This document provides information to data subjects under Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR") and, where applicable, under the Irish Data Protection Act 2018.

1. Controller and data subjects

ELEVIA LIMITED, a private company limited by shares incorporated under the laws of Ireland, registered with the Companies Registration Office under number 819393, with its registered office at 77 Camden Street Lower, Dublin, D02 XE80, Ireland ("Elevia" or the "controller"), is the controller of personal data to the extent it processes personal data for its own purposes.

Elevia may process personal data of the following categories of data subjects in particular: clients and potential clients of Elevia in pre-contractual relationships, contractual or authorised representatives of clients and potential clients, employees, contractors or users of clients who have been granted access to the platform, contractual clients of Elevia and their contact persons, website visitors, marketing communication recipients or event participants, other persons communicating with Elevia or using its services.

Where Elevia processes personal data on behalf of a customer when providing the platform, it normally acts as processor and the processing terms are governed by the relevant Data Processing Addendum (DPA).

2. Processors and recipients

In connection with the processing of personal data, Elevia may use processors and other suppliers. Such persons are engaged only to the extent necessary to provide, secure and support the services and after appropriate assessment of their technical and organisational measures.

The current list of processors or subprocessors may be published on www.elevialms.com, included in contractual documentation or made available upon a reasonable customer request.

3. Purposes and legal bases of processing

Purpose	Legal basis
Newsletter and marketing communication	Consent under Article 6(1)(a) GDPR or legitimate interest under Article 6(1)(f) GDPR, where applicable.
Direct marketing and cookies	Consent for non-essential cookies and legitimate interest or performance of a contract for essential and service communications, depending on the specific use.
Pre-contractual and contractual relationships, quotations, orders and provision of services	Performance of a contract or steps prior to entering into a contract under Article 6(1)(b) GDPR.
Accounting, tax and corporate agenda	Compliance with a legal obligation under Article 6(1)(c) GDPR, in particular Irish and EU tax, accounting and corporate regulations.
Platform operation, account administration, security, logging and support	Performance of a contract under Article 6(1)(b) GDPR and legitimate interest under Article 6(1)(f) GDPR in security, prevention of misuse and proper provision of the service.
Establishment, exercise or defence of legal claims	Legitimate interest under Article 6(1)(f) GDPR.
Website analytics and service improvement	Consent or legitimate interest depending on the specific tool and cookie settings.

Elevia’s legitimate interests include in particular protection of property and systems, service security, prevention of misuse, customer care, information about services and defence of legal claims.

4. Scope of personal data processed

Elevia processes personal data to the extent necessary for the relevant purpose. This may include identification and contact details, job or organisational role, order data, billing data, login and audit logs, service usage data, technical data, IP address, communication data and data contained in documents or content uploaded to the platform. When using the website or platform, technical data may be stored automatically, such as IP address, browser type and version, operating system, access time and basic diagnostic data for security, statistics, system administration and service improvement purposes.

5. Disclosure, transfer and retention of personal data

Personal data may be disclosed, to the necessary extent, to public authorities, courts, legal advisers, accountants, auditors, IT, hosting, cloud, analytics, communication and payment service providers. If personal data is transferred outside the EEA, Elevia will use an appropriate transfer mechanism under the GDPR, in particular an adequacy decision, standard contractual clauses or another lawful mechanism.

Category	Indicative retention period
Accounting, tax and corporate records	usually 6 years or longer if required by law or ongoing proceedings
Contracts and business documentation	for the term of the contract and usually 6 years thereafter, or longer for legal claims
Dispute files and legal claims	for the period necessary to establish or defend claims and during proceedings
Consent-based marketing	until consent is withdrawn or the purpose ends
Technical and security logs	for a period proportionate to the security purpose, usually in retention cycles configured for the platform

6. Data subject rights

Subject to the conditions set out in the GDPR, a data subject has the right of access, rectification, erasure, restriction of processing, data portability, objection to processing, withdrawal of consent and the right to lodge a complaint with a supervisory authority. The Irish supervisory authority is the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland. Data subjects may exercise their rights or ask privacy questions at: hello@elevialms.com.

This document is available on the Elevia website and may be updated from time to time. Dublin, 23 June 2026.