ADDITIONAL EUROPEAN ECONOMIC AREA, UNITED KINGDOM, AND SWITZERLAND PRIVACY DISCLOSURES

Last Updated: August 30, 2026

These disclosures supplement the information contained in our Privacy Notice by providing additional information about our personal data processing practices relating to individuals who access our website or otherwise interact with us from the European Economic Area (“EEA”), United Kingdom ("UK”) or Switzerland. For a detailed description of how we collect, use, disclose, and otherwise process personal data, please read our Privacy Notice.

‍

Controller Details and Privacy Contacts

‍

EEA, UK, and Swiss Controller

Future Secure AI Inc. and each of its direct or indirect subsidiaries, affiliated entities, as applicable, is the controller responsible for the processing of personal data in connection with the website and services described in our Privacy Notice. This means Future Secure AI determines and is responsible for how your personal data is used. You may contact us at privacy@futuresecure.ai or 7001 Burnet Road, 2nd Floor, Austin, TX 78757, USA.

‍

Additional Questions or Complaints

If you have a concern about our processing of personal data, you have the right to lodge a complaint with the Data Protection Authority where you reside, where you work, or where an alleged violation of the law has occurred. Contact details for applicable Data Protection Authorities can be found using the links below:

• European Economic Area: https://edpb.europa.eu/about-edpb/board/members_en
• United Kingdom: https://ico.org.uk/global/contact-us/
• Switzerland: https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html

We would, however, appreciate the chance to handle your concerns directly prior to a complaint being filed, so please contact us directly at privacy@futuresecure.ai if you have any concerns.

‍

Purposes and Legal Bases of Processing

When we process your personal data, we will do so in reliance on the following lawful bases:

• Contract: Where the processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract with you. This applies to any processing where you sign a contract with us, for example when you become our customer or deliver services to us as a vendor or contractor. This may also include processing necessary for the performance of our Terms of Use.
• Legitimate Interest: Where the processing is necessary for the purposes of a legitimate interest that are not overridden by your interests or fundamental rights and freedoms (e.g., to provide, maintain, and improve our products and services, conduct data analytics, and communicate with you regarding our services, prevent and detect fraud or security incidents).
• Vital Interest: Where the processing is necessary to protect the vital interests of you or another person (e.g., to protect your physical safety).
• Public Interest: Where the processing is necessary to perform tasks carried out in the public interest or in the exercise of official authority vested in us (e.g., to cooperate in an ongoing law enforcement investigation).
• Legal Obligation: Where the processing is necessary to comply with our legal obligations (e.g., to maintain a record of your personal data to comply with laws and regulations related to bookkeeping, accounting, taxation, and employment).  
• Consent: Where we have your consent for the processing (e.g., when you opt in to receive marketing communications from us). When consent is the legal basis for our processing of your personal data, you may withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to the withdrawal, and we may continue to process your personal data on another lawful basis.

When we process special categories of personal data, we do so only where a recognized condition applies, such as where the processing relates to personal data you manifestly made public, is necessary for employment, recruitment, reasonable accommodation or related legal obligations, is necessary for the establishment, exercise or defense of legal claims, is necessary for reasons of substantial public interest, or is based on your explicit consent where required.

Where we process personal data relating to criminal convictions or offenses, we do so only to the extent authorized by applicable law, including any additional conditions or safeguards that law requires for that category of data.

You are not required to provide personal data to us, but we rely on certain personal data to provide services, respond to requests, administer recruitment, assess applications, and manage customer, investor and business relationships. If you choose not to provide personal data we require, we may be unable to provide certain services, respond to your request, assess your application, or otherwise interact with you in the same manner.

‍

Personal Data Obtained from Third-Party Sources

Where we obtain Personal Data about you from a source other than you directly, the categories of personal data we may obtain include: Identity Data, Contact Data, Employment or Candidate Data, Special Personal Data (where permitted by law), Personal Data relating to criminal convictions or offenses, and Third-Party Data, each as described in our Privacy Notice. Sources from which we may obtain such data include recruitment agencies, staffing firms, referral sources, references provided by candidates, background check or identity verification providers, publicly available sources (such as professional networking platforms), and business partners.

