> For the complete documentation index, see [llms.txt](https://docs.novalink.technology/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.novalink.technology/privacy-and-data-protection/gdpr-addendum-eu-+-uk.md). # GDPR Addendum (EU + UK) EU GDPR and UK GDPR provisions supplementing the Privacy Policy **Published notice — status, accuracy and right to amend.** This document is published by the Company in good faith for general information and transparency. It is current only as of its stated date and is provided “as is,” without warranty of completeness or accuracy; it may contain errors or omissions and does not constitute legal, financial, tax, or investment advice, an offer or solicitation, or any guarantee. The Company may revise, correct, update, supplement, or withdraw this document at any time without prior notice, and the version published on the NovaLink Transparency Portal is the controlling current version and supersedes any earlier copy. Where this document conflicts with a signed agreement between you and the Company, or with applicable law, that signed agreement or applicable law prevails. If you believe anything here is inaccurate or out of date, please contact so we can review it and, where appropriate, correct it. To the maximum extent permitted by law, the Company accepts no liability for any reliance placed on this document. **Document ID:** NL-GDPR-01 **Version:** 1.0 **Status:** Issued **Issuing entity:** Group-wide policy — adopted by each NovaLink entity listed in the Corporate Structure & Entity Register (NL-ORG-01). Data controllers: Ntech Link Technologies Ltd (NovaLink Store and web properties) and Auralink Nova Technology L.L.C (applications and network) **Applies to:** the NovaLink product, network and Nx1/Hx1 Home Stations, regardless of which Community Platform a participant joined through **The NovaLink entities:** Ntech Link Technologies Ltd, Co. No. 2195904 (Store Operator) · Auralink Nova Technology L.L.C, Dubai, Reg. No. 1607764 (Technology Provider) · NodeLink USA, Inc., Delaware, File No. 10606222 (US Distribution) **Effective date:** 22 May 2026 **Contact:** ### 1. Purpose and relationship to the Privacy Policy This addendum (the "GDPR Addendum") supplements the Company Privacy and Cookies Policy with provisions specific to the General Data Protection Regulation (EU) 2016/679 ("EU GDPR") and the UK General Data Protection Regulation ("UK GDPR", as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018). Where this Addendum is in conflict with the Privacy and Cookies Policy, this Addendum prevails for data subjects in the European Economic Area or the United Kingdom. ### 2. Identity of the controller Ntech Link Technologies Ltd, BVI Company Registration No. 2195904, is the data controller in respect of personal data of EEA and UK data subjects processed in connection with the NovaLink Platform. EU representative (under Article 27 GDPR): to be appointed. Target appointment date: 31 July 2026. The appointed representative's details will be published on the NovaLink Transparency Portal. UK representative (under Article 27 UK GDPR): to be appointed. Target appointment date: 31 July 2026. Data Protection Officer / DPO: . DPO appointment is in progress; in the interim, all DPO functions are performed by the Company Compliance Officer. ### 3. Lawful bases for processing — consolidated table The following consolidates the lawful-basis table in the Privacy Policy and clarifies application under the EU GDPR / UK GDPR: | Processing purpose | Lawful basis | Article | | ----------------------------------------------------------------------------------- | ----------------------------------------------------------- | -------------------------------------- | | Account creation, authentication, providing the Platform | Performance of a contract | Art 6(1)(b) | | Customer support, defence of legal claims | Legitimate interests | Art 6(1)(f) | | Service-related transactional communications | Legal obligation / contract | Art 6(1)(b) / (c) | | Marketing communications | Consent | Art 6(1)(a) | | KYC / AML record-keeping | Legal obligation | Art 6(1)(c) (BVI AML Regulations 2008) | | Cookies (essential) | ePrivacy strict-necessity exemption | ePrivacy Directive Art 5(3) | | Cookies (analytical/marketing) | Consent | ePrivacy Art 5(3); GDPR Art 6(1)(a) | | Operational telemetry from Nx1/Hx1 Home Station (no personal data of third parties) | Performance of contract with Node Operator | Art 6(1)(b) | | Disclosure to law-enforcement | Legal obligation | Art 6(1)(c); Art 6(1)(f) where wider | | International transfers to BVI and other non-EEA jurisdictions | Standard Contractual Clauses (Commission Decision 2021/914) | Chapter V GDPR | ### 4. International transfers Personal data of EEA and UK data subjects is transferred to the Company in the BVI and may be transferred to the Company subprocessors. The Company relies on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), including the UK Addendum to those SCCs issued by the UK Information Commissioner, for those transfers. A Transfer Impact Assessment has been conducted in respect of the BVI as a destination and is available to supervisory authorities on request. ### 5. Subprocessors The Company maintains a list of subprocessors, available on request from . The current list includes (illustrative; the live list is authoritative): | Subprocessor | Purpose | Country | Transfer mechanism | | ---------------------------------------------------------------------------------- | -------------------------------------- | ------------------- | ------------------------ | | Third-party KYC vendor (e.g., Sumsub, Onfido, Veriff — actual vendor as published) | Identity verification, AML screening | EEA, UK, USA | SCCs (where outside EEA) | | Cloud infrastructure provider (Coordination Plane) | Hosting of the Company control servers | EEA, USA, Singapore | SCCs (where outside EEA) | | OpenAI | AI Chatbot inference | USA | SCCs; OpenAI BAA / DPA | | E-mail delivery vendor | Transactional and marketing email | EEA / USA | SCCs (where outside EEA) | | Analytics provider | Product analytics | EEA | Within EEA | The Company notifies Users of a change in subprocessors with at least 30 days' prior notice via the Platform notification centre, and provides the right to object on legitimate grounds. ### 6. Data subject rights — process Requests under Articles 15 (access), 16 (rectification), 17 (erasure), 18 (restriction), 20 (portability), and 21 (objection) of the GDPR may be submitted to or via the in-platform "Privacy Requests" form. | Step | Timing | | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Acknowledgement | Within 5 business days | | Identity verification | Within 10 business days | | Substantive response | Within 30 calendar days (extendable to 90 days for complex requests under Art 12(3)) | | Appeal route | Right to lodge a complaint with the supervisory authority of the data subject's habitual residence; UK data subjects: Information Commissioner's Office (ICO) | ### 7. Article 22 — automated decision-making and profiling The Company does not, as at the date of this Addendum, make decisions about individual data subjects that produce legal or similarly significant effects solely on the basis of automated processing. Sanctions screening produces a candidate "hit" which is reviewed by a human Compliance Officer before any action is taken (see the Sanctions & OFAC Compliance Policy). ### 8. Breach notification A personal data breach within the meaning of Article 4(12) GDPR is reported to the relevant supervisory authority within 72 hours of the Company becoming aware of it, in accordance with Article 33, and to affected data subjects without undue delay in accordance with Article 34 where the breach is likely to result in a high risk to their rights and freedoms. ### 9. Records of processing (Article 30) The Company maintains records of its processing activities and makes those records available to supervisory authorities on request. ### 10. Children The Platform is not intended for, and not offered to, individuals under the age of 18, in line with Section 2.1 of the Terms and Conditions. Where the Company becomes aware that personal data of a child has been collected, it will be deleted promptly. ### 11. Changes to this Addendum Material changes are notified by e-mail and posted on the NovaLink Transparency Portal. ### 12. Contact Data subject requests: | Supervisory authority concerns: contact the supervisory authority of your habitual residence. *Status note. The Article 27 EU and UK representative appointments and the formal DPO appointment are in active commissioning. Target completion 31 July 2026. In the interim, the Company performs the substantive obligations through its Compliance Officer.*