PRIVACY STATEMENT

OASYS NOW B.V.

September 2026

Who we are and what this statement covers
1. OASYS NOW B.V. ("OASYS NOW", "we") is registered with the Dutch Chamber of Commerce under number 82393338 and has its office at Molengraaffsingel 12, 2629 JD Delft, the Netherlands. We are the controller for the personal data described in this statement. Our Data Protection Officer can be reached at dpo@oasysnow.com.
2. This statement explains how we handle personal data of visitors to www.oasysnow.com (the "Website"), of people who contact us, request a demo or otherwise deal with us as a business contact, and of people who follow us on social media.
3. It does not cover the personal data that our clients process through our products and services such as ELaiGIBLE CT, ELaiGIBLE RWD and De-ID. For that data, our client is the controller, and we generally act as processor under a data processing agreement with that client. Questions about that data should be addressed to the client concerned.
Which personal data we process and why
1. Website visitors. When you visit the Website we process technical data such as your IP address, browser and device type, pages visited and the time of your visit, through cookies and similar techniques (see article 4). We use this data to keep the Website secure and available (legitimate interest) and, with your consent, to understand how the Website is used and to improve it.
2. Business contacts. When you fill in a contact form, request a demo, book a meeting, email us or exchange business cards with us, we process your name, email address, telephone number, organisation, job title and the content of your message. We use this data to answer you, to prepare and follow up on meetings, to conclude and perform agreements with your organisation, and to keep in touch about our products and services where this is relevant to your role (legitimate interest, or performance of a contract). You can object to commercial messages at any time.
3. Clients and suppliers. For the organisations we work with, we process the business contact details of the people involved, and the data needed for invoicing and our administration (performance of a contract and legal obligations, including tax law).
4. Social media. We have pages on LinkedIn, X, Instagram and YouTube. If you interact with them, the provider of that platform processes your data under its own privacy statement. We see the public information you share with us and the aggregated statistics the platforms provide.
5. We do not process special categories of personal data through the Website, and we do not make decisions about you based solely on automated processing.
Who receives your data
1. We use service providers who process personal data on our behalf under a data processing agreement: hosting and cloud providers, our website and analytics tools (such as Google Tag Manager, Google Analytics and PostHog), our customer relationship management and email system, our meeting scheduling tool, and video and social media embeds (such as YouTube and LinkedIn). We select providers that store data within the European Economic Area where possible. Where a provider processes data outside the EEA, we rely on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or on the European Commission's standard contractual clauses.
2. We do not sell personal data, and we do not share it with third parties for their own marketing. We disclose personal data to authorities only where the law requires us to.
Cookies
1. The Website uses functional cookies that are necessary for it to work. These do not require your consent.
2. With your consent, given through the cookie banner, we also use analytics cookies (such as Google Analytics and PostHog) to measure how the Website is used, and third-party cookies set by embedded content such as YouTube videos, meeting scheduling and LinkedIn. You can withdraw your consent at any time through the cookie settings on the Website or by deleting cookies in your browser. Without analytics cookies, the Website works normally.
How long we keep your data
1. We keep personal data no longer than necessary for the purpose for which we collected it. As a rule: website analytics data for a maximum of 14 months; contact and demo requests for five years after our last contact, unless an agreement follows; client and supplier contact details for the term of the agreement and two years thereafter; invoicing and administrative records for seven years under Dutch tax law; cookie consent for twelve months.
How we protect your data
1. We protect personal data with appropriate technical and organisational measures under our information security management system, which is certified against ISO 27001 and NEN 7510. Access is limited to employees who need it for their work, and all employees are bound by confidentiality.
Your rights
1. You have the right to access the personal data we hold about you and to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw any consent you have given. To exercise these rights, email dpo@oasysnow.com. We respond within one month and may ask you to verify your identity.
2. If you are not satisfied with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, www.autoriteitpersoonsgegevens.nl). We would appreciate the chance to resolve your concern first.
Changes and contact
1. We may update this statement, for example when we change the Website or our tools. The current version is always available on the Website with its version number and date. Material changes are announced on the Website.
2. Questions about this statement can be sent to dpo@oasysnow.com or to OASYS NOW B.V., Molengraaffsingel 12, 2629 JD Delft, the Netherlands.