This policy (hereinafter, the "Privacy Policy" or "Policy") has been in effect since November 2, 2022 (the "Effective Date"). The owner of the website certatraq.com (hereinafter, the "Website") is Streamail (hereinafter, the "Company" or "we"), a company of Spanish nationality, with Tax ID (CIF) B88113030, and registered address at Calle de Bohemios, 11 - pta c, plt 5, Madrid, 28041, Spain. The Company is registered with the Commercial Registry of Madrid, Volume 31853, Folio 1, Section 8, Sheet M-573205. The Company carries out its activity in the permission e-mail marketing sector (advertising campaigns with prior consent of the recipient). It is mainly engaged in direct marketing, affiliate marketing, online advertising, and telemarketing. You may contact us with any questions about this Privacy Policy at dpd@unsubscribeservices.com and/or at Streamail, Calle de Bohemios, 11 - pta c, plt 5, Madrid, 28041, Spain. The content of this Privacy Policy is as follows: 1. SCOPE OF APPLICATION AND RESPONSIBILITY 2. COMPANY SERVICES 3. PERSONAL DATA COLLECTED BY THE COMPANY 4. USE OF THE DATA COLLECTED BY THE COMPANY 5. PURPOSE OF DATA PROCESSING AND LEGAL BASIS 6. TYPES OF DATA PROCESSING 7. ACCESS TO YOUR PERSONAL DATA AND INTERNATIONAL DATA TRANSFERS 8. AGE REQUIRED TO REGISTER ON THE WEBSITE AND ACCOUNT SECURITY 9. RIGHTS OF DATA SUBJECTS REGARDING THEIR DATA 10. COMMERCIAL COMMUNICATIONS 11. SECURITY AND CONFIDENTIALITY OF DATA 12. STATEMENT OF GOOD PRACTICES 13. VALIDITY OF THE PRIVACY POLICY 14. APPOINTMENT OF A DPO. CONTACT US 1. SCOPE OF APPLICATION AND RESPONSIBILITY The Company is responsible for the processing of your personal data (e.g., information that identifies a person, such as their full name or email address) collected through our services, in accordance with this Privacy Policy. This Privacy Policy, like our Cookie Policy, applies to all users, both those who use our services without having registered or subscribed to any of them, and those who have registered or subscribed to one of our services. For the sake of clarity, this Privacy Policy does not apply to data collected by third parties through their own websites, even if such websites contain links to the Company's Website. The Company is not responsible for any content within the privacy policy of third parties, and offers no warranty, express or implied, regarding the accuracy, legality, correctness, or validity of any website. 2. COMPANY SERVICES The Website offers you the possibility of managing your user area, setting up alerts, and receiving newsletters, information, and advertising about the Company's and/or third parties' products and services. The aforementioned newsletters, information, and advertising will be based on the areas of interest you have indicated to us, in accordance with the website's criteria and your profile. If you wish, you may also take part in various promotions, contests, and sweepstakes. To use the Company's services, you must register on the Website through the registration form provided, and freely and expressly consent to the processing of your data, this Privacy Policy, and our Cookie Policy. In this regard, you may select, by checking certain boxes, at least three (3) areas of interest among the options provided by the Website. Additionally, if you wish, you may agree to the transfer of your anonymized data (anonymized through encryption and the use of an electronic pseudonym), so that we may combine it with other information and enrich the data. This process would be carried out through technical means in a fully anonymous and non-identifiable manner. The purpose of the data transfer is to combine information from different sources to increase information regarding areas of interest, which may have been defined directly, through browsing, or through other subscriptions, and to refine our advertising campaigns. All of this without prejudice to your privacy, which is guaranteed through the encryption and compartmentalization of your data. 3. PERSONAL DATA COLLECTED BY THE COMPANY The Company collects information in order to provide you with services, either directly, through the personal data you provide directly to the Company, or indirectly through your use of the Website and the services it provides (device-related information, log data, and physical location). In particular, the Company collects the following data from and about you: a. Data provided by the user in order to register for a Company service, through subscription forms. Subscription forms request personal data through mandatory or optional fields that the user must complete, such as their name, phone number, and email address, so that we can manage our mailing lists and send you personalized online advertising. Subscription to the mailing lists is carried out through the Hermes and Perseo tools. The sending of emails is managed by the Company, which first verifies your email address. To verify it, you will receive an email from the Company with the subject "Successfully registered for our exclusive offers newsletter" or similar in your inbox. We will use the data provided to send you advertising from our clients. Registration information may include, among other data, first name, last name, email address, gender, country, postal code, date of birth, areas of interest, and academic/professional details. At any time, you may revoke your consent or inform us that you have not subscribed to any of our services, following the instructions set out in Section 13 of this Privacy Policy. b. Social media information. If you access or register for a Company service through a social network, or connect a Company service to a social network, the data we obtain may include your user identity and/or the username you have associated with that social network, any information you allow the social network to share with us (such as your profile photo, email address, or friends lists), and any other personal data you have made public through that social network. These social networks may collect a great deal of personal data and information, such as the web pages you have visited and your IP address, and may install cookies on your device to enable the social network's services to function properly. The Company is not responsible for the security