for doing so under Article 6 GDPR (and, where special category data is involved, Article 9 GDPR). The table below summarises the principal purposes, the categories of personal data involved, and the relevant legal basis. Where we rely on legitimate interests, we have carried out a balancing exercise; you may request information about it by contacting us. 6.1 Account creation, authentication, and service delivery We process registration data, profile data, mission data, ranking data, community data, dashboard data, academy data, and technical data to create your account, authenticate you, deliver the service, and operate the features described in our Terms of Service. Legal basis: Performance of a contract with you (Article 6(1)(b) GDPR). Pre-contractual processing necessary to take steps at your request before entering into a contract is also covered by Article 6(1)(b). 6.2 Subscription billing and tax compliance We process billing data, subscription data, and transaction data to process payments, manage renewals, issue invoices, calculate and collect applicable taxes, and process refunds. Legal basis: Performance of a contract (Article 6(1)(b) GDPR) for the payment processing element; compliance with legal obligations (Article 6(1)(c) GDPR), including Slovak accounting and tax law, for invoice retention and reporting. 6.3 Service-related communications We send transactional emails, security alerts, payment receipts, policy update notifications, and other service-related messages. Legal basis: Performance of a contract (Article 6(1)(b) GDPR); compliance with legal obligations (Article 6(1)(c) GDPR) where required. 6.4 Marketing communications and promotion We send marketing communications about TQK products, features, and offers, including newsletters and promotional emails. Legal basis: Consent under Article 6(1)(a) GDPR and the Slovak transposition of the e-Privacy Directive for prospects and new contacts; legitimate interests under Article 6(1)(f) GDPR for direct marketing to existing customers in respect of similar products or services (the “soft opt-in”), subject to your right to object at any time. You can unsubscribe via the link in any marketing email or by contacting us. 6.5 Personalisation, ranks, missions, and progression We process activity, mission, and ranking data to operate the gamified progression that is core to TQK, recommend missions, surface relevant content, and present leaderboards. Legal basis: Performance of a contract (Article 6(1)(b) GDPR), because the progression system is an integral part of the contracted service; legitimate interests in providing a relevant and engaging product (Article 6(1)(f) GDPR). 6.6 Analytics, research, and product improvement We analyse aggregate and individual usage to measure performance, identify product issues, prioritise improvements, and conduct research. Legal basis: Legitimate interests in understanding and improving our service (Article 6(1)(f) GDPR); consent under Article 6(1)(a) GDPR for non-essential analytics cookies and similar technologies, where required by the e-Privacy Rules. 6.7 Security, fraud prevention, abuse prevention, and rule enforcement We process technical, account, and transaction data to detect and prevent fraud, abuse, account takeover, payment-related fraud, scraping, and violations of our Terms of Service or community rules; to investigate reports and disputes; and to enforce our agreements. Legal basis: Legitimate interests in protecting the platform, users, and our business (Article 6(1)(f) GDPR); compliance with legal obligations (Article 6(1)(c) GDPR), including anti-money-laundering and consumer protection laws, where applicable. 6.8 Legal, regulatory, and tax compliance We process personal data as necessary to comply with legal, regulatory, accounting, and tax obligations to which we are subject. Legal basis: Compliance with legal obligations (Article 6(1)(c) GDPR). 6.9 Disputes and legal claims We process personal data to investigate and respond to complaints, disputes, regulatory enquiries, and legal claims, and to establish, exercise, or defend legal claims. Legal basis: Legitimate interests (Article 6(1)(f) GDPR); Article 9(2)(f) GDPR for special category data, where applicable. 6.10 Corporate transactions We may process personal data in connection with a merger, acquisition, financing, restructuring, insolvency, sale of assets, or similar transaction. Disclosure to counterparties or successors will be subject to confidentiality and applicable law, and we will notify users of any change in the controllership of their personal data where required. Legal basis: Legitimate interests in conducting and developing the business (Article 6(1)(f) GDPR). 6.11 Other purposes with your consent Where we ask for your specific consent for a purpose disclosed at the time, we process the relevant personal data on the basis of that consent. Legal basis: Consent (Article 6(1)(a) GDPR), which you may withdraw at any time without affecting the lawfulness of prior processing.
