4.2 Personal Data Collected from Professionals

When you use the Platform as a Professional, we may collect and process the following categories of personal data:

• Account and Identity Data: your full name, email address, telephone number, and password (stored in encrypted form). For identity verification purposes, we may also collect a copy of your government-issued photo identification and supporting identity documents.
• Business and Professional Data: your business or trading name, business address, registered business number or tax identification number (where applicable), a description of your services, your service categories, and the geographic areas in which you operate.
• Credentials and Compliance Data: professional licences, certifications, insurance certificates, trade memberships, and any other credentials you provide as part of the registration process or any enhanced verification (including the Huuply Verified programme).
• Profile Content: photographs, portfolio images, service descriptions, and any other content you publish on your public Profile on the Platform.
• Credit and Payment Data: records of your Credit purchases, Credit balances, Credit redemptions, Subscription Services billing records, and payment transaction histories. Your full payment card details are processed directly by our authorised third-party payment processors and are not stored in full by Huuply.
• Background Check Data: where you participate in the Huuply Verified programme or another enhanced verification process, we may receive criminal background check results, civil records checks, and professional credential verification reports from authorised third-party verification providers.
• Communications Data: messages exchanged with Homeowners through the Platform's messaging tools, correspondence with our support team, and any other communications you send to or receive from Huuply.
• Performance Data: reviews and ratings submitted about your services by Homeowners, your average rating, your response rate, and other performance metrics maintained by the Platform.
• Usage and Technical Data: your IP address, device type, operating system, browser type, referring website, pages visited, time on site, and other usage information collected automatically through cookies and similar technologies.
• Marketing Preferences: your preferences regarding receiving marketing, promotional and operational communications from Huuply.

4.3 Personal Data Collected from All Users and Website Visitors

In addition to the category-specific data described above, we collect the following types of data from all individuals who access the Platform, including Website Users who do not register an account:

• Technical and Device Data: IP address, device identifiers, browser type and version, operating system, screen resolution, and network information.
• Usage and Behavioural Data: pages or screens visited, duration of visits, referral source, search terms used within the Platform, features accessed, and user journey data.
• Cookie and Tracking Data: data collected through cookies, web beacons, pixels, SDKs and similar technologies as described in our Cookies Policy at huuply.com/legal/cookies-policy.
• Aggregate and De-identified Data: we may create anonymised, aggregated statistical data derived from individual usage data for research, analytics and platform improvement purposes.

5.2 Information Collected Automatically

We and our authorised third-party service providers collect certain data automatically when you access or use the Platform, including:

• Technical data collected by our servers and analytics systems, including IP address, device information, and browser data;
• Usage data collected through cookies, web beacons, pixel tags, embedded scripts and software development kits (SDKs) — see our Cookies Policy for full details;
• Mouse movements, scrolling patterns, clicks, and other interaction data collected through session recording and analytics tools; and
• Location data derived from your IP address (general geographic location) or, where you have granted permission, more precise location data from your device.

5.3 Information From Third Parties

We may also receive personal data about you from third parties, including:

• Identity and background verification providers: when you undergo identity verification or background checks as part of the registration or Huuply Verified programme;
• Payment processors: transaction confirmation data and fraud signals from our authorised payment processing partners;
• Analytics and advertising partners: usage and engagement data from analytics providers such as Google Analytics 4, and advertising platforms such as Google Ads and Meta;
• Third-party login services: if you choose to create or access your account using a third-party authentication service (such as Google or Apple Sign In), we receive certain profile information from that service;
• Public sources: publicly available information about Professionals, such as publicly registered business information, published reviews on other platforms, and publicly available credential records; and
• Other users: information that Homeowners or Professionals provide about other parties in the course of their interactions on the Platform (for example, a Homeowner describing a service situation that involves a family member).

