COOKIE INFORMATION ("COOKIE")

About data management with cookies used on HelloPay website and HelloPay app

A HelloPay Information Technology and Services Private Limited Company (registered office: 1037Budapest, Montevideo utca 10.; company registration number: 01-10-048364, registrar: Fővárosi Törvényszék Cégbírósága; tax number: 25155781-2-41, represented by Norbert Varga, CEO, e-mail address: dpo@hellopay.hu; hereafter: HelloPay or Data Controller) hereby informs the data subjects about the processing of data relating to cookies ("cookies") used during the use and enjoyment of the HelloPay website and HelloPay application in accordance with Regulation 2016/679 of the European Parliament and of the Council on the General Data Protection Regulation (hereinafter: GDPR) in line with.

HelloPay may unilaterally amend this Cookie Notice at any time. This Cookie Notice is published on the HelloPay website and is also available in the HelloPay app. This Cookie Policy shall enter into force upon its publication.

1. General information on how the cookies work

We use cookies and other various programs (hereinafter collectively referred to as "cookies") on the HelloPay website and HelloPay application in order to learn about users' needs and behaviour with the HelloPay website and HelloPay application and to use them to improve the HelloPay website and application, to compile anonymous statistics about visits to and use of the HelloPay website and application, and to send users targeted advertising messages.

A cookie is a small text file consisting of letters and numbers in the source code of a website, which the website uses to send information to the user's browsing device or browser and to access the data stored by the cookie on the user's browsing device.

2. What personal data do we process, for how long, what we use it for and under what authority?

The legal bases for our processing are:

6. the voluntary informed consent of the user to the processing of personal data pursuant to Article (1)(a) of the GDPR (hereinafter: Contribution);
7. the processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party pursuant to Article (1)(f) of the GDPR (hereinafter: legitimate interest).

The table below shows the purpose, legal basis, retention period and type of each cookie, broken down by cookie.

The cookies used on the HelloPay website and app are divided into three main categories:

1. Cookies required for the HelloPay website and app to work: without them, the HelloPay website and application will not function at all or not function as intended, these cookies are necessary for the HelloPay website and application to run. If the User blocks these cookies in his browser, the HelloPay website and application will not function properly.

HelloPay processes the cookies that are strictly necessary for the operation of the HelloPay website and app on the basis of Legitimate Interest pursuant to Article 6(1)(f) of the GDPR.

HelloPay's legitimate interest: it is in HelloPay's legitimate business interest that the HelloPay website and application function as intended and that the HelloPay website and application can be displayed to users. This requires the use of the cookies indicated above and the processing of personal data collected by them.

In the case of processing based on legitimate interest, the data subject may object at any time to the

data processing, in which case the Service Provider will no longer process your data.

A full copy of the balancing of interests test on data processing based on legitimate interests is available to data subjects on request. The request should be made to the above e-mail address.

1. Cookies for analytical and statistical purposes: these cookies allow HelloPay to measure visitor traffic to the HelloPay website and app, and to understand which products and activities are more popular than others. These cookies can be blocked by the User's browser or used by the User: https:\tools.google.com/dlpage/gaoptout. HelloPay uses the data collected by these cookies to optimize and improve the HelloPay website and application.

HelloPay processes this data on the basis of consent pursuant to Article 6(1)(a) of the GDPR.

In the case of consent-based processing, the data subject may withdraw his or her consent at any time.

1. Cookies for marketing and remarketing purposes: these cookies are set for marketing, advertising and promotional activities in order to allow HelloPay to track users' interests and to display relevant ads on the HelloPay website and app. Based on the data collected by these cookies, user profiles are created about users based on their browsing and app usage patterns. If the user does not allow these cookies, they will not receive targeted ads in the future. Data collected through the use of these cookies

for the purpose of direct marketing segmentation for the publication of targeted advertising. In addition, in order to ensure that users only receive ads that match their interests and are relevant to them, HelloPay uses the automatically collected data to segment and group users and advertising recipients.