or privacy of the information collected by these third parties. You should read and understand the policies applicable to the third-party services you use, or that you access, before granting your consent to such third parties. You should also configure these services in line with your interests. When you access our services through a social network, or when you connect a Company service to a social network, you are authorizing the Company to obtain, store, and use such personal data and content, in accordance with this Privacy Policy. c. Information sent to the Company through a contact form. There is a contact form on the Website for inquiries, suggestions, and/or professional matters. If you contact us through this online form, we will use your email address to reply to you and send you the information you requested, where applicable. d. Activity data. When you access and interact with our Services, we may obtain certain information about those actions. For example, in order to enable your connection to the Company's services, our servers receive and store information about your terminal device and browser, potentially including your IP address, browser type, and other information about the software or hardware used. We may also install cookies and other tracking technologies (such as browser cookies, pixels, and beacons). These technologies may be used to obtain and store information about your use of our services, such as the pages you visit, the videos and other content you view, the searches you perform, and the ads shown to you. For more information, please visit our Cookie Policy. e. Information from other sources. We may supplement the information we collect with information from other sources, such as information publicly available on social networking services and commercially available sources. Your personal data will be retained for two (2) years from the date on which it was provided to the Company. We will use the data to fulfill the purposes for which it was collected. However, the retention period of your data will always be subject to your request to unsubscribe from the mailing list or blog subscription, unless there is a legitimate interest of the Company that prevails over your interests, or in order to bring legal action. At the end of the retention period, your personal data will be deleted, anonymized, or aggregated. 4. USE OF THE DATA COLLECTED BY THE COMPANY We use the personal data we collect from and about you to: a) Provide you with the Company's services; b) Measure, analyze, and improve our services and their features; c) Provide you with our customer support service and respond to your inquiries; d) Protect the rights of the Company and others, such as entities belonging to the Group or its employees, agents, contractors, licensors, and suppliers; users of the Company's services or third parties; and the Company's suppliers; e) Allow you to manage your browsing and alert settings; f) Allow you to participate and subscribe, where possible, to promotions, contests, and/or sweepstakes; g) Comply with applicable laws or legal proceedings and/or respond to requests from authorities or governmental bodies; h) Carry out corporate transactions (e.g., merger, sale, joint venture, assignment, transfer, or other disposal of all or part of the Company's business, assets, or shares, including those carried out as part of insolvency proceedings or other similar procedures). For example, if the Company is in the process of a merger or transfer of all or a substantial part of its business, the Company may disclose or transfer your personal data to the party or parties involved in such transaction, as part of that transaction; i) Allow you to log in to the Company's services through a social network; j) Send you (via email, SMS, phone, multimedia messaging services, calls, chat, and social networks, or other means of communication) offers, promotions, or other commercial communications related to services and/or products of the Company, Group entities, and/or third parties operating in the sectors or areas of interest indicated by you, where applicable, as well as other sectors that may be of interest to you (in accordance with the Website's criteria and/or your user profile and depending on your browser's cookie settings). You can read our Cookie Policy here; k) With your prior "consent," transmit or transfer your data to third parties for the purpose of carrying out commercial and telemarketing practices in various business sectors or areas of interest that may be of interest to you. Personal data may be used for segmentation and analysis purposes. Advertising may be sent by third-party companies. This processing is optional and applies only if you expressly agree to have your data transferred to third parties. The sectors or areas of interest mentioned above are as follows:

Finance Publishing Education Automotive NGOs IT Telecommunications Consulting Energy Medicine

Textiles Home Hygiene Health Beauty and Personal Care Products Furniture Food Collecting Music Videos

Hobbies Office Supplies IT Technology Travel Toys Jewelry Household Cleaning Products Insurance

For the sake of clarity, the Company will carry out permission e-mail marketing and direct marketing actions, telemarketing; will develop profiles and segmentations based on your data; and/or will combine files containing your data. On occasion, we carry out profiling to assess certain personal aspects of an individual, in particular to analyze or predict aspects relating to performance, personal preferences, interests, reliability, behavior, location, or movements, for the purpose of segmenting advertising campaigns in order to make them more effective, and thereby offer advertising that may be tailored to the user's interests. The Company collects data that is adequate, relevant, and not excessive in relation to the scope and purposes set out in this Privacy Policy. 