Privacy Policy

SOAX LTD — Privacy Policy.

We respect Your privacy and are committed to protecting Your personal data. This Privacy Policy explains how we collect, use, manage and safeguard it.

Please read this Privacy Policy carefully together with our Terms of Use and Cookie Policy. Unless otherwise defined, capitalised terms used in this Privacy Policy have the same meaning as those set out in the Terms of Use.

1. Introduction

This Privacy Policy explains how SOAX LTD ("SOAX", "we", "us" or "our") collects, uses, processes and protects personal data in connection with our Platform and Services.

This Privacy Policy applies to the processing of Your personal data in the following situations:

• when You browse or interact with our Site or Platform;

• when You create, register for and manage an Account;

• when You access or use our Platform and Services;

• when You purchase Subscriptions or Top-Up Credits, or otherwise engage in billing and payment processes;

• when You communicate with us, including via customer support channels;

• when You receive or interact with our marketing communications or participate in promotional activities.

Our Platform is primarily intended for business use; however, individual Users may also access the Platform. In such cases, the provision of personal data may be necessary for entering into or performing a contract. If You do not provide such data, we may not be able to provide access to the Platform and Services.

2. Who we are (Data Controller)

For the purposes of applicable data protection laws, including the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, and the EU General Data Protection Regulation ("GDPR"), the controller of Your personal data is:

SOAX LTD, a company incorporated in the United Kingdom (registration number 11828506), with its registered address at The Charter Building, Uxbridge, England, UB8 1JG.

If You have any questions regarding this Privacy Policy or how we process Your personal data, You can contact us at:

• email: support@soax.com

• or via the "Contact Us" form available on our Site.

3. Categories of Data Subjects

We process personal data relating to the following categories of individuals:

• Site visitors — individuals who access or browse our Site without creating an Account or signing in. In such cases, data may be collected automatically through cookies and analytics tools and is not linked to an identified individual unless they voluntarily provide their details (for example, by submitting a form).

• Platform users (customers) — individuals who create an Account and use our Platform and Services. This includes users whose activity on the Platform, including Services usage and interactions, is processed and stored in our internal systems and third-party services.

• Prospective customers (leads) — individuals who express interest in our Platform and Services, including by submitting their contact details through forms, chat, or other communication channels, as well as individuals we may contact in a business context. Their data may be processed in customer relationship management (CRM), communication, and marketing tools. Where applicable, such data may be linked to an existing Account.

• Billing contacts — individuals responsible for billing, payments, or financial administration in relation to an Account, where such person is different from the platform user.

• Support correspondents — individuals who contact us for support or other inquiries via email, chat, or other communication channels. Where applicable, such data may be linked to an existing Account.

4. Categories of Personal Data

Depending on how You interact with our Platform and Services, we may collect and process the following categories of personal data:

Account Data

Information provided during registration and used for Account management, including:

• name and surname;

• email address;

• phone number;

• business address (where applicable);

• Account identifier (Account ID);

• date of registration;

• Account status (active / suspended).

Login and Authentication Data

Information related to access to and use of the Platform, including:

• login credentials (e-mail);

• third-party authentication identifiers (authentication is handled via third-party providers such as WorkOS);

• authentication timestamps;

• session lifecycle data (including login and logout time, session duration);

• IP address and time zone;

• device and application metadata (such as operating system, browser type and version, and device model);

• system event logs and error logs.

Billing and Transaction Data

Information related to purchases and payments, including:

• billing contact name and details;

• billing address;

• legal entity details (where applicable);

• tax identification number;

• Plans, Subscriptions terms and Top-Up Credits purchased;

• Tiers of Services consumed (Pricing Tiers, Traffic Tiers) and other usage data relevant for billing purposes;

• order identifiers;

• purchase and renewal dates;

• amounts charged and currency;

• payment status (including successful, failed, refunded or chargeback transactions);

• payment provider information, payment tokens and related payment and transaction metadata;

• tax-related information, including tax country and VAT applied;

• billing history, including invoices, credit notes and refunds.

KYC / KYB Data

Information collected for identity verification and compliance purposes, including:

• identity and contact details of individuals (including authorised representatives, where applicable);

• identification document data (where required);

• date of birth and residential address (where required);

• beneficial ownership information (where applicable);

• verification results, status and risk indicators;

• provider metadata associated with verification and compliance checks;

• information provided in connection with access, verification, compliance or use-case review requests, including descriptions of intended use cases, target resources, business justification and supporting materials.