7. Profiling and Automated Decision-Making The TQK platform includes systems that score, rank, and progress users based on their participation, mission completion, and other in-platform activity. This activity-based ranking and recommendation constitutes profiling within the meaning of Article 4(4) of the GDPR. The profiling we carry out is limited to operational, gamified, and personalisation purposes. Algorithmic and machine-learning systems. The systems we use to operate ranking, mission recommendations, dashboard personalisation, leaderboard placement, spam and abuse detection, and content moderation may include rules-based algorithms, statistical models, and machine-learning systems (collectively, “algorithmic systems”). The categories of personal data processed by these algorithmic systems are those described in Section 5; the purposes are those described in Section 6. We do not use the personal data of users to train general-purpose or publicly available generative artificial intelligence models. Where we use third-party AI or machine-learning services in our processing, we do so under processor or service-provider agreements that prohibit those providers from using your personal data to train their own foundation models, except where we have separately disclosed and obtained your consent. Ranks, progression status, and recommendations affect only your standing, content recommendations, and visibility within the TQK community. They do not produce legal effects concerning you and are not, in our assessment, similarly significant within the meaning of Article 22 of the GDPR. We do not use solely automated decision-making to take decisions that have legal or similarly significant effects on you (such as denying access to a paid feature you have lawfully purchased, terminating your account without human review, or determining your eligibility for a credit or insurance product). Where we apply automated tools to detect fraud, abuse, or rule violations, the outcome of such automated review is in all material cases reviewed by a human before any final decision is made that significantly affects you. If we ever introduce solely automated decision-making with legal or similarly significant effects, we will update this Privacy Policy and provide the rights required by Article 22(3) of the GDPR, including the right to obtain human intervention, to express your point of view, and to contest the decision. You have the right at any time, on grounds relating to your particular situation, to object to profiling that is based on legitimate interests under Article 21(1) of the GDPR. If you do, we will cease the relevant profiling unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where the processing is necessary for the establishment, exercise, or defence of legal claims. Where profiling is necessary for the performance of the contract you have with us (for example, the operation of the gamified mission, ranking, and progression system that is the contracted service), opting out of that profiling will require you to close your account; we will of course assist you with that closure on request. Where US state privacy law gives you the right to opt out of profiling that produces legal or similarly significant effects, we honour that right in the manner described in Section 18.
8. Recipients of Personal Data and Subprocessors 8.1 Categories of recipient We share personal data with the following categories of recipients, only where necessary for the purposes set out in Section 6 and under appropriate contractual safeguards: Cloud hosting and infrastructure providers; Database, storage, and content delivery network providers; Payment processors and fraud-prevention vendors; Email, transactional messaging, and push notification providers; Customer support and ticketing tools; Analytics, error monitoring, and product analytics providers; Authentication and identity providers; Security, anti-spam, and bot mitigation vendors; Tax, accounting, and audit providers; Legal advisers and other professional service providers; Marketing and advertising platforms, only with your consent or under legitimate interests where lawful; Government, regulatory, or law-enforcement authorities, where required; Acquirers, successors, or counterparties in a corporate transaction, subject to confidentiality. 8.2 Disclosure to other users Certain personal data is shared with other TQK users by design, in connection with the social and community nature of the platform. This includes: Display name, profile photo or avatar, and bio shown on your public profile; Rank, progression, achievements, and selected activity displayed in leaderboards or community feeds; Posts, comments, messages, and other content you share in community spaces according to the visibility setting of those spaces; Participation in shared map or territory features. Where features include direct messaging or private group messaging, your messages are visible to the recipient(s) you select. We are not able to recall messages you send to other users, although we may delete content from our systems in accordance with this Privacy Policy or applicable law. You should not share information you are not comfortable making visible to other users. 8.3 Subprocessor list We engage processors and subprocessors to support the operation of TQK. The current named list, including the categories of personal data they process and the country in which they primarily process data, is set out below. We update this list from time to time. Provider name Service category Personal data processed Country of processing Transfer mechanism (if outside EEA) [INSERT — e.g., Amazon Web Services] Cloud hosting / infrastructure All categories (encrypted) [INSERT — e.g., Ireland / Germany] [N/A or SCCs] [INSERT — e.g., Stripe] Payment processing Billing, payment, fraud signals [INSERT — e.g., Ireland / United States] SCCs and supplementary measures [INSERT — e.g., SendGrid / Postmark] Transactional email Email address, message content [INSERT] [INSERT] [INSERT — e.g., Cloudflare] CDN, DDoS protection, bot mitigation IP address, request metadata [INSERT] [INSERT] [INSERT — e.g., Sentry] Error monitoring Diagnostic data, partial user identifiers [INSERT] [INSERT] [INSERT — e.g., Mixpanel / PostHog] Product analytics Usage events, pseudonymised identifiers [INSERT] [INSERT] [INSERT — e.g., Intercom / Crisp] Customer support Communications, account identifiers [INSERT] [INSERT] [INSERT] [INSERT] [INSERT] [INSERT] [INSERT]

