SIA ESTATE BASE

PERSONAL DATA PROCESSING POLICY

(Privacy Policy)

Estate Base Platform https://estatebase.ai/

Revised October 1, 2026. Effective from the date of publication on the Platform

Data Controller: SIA Estate Base, reg. No. 40203765991, legal address: st. Miera 87A-9, Riga, LV-1013, Republic of Latvia

Contents

1. General Provisions

2. Definitions

3. Categories of Personal Data and Sources of Obtaining Them

4. Purposes and Legal Grounds for Processing Personal Data

5. Use of Artificial Intelligence Technologies

6. Personal Data Recipients and Processors

7. Transfer of Personal Data Outside the EEA

8. Personal Data Retention Periods

9. Personal Data Security Measures

10. Rights of Data Subjects

11. Account Deletion

12. Cookies and Similar Technologies

13. Personal Data of Minors

14. Contact Information for Inquiries

15. Amendments to this Policy

16. Final Provisions

1. General Provisions

1.1. This Personal Data Processing Policy (hereinafter referred to as the "Policy") describes the personal data collected and processed by Estate Base Ltd., reg. No. 40203765991, registered office: Miera Street 87A-9, Riga, LV-1013, Republic of Latvia (hereinafter referred to as "Estate Base," "Operator," "we," or "Controller") in connection with providing access to the Estate Base digital platform, including the website, mobile applications, and the associated AI agent (hereinafter referred to as the "Platform"), the purposes for which and on what legal basis such data is processed, with whom it may be transferred, the storage period, and the rights of the data subject.

1.2. Capitalized terms used in this Policy and not otherwise defined in Section 2 have the meaning ascribed to them in the Platform Terms and Conditions of Service (hereinafter referred to as the "Terms") [https://estatebase.ai/policies/terms-of-service].

1.3. Using the Platform, including by registering an account, contacting an AI agent, or filling out forms on the Platform, means that the data subject has had the opportunity to review this Policy. This clause does not replace the separate consent of the data subject in cases where applicable law or this Policy requires such consent as an independent legal basis for processing.

1.4. Personal data is processed in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR), the Law of the Republic of Latvia on the Processing of Personal Data of Individuals, as well as other applicable laws of the Republic of Latvia and the European Union.

1.5. This Policy applies to the processing of personal data of: (a) Platform Users, regardless of account registration; (b) representatives of Partners interacting with the Operator; (c) individuals whose data is specified in real estate advertisements posted on the Platform directly by Users or Partners – hereinafter collectively, where applicable, "Data Subjects". Personal data that may be contained in advertisement information processed by the AI ​​agent from Sources is used by the Operator solely temporarily, in real time, to generate a response to the User's request and is not stored in the Platform Database.

2. Definitions

For the purposes of this Policy, in addition to the terms defined in the Terms, the following terms are used.

Personal data – any information relating to a directly or indirectly identified or identifiable individual.

Processing – any action or set of actions performed with personal data, including collection, recording, systematization, storage, modification, use, transfer, access restriction, deletion, or destruction.

Controller (Operator) – SIA Estate Base, which determines the purposes and methods of processing personal data processed in connection with the operation of the Platform.

Processor (Sub-processor) – an individual or legal entity processing personal data on behalf of and at the direction of the Controller under an agreement concluded with the Controller (in particular, providers of hosting, analytics, payment services, and artificial intelligence technologies).

Data subject – an individual whose personal data is processed by the Operator.

Consent - a voluntary, specific, informed, and unambiguous expression of the Data Subject's will.

Digital Profile – a profile of the User's preferences (in particular, preferred areas, price range, and property characteristics) voluntarily generated by the Platform, used to personalize offers and notifications.

3. Categories of Personal Data and Sources of Collection

The personal data specified in this section may be obtained by the Operator: directly from the Data Subject; from other Users and Partners; from Sources; automatically, by technical means, during use of the Platform; from the Operator's payment, analytics, and other technical service providers.

3.1. Data provided during account registration and use. Some technical data (IP address, country of connection, browser and device information) is processed by the Operator while the User is using the Platform, regardless of whether the account has been registered. During account registration and use, the Operator additionally processes the following: email address, password (if registered via email, this is encrypted, without the Operator's access to the password in plain text), the User's public name, a public avatar (provided by the relevant service when registering through third-party authentication services such as Google and/or Apple), time zone, and an account login log with date and time.