Usage Data (Request / Usage Logs)

Information generated in connection with the use of our Platform and Services, including metadata relating to individual requests processed through our Platform:

• user and organisation identifiers;

• proxy package and session identifiers;

• timestamp of a request;

• ingress and egress IP addresses;

• metadata derived from IP addresses;

• target domain (hostname and/or IP address only);

• request/package configuration and usage-metering parameters, including applicable Tiers of Services consumed (Pricing Tiers, Traffic Tiers) and Burn Rates;

• network type;

• traffic volume (in bytes);

• performance metrics and error codes.

We do not inspect or store the content of communications or request payloads. We do not store full URLs beyond the hostname level. Our infrastructure is not technically designed to retain such content.

Security Logs

Information collected for security monitoring and incident detection, including:

• failed login attempts;

• Account lock events;

• suspicious activity indicators;

• firewall and access control logs;

• internal administrative access logs;

• verification logs.

Marketing Data

Information used for marketing and outreach purposes, including:

• name and contact details (such as email address and phone number);

• company name (where applicable);

• marketing preferences;

• interaction with marketing communications;

• campaign and event participation data;

• commercial engagement data, including information about purchases, subscriptions and spending history;

• aggregated or derived product interest and use-case signals.

Communication Data

Information provided when communicating with us, including:

• name and contact details;

• content of communications (such as emails, chat messages and support tickets);

• attachments.

Cookies and Tracking Data

Information collected automatically when You interact with our Site or Platform, including:

• IP address;

• device and browser metadata;

• access timestamps;

• referral sources;

• interaction data (such as clicks, navigation events and user preferences);

• stored preferences;

• cookie identifiers and similar tracking technologies;

• tracking pixels.

For more detailed information about the types of cookies we use, their purposes and how You can manage Your preferences, please refer to our Cookie Policy.

We may also create aggregated or anonymised data that no longer identifies individuals. Such data is not considered personal data and may be used for analytics, product improvement and business purposes.

5. Sources of Personal Data

We collect personal data:

• directly from You when You use our Platform and Services, including when You register an Account, make a purchase or communicate with us;

• automatically from Your devices when You interact with our Platform and Services, including through cookies, logs and technical systems;

• from third parties, where applicable, including:

  • identity verification providers;

  • payment and billing providers;

  • analytics and marketing partners;

  • fraud prevention and security service providers.

6. How we use Your data (Purposes)

Depending on how You interact with our Platform and Services, we use the categories of personal data described above for the following purposes:

Provision of Services

We use personal data, in particular usage data, login and authentication data, and Account data, to provide access to and operate our Platform and Services, including:

• routing and delivery of requests through our infrastructure;

• managing traffic and ensuring service availability;

• enforcing usage limits, configurations and access rights;

• monitoring performance, diagnosing technical issues and ensuring service continuity.

Account Management

We use personal data, in particular Account data and login and authentication data, to create, maintain and manage Accounts, including:

• registration and onboarding;

• authentication and access control (including via third-party identity providers);

• Account administration and user identification;

• management of Account settings and preferences.

Billing and Payments

We use personal data, in particular billing and transaction data, Account data and relevant usage data, to manage billing and financial operations, including:

• processing payments and managing transactions;

• calculating usage-based charges and applying Tiers of Services consumed (Pricing Tiers, Traffic Tiers);

• managing Subscriptions, Plans, Credits and renewals;

• issuing invoices and maintaining accounting records;

• handling refunds, disputes and chargebacks;

• conducting internal financial reporting;

• complying with tax and financial reporting obligations.

Identity Verification (KYC / KYB)

Where applicable, we use personal data, in particular KYC / KYB data and Account data, to verify identity and assess eligibility for certain Services or payment methods, including:

• performing identity and business verification checks;

• assessing risk and preventing fraud;

• complying with applicable regulatory and contractual requirements.

Security and Abuse Prevention

We use personal data, in particular login and authentication data, usage data and security logs, to ensure the security of our Platform and Services, including:

• detecting, preventing and investigating fraud, abuse and unauthorised use;

• monitoring system activity and enforcing acceptable use policies;

• identifying suspicious behaviour and mitigating security risks;

• protecting the integrity of our infrastructure and users;

• enforcing our Terms of Use and Acceptable Use Policy.