Where you require a copy of the data processing agreement with any subprocessor, contact us using the details in Section 1. We make commercially reasonable efforts to ensure that all subprocessors offer sufficient guarantees of compliance with applicable data protection laws. 8.4 No sale or sharing of personal data for cross-context behavioural advertising We do not sell personal data in exchange for monetary or other valuable consideration. We do not share personal data for cross-context behavioural advertising as defined under the CPRA. We do not knowingly sell or share personal data of users below the applicable minimum age threshold. 9. International Data Transfers TQK operates internationally, and your personal data may be transferred to and processed in countries outside the EEA, the United Kingdom, or your country of residence, including in countries that may not provide an equivalent level of data protection. We rely on one or more of the following safeguards for any such transfers: Adequacy decisions adopted by the European Commission (or, where applicable, the UK Government), in respect of countries that have been determined to provide an adequate level of data protection. This includes, where transfers fall within its scope, the EU-U.S. Data Privacy Framework adopted by Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 in respect of certified U.S. organisations, and the UK Extension to the EU-U.S. Data Privacy Framework where the UK GDPR applies; Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 of 4 June 2021, and, where the UK GDPR applies, the UK International Data Transfer Addendum or the UK International Data Transfer Agreement; Binding Corporate Rules approved by a competent supervisory authority, where applicable; Other lawful transfer mechanisms permitted under Article 46 of the GDPR; Derogations under Article 49 of the GDPR (such as your explicit consent to the proposed transfer, after being informed of the possible risks), where appropriate and lawful for the specific transfer. Following the judgment of the Court of Justice of the European Union of 16 July 2020 in Case C-311/18 (Schrems II), we conduct transfer impact assessments for transfers to third countries that lack an adequacy decision, and we apply supplementary measures (technical, contractual, and organisational) where reasonably required to ensure that the transferred personal data continues to receive a level of protection essentially equivalent to that within the EEA. Supplementary measures we apply may include encryption with keys held within the EEA, pseudonymisation, contractual commitments to challenge unlawful access requests, and policies for handling government data access requests. Where we transfer personal data to a U.S.-based service provider that participates in the EU-U.S. Data Privacy Framework (or the UK Extension thereto, or the Swiss-U.S. Data Privacy Framework), we monitor the continued certification of that service provider on the official Data Privacy Framework List maintained at www.dataprivacyframework.gov. If a relevant participant’s certification lapses, is withdrawn, or the underlying adequacy decision is annulled, suspended, or invalidated, we treat onward transfers to that participant as transfers to a third country without an adequacy decision and apply Standard Contractual Clauses together with appropriate supplementary measures pending resolution. You may request a copy of the safeguards we rely on for any specific transfer by contacting us using the details in Section 1. 10. Data Retention We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, audit, dispute-resolution, or reporting obligations. The retention periods below are indicative and may be adjusted where retention for a longer period is required by law or where retention for a shorter period is appropriate. Data category Retention period Rationale Account profile data (active) Duration of account + up to 12 months post-closure Operating the service; backup; account recovery; dispute resolution Authentication logs and session data Up to 24 months Security, fraud prevention, abuse detection Mission, ranking, and progression data Duration of account + up to 12 months post-closure Service delivery; progression continuity; dispute resolution Community posts and messages Until user deletes the content or account is closed; backups up to 12 months Service delivery; community continuity Direct messages Until user or recipient deletes; backups up to 12 months Communication delivery Billing, invoice, and tax records 10 years from the end of the relevant accounting period Slovak tax and accounting law Payment transaction logs and fraud signals Up to 7 years Anti-fraud, chargeback handling, regulatory compliance Marketing consent records Until consent is withdrawn + up to 5 years Demonstrating consent under GDPR Article 7(1) Email engagement signals (opens, clicks) Up to 24 months Marketing analytics; deliverability Customer support correspondence Up to 36 months from last interaction Quality, dispute resolution, training Security logs and incident records Up to 24 months; longer where investigation continues Security incident management; regulatory cooperation DPIA, audit, and accountability records Up to 7 years GDPR Article 5(2) (accountability) Cookies and similar technologies As set out in our Cookie Policy Per technology and provider