3.2. “Digital Portrait “and Search History Data. When using the personalization functionality, the Operator creates a digital portrait of the User based on the User's search queries and preferences (e.g., preferred area, price range, parking availability, and other criteria). This portrait is used to send the User suitable offers for real estate properties as they become available on the market. This functionality is available on a voluntary basis, and the User has the right to delete the generated digital portrait at any time and disable its further generation in their account settings, without affecting the storage of the history of interactions with the AI ​​agent.

3.3. History of interactions with the AI ​​agent. The Operator stores the content of the User's requests (prompts) to the AI ​​agent and the generated responses, including files and images uploaded by the User. Such data is used to provide responses, technical support, investigate failures and errors, and for the purposes specified in Section 4. The history of interactions with the AI ​​agent is saved regardless of whether the Digital Portrait generation function specified in Section 3.2 is disabled.

3.4. Technical and Security Data. To ensure the security, stability, and proper functioning of the Platform, the Operator processes IP addresses, account login information, device identifiers, and other technical data necessary to ensure security and prevent unauthorized access.

3.5. Data Contained in Ads Posted Directly on the Platform. The Operator may process personal data of individuals contained in such ads, including the name, telephone number, and email address of the seller, landlord, or other contact person, directly on the Platform by Users and Ad Partners. Such data may be displayed to Platform Users as part of the relevant ad.

3.6. Data Processed by the AI ​​Agent from Sources. When generating reference responses, the AI ​​Agent accesses publicly available information about real estate properties contained in the Sources. Such information is processed by the Operator temporarily, in real time, and solely to the extent necessary to generate a response to a specific User request. If the original listing on the Source contains personal information of individuals (name, phone number, or other contact information of the seller, landlord, or agent), such information is not stored by the Operator and is not displayed to Users in AI agent responses or search results on the Platform. The User is provided only with structured property characteristics (area, price, parameters, location), which do not allow for direct identification of the contact person.

To obtain contact information and directly contact the listing's copyright holder, the User is provided with a redirect link directly to the Source. Sources operate based on their own privacy policies; the Operator does not control their content and is not responsible for the legality of the initial posting of data on such platforms.

3.7. Payment Information. When registering for paid Services, payment information (bank card details and other data required for payment) is processed directly by the Operator's payment provider in accordance with the applicable payment processing architecture. The role of such a provider (as the Operator's processor or an independent controller for certain categories of payment data), as well as the volume of data actually transferred to the Operator, are determined by the terms of service and the agreement with the relevant provider.

3.8. Data voluntarily provided in correspondence with the AI ​​Agent. If the User voluntarily provides personal data of third parties or special categories of personal data in a request to the AI ​​Agent, which is not permitted by Section 7.2 of the Terms, such data will be processed by the Operator to the extent provided for the purpose of generating a response and in accordance with this Policy. The Operator does not collect such data intentionally and is not responsible for the legality of its provision by the User.

3.9. Cookies and Similar Technologies. The categories of data collected through cookies and similar technologies are described in Section 12.

3.10. Partner Data Provided for the Purpose of Confirming Legal Status. In cases stipulated by Section 9.4 of the Terms, the Operator has the right to request documents and information from Partners confirming their legal status, the availability of the necessary licenses, permits, or authorities for the placement of real estate. If the Partner is an individual or the documents provided contain personal data of representatives of a legal entity (name, contact information, details of documents of authority), such data is processed by the Operator solely to the extent necessary to verify the authenticity of the advertisements posted, the authority of the legal entity's representatives, and to prevent abuse, unauthorized access, and other threats to the security of the Platform.

4. Purposes and legal basis for processing personal data

4.1. The Operator processes personal data based on the legal basis provided for in Article 6(1) of the GDPR, applicable to each data category and processing purpose, as specified in the table at the end of this document.

4.2. The processing of personal data contained in advertisements posted directly on the Platform is carried out based on the Operator's legitimate interest in ensuring the functioning of the Platform, aggregating and structuring information about real estate properties, and providing Users with up-to-date data for searching and comparing properties. When assessing such legitimate interest, the following is taken into account, in particular: the fact that the relevant data was independently provided by the User or Partner when posting the advertisement on the Platform; the absence of the display of contact information of individuals directly to Users of the Platform; the ability of the Data Subject to contact the Operator with a request to limit or terminate processing in accordance with Section 10.