7.2 Third-Party Service Providers (Processors)

We share personal data with trusted third-party companies and individuals who process data on our behalf (as our 'processors') to help us provide, operate, analyse and improve the Platform. These providers are contractually required to process personal data only in accordance with our instructions and applicable data protection laws. They include:

• Cloud infrastructure and hosting providers: for Platform hosting, data storage and content delivery;
• Payment processors: for processing Credit purchases and Subscription Services billing (these providers handle your payment card data directly and are subject to PCI-DSS compliance obligations);
• Identity and background verification providers: for conducting identity checks and background verification as part of the Huuply Verified programme;
• Analytics providers (Google Analytics 4): for web and app usage analytics — see our Cookies Policy for details;
• Email marketing and marketing automation (Perfit): for managing email communications, newsletters and marketing sequences;
• SMS communications providers: for delivering SMS notifications to Professionals about new Service Requests;
• Customer support tools: for managing support tickets, help centre content and live chat functionality;
• Fraud detection and security providers: for identifying and preventing fraudulent activity on the Platform; and
• Internal CRM system: Huuply maintains a proprietary internal CRM for managing Professional and Homeowner account relationships.

7.3 Third-Party Advertising Partners (Controllers)

We work with third-party advertising partners who may use your personal data for their own purposes as independent data controllers. These include:

• Google Ads (Alphabet Inc.): for retargeting campaigns and interest-based advertising. Google processes data in accordance with its own Privacy Policy at policies.google.com/privacy.
• Meta Platforms (Facebook Pixel): for retargeting and conversion tracking on Facebook, Instagram and other Meta platforms. Meta processes data in accordance with its Privacy Policy at facebook.com/privacy/policy.

These organisations have their own privacy notices which you should read, and they have their own responsibilities to comply with applicable data protection laws. We may share common account identifiers (such as hashed email addresses) with these partners to facilitate audience matching and retargeting.

7.4 Legal, Regulatory and Safety Disclosures

We may disclose your personal data to third parties where we are required or permitted to do so by law, or where we reasonably believe disclosure is necessary to:

• Comply with a legal obligation, court order, judicial process, or governmental or regulatory request in any jurisdiction;
• Enforce our Terms and Conditions, Privacy Policy, or other agreements;
• Investigate, prevent or take action regarding suspected fraud, illegal activity, or violations of our policies;
• Protect the rights, property or safety of Huuply, our users, or the general public;
• Respond to requests from law enforcement agencies, tax authorities (including the Canada Revenue Agency and relevant US tax authorities), or other regulatory bodies; or
• Protect the vital interests of any person.

7.5 Business Transfers

In the event of a merger, acquisition, reorganisation, sale of assets, bankruptcy, insolvency, or other similar corporate transaction involving Molokaih LLC, your personal data may be disclosed, transferred or assigned to the parties involved in that transaction or its advisors. We will provide notice of any material change in the data controller's identity in accordance with applicable law.

7.6 With Your Consent

Where we have obtained your specific and informed consent to share your personal data with a particular third party for a specific purpose, we will share your data on that basis. You may withdraw your consent at any time by contacting us at privacy@huuply.com.

10.1 Rights Available to All Users

Regardless of your jurisdiction, we provide all users with the following privacy choices:

• Communication preferences: You may adjust your preferences for receiving communications from Huuply at any time through the 'notifications' or 'account settings' section of your account, or by clicking 'unsubscribe' in any email you receive from us.
• Cookie and tracking preferences: You may manage your cookie preferences through the Cookie Preferences manager available in the footer of our website, or through your browser settings. See our Cookies Policy at huuply.com/legal/cookies-policy for full details.
• Access to your account data: You may access and update much of the personal data held in your account directly through your account dashboard.

10.2 Canada — Rights Under PIPEDA

If you are a resident of Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation (including the Personal Information Protection Act (PIPA) in British Columbia and Alberta, and Law 25 (formerly Bill 64) in Quebec) provide you with the following rights:

• Right of access: You have the right to request access to the personal information we hold about you and to receive information about how it is being used and disclosed.
• Right of correction: You have the right to challenge the accuracy and completeness of your personal information and to request correction where it is inaccurate or incomplete.
• Right to withdraw consent: Where we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time. Note that withdrawal of consent may limit our ability to provide certain services to you.
• Right to complain: You have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca, or with the applicable provincial privacy commissioner, if you believe that we have not handled your personal information in accordance with applicable law.