5. PURPOSE OF DATA PROCESSING AND LEGAL BASIS Your data is collected and processed by the Company for the following purposes: • The data processing described in points a) to f) of Section 4 of this Privacy Policy is necessary for the provision of the Company's services. The personal data requested is mandatory, such that refusal to provide it will make it impossible to provide the contracted services. • The data processing described in point g) of Section 4 of this Privacy Policy is mandatory and is required in accordance with applicable law. • Point h) of Section 4 of this Privacy Policy is carried out based on the legitimate interest of the Company and its counterparties in carrying out the aforementioned economic activities. This data processing is not mandatory and you may object to it at any time, following the instructions set out in Section 13 of this Privacy Policy. • Point i) of Section 4 of this Privacy Policy is discretionary, although without your consent it is not possible to connect a social media account to the Company's services. To this end, without your consent, you will need to use a different mechanism to log in to the Company's services. • Section 4, points j) and k), is discretionary, although without your consent it is not possible for the Company and/or third parties to provide you with generic commercial communications about the Company's and/or third parties' services and/or products, or communications based on your interests and needs. On occasion, we segment advertising campaigns in order to make them more effective, through the creation of a profile. This type of profiling is carried out solely using the data that the data subject has themselves provided and consented to directly with the company, or through its website via the registration form (such as their name, phone number, and email address...), so that we can manage our mailing lists and send you personalized online advertising; under no circumstances will individuals be tracked across different websites, applications, and/or services. • With your prior "consent," transmit or transfer your data to third parties for the purpose of carrying out commercial and telemarketing practices in various business sectors that may be of interest to you. If you are interested in revoking your consent to the processing of your personal data or exercising your right to object to receiving commercial communications, please contact us at the addresses listed in Section 13 of this Privacy Policy or, in the case of the purposes set out in point i) of Section 4, click on the unsubscribe link available in any commercial communication. Please remember that, by checking the corresponding box, you are giving your free and express consent to receive advertising, to the transfer of your data to third parties, as well as to our Terms and Conditions, Privacy Policy, and Cookie Policy. In order to carry out direct marketing actions, the Company will enter into agreements with third parties. These third parties are suitable service providers, operating in the sectors set out in Section 4 of this Privacy Policy. These service providers will process the data following the Company's precise instructions and in strict compliance with legal regulations on personal data protection, information security, and other applicable regulations. In general, they will carry out tasks on behalf of the Company relating to your interest in certain products or advertising campaigns, as well as for the conversion of such campaigns into product purchases or service subscriptions. This will require providing your data to such third parties, so that they can carry out direct marketing actions. This data processing is based on the contractual relationship between the Company and you, following registration and consent to the processing of data. 6. TYPES OF DATA PROCESSING Your personal data is processed through both automated and non-automated means, and is protected by appropriate security measures, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing. In this regard, the Company uses appropriate administrative, technical, personnel, and physical measures to protect the personal data in its possession against loss, theft, and unauthorized use, disclosure, or modification. Our information security policies and procedures are closely aligned with international standards, which are widely accepted and regularly reviewed and updated as necessary to meet the needs of our business, technological changes, and regulatory requirements. The Company has designed a business continuity plan aimed at addressing any type of adverse and unexpected event, in order to safeguard the continuity of our service to our customers and protect our assets and personnel. We appropriately restrict access to personal information and implement the necessary measures and controls, including physical and monitoring measures, to store and transfer data securely. In addition, we require our employees and contractors to receive ongoing training in information security. However, please note that internet security measures are not impenetrable. 7. ACCESS TO YOUR PERSONAL DATA AND INTERNATIONAL DATA TRANSFERS The Company may share your personal data with the following categories of recipients, in compliance with and within the limits established by applicable law: • Third-party service providers, to whom the Company entrusts data processing activities, duly designated as data processors where required by applicable law. For example, cloud service providers, other Group entities, information technology service providers, experts, consultants, and lawyers, among others. You may request a list of our data processors at the addresses set out in Section 13 of this Privacy Policy. • Companies resulting from corporate transactions, such as possible mergers, spin-offs, or other transformations. • Partner companies. With your prior consent, the Company may share your personal data with partner companies in the media sectors indicated by you – mainly in accordance with Sections 2 and 4 of this Policy – in order to send you commercial communications. • Competent authorities, for the purpose of complying with applicable laws. Your personal data may be transferred to countries within and outside the European Economic Area ("EEA"). Certain countries outside the EEA have been recognized by the European Commission as providing an adequate level of data protection, in accordance with EEA standards. The full list of these countries is available at http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm. For transfers from the EEA to countries not considered adequate by the European Commission, we have put in place sufficient measures and appropriate safeguards, designed to protect your personal data and the transfer of your data, all in accordance with applicable data protection regulations, such as the standard contractual clauses adopted by the European Commission, pursuant to Articles 45 and 46 of the EU General Data Protection Regulation 679/2016 ("GDPR"). You have the right to request additional information about your personal data by contacting the Company at the addresses set out in Section 13 of this Privacy Policy. 