Short-term processing of personal data by the AI ​​agent when analyzing advertisements from Sources (Section 3.6) is also carried out based on the Operator's legitimate interest in providing the User with an accurate and up-to-date reference response to their request. The extent of interference with the Data Subject's rights is limited: processing occurs only once, at the time of responding to the User's request, without storing it in the Platform Database or displaying such data to the User.

4.3. Personal data processed on the basis of the Data Subject's consent (in particular, the creation of a digital profile, sending marketing messages, and the use of optional cookies) are processed only after such consent has been received. The Data Subject has the right to revoke consent at any time in the manner specified in Section 10, without affecting the lawfulness of processing carried out on the basis of consent prior to its revocation.

4.4. Electronic and other messages sent by the Operator to the User may be service-related (related to the execution of the contract and account operation, such as security notifications, confirmations of actions, and changes to the Terms or Policy) or marketing-related (in particular, newsletters, advertising materials, and notifications of new items corresponding to the User's digital profile). Service messages are sent on the basis of contractual fulfillment (Article 6(1)(b) of the GDPR) and do not require separate consent. Marketing messages are sent only with the User's consent, obtained separately from consent to the use of cookies, and can be revoked at any time using the method specified in the account settings or via the unsubscribe link in the relevant message.

5. Use of Artificial Intelligence Technologies

5.1. To implement the AI ​​Agent's functionality, the Operator engages third-party providers of generative artificial intelligence technologies as Processors, acting under agreements concluded with them, in particular the Google Gemini API (Google Cloud Infrastructure). The Operator reserves the right to further engage other providers of similar technologies.

5.2. User requests (text prompts and files in formats that allow them to be uploaded to the User's request) are transferred to the relevant AI technology provider solely for the purpose of generating a response in real time. In accordance with the relevant provider's terms of service, such data is not used by them for training or further training of artificial intelligence models.

5.3. The Operator does not transfer the User's personal data from their account profile to the AI ​​technology provider, unless the User voluntarily specifies such data directly in the request text or in uploaded files.

5.4. The Operator processes the User's interaction history with the AI ​​Agent for the purposes specified in Section 4, including ensuring and improving the quality of the Services, identifying and eliminating technical failures and errors, internal testing, analytics, and developing and improving the functionality of the Platform and the algorithms used. The interaction history may also be used to train and further train the Operator's internal algorithms in accordance with applicable data protection laws.

The AI ​​Agent's responses and related User requests may be selectively reviewed by authorized employees of the Operator for the purposes of quality control, technical support, and processing User requests. Employee access to the interaction history is granted exclusively to authorized persons and to the extent necessary for the relevant processing purposes.

5.5. The AI ​​Agent's functionality is not intended to make fully automated decisions that have legally significant or otherwise materially significant consequences for the Data Subject, without meaningful human intervention, within the meaning of Article 22 of the GDPR. Further information regarding the nature and limitations of the AI ​​Agent's functionality is provided in Section 12 of the Terms.

6. Personal Data Recipients and Processors

6.1. To ensure the functioning of the Platform, the Operator transfers personal data to a limited number of Processors acting on the basis of contracts or other legally binding agreements concluded with them, providing for the processing of personal data in accordance with applicable law:

(a) hosting and data storage service providers (currently Scaleway; backups are additionally performed using Hetzner and, if necessary, Amazon Web Services);

(b) payment provider Stripe for the purpose of processing payments for paid Services;

(c) web analytics, used only with the User's consent: the Operator's own Umami analytics, hosted on the Operator's servers with the hosting provider named in (a), whose data no third party receives; and Google Analytics 4 (Google Ireland Limited), with its advertising features switched off — see Section 5 of the Cookie Policy;

(d) generative artificial intelligence technology providers, including Google Gemini;

(e) legal, tax, or financial advisors, auditors, as well as courts and other dispute resolution bodies – in cases where this is necessary to comply with the Operator's legal obligations or to establish, exercise, or protect its legal rights and interests;

(e) The Operator has the right to engage additional Processors necessary for the functioning of the Platform, subject to compliance with the requirements of applicable data protection legislation and the conclusion of appropriate contracts or other data processing agreements with them. Up-to-date information on the engaged Processors of personal data may be provided to the Data Subject upon request submitted in accordance with Section 14.