Where personal data is no longer required for the purpose for which it was collected, we delete, anonymise, or aggregate it in accordance with our retention schedule and applicable law. Where deletion from active systems has occurred but data remains in routine backups, we ensure that the data will not be accessed or used other than for the purpose of restoring the systems and that it will be deleted in line with backup rotation schedules. Exceptions to retention periods. The retention periods set out above are subject to the following exceptions, in which case we may retain the relevant personal data for longer than the stated period: (i) where a longer retention period is required or permitted by law; (ii) where the data is the subject of an actual or reasonably anticipated legal claim, regulatory investigation, audit, or dispute (a “legal hold”), in which case we suspend deletion of the relevant data until the matter is resolved and the legal hold is lifted; (iii) where retention is necessary for the establishment, exercise, or defence of our legal rights; (iv) where retention is necessary to comply with a binding instruction from a competent court or supervisory authority; or (v) where the data has been irreversibly anonymised, in which case it is no longer personal data and is not subject to this Privacy Policy. 11. Data Security We implement appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage, taking into account the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. Our measures include: 11.1 Technical measures Encryption of data in transit using industry-standard protocols (TLS 1.2 or higher); Encryption of sensitive data at rest using industry-standard algorithms; Hashing of passwords using algorithms designed for password storage; Hardened production infrastructure provided by reputable hosting providers; Network-level isolation, firewalls, and security group controls; Continuous monitoring, logging, and alerting of security-relevant events; Regular patching and dependency management; Backups stored with appropriate access controls and tested for recoverability. 11.2 Organisational measures Role-based access control and the principle of least privilege for personnel and contractors; Multi-factor authentication required for administrative access to systems containing personal data; Confidentiality obligations binding on all personnel and contractors with access to personal data; Mandatory training for personnel handling personal data, with refreshers as appropriate; Vendor due diligence and data processing agreements with subprocessors; Documented incident response and breach notification procedures; Periodic review of our security practices and risk assessments. 11.3 Your role in security Security is a shared responsibility. You are responsible for keeping your account credentials confidential, using a unique strong password, enabling multi-factor authentication where offered, keeping your devices secure and up to date, and notifying us promptly of any suspected unauthorised use of your account. No system can be guaranteed to be completely secure. While we apply the measures described above, we cannot guarantee absolute security and we expressly disclaim any such guarantee to the extent permitted by law. 12. Data Breach Notification In the event of a personal data breach, we will: Investigate and contain the breach without undue delay; Where the breach is likely to result in a risk to the rights and freedoms of natural persons, notify the competent supervisory authority (the Slovak Office for Personal Data Protection or another lead authority, as applicable) without undue delay and, where feasible, within 72 hours of becoming aware of it, in accordance with Article 33 of the GDPR; Where the breach is likely to result in a high risk to the rights and freedoms of natural persons, notify the affected data subjects without undue delay, in accordance with Article 34 of the GDPR; Document the breach, our response, and any remedial measures, in accordance with Article 33(5) of the GDPR; Cooperate with the supervisory authority and any affected data subjects to address the breach and mitigate harm. Where we are required to notify you of a personal data breach under Article 34 GDPR, US state breach-notification laws, or any other applicable law, our notification will (in plain language and to the extent we are required to provide it): describe the nature of the breach; identify the categories and approximate number of data subjects and personal data records concerned; communicate the name and contact details of our Data Protection Officer or other contact point from whom further information can be obtained; describe the likely consequences of the breach; and describe the measures we have taken or propose to take to address the breach, including, where appropriate, measures to mitigate possible adverse effects. We will deliver such notification by email to your registered address or, where that is not feasible, by another channel reasonably calculated to reach you (for example, in-app notification or a prominent posting on our website). 