GDPR AND DATA PROTECTION NOTICE Last updated: 24 June 2026 Controller: VSA LTD Contact email: info@vsa.gr This notice explains how personal data is processed when you use this vehicle diagnostics platform. It is designed to reflect the actual operation of the software, including personal search history, saved solutions, verified solutions, community submissions, subscription-based sharing features, and internal management analytics. 1. WHO THIS NOTICE APPLIES TO This notice applies to registered users, workshop users, administrators, and any person whose personal data is entered into the platform by an authorized user. Users should not enter unnecessary personal data about drivers, customers or third parties into free-text fields. 2. PERSONAL DATA WE PROCESS Depending on how you use the platform, we may process: - account data, such as name, email address, role and authentication records; - subscription data, such as selected plan, plan status, billing-related identifiers and usage limits; - vehicle search data, such as make, model, year, fuel type, engine code, mileage, system, fault codes, problem descriptions, uploaded diagnostic context and search results; - saved solution data, such as your own solutions, confirmed working solutions, review status, contribution status and workshop identifier; - community verification data, such as whether a solution was verified, how many users verified it, and the email or account identifier stored to prevent duplicate verification and maintain an audit trail; - usage, product, moderation and support data, such as timestamps, exports, admin actions and query statistics; - internal management analytics derived from query history, such as monthly query totals, repair frequency patterns, solved repair trends, and top vehicle repair summaries based on make, model and fault-code combinations. 3. PURPOSES AND LEGAL BASES We process personal data for the following purposes: - to create and manage user accounts and provide access to the service; - to run diagnostic searches and store query history for the user account; - to save personal solutions and confirmed fixes for later retrieval; - to enable optional sharing, contribution, moderation and publication flows; - to manage subscriptions, plan entitlements, exports and usage limits; - to generate internal management dashboards, monthly operational statistics and repair trend insights for service monitoring, planning and business oversight; - to maintain platform security, prevent abuse, investigate issues and improve service quality; - to comply with legal obligations and maintain business records. The main legal bases are: - performance of a contract, where processing is necessary to provide the service requested by the user; - legitimate interests, where processing is necessary for security, fraud prevention, moderation, product analytics, service reliability, internal business reporting and maintaining the integrity of the community knowledge base; - consent or clear user action, where the user chooses to share or submit content to broader platform workflows. 4. HOW SEARCHES, CONFIRMED SOLUTIONS AND OWN SOLUTIONS ARE HANDLED A. Searches Your searches and diagnostic queries are stored in your account history so you can review them later. Search data may include vehicle details, fault codes, problem descriptions, AI summaries, ranked solutions, source links, verification status and related statistics. By default, searches are treated as private account content and are visible to the user and authorized administrators who operate or support the platform. B. Your own solutions When you save your own solution, the platform stores it in your personal solutions area. This includes the vehicle context, the problem description and the solution text you provided. By default, your own saved solution remains private to your account and platform administrators unless you choose to submit it to the platform review flow or unless automatic contribution applies under your plan configuration. C. Confirmed solutions When you mark a solution as verified or save a solution that worked for your search, the platform may record that confirmed fix against the relevant search. Depending on the action taken, the platform may also create or update a community knowledge entry using search context such as make, model, year, engine code, fault codes, problem description, root cause, steps and parts information. If a community verification record is created or updated, your email address or account identifier may be stored in verification logs or verifier lists so the system can prevent duplicate verification, maintain counts accurately and preserve the integrity of the community record. 5. SHARING OPTIONS BY SUBSCRIPTION PLAN The platform includes sharing and export options that depend on the subscription plan and current app configuration. Under the current configuration of this software: - Free plan: search history and saved solutions are stored for account use, but export features are not enabled by default and confirmed solutions are not automatically contributed to the community flow. - Basic plan: users may keep searches and solutions private, may export eligible records where the export feature is enabled for the plan, and may manually submit their own saved solutions for platform review. - Professional plan: includes the same core features as Basic and, under the current configuration, confirmed user solutions saved from a search may be automatically submitted to the platform's community review flow for approval. - Enterprise plan: includes the same sharing logic as Professional under the current configuration, including automatic submission of eligible confirmed solutions to the review flow, plus plan-based access to other enabled features. Important clarifications: - Manual submission: users can choose to submit their own saved solutions to the platform for review even when automatic contribution does not apply. - Automatic contribution: where enabled by plan configuration, the platform may automatically flag a confirmed user solution as submitted for platform review when it is saved from a diagnostic search. - Admin moderation: automatic submission does not necessarily mean immediate public publication. A solution may still remain pending, be reviewed by an administrator, and only then be approved for broader community use. - If the user does not choose to submit content, and automatic contribution does not apply, searches and own solutions remain private within the user's account area except for internal administrative access. 6. MANAGER DASHBOARDS AND TOP REPAIR INSIGHTS The platform may generate internal administrator dashboards that display monthly query totals, solved-query counts and top vehicle repair trends. These dashboards are intended for internal management use, service oversight, planning and performance monitoring. Such dashboards are produced from data already stored in the platform, including query dates, vehicle make and model, fault-code combinations and solution outcomes. They are intended to highlight operational patterns and repair trends rather than to publish user identities publicly. Access to these dashboards is restricted to authorized administrators. 7. RECIPIENTS OF DATA Personal data may be accessed by: - the data controller and authorized staff or administrators; - service providers involved in hosting, authentication, storage, analytics, email delivery and payment processing; - moderators or administrators reviewing user-submitted or auto-submitted solutions; - other users only where content is approved and shared into community features, and normally only to the extent included in the solution record or verification record. We do not intentionally publish private account content to other users unless it is submitted into a sharing workflow or otherwise processed according to the active product configuration. 8. EXPORTS, LINKS AND PLAN-BASED VISIBILITY The platform may provide plan-based export functions for search records and saved solutions, as well as plan-based visibility of external source links. If you export data, the exported copy becomes your responsibility. You must handle exported data lawfully, securely and in accordance with your own professional obligations. 9. RETENTION We retain personal data for as long as necessary to provide the service, maintain user history, manage subscriptions, enforce platform rules and meet legal, accounting and dispute-handling requirements. Private searches and saved solutions may remain in the account until deleted by the user, removed by an administrator, or no longer needed for the stated purposes. If content has been contributed to a community knowledge base, some records may need to be retained for audit, moderation, fraud prevention or system integrity reasons, even if a user later requests removal. Where feasible, personal identifiers can be minimized or removed while preserving the technical record. 10. USER RIGHTS Subject to GDPR and applicable law, users may have the right to: - access their personal data; - request correction of inaccurate data; - request deletion of data in appropriate circumstances; - request restriction of processing; - object to certain processing based on legitimate interests; - receive a copy of relevant personal data in a portable format where applicable; - lodge a complaint with a competent supervisory authority. Users may also contact the controller to ask how specific searches, saved solutions, confirmed solutions, community submissions or management analytics derived from their use of the platform are being processed. 11. SECURITY We use organizational and technical measures designed to protect personal data against unauthorized access, loss, misuse or unlawful alteration. However, no online system can guarantee absolute security, and users remain responsible for the data they choose to enter and share. 12. INTERNATIONAL TRANSFERS Where service providers or infrastructure involve processing outside the European Economic Area, transfers should be protected through appropriate safeguards, such as contractual protections or other lawful transfer mechanisms, where required. 13. CHANGES TO THIS NOTICE This notice may be updated from time to time to reflect product, legal or operational changes. Where changes materially affect user rights or sharing expectations, a new version may be published and renewed acceptance may be required. 14. CONTACT For privacy questions or GDPR requests, contact: VSA LTD Email: info@vsa.gr Website: www.vsa.gr 15. SUB-PROCESSORS AND DATA SHARING (UPDATE) We do not sell your personal data to advertisers or any other third party. To operate the platform we share limited, necessary data with the following categories of processors, each under a data-processing agreement: (a) cloud hosting and IT infrastructure providers; (b) AI/large-language-model providers, who process the diagnostic prompts and vehicle data you submit solely to generate AI-assisted responses; (c) payment processing providers (Stripe), who process billing data for subscriptions; (d) email-delivery providers, who send transactional and account emails. We may also disclose data to comply with a legal obligation, to protect the rights, property or safety of the company, our users or the public, to prevent fraud, and to competent public authorities, tax authorities, law enforcement or courts on lawful request. 16. USAGE AND TECHNICAL DATA In addition to the data described in Section 2, we automatically collect technical and usage data such as IP address, device type, operating system, browser, application version, and approximate location derived from your IP address, in order to secure the service, diagnose issues and improve performance. 17. SOCIAL SIGN-IN If you sign in using Google, we receive only the profile fields Google is authorised to share with us (typically your name, email address and profile photo). This data is stored as part of your account until you delete your account. 18. DIRECT MARKETING Where you have given consent, we may send you service updates or promotional communications by email or in-app notification. You may withdraw consent and opt out of marketing communications at any time, without affecting transactional or account-related emails. 19. CHILDREN'S PRIVACY This service is intended for professional/business use and is not directed at, and must not be used by, individuals under 15 years of age. If we become aware that we hold personal data of a person under 15 without appropriate consent, we will delete it. 20. ACCOUNT DELETION — WHAT HAPPENS If you delete your account, we delete or anonymise your personal data, subject to a limited retention period necessary for legal, tax, accounting or dispute-related obligations and to purge data from backups, which may take some time. Deleting your account also ends any active subscription and forfeits unused query credits or reward points. 21. INTERNATIONAL TRANSFERS — SAFEGUARDS Where a processor referenced in Section 15 processes data outside the European Economic Area, the transfer is based on an adequacy decision of the European Commission, on Standard Contractual Clauses approved by the European Commission, or on your explicit consent. Transfers based on consent alone may carry a higher risk due to the absence of an adequacy decision or equivalent safeguards in the destination country. 22. YOUR RIGHTS IN FULL AND HOW TO COMPLAIN In addition to the rights listed in Section 10, you have the right to be informed about the processing of your data (this notice), the right to data portability, and the right to withdraw consent at any time where processing is based on consent. If you are not satisfied with our response, you have the right to lodge a complaint with the Hellenic Data Protection Authority (Kifisias 1-3, 115 23 Athens, Greece, www.dpa.gr), or with the supervisory authority of your habitual residence or place of alleged infringement. 23. GOVERNING LANGUAGE This notice is provided in Greek and English. In case of any conflict or inconsistency between the two versions, the Greek version prevails.