Analytics and Product Improvement

We use personal data, in particular usage data, cookies and tracking data, communication data and Account data, to analyse and improve our Platform and Services, including:

• understanding how users interact with the Platform and Services;

• analysing usage patterns and performance metrics;

• conducting internal analytics and business reporting;

• capacity planning;

• improving functionality, reliability and user experience;

• developing new features and optimising existing Services.

Customer Support and Communications

We use personal data, in particular communication data and Account data, to communicate with users and provide support, including:

• responding to inquiries, requests and complaints;

• troubleshooting technical issues;

• providing service-related communications and updates;

• managing customer relationships (CRM);

• maintaining records of communications for quality assurance and support continuity.

Marketing and Communications

We use personal data, in particular marketing data, Account data, relevant usage data and cookies and tracking data, to communicate with users about our Platform and Services and manage marketing activities, including:

• sending newsletters, product updates and promotional communications;

• managing marketing preferences and opt-out requests;

• analysing engagement with marketing campaigns and improving outreach;

• analysing product interest, customer segments and demand for specific Platform features or access configurations.

Legal and Compliance

We use personal data, in particular Account data, billing and transaction data, KYC / KYB data, usage data and security logs, to comply with legal obligations and protect our rights, including:

• complying with applicable laws and regulations (including AML, tax and accounting requirements, regulatory obligations relating to communications metadata);

• responding to lawful requests from authorities;

• establishing, exercising or defending legal claims;

• enforcing our Terms of Use and other contractual rights.

7. Legal Bases for Processing

We process Your personal data only where we have a valid legal basis to do so under applicable data protection laws, including the UK GDPR, the EU GDPR and the Data Protection Act 2018.

Depending on the context in which Your personal data is processed, we rely on one or more of the following legal bases:

Performance of a Contract

We process personal data where it is necessary for the performance of a contract with You or to take steps at Your request prior to entering into a contract.

This includes, in particular:

• providing access to and operating our Platform and Services, including routing and delivery of requests;

• creating and managing Accounts;

• processing payments and managing Subscriptions, Credits and billing;

• providing customer support and handling service-related communications.

Compliance with Legal Obligations

We process personal data where it is necessary to comply with legal and regulatory obligations.

This includes, in particular:

• compliance with applicable laws and regulations, including tax, accounting and reporting obligations;

• performing identity verification (KYC / KYB), where required;

• complying with applicable legal and regulatory obligations relating to communications metadata and other service-related records, where such obligations apply;

• complying with anti-money laundering (AML) and fraud prevention requirements;

• responding to lawful requests from authorities and regulators.

Legitimate Interests

We process personal data where it is necessary for the purposes of our legitimate interests, provided that such interests are not overridden by Your rights and freedoms.

Our legitimate interests include, in particular:

• ensuring the security of our Platform and Services, including detecting and preventing fraud, abuse and unauthorised use;

• monitoring system performance and ensuring the stability and reliability of our infrastructure;

• analysing how our Platform and Services are used, including internal analytics and business reporting;

• improving and developing our Platform and Services, including through product analytics and capacity planning;

• enforcing our Terms of Use and protecting our legal rights.

You may contact us to obtain further information about our legitimate interest assessments.

Consent

Where required by applicable law, we process personal data on the basis of Your consent.

This includes, in particular:

• sending marketing communications, where consent is required;

• the use of cookies and similar tracking technologies that are not strictly necessary for the operation of the Platform.

You may withdraw your consent or update your marketing preferences at any time by contacting us using the contact details set out in this Privacy Policy or, where available, by using the unsubscribe link or preference-management tools provided in our communications, on the Site or on the Platform. This will not affect the lawfulness of processing carried out before the withdrawal of consent.

8. How we share Your data

We may share Your personal data with third parties where necessary for the provision of our Platform and Services, for business operations, or to comply with legal obligations. We share personal data with such recipients only where this is necessary for the purposes described above and in accordance with the applicable legal bases.

Such third parties may act as processors (processing data on our behalf) or, in certain cases, as independent controllers. In particular, some providers (such as payment and identity verification providers) may act as independent controllers in relation to the personal data they process in accordance with their own privacy policies.

We share personal data with the following categories of recipients:

Infrastructure Providers

We use cloud and infrastructure providers to host and operate our systems and data processing environments.