13. Your Rights as a Data Subject Subject to the conditions set out in applicable data protection laws, you have the following rights: Right of access (Article 15 GDPR): to obtain confirmation of whether we process your personal data and, if so, to receive a copy of that data and information about the processing; Right to rectification (Article 16 GDPR): to have inaccurate or incomplete personal data corrected without undue delay; Right to erasure (Article 17 GDPR): to request deletion of your personal data in certain circumstances, including where the data is no longer necessary, where you withdraw consent, where you object to processing and there are no overriding legitimate grounds, or where the data has been unlawfully processed; Right to restriction of processing (Article 18 GDPR): to limit how we process your personal data in certain circumstances; Right to object (Article 21 GDPR): to object to processing based on legitimate interests, including profiling; you have an absolute right to object to direct marketing; Right to data portability (Article 20 GDPR): to receive personal data you have provided to us in a structured, commonly used, and machine-readable format and to transmit it to another controller, where technically feasible and where the processing is based on consent or contract; Right to withdraw consent (Article 7(3) GDPR): where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal; Right not to be subject to a solely automated decision (Article 22 GDPR): with legal or similarly significant effects, where applicable; Right to lodge a complaint (Article 77 GDPR): with the Slovak supervisory authority or another competent supervisory authority. 14. How to Exercise Your Rights To exercise any of the rights described in Section 13, please contact us using the details in Section 1. To help us respond to your request: Identify yourself and the account or accounts that your request relates to; Specify the right or rights you wish to exercise; Provide any details that will help us understand the scope of your request; Where you act on behalf of another person, provide evidence of your authority to act. We may need to verify your identity before responding to ensure that we do not disclose personal data to anyone other than the data subject. Verification typically involves confirming control of the registered account email or providing other reasonable identifying information. We will respond to requests without undue delay and in any event within one month of receipt. Where requests are complex or numerous, we may extend the response period by up to two further months and will inform you of any such extension and the reasons for it within one month of receipt. We do not charge a fee for handling rights requests, unless requests are manifestly unfounded or excessive (in particular because of their repetitive character), in which case we may either charge a reasonable fee or refuse to act on the request. If we are unable to fulfil your request, we will explain why and inform you of your right to lodge a complaint with the supervisory authority. Right of appeal. If we decline, in whole or in part, to take action on your request, you may appeal that decision within a reasonable time after receiving our response. To appeal, contact us using the details in Section 1 with the subject line “Privacy Rights Appeal” and include the reference number we provided with our original response (where applicable), the original request, and the reasons you believe our response was incorrect. We will respond in writing to your appeal within sixty (60) days of receipt, or such shorter period as may be required by the law of your jurisdiction (for example, forty-five (45) days under the Colorado Privacy Act, Connecticut Data Privacy Act, and Virginia Consumer Data Protection Act). If we deny your appeal, we will provide you with the contact information for the supervisory authority or attorney general competent to receive a further complaint. Authorised agents. You may designate an authorised agent to submit a request on your behalf. We may require the agent to provide written, signed authorisation from you, may require you to verify your identity directly with us, and may require you to confirm directly that you have provided the agent with permission to submit the request, in accordance with 11 CCR § 7063 (California) and equivalent provisions in other jurisdictions. We may deny a request from an agent that does not submit proof that they have been authorised by you to act on your behalf. 15. Slovak Supervisory Authority and Complaints If you are in Slovakia, you have the right to lodge a complaint with the Slovak supervisory authority: Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky) Hrašovská 4826/14, 821 04 Bratislava, Slovak Republic Telephone: +421 2 32 31 32 14 | Email: statny.dozor@pdp.gov.sk Website: www.dataprotection.gov.sk If you are in another EEA country, you may also lodge a complaint with the supervisory authority of your habitual residence, place of work, or place of an alleged infringement. 16. United Kingdom GDPR Where your personal data is processed in connection with the offering of goods or services to you in the United Kingdom, or in connection with monitoring your behaviour in the United Kingdom, the UK GDPR and the UK Data Protection Act 2018 apply in addition to or instead of the GDPR. References to the GDPR in this Privacy Policy should be read as including the UK GDPR where applicable. Complaints in respect of UK GDPR processing may be made to: Information Commissioner’s Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom Telephone: +44 303 123 1113 | Website: www.ico.org.uk 17. California Residents — CCPA/CPRA Notice If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you specific rights regarding your personal information. 17.1 Categories collected, sources, purposes, and disclosures The categories of personal information we collect, the sources of that information, the purposes of collection, and the categories of recipients are described in Sections 5, 6, and 8 of this Privacy Policy. The categories of personal information we have collected in the preceding 12 months map to the following CCPA categories: Identifiers (e.g., name, email, IP address, account identifier); Customer records (e.g., billing data); Commercial information (e.g., subscription tier, transaction history); Internet or other electronic network activity (e.g., usage events, cookies); Geolocation data (approximate, derived from IP); Audio, electronic, visual, or similar information (e.g., profile photo, mission proofs); Inferences drawn from the above (e.g., interest categories for personalisation). 17.2 Sale and sharing We do not sell personal information for monetary consideration. We do not share personal information for cross-context behavioural advertising in a manner that would require an opt-out under the CPRA. If this changes, we will update this Privacy Policy and provide an opt-out mechanism. 17.3 Sensitive personal information We do not use sensitive personal information for purposes that require us to provide a right to limit its use under the CPRA. We do not infer characteristics about you from sensitive personal information for purposes other than the limited purposes set out in 11 CCR § 7027(m). 17.4 California rights Right to know the categories and specific pieces of personal information we have collected; Right to delete personal information, subject to exceptions; Right to correct inaccurate personal information; Right to opt out of sale or sharing (we do not currently sell or share); Right to limit the use of sensitive personal information (we do not use sensitive PI beyond permitted purposes); Right to non-discrimination for exercising your rights. To exercise these rights, contact us using the details in Section 1. You may designate an authorised agent to act on your behalf, subject to verification under 11 CCR § 7063. 17.5 Designated request methods, non-discrimination, and financial incentives In accordance with 11 CCR § 7020, we provide California consumers with at least two designated methods for submitting requests to exercise their rights: By email to our privacy address set out in Section 1, with the subject line “California Privacy Rights Request”; and Through any in-app or website-based privacy request form we make available, where applicable. We will not discriminate against you, or otherwise penalise you, for exercising any right under the CCPA/CPRA. We do not deny goods or services, charge different prices or rates, provide a different level or quality of goods or services, or suggest that you will receive a different price, rate, level, or quality of goods or services because you exercised any of these rights, except as permitted by Civil Code § 1798.125(a)(2). We do not currently offer any financial incentives or price or service differences that are subject to the requirements of Civil Code § 1798.125(b). If we ever introduce any such financial incentive, we will provide a separate Notice of Financial Incentive in advance and obtain your opt-in consent. If we are required to publish CCPA metrics under 11 CCR § 7102 because we process the personal information of 10,000,000 or more California residents in any calendar year, we will publish those metrics on our website by 1 July of the following year and update this Privacy Policy with the link. 17.6 Universal opt-out signals (Global Privacy Control) Where required by 11 CCR § 7025 (California), Colorado Rule 5.06, the Connecticut Data Privacy Act, and equivalent provisions in other state laws, we recognise opt-out preference signals sent by your browser or platform that comply with technical specifications approved under the relevant law (including the Global Privacy Control, or “GPC”). Where we receive a recognised universal opt-out signal in connection with your interaction with our website, we treat it as a valid request to opt out of any sale of personal information and any sharing of personal information for cross-context behavioural advertising, in respect of the browser, device, and (where we can reasonably associate the signal with you) the consumer profile from which the signal originates. Because we do not currently sell personal information or share it for cross-context behavioural advertising, recognition of these signals does not change the way we process your data; if our practices change, we will continue to honour these signals and will update this Privacy Policy. 18. Other US State Privacy Laws Residents of certain other US states may have rights under their respective comprehensive privacy laws, including rights to access, delete, correct, and port personal information, and rights to opt out of certain processing activities such as the sale of personal information, the processing of personal information for purposes of targeted advertising, and profiling that produces legal or similarly significant effects. The states currently providing such rights (and the year their comprehensive privacy law took effect) include: California (2020/2023), Virginia (2023), Colorado (2023), Connecticut (2023), Utah (2023), Texas (2024), Oregon (2024), Montana (2024), Iowa (2025), Delaware (2025), New Hampshire (2025), New Jersey (2025), Tennessee (2025), Minnesota (2025), Nebraska (2025), Maryland (2025), Indiana (2026), Kentucky (2026), and Rhode Island (2026), as well as any further state laws that come into force from time to time. Where applicable, we honour these rights and the related procedural requirements of the relevant state law, including, where required by the relevant law, the right to appeal a denial of a request, recognition of universal opt-out preference signals, additional protections for sensitive data and the data of known minors, and notice obligations relating to the processing of sensitive data. To exercise rights under your state’s law, contact us using the details in Section 1 and identify the relevant state. Where the law permits, we may verify your residency and identity before responding. Some states (notably Maryland under the Maryland Online Data Privacy Act) impose additional substantive limits on the processing of sensitive data and the data of known minors; where you are resident in such a state, we apply those additional limits to our processing of your personal data. 19. Other Jurisdictions Residents of other jurisdictions may have additional rights under their local laws, including: Brazil: the Lei Geral de Proteção de Dados Pessoais (LGPD) (Federal Law No. 13.709/2018); Canada: the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws; Australia: the Privacy Act 1988 (Cth) and the Australian Privacy Principles; Switzerland: the revised Federal Act on Data Protection (FADP); Other jurisdictions where we offer services. Where applicable, we will honour these rights as required by law. Contact us for jurisdiction-specific requests. 20. Children’s Privacy TQK is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you are under 16, do not register an account or submit any personal data through TQK. Where local law sets a higher minimum age for consent to information society services, that higher age applies. In Slovakia, the minimum age for a child to consent to information society services on their own behalf is 16 years (Slovak Act No. 18/2018 Coll.). If you are a parent or guardian and you believe that a child below the applicable minimum age has provided personal data to TQK without appropriate parental or guardian consent, please contact us using the details in Section 1 so that we can take appropriate action, including deletion. If you are a resident of the United States, this service is not directed to children under 13, and we comply with the Children’s Online Privacy Protection Act (COPPA) in respect of any personal data inadvertently collected from such children. Age confirmation at registration. At account registration we require you to confirm that you are at least the applicable minimum age in your jurisdiction. We do not market our service to anyone below the applicable minimum age, do not direct any feature, mission, or community room to anyone below that age, and do not knowingly enrol such users. We reserve the right to terminate any account where we have reasonable grounds to believe the account holder is below the applicable minimum age, and to delete the associated personal data. Discovery and remediation. If we become aware that we have collected personal data from a child below the applicable minimum age without verifiable parental or guardian consent (where such consent could lawfully be relied on), we will, without undue delay: (i) suspend the relevant account; (ii) delete the personal data from our active systems and instruct relevant subprocessors to do the same; (iii) where required, notify the competent supervisory authority; and (iv) where the parent or guardian can be identified, notify them. Backups containing such data will be overwritten in line with our backup rotation schedule. Known minors under US state laws. Several US state privacy laws (including the laws of California, Colorado, Connecticut, Maryland, and Tennessee) impose additional protections in respect of personal data of consumers known to be minors, including limits on targeted advertising, the sale or sharing of personal information, and certain forms of profiling. Where we know or have reason to know that a user is a minor under the threshold set by the law of the user’s state of residence, we apply those additional protections in accordance with the relevant law and obtain consent from the user (or, where applicable, the user’s parent or guardian) before engaging in any processing for which consent is required. 21. Marketing Communications Where you have opted in to marketing communications, or where we send marketing emails to existing customers under the legitimate-interests “soft opt-in” for similar products or services, you have an absolute right to object at any time. You can opt out by: Clicking the unsubscribe link contained in every marketing email; Adjusting your account or notification settings; Contacting us using the details in Section 1. Opting out of marketing does not affect service-related communications, such as transactional notifications, security alerts, billing-related messages, and policy updates, which are necessary for the operation of your account and the contract between us. Where required by Slovak transposition of the e-Privacy Directive or other applicable law, we obtain prior consent for unsolicited marketing communications and for the use of cookies and similar technologies for marketing purposes. 