Where we obtain Personal Data about you from a source other than you, we will provide you with the information required by applicable law: (a) within a reasonable period after obtaining the Personal Data, having regard to the specific circumstances in which the Personal Data are processed, but at the latest within one month; (b) if the Personal Data will be used to communicate with you, at the latest at the time of the first communication; or (c) if disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed. We are not required to provide this notice where you already have the information, where the provision of such information would be impossible or involve disproportionate effort (in which case we will take appropriate measures to protect your rights, such as making the information publicly available), where obtaining or disclosure is expressly laid down by applicable law and that law provides appropriate measures to protect your legitimate interests, or where the Personal Data must remain confidential subject to an obligation of professional secrecy regulated by applicable law.

‍

Automated Decision-Making and Profiling

We may use AI-assisted tools in recruitment for the purposes described in our Privacy Notice. These tools may assist human reviewers by parsing CVs or résumés, summarizing candidate information, identifying role-relevant skills or experience, assisting with candidate ranking or prioritization, and routing applications. We do not use AI systems to make solely automated decisions that produce legal or similarly significant effects concerning candidates, and we do not use candidate personal data to train or fine-tune underlying AI models. Human reviewers remain involved at multiple points in the recruitment process and retain responsibility for recruitment and hiring decisions.

‍

Retention of Personal Data

We will usually retain the personal data we collect about you for no longer than reasonably necessary to fulfill the purposes for which it was collected, and in accordance with our legitimate business interests and applicable law. However, if necessary, we may retain personal data for longer periods of time as required under applicable law or as needed to resolve disputes or protect our legal rights.

For candidates, we retain personal data for the applicable recruitment process and, where permitted by applicable law, for a reasonable period thereafter for consideration for future opportunities, legal compliance, recordkeeping, audit, security, dispute resolution, and legitimate business purposes.

The criteria used to determine the period of time for which personal data about you will be retained varies depending on the legal basis under which we process your personal data:

• Contract: Where we are processing personal data based on contract, we generally will retain the information for the duration of the contract plus some additional limited period of time that is necessary to comply with law or that represents the statute of limitations for legal claims that could arise from the contractual relationship.
• Legitimate Interest: Where we are processing personal data based on legitimate interests, we generally will retain the information for a reasonable period of time based on the particular interest, taking into account the fundamental interests and the rights and freedoms of data subjects.
• Vital Interest: Where we are processing personal data based on vital interests, we generally will retain the information for the period of time necessary to protect the vital interests of the relevant person plus some additional limited period of time that represents any applicable statute of limitations for legal claims that could arise out of the related events.  
• Public Interest: Where we are processing personal data to perform tasks carried out in the public interest or in the exercise of official authority vested in us, we generally will retain the information for a reasonable period of time based on the public interest / official authority, taking into account any obligations we may have to retain the information for a longer period of time.
• Legal Obligation: Where we are processing personal data based on a legal obligation, we generally will retain the information for the period of time necessary to fulfill the legal obligation plus some additional limited period of time that represents the statute of limitations for legal claims that could arise from the legal obligation.
• Consent: Where we are processing personal data based on your consent, we generally will retain the information for the period of time necessary to fulfill the purposes for which you have provided your consent.  

In certain circumstances, we may need to apply a “legal hold” that retains information beyond our typical retention period where we face threat of legal claim. In that case, we will retain the information until the hold is removed, which typically means the claim or threat of claim has been resolved. In all cases, in addition to the purposes and legal bases identified above, we consider the amount, nature and sensitivity of personal data, as well as the potential risk of harm from unauthorized use or disclosure of personal data, in determining the relevant retention period.

Once retention of the personal data is no longer reasonably necessary for the purposes outlined above, we will either delete or destroy the personal data or, where permitted by applicable law, anonymize or de-identify it such that it is no longer considered personal data under applicable law. If deletion, destruction, anonymization, or de-identification is not immediately possible (for example, because personal data has been stored in backup archives), we will securely store the personal data and isolate it from further active processing until deletion, destruction, anonymization, or de-identification is possible.

‍

International Transfers of Personal Data

We operate and engage third-party partners and providers in various jurisdictions. Therefore, we and our third-party providers may transfer personal data to, or store, access, or process personal data in, a country other than the one in which it was collected, including, but not limited to, the United States. The country to which personal data is transferred may not provide the same level of protection for personal data as the country from which it was transferred.