This includes providers such as Servers.com and ClickHouse Cloud, which may process login and authentication data, billing and transaction data, Account data, usage data and security logs.

Identity and Access Management Providers

We use identity and authentication providers to manage user access and authentication.

This includes providers such as WorkOS, which may process Account data, login and authentication data, security logs, KYC / KYB data, cookies and tracking data.

Billing, Payment and Accounting Providers

We use third-party providers to process payments, manage Subscriptions, support billing operations and maintain related accounting and tax processes.

This includes providers such as Stripe, Orb, Eukapay, Anrok and Xero, which may process billing and transaction data, Account data and relevant usage data.

Identity Verification Providers

We use third-party providers to perform identity verification and compliance checks.

This includes providers such as SumSub, which may process Account data, KYC / KYB data and security logs.

Analytics Providers

We use analytics providers to understand how our Platform and Services are used and to improve performance.

This includes providers such as Posthog, which may process Account data, login and authentication data, billing and transaction data, security logs and marketing data.

CRM and Customer Support Providers

We use customer relationship management and support tools to manage communications and provide support.

This includes providers such as Attio and Pylon, which may process Account data, KYC / KYB data, communication data and marketing data.

Marketing and Advertising Providers

We use marketing and advertising partners to communicate with users and analyse campaign performance.

This includes providers such as Flodesk, which may process Account data and marketing data.

Internal Tools and Business Systems

We use internal tools and business systems to support our operations, including communication, documentation, reporting, email, issue tracking and internal analytics. These tools may incidentally contain or process personal data where such data is included in communications, documentation or internal workflows.

This includes tools such as Slack, Notion, Google and Linear.

Legal and Regulatory Authorities

We may disclose personal data to courts, law enforcement agencies, regulators or other public authorities where required by applicable law or to protect our legal rights.

Business Transfers

We may share or transfer personal data in connection with any actual or potential merger, acquisition, reorganisation, asset sale or other corporate transaction.

Business Partners

We may share data with business partners, resellers or affiliates where necessary to provide access to or distribute our Platform and Services.

Professional Advisors

We may share personal data with our professional advisors, including legal, tax and audit advisors, where necessary for compliance, risk management and business operations.

9. International Data Transfers

Due to the global nature of our business and the use of third-party service providers, Your personal data may be transferred to, and processed in, countries outside the United Kingdom and the European Economic Area (EEA).

In particular, some of our service providers are located in the United States and other jurisdictions where data protection laws may differ from those in the United Kingdom or the European Economic Area (EEA).

Where we transfer personal data to such countries, we ensure that appropriate safeguards are in place to protect Your personal data in accordance with applicable data protection laws.

These safeguards may include:

• the use of Standard Contractual Clauses (SCCs) approved by the European Commission, including, where applicable, the UK Addendum, or the UK International Data Transfer Agreement (IDTA);

• reliance on adequacy decisions, where applicable;

• the implementation of additional technical and organisational measures to ensure an adequate level of protection.

You may request further information about the safeguards we apply to international data transfers by contacting us using the details set out in this Privacy Policy.

10. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying legal, regulatory, accounting or reporting requirements.

The retention periods applied by us depend on the type of personal data and the context in which it is processed.

Account Data

We retain Account data for the duration of the contractual relationship with You and thereafter for a limited period, as necessary for legitimate business purposes, including fraud prevention, dispute resolution and compliance with legal obligations.

Where You request deletion of Your Account, we will delete or anonymise Your Account data, unless retention is required or permitted by law.

Login and Authentication Data

We retain login and authentication data for as long as Your Account is active and for a limited period thereafter, including for security monitoring and incident investigation.

In particular, certain authentication data may be retained for up to one (1) year after Account deletion for the purposes of preventing fraud and detecting repeated abusive activity.

Billing and Transaction Data

We retain billing and transaction data in accordance with applicable accounting and tax laws and regulatory requirements.

Certain billing records, including payment data, may be retained for longer periods where required for financial reporting, audit or legal purposes.

KYC / KYB Data

We retain KYC / KYB data for the duration of the customer relationship and for a period thereafter as required for compliance with legal and regulatory obligations and audit purposes.

In particular, certain KYC / KYB data may be retained for up to one (1) year after Account deletion for the purposes of preventing fraud.