22. Account Suspension, Closure, and Deletion You may close your TQK account at any time. To do so, use the account-closure feature in your account settings, or contact us using the details in Section 1. On closure of your account: Your account profile is deactivated and your username and display name are no longer visible to other users in active areas; Personal data associated with your account is deleted or anonymised in accordance with our retention schedule (Section 10), subject to retention required for legal, accounting, security, fraud-prevention, or dispute-resolution purposes; Posts, comments, and other content you have shared in community spaces may remain visible if removing them would significantly disrupt the community context, but will be displayed without your account name where feasible; Backups containing your personal data are subject to backup rotation and will be overwritten or deleted in line with our backup schedule; We will confirm the closure of your account once the deactivation is complete. We may suspend or terminate your account in accordance with our Terms of Service, including for violations of community rules, suspected fraud, or where required by law. Suspension does not necessarily entail deletion of your personal data. 23. Government and Law Enforcement Requests We may receive requests for personal data from government, regulatory, or law-enforcement authorities. We respond to such requests only where we are legally compelled to do so or where we believe in good faith that disclosure is necessary to protect rights, property, or safety, and we apply the following principles: We require valid legal process appropriate to the type of data and the requesting authority’s jurisdiction; We narrow the scope of disclosure to what the legal process requires; Where lawful, we notify affected data subjects before disclosure; We challenge requests we consider overbroad, improper, or unlawful; We document and may publish, in aggregate form, statistics about requests received and our response. 24. Data Protection Impact Assessments We conduct Data Protection Impact Assessments (DPIAs) under Article 35 of the GDPR where a type of processing, in particular using new technologies, and taking into account the nature, scope, context, and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons. DPIAs are kept under review and updated as the relevant processing evolves. 25. Accountability and Governance We have implemented internal policies and procedures designed to ensure compliance with applicable data protection laws, including: Maintenance of records of processing activities under Article 30 GDPR where applicable; Privacy by design and by default in our product development; Vendor and subprocessor due diligence; Personnel training and access controls; Periodic review of this Privacy Policy and our broader privacy programme. 26. Third-Party Links and Integrations Our platform may include links to or integrations with third-party websites, applications, or services, including embedded videos, social media buttons, payment provider interfaces, and authentication providers. These third parties have their own privacy practices and policies. We are not responsible for their practices, and this Privacy Policy does not apply to them. We encourage you to review the privacy notices of any third party before interacting with their service. Where embedded third-party content sets cookies or collects personal data on our platform, this is described in our Cookie Policy. 27. Changes to This Privacy Policy We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will revise the “Last Updated” date at the top and increment the version number. If the changes are material, we will provide additional notice, such as by email, in-app banner, or another reasonable means, before the changes take effect. We retain prior versions of this Privacy Policy and can provide them on request. Your continued use of TQK after the updated Privacy Policy becomes effective constitutes your acceptance of the updated policy, except where applicable law requires fresh consent for any change in processing activity. 28. Language Versions This Privacy Policy is available in English. Where required by Slovak consumer protection law or any other applicable law, a Slovak-language version is also available and will be made accessible to Slovak users at the same point in the user journey as the English version. In the event of a conflict between the English and any translated version, the language version designated as authoritative on the relevant version page will prevail, except to the extent that mandatory law requires the local-language version to prevail. [REVIEWER NOTE: Slovak Act No. 250/2007 on consumer protection and related case law typically require consumer-facing terms and notices to be available in Slovak when offered to Slovak consumers. Confirm with counsel and produce a Slovak version before launch in Slovakia.] 29. Contact Us If you have questions, requests, or complaints about this Privacy Policy or our data practices, please contact us at: [FULL LEGAL ENTITY NAME] [REGISTERED ADDRESS] Privacy enquiries: [privacy@tqk.example] General support: [support@tqk.example] If we have appointed a Data Protection Officer, an EU representative, or a UK representative, their contact details are set out in Section 1.