6.2. The Operator has the right to disclose personal data to competent government agencies in cases stipulated by applicable law, including upon a reasoned request.

6.3. The Operator does not sell personal data to third parties or transfer personal data to third parties for their own direct marketing purposes without the express consent of the Data Subject.

7. Transfer of Personal Data Outside the EEA

7.1. The Controller stores and processes personal data, to the extent possible, within the European Economic Area (EEA). However, certain Processors specified in Section 6 may, as part of providing their services, process personal data using infrastructure located outside the EEA or access data from third countries, including in connection with the provision of technical support.

7.2. Where the processing of personal data involves transferring or making it available outside the EEA, such transfer will be carried out in accordance with the requirements of Chapter V of the GDPR, using the data transfer mechanism provided for by the GDPR, including, where appropriate, standard contractual clauses approved by the European Commission.

7.3. Further information about specific Processors involved in cross-border data transfers and the safeguards applied may be provided to the Data Subject upon request in accordance with Section 14.

8. Retention Periods of Personal Data

8.1. The Operator stores personal data for the period necessary to achieve the purposes specified in Section 4 and in accordance with the principle of storage limitation (Article 5(1)(e) of the GDPR). The applicable storage periods by data category are provided in the table below.

8.2. The Operator stores the history of interactions with the AI ​​Agent for the period specified in the table above and automatically deletes or anonymizes it upon expiration of the applicable retention period. Individual records may be deleted by the Operator prior to the expiration of the applicable retention period at the Data Subject's request, as described in Section 10.

8.3. Upon expiration of the applicable retention period, personal data is deleted or anonymized in such a way that the relevant individual cannot be identified.

9. Personal Data Security Measures

9.1. The Operator applies technical and organizational measures commensurate with the nature, volume, and risks of personal data processing, including: encrypted data transfer between the User's device and the Operator's servers using the TLS/SSL protocol; data storage in encrypted databases; storage of the User's password in encrypted (hashed) form, preventing the Operator from accessing the password in cleartext; role-based and need-to-know access control; data backup on a geographically distributed infrastructure; access logging and security monitoring; and other measures aimed at preventing unauthorized access, loss, modification, or disclosure of personal data.

9.2. In the event of a personal data security breach that could entail a risk to the rights of Data Subjects, the Operator shall notify the competent supervisory authority in the manner and within the timeframes stipulated by applicable law. In cases provided for by applicable law, the Operator will also notify the affected Data Subjects of such a breach.

10. Rights of Personal Data Subjects

10.1. In accordance with the applicable data protection legislation, the Data Subject has the right to: (a) obtain confirmation of the fact that their personal data is being processed and access thereto; (b) request the correction of inaccurate or incomplete personal data; (c) request the deletion of personal data in cases provided for by law; (d) request the restriction of the processing of personal data; (e) object to the processing of personal data carried out on the basis of the Operator’s legitimate interest; (e) receive their personal data in a structured, machine-readable format and transfer them to another controller in cases where the processing is carried out on the basis of consent or a contract using automated means; (g) revoke previously given consent to the processing of personal data at any time without affecting the lawfulness of the processing carried out before the revocation; (h) file a complaint with the data protection supervisory authority. (i) not be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning the Data Subject or similarly significantly affects them, except in cases provided for in Article 22 of the GDPR (see also Section 5.5).

10.2. To exercise these rights, the Data Subject may contact the Operator by email at support@estatebase.ai or through the appropriate form on the Platform or in the mobile application. The Operator will review the request and provide a response within one month of receipt of the request, with the possibility of extending this period by notifying the applicant.

10.3. A data subject who believes that the processing of their personal data by the Operator violates applicable law has the right to file a complaint with the State Data Inspectorate of the Republic of Latvia, address: 10 ... Elijas 17, Riga, LV-1050, Republic of Latvia, www.dvi.gov.lv, or to the supervisory authority of the EU Member State where they have their habitual residence, place of work or where the alleged infringement occurs.