Usage Data (Request / Usage Logs)

We retain usage data in accordance with operational, legal and security requirements.

• Individual request data (raw logs), including communications metadata, where applicable, is subject to restricted operational access and is typically retained for a limited period for service operation, troubleshooting, fraud detection and compliance with applicable legal obligations. Where required by applicable law, certain communications metadata may be retained for up to two (2) years.

• Aggregated usage data may be retained in pseudonymised form for up to five (5) years for analytics, performance monitoring, capacity planning, product improvement and business reporting purposes, based on our legitimate interest in operating, maintaining, and improving the Platform. Following expiry of this period, or following Account deletion (whichever is earlier), such data is anonymised or deleted.

Security Logs

We retain security logs for as long as necessary to ensure system security, detect and investigate incidents and comply with legal obligations.

Certain security-related data may be retained for up to one (1) year after Account deletion for fraud prevention and monitoring purposes.

Communication Data

We retain communication data for as long as necessary to handle inquiries, provide support, manage the customer relationship and resolve disputes.

Marketing Data

We retain marketing data until You delete Your Account, withdraw Your consent or object to receiving marketing communications, unless longer retention is justified for legal or operational purposes.

Cookies and Tracking Data

We retain cookies and similar tracking data in accordance with the applicable cookie lifetimes and Your preferences.

Further details are available in our Cookie Policy.

11. Your Data Protection Rights

If You are located in the United Kingdom or the European Economic Area (EEA), You have certain rights in relation to Your personal data under applicable data protection laws, including the UK GDPR and the GDPR.

Please note that we do not sell personal data and do not use it for automated decision-making or profiling that produces legal or similarly significant effects.

How to Exercise Your Rights

To exercise Your rights, please contact us using the contact details set out in this Privacy Policy.

We will respond to Your request as soon as reasonably practicable and, in any event, within the time limits prescribed by applicable law.

In certain cases, we may need to verify Your identity before processing Your request.

Your Rights

You have the following rights:

Right of access. You have the right to obtain confirmation as to whether we process Your personal data and, where that is the case, to access that data and information about how it is processed.

Right to rectification. You have the right to request that we correct inaccurate or incomplete personal data.

Right to erasure. You have the right to request the deletion of Your personal data in certain circumstances, including where:

• the data is no longer necessary for the purposes for which it was collected;

• You withdraw Your consent (where processing is based on consent) and there is no other legal basis;

• You object to processing and there are no overriding legitimate grounds;

• the data has been unlawfully processed.

Right to restriction of processing. You have the right to request that we restrict the processing of Your personal data in certain circumstances, including where:

• You contest the accuracy of the data;

• the processing is unlawful and You oppose erasure;

• You have objected to processing and verification is pending;

• the data is no longer necessary for the purposes for which it was collected, but is required by You for the establishment, exercise or defence of legal claims.

Right to data portability. Where processing is based on consent or contract and carried out by automated means, You have the right to receive personal data that You have provided to us in a structured, commonly used and machine-readable format, and to transmit it to another controller, where technically feasible.

Right to object. You have the right to object to processing of Your personal data where such processing is based on our legitimate interests, unless we can demonstrate compelling legitimate grounds to continue such processing.

You also have the right to object at any time to the processing of Your personal data for direct marketing purposes.

Right to withdraw consent. Where we rely on Your consent to process personal data, You have the right to withdraw your consent at any time by contacting us using the contact details set out in this Privacy Policy. This will not affect the lawfulness of processing carried out before the withdrawal.

Right to lodge a complaint. You have the right to lodge a complaint with a competent supervisory authority, in particular in the UK or the EU Member State of Your habitual residence, place of work or place of the alleged infringement.

12. Security

We implement and maintain appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

These measures are designed taking into account the nature, scope, context and purposes of processing, as well as the risks to individuals' rights and freedoms.

Our security measures include, in particular:

• access controls and role-based access management, ensuring that access to personal data is restricted to authorised personnel on a need-to-know basis;

• authentication and identity management controls, including secure authentication mechanisms and session management;

• encryption and data protection measures, including encryption of data in transit and, where appropriate, at rest;

• monitoring, logging and auditing, including logging of access to systems and data, and monitoring for suspicious or unauthorised activity;

• security incident detection and response processes, including procedures for identifying, managing and responding to potential or actual security incidents;

• segregation of environments and systems, where appropriate, to reduce risk and limit the impact of potential incidents;

• use of trusted third-party service providers, who are subject to contractual and security obligations;

• regular review and testing of security measures, including updates and improvements to address evolving threats and vulnerabilities.