8. AGE REQUIRED TO REGISTER ON THE WEBSITE AND ACCOUNT SECURITY Registration on the Website is limited to users over the age of eighteen (18). An authentication mechanism prevents registration by (a) those who do not enter their year of birth using valid characters, which must demonstrate that they are of legal age, and (b) those who do not expressly confirm that they are of legal age. By registering on the Website, you confirm that you are of legal age. All registration information you submit to create an account must be true, accurate, complete, and up to date. You acknowledge that you will be liable for any direct or indirect damages that may arise from any breach of this obligation. If the data provided belongs to a third party, you confirm that you have informed that third party of the matters set out herein and have obtained their consent to provide their data to the Company for the purposes specified in this Privacy Policy. You are responsible for maintaining the confidentiality of your password and for the use of your account. It is therefore essential that you do not share your password with anyone. You agree never to use the account, username, email address, or password of another member or subscriber. You agree to notify the Company immediately if you suspect any unauthorized use of, or access to, your account or password. 9. RIGHTS OF DATA SUBJECTS REGARDING THEIR DATA Through this Privacy Policy, we inform you that you have the right to exercise your rights, free of charge and whenever you deem appropriate, in accordance with applicable law, with respect to: • Access to your own personal data; • Rectification of inaccurate or incomplete data; • Erasure of your personal data; • Objection to the processing of your data; • Obtaining restriction of the processing of your data when any of the conditions set out in data protection regulations are met; and • Portability of your data. To exercise the above-mentioned rights, you may send your request by email to dpd@unsubscribeservices.com or by written communication addressed to Streamail, Calle Barquillo, 8, 2ª izq., 28004 Madrid. Please accompany your request with a copy of your ID document, in order to prove that you are the data subject. If you believe that the Company has infringed, or may have infringed, your rights under applicable data protection regulations, you may file a complaint with the relevant Supervisory Authority. In Spain, the Supervisory Authority is the Spanish Data Protection Agency (www.aepd.es), located at Calle Jorge Juan, 6, 28001 Madrid (Spain). 10. COMMERCIAL COMMUNICATIONS The content of communications sent by electronic means complies with the regulations established in the GDPR, Organic Law 3/2018, of December 5, on the Protection of Personal Data and the guarantee of digital rights ("LOPDGDD"), and Law 34/2002, of July 11, on information society services and electronic commerce ("LSSI"). These emails include a link to unsubscribe from our commercial communications, as well as instructions for you to follow should you wish to exercise your data protection rights, in accordance with Section 9 of this Privacy Policy. 11. INFORMATION SECURITY We take all organizational and technical security measures aimed at ensuring the confidentiality and integrity of your personal data. In this regard, administrative, organizational, technical, and physical precautions are intended to protect your personal data from loss, theft, misuse, unauthorized access, unauthorized transmission, and any improper modification or destruction. The data controller will take security measures appropriate to the nature of the data collected. The data collected will be stored confidentially and protected with a high level of security. The servers on which this data is stored comply with current security standards. They are protected against computer and physical attacks. However, despite all our efforts, we cannot guarantee that this protection is infallible against the inevitable risks that may arise during the transmission of personal data. 12. STATEMENT OF GOOD PRACTICES The Company complies with applicable legislation, in particular the provisions of the GDPR, the LOPDGDD, the Codes of Good Practice on Data Protection, and the LSSI. The Company does not send commercial communications by electronic means that have not been previously requested or authorized by the User in accordance with applicable legislation. The Company will terminate agreements with advertising companies or members of the affiliate network that engage in practices contrary to applicable legislation. 13. VALIDITY OF THE PRIVACY POLICY The Company may modify or update this Privacy Policy for any reason (including, among others, changes in applicable laws and related interpretations, decisions, opinions, and instructions relating to such applicable law). Please check the Effective Date at the top of this Privacy Policy to see when it was last revised. Any changes to the Privacy Policy will be notified, with sufficient advance notice, by publishing the updated Privacy Policy on the Website. Substantial modifications to this Privacy Policy that alter the nature of the processing or expand our rights to use the personal data we collect from you will be notified in advance, and we will give you a choice regarding our future use of such personal data, in accordance with applicable law. 14. APPOINTMENT OF A DPO. CONTACT US The company has appointed a Data Protection Officer (DPO). If you have any questions regarding this Privacy Policy, please contact us at the following addresses: • Email address: dpd@unsubscribeservices.com • Postal address: Streamail, Calle de Bohemios, 11 - pta c, plt 5, Madrid, 28041, Spain.