10.3 United States — Rights Under the CCPA/CPRA (California Residents)

If you are a resident of California, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with the following rights:

• Right to know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, the purposes for collecting it, and the categories of third parties with whom we have shared it.
• Right to delete: You have the right to request that we delete personal information we have collected from you, subject to certain exceptions permitted by law (for example, where we are required to retain the data to comply with a legal obligation or to complete a transaction you have requested).
• Right to correct: You have the right to request correction of inaccurate personal information that we hold about you.
• Right to opt out of sale or sharing: We do not sell your personal information in the traditional sense. However, our sharing of personal data with advertising partners for cross-context behavioural advertising may constitute 'sharing' under the CCPA/CPRA. California residents may opt out of such sharing by contacting us at privacy@huuply.com or by managing your cookie preferences.
• Right to limit use of sensitive personal information: Where we process sensitive personal information (as defined under the CCPA/CPRA), you have the right to limit our use of that information to purposes permitted by law.
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

To exercise your California privacy rights, please contact us at privacy@huuply.com or through the privacy request form at huuply.com/legal/privacy-policy. We will verify your identity before processing your request. We will respond to verified requests within 45 days, with a possible extension of an additional 45 days where reasonably necessary.

10.4 European Economic Area — Rights Under the GDPR

If you are located in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR) or, as applicable, the UK GDPR provides you with the following rights:

• Right of access (Article 15 GDPR): You have the right to obtain confirmation as to whether we process personal data about you, and if so, to receive a copy of that data and certain supplementary information about how we process it.
• Right to rectification (Article 16 GDPR): You have the right to require us to correct inaccurate personal data about you and to complete incomplete personal data.
• Right to erasure / 'right to be forgotten' (Article 17 GDPR): You have the right to request that we erase your personal data in certain circumstances, including where the data is no longer necessary for the purposes for which it was collected, where you withdraw your consent (and no other lawful basis exists), or where you successfully object to processing based on legitimate interests.
• Right to restriction of processing (Article 18 GDPR): You have the right to request that we restrict the processing of your personal data in certain circumstances.
• Right to data portability (Article 20 GDPR): Where processing is based on your consent or on the performance of a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format, and to transmit that data to another controller.
• Right to object (Article 21 GDPR): You have the right to object to processing of your personal data where we rely on legitimate interests as the lawful basis for processing, and to object to processing for direct marketing purposes at any time and without justification.
• Right to withdraw consent: Where we process personal data on the basis of your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to lodge a complaint: You have the right to lodge a complaint with the relevant data protection supervisory authority in your EEA member state or in the UK (the Information Commissioner's Office).

To exercise your GDPR rights, please contact us at privacy@huuply.com. We will respond to requests within one month, with a possible extension of two further months where the complexity or number of requests warrants it. We will verify your identity before processing your request.

10.5 Brazil — Rights Under the LGPD

If you are a resident of Brazil, the Lei Geral de Proteção de Dados Pessoais (LGPD) (Law No. 13,709/2018) provides you with the following rights in relation to your personal data:

• Confirmation of existence of processing: the right to confirm whether your personal data is processed by Huuply;
• Access: the right to access your personal data;
• Correction: the right to correct inaccurate or incomplete personal data;
• Anonymisation, blocking or deletion: the right to request anonymisation, blocking or deletion of personal data that is unnecessary, excessive or processed in non-compliance with the LGPD;
• Data portability: the right to receive your personal data in a structured format for transfer to another controller;
• Deletion of consented data: the right to request deletion of personal data processed on the basis of your consent;
• Information about sharing: the right to obtain information about the public and private entities with whom Huuply has shared your personal data;
• Information about the possibility of denying consent: the right to be informed about the consequences of withholding or withdrawing consent; and
• Revocation of consent: the right to revoke your consent to data processing at any time through a free and simplified process.

To exercise your LGPD rights, please contact us at privacy@huuply.com. The National Data Protection Authority (ANPD) in Brazil may be contacted at www.gov.br/anpd for complaints about our data processing practices.

10.6 Exercising Your Rights — General Process

To exercise any of the rights described in this Section 10, please contact us using the details provided in Section 17 of this Privacy Policy. Please provide us with sufficient information to identify you and to process your request, including your name, email address associated with your account (if applicable), your country or region of residence, and the nature of the right you wish to exercise. We may need to verify your identity before processing your request. We will not charge a fee for processing your request unless it is manifestly unfounded, excessive or repetitive, in which case we may charge a reasonable fee or decline to respond.