11. Account Deletion

11.1. The User has the right to delete their account at any time using the method provided in the Platform interface or by contacting the Operator in accordance with Section 10.2.

11.2. After account deletion, the personal data of the User's profile (email address, public name, avatar, and related profile data) will be deleted by the Operator, with the exception of data required to be retained by applicable law.

11.3. After account deletion, the User's interaction history with the AI ​​Agent and related technical logs will not necessarily be deleted immediately if their continued storage is necessary for the purposes specified in Section 4 and for the periods specified in Section 8. Upon expiration of the applicable retention period, such data will be deleted or anonymized in such a way that the relevant individual cannot be identified.

12. Cookies and Similar Technologies

12.1. The Platform uses cookies and similar technologies to: (a) ensure the technical functioning of the Platform (strictly necessary cookies); (b) with the User's consent, conduct web analytics of Platform usage through the Operator's own self-hosted Umami analytics and Google Analytics; (c) with the User's consent, for marketing purposes, including the use of marketing pixels, should the Operator introduce them (none are used at present — see the Cookie Policy).

12.2. Strictly necessary cookies are installed without the User's consent, as they are essential for the basic technical functioning of the Platform. Other categories of cookies (analytical, advertising) are installed only after the User's consent, expressed via the cookie consent banner displayed upon the first visit to the Platform. The banner provides the ability to individually accept or reject all optional cookies, as well as customize consent for specific categories (manage settings). Optional cookies are not installed until consent is obtained.

12.3. The User has the right to change or revoke their consent to the use of optional cookies at any time through the settings available in the Platform interface or through their browser settings. The provision, change, or revocation of consent is automatically recorded by the Operator in the technical log (containing a timestamp and consent status) without storing the User's full personal data.

12.4. Detailed information on the categories of cookies used, specific providers, and the storage periods for each cookie is provided in a separate Cookies Policy available on the Platform. Unless otherwise specified in the cookie settings on the Platform or in the Cookies Policy, optional cookies are stored for no more than 12 (twelve) months from the date the User provides the relevant consent or until the User revokes their consent.

12.5. In addition to managing cookies through the Platform settings, the User can restrict or block cookies in the settings of their browser or device, as well as use independent advertising cookie management tools. Disabling certain categories of cookies may limit the availability of some Platform features.

13. Personal Data of Minors

13.1. The Platform is intended for use by adults (18 years of age and older) in accordance with Section 6.2 of the Terms, and the Operator does not process the personal data of minors. If the Operator becomes aware that personal data of a minor has been provided without the proper consent of a legal representative, the Operator will take reasonable steps to delete it.

14. Contact Information for Inquiries

14.1. For any questions related to the processing of personal data, the exercise of the rights of Data Subjects, or other matters regulated by this Policy, Data Subjects may contact the Operator:

• by email: support@estatebase.ai or info@estatebase.ai;

• at the Operator's legal address: Miera Street 87A-9, Riga, LV-1013, Republic of Latvia.

14.2. The Operator does not appoint a Data Protection Officer (hereinafter referred to as the DPO) unless the obligation to appoint one arises in accordance with Article 37 of the GDPR or other requirements of applicable law. Until the appointment of the DPO, the Operator can be contacted for all questions related to the processing of personal data using the contact information specified in Section 14.1. If a DPO is appointed, their current contact information will be published on the Platform.

15. Amendments to this Policy

15.1. The Operator reserves the right to amend or supplement this Policy at any time due to changes in the Operator's data processing practices, legal requirements, or for other justified reasons. The current version of the Policy is published on the Platform, indicating the effective date. The Operator will additionally notify registered Users of any material changes affecting the scope or purposes of personal data processing by email or via a notification in the Platform interface no later than 14 (fourteen) days prior to the changes taking effect.

15.2. Continued use of the Platform after the amendments take effect shall be deemed to constitute familiarization by the Data Subject with the updated version of the Policy. In cases where applicable law requires separate consent to the amended processing terms (in particular, if the purposes of processing based on consent are expanded), such consent shall be additionally requested by the Operator.

16. Final Provisions

16.1. This Policy is governed by the laws of the Republic of Latvia and directly applicable European Union law.

16.2. This Policy shall enter into force on the date of its publication on the Platform.