We may transfer personal data about you outside of the EEA, UK, and Switzerland, and when we do so we rely on appropriate or suitable safeguards recognized under applicable law, including adequacy decisions, standard contractual clauses, data transfer agreements, and, where applicable, the EU-U.S. Data Privacy Framework for participating third parties. If you would like more information on the specific safeguards we use, please contact us at privacy@futuresecure.ai.

‍

Adequacy Decisions

We may transfer personal data about you to countries that the relevant regulatory authority have deemed to adequately safeguard personal data, either automatically or in connection with a specific safe harbor framework.

‍

Standard Contractual Clauses

Certain regulatory authorities have adopted standard contractual clauses, which provide safeguards for personal data transferred outside of the originating jurisdiction. We may use these standard contractual clauses when transferring personal data to a third country that has not been deemed to adequately safeguard personal data.

‍

EU-U.S. Data Privacy Framework

The EU-U.S. Data Privacy Framework was designed by the U.S. Department of Commerce and the European Commission to ensure adequate protection for personal data transferred to a company participating in the EU-U.S. Data Privacy Framework. If we transfer any personal data about you from the EEA to a third party outside the EEA who is participating in the EU-U.S. Data Privacy Framework, we may rely on their participation in the Framework to ensure adequate protection for personal data so transferred.

‍

Your Additional EEA, UK, and Swiss Privacy Choices

Subject to certain limitations at law, you may be able to exercise the following rights:  

• Right to Access: The right to obtain confirmation of whether we are processing personal data about you, access to and a copy of the personal data we are processing about you, and information relating to its processing, including:
  • The categories of personal data being processed;
  • The purposes of the processing;
  • The categories of the sources of the personal data;
  • The categories of recipients to whom the personal data have been or will be disclosed;
  • The envisaged period for which the personal data will be stored, or the criteria used to determine that period;
  • Any automated decision-making or profiling performed in connection with your personal data; and
  • The safeguards relied upon for the transfer of personal data to any third country.
• Right of Portability: The right to obtain a copy of the personal data we have collected about you in a structured, commonly used, and machine-readable format, and the right to transmit that personal data to another controller without hindrance.
• Right to Rectification: The right to correct or update any personal data about you that is inaccurate or incomplete.
• Right to Restriction of Processing: The right to require us to limit the purposes for which we process your personal data if the continued processing of the personal data in this way is not justified, such as where the accuracy of the personal data is contested by you.
• Right to Object to Processing: The right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation. There may be compelling reasons for continuing to process your personal data, and we will assess and inform you if that is the case. You can object to marketing activities for any reason.
• Right to Withdraw Consent: The right to withdraw your previously provided consent to our processing of your personal data. Please note withdrawing your consent will not affect the lawfulness of our use of your personal data before your consent was withdrawn, nor our processing of personal data pursuant to a different lawful basis for processing.
• Right to Erasure: The right to have us erase your personal data if the continued processing of that personal data is not otherwise justified.
• Right Not to Be Subject to Solely Automated Decision-Making: The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless such processing is necessary for entering into or performing a contract, is authorized by applicable law, or is based on your explicit consent. Where any of these exceptions applies and the decision is based on your explicit consent or is necessary for a contract, you have the right to obtain human intervention, to express your point of view, and to contest the decision.

Please note that if the exercise of these rights limits our ability to process personal data, we may not be able to provide our services to you or otherwise engage with you in the same manner.

‍

Submitting Privacy Rights Requests

Please submit a request specifying the right you wish to exercise by contacting us at privacy@futuresecure.ai. We will respond to your request without undue delay and in any event within one month of receipt. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests; if so, we will inform you of the extension and the reasons for the delay within one month of receipt of your request. There is no charge for exercising your rights, although we may charge a reasonable fee or refuse to act on a request that is manifestly unfounded or excessive.

To exercise your right to object as it relates to the use of automatic data collection technologies, please use the cookie preference tools or browser settings described in our Privacy Notice. Where required by law, non-essential cookies are set only after you provide consent, and you may withdraw or change your consent through the cookie preference center on our website or by adjusting your browser settings.

Before processing your request to exercise certain rights, we will need to verify your identity and confirm you are accessing our services or otherwise interacting with us from the EEA, UK, or Switzerland. To verify your identity, we may request information such as your name, email address, location or jurisdiction, and other information reasonably necessary to match your request to information we maintain about you.

In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity as needed to protect your personal data, locate your information in our systems, or confirm that the requested right applies to you.

‍