HelloPay processes these cookies on the basis of consent in accordance with Article 6(1)(a) of the GDPR.

In the case of consent-based data processing, the data subject can withdraw his or her consent at any time in the browser settings, in which case HelloPay will not use the cookie in question and will no longer collect or process data with it.

3. Data transfers to third countries

HelloPay transfers personal data collected by cookies to the following third countries outside the EEA (European Economic Area) in connection with the processing of the cookies listed in section 2 above:

2020. Cookies placed by Google LLC ("Google"): Google is a company based in the United States. The United States does not provide the level of protection required under Chapter V of the EU General Data Protection Regulation 2016/679 ("GDPR") for data protection within the EEA, as ruled by the Court of Justice of the European Union in its judgment C-311/18 (Schrems II) of 16 July. Google uses the Data Privacy Framework ("DPF") certificate established between the European Union and the United States by the European Commission's Data Protection Compliance Decision adopted on 10 July 2023 pursuant to Article 45 of the GDPR to provide adequate safeguards for its data transfers outside the EEA. More information on this is available at the following links: https://www.dataprivacyframework.gov/list and https://policies.google.com/privacy/frameworks?hl=en-US.

Google data:

• Name: Google LLC
• address: 1600 Amphitheatre Parkway Mountain View, CA 94043, United States
• contact details for data protection issues: Privacy Help Center - Policies Help (google.com) and the contact details of Google's Data Protection Officer: Privacy Inquiry form - Policies Help (google.com)

2020. Cookies placed by Meta Platforms ("Meta", formerly Facebook): Meta is a company based in the United States. The United States does not provide the level of protection required under Chapter V of the GDPR for data protection within the EEA, as ruled by the Court of Justice of the European Union in Case C-311/18 (Schrems-II) of 16 July 2020. It is therefore necessary to provide adequate safeguards for data transfers to the United States. Meta uses the Data Privacy Framework ("DPF") certificate established between the European Union and the United States by the European Commission's Data Protection Compliance Decision adopted on 10 July 2023 pursuant to Article 45 of the GDPR to provide adequate safeguards for its data transfers outside the EEA. More information on this is available at the following links: https://www.dataprivacyframework.gov/list and https://www.facebook.com/privacy/policies/data_privacy_framework/.

Details of the Meta:

• name: Meta Platforms
• address: 1601 Willow Road Menlo Park, CA 94025, United States
• contact details for data protection issues: http://www.facebook.com/

4. Managing cookies in your browser

The user can set their browser to accept all cookies, reject all cookies or to notify the user when a cookie is received on the user's device. More information on the nature of cookies and how to disable them can be found, for example, on the following page: http://www.youronlinechoices.com/hu/.

For the most commonly used browsers, the menu items for managing cookies:

• Mozilla Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies- website-preferences
• Google Chrome: https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DDesktop& hl=en
• Internet Explorer: https://support.microsoft.com/en-us/help/17442/windows-internet- explorer-delete-manage-cookies

• Microsoft Edge: https://support.microsoft.com/en-us/help/4468242/microsoft-edge- browsing-data-and-privacy-microsoft-privacy
• Safari: https://support.apple.com/guide/safari/prevent-cross-site-tracking- sfri40732/mac

5. Rights and remedies

The user's data protection rights and remedies and their limitations are set out in detail in the GDPR (in particular Articles 15, 16, 17, 18, 19, 21, 22, 77, 78, 79 and 82 of the GDPR).

The user:

• use the cookie settings to turn cookies on and off,
• request information about what personal data is processed when cookies are used,
• request the rectification of your personal data processed when using cookies, and
• request the erasure or restriction of the processing of your personal data processed when using cookies.

Without prejudice to any other administrative or judicial remedies, the user has the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement, if the processing of personal data in the course of the use of cookies infringes the provisions of the GDPR.

Budapest, 2024. 07.09...