We also implement organisational measures, including internal policies and procedures, to ensure that personal data is handled securely and in accordance with applicable data protection laws.

13. Incident Handling

We maintain internal processes and procedures for the detection, assessment and management of security incidents.

In the event of a personal data breach, we will:

• take appropriate steps to identify, contain and investigate the incident;

• assess the potential impact on individuals and our systems;

• implement measures to mitigate risks and prevent recurrence;

• notify relevant supervisory authorities and affected individuals where required by applicable law.

Our incident response processes are designed to ensure timely and appropriate handling of security incidents in accordance with applicable data protection requirements.

14. Cookies

We use cookies and similar tracking technologies on our Site and Platform to ensure functionality, enhance user experience, analyse usage and support marketing activities.

Cookies may include strictly necessary cookies, as well as analytics and marketing cookies, depending on Your preferences.

For more detailed information about the types of cookies we use, their purposes and how You can manage Your preferences, please refer to our Cookie Policy.

15. Children

Our Platform and Services are not intended for individuals under the age of 18.

We do not knowingly collect personal data from children. If You believe that a child has provided personal data to us, please contact us. If we become aware that personal data has been provided by a child without appropriate authorisation, we will take steps to delete such data as soon as reasonably practicable.

16. Data Relating to Users of Third-Party Solutions (SDK Integrations)

Participation via Third-Party Solutions

Our Platform and Services may be supported by a network of devices provided by users of third-party applications or services that integrate SOAX technology (including the SOAX SDK) ("Partner Solutions").

In such cases, users of Partner Solutions may choose to enable optional functionality allowing their device to participate in the SOAX network (for example, by contributing limited device resources such as network connectivity when the device is not actively in use).

Participation in the SOAX network is voluntary and subject to user choice, including the ability to withdraw at any time, as implemented by the relevant Partner.

Role of the Partner

The relevant Partner is responsible for:

• determining how and when such functionality is presented to users;

• providing appropriate disclosures to users;

• obtaining any consents or permissions required under applicable laws;

• enabling users to withdraw or opt out of participation.

SOAX does not control the Partner's user interface, consent flows or user experience.

Categories of Data Processed

In connection with the operation of the SOAX network, we may process limited technical data relating to devices participating in the network, which may in certain cases constitute personal data under applicable law, including:

• IP address associated with the participating device or connection;

• metadata derived from that IP address;

• software and hardware metadata;

• timestamps relating to device participation and network activity;

• connection type and similar connectivity information relevant to network operation;

• usage data related to the device participation in the SOAX network (including bandwidth usage and computational resource utilisation) and related performance metrics;

• signals relating to participation status, including opt-in / opt-out status.

Purposes of Processing

We process such data for the following purposes:

• operating and maintaining our Platform and Services;

• detecting, preventing and investigating fraud, abuse or unauthorised use;

• complying with legal and regulatory obligations.

Legal Bases

Depending on the context, we rely on one or more of the following legal bases:

• user consent obtained by the Partner in connection with the relevant functionality;

• our legitimate interests in operating, securing and improving our Platform and Services and infrastructure;

• compliance with legal obligations.

Retention

Data relating to users of Partner Solutions and participating devices is retained for as long as necessary for network operation, security, fraud prevention, compliance and related technical purposes, unless a longer retention period is required or permitted by law.

Additional Information

This section is intended to provide information to individuals whose data we may receive indirectly via third-party Partners and their Partner Solutions.

If You have questions about how Your device participates in the SOAX network, we recommend contacting the relevant Partner in the first instance. You may also contact us using the details set out in this Privacy Policy.

17. Changes

We may update this Privacy Policy from time to time to reflect changes in our practices, our Platform and Services, or applicable legal requirements.

Where appropriate, we will notify You of material changes, for example by posting a notice on our Site or through other appropriate communication channels.

The "Last updated" date at the top of this Privacy Policy indicates when it was last revised.

18. Contact

If You have any questions regarding this Privacy Policy or how we process Your personal data, You can contact us at:

• email: support@soax.com

• or via the "Contact Us" form available on our Site.

Effective Date: 1 June 2026