PRIVACY POLICY - PONNECT v2.1

Welcome to Ponnect - a platform for scheduling appointments with veterinarians, pet salons (grooming), dog walkers, pet-sitters and other pet service providers, available via website and mobile app for iOS and Android devices. This Privacy Policy explains how Ponnect collects, uses, shares, stores and protects your personal information when you use Ponnect as a user (pet owner), partner (service provider) or other person who interacts with us through the platform. This Privacy Policy is read together with the Ponnect Platform Cookie Policy and the Ponnect Platform General Terms of Use. When we use cookies, similar technologies, analytics or push notifications, additional information about those mechanisms is also available in the linked documents and application settings. Ponnect undertakes to maintain high standards of privacy protection in accordance with the Personal Data Protection Act of the Republic of Serbia and relevant privacy protection standards, including GDPR principles to the extent applicable.

The controller of your personal data is: For questions related to privacy and data processing, you can contact us at: **E-mail:** [[email protected]](mailto:[email protected]) **Subject:** Data protection

Ponnect collects the following categories of user data: - name and surname, - e-mail address, - phone number, - optional city and address, - data about the pet, such as name, species, breed, age, weight and other data entered by the user, - history of scheduled appointments, visits and interactions through the platform, - health data about the pet, such as vaccines, therapies, diagnoses, allergies or special notes, when the user enters them voluntarily and when there is an appropriate legal basis for it, - data related to communication, support and complaints.

When using the website or mobile application, Ponnect automatically collects certain technical and analytical data, such as: - IP address, - device type, - operating system, - application version, - technical device and application identifiers, - data about the use of the platform, such as pages or screens visited, session duration, clicks, usage flow and technical events, - data on errors, performance and system stability, - push tokens and related technical identifiers necessary for sending push notifications, - phone number when SMS registration verification or account security confirmation is used.

For partners using Ponnect are collected: - company name or first and last name, - TIN, social security number, decision number or other registration data, when applicable, - address, e-mail address and phone number, - name of the contact person, - data on services, prices, working hours, availability and appointment calendar, - data on employees or associates, when the partner enters them into the system, - optional data on licenses, approvals or professional qualifications, when they are relevant for the type of service, - data on scheduled appointments and business activity on the platform. For private entities that offer certain services, such as dog-walking or pet-sitting, we may also collect additional identification and verification data when necessary for identity verification, user security, or compliance with the platform's internal rules.

In the initial stages, Ponnect can function without directly processing online payments through the application. When Ponnect introduces a booking fee, online payment or other payment model through the platform, this Privacy Policy will be supplemented with additional information about the types of data processed in connection with the payment, the payment service providers and the retention periods of such data. Ponnect does not store full payment card data on its own servers when payment is made through a certified payment service provider.

Ponnect processes personal data for the following purposes: - creating and maintaining a user or partner account, - registering a pet and managing its profile, - scheduling, confirming, changing and canceling appointments, - facilitating communication between users and partners regarding the reservation, - sending transactional, service and security notifications, including push notifications, SMS messages and e-mail messages, - providing customer support, - improving the functionality, security, stability and quality of the platform, - prevention of abuse, fraud and unauthorized access, - fulfilling legal and regulatory obligations, - sending marketing messages, promotional campaigns and recommendations, when there is an appropriate consent or other legal basis for this. We process data based on one or more of the following legal bases: - **agreement** – when processing is necessary for the provision of the Ponnect platform service, including registration, account usage, appointment scheduling and reservation management, - **consent** – for the processing of certain more sensitive or optional data, as well as for certain marketing activities, promotional push notifications and similar communications when such consent is required, - **legitimate interest** – for the protection of platform security, analytics, error detection, product improvement and abuse prevention, except when the interests or rights and freedoms of persons are stronger than such interest, - **legal obligation** – when we have to process data in order to fulfill obligations from accounting, tax, regulatory or other regulations.

Push notifications are already integrated into the Ponnect application and are used to send important notifications regarding the use of the platform. Such notices may include: - booking confirmation, - appointment reminders, - change of appointment, - appointment cancellation, - security and service notices, - promotional or marketing messages, when there is appropriate consent. To send push notifications Ponnect processes push tokens and associated technical device identifiers. The user can manage push notifications through device settings and, when available, through in-app settings.

Ponnect does not sell your personal information. Your data may be shared only when necessary for the functioning of the platform, the performance of the service or the fulfillment of legal obligations, including the following categories of recipients: - cloud and hosting infrastructure providers, - providers of analytics, technical monitoring and system security, - providers of SMS, e-mail and push communication services, - certified payment service providers, when online payment is introduced, - partners - service providers, but only to the extent necessary to realize the reservation, appointment or communication related to the service, - state authorities and other authorized bodies, when there is a legal obligation or a valid legal request. When third parties process data on behalf of Ponnect, Ponnect will endeavor to establish an appropriate contractual and organizational data protection framework with them.

If individual providers of services, infrastructure, analytics or communication systems process data outside the Republic of Serbia, Ponnect ensures that such transfer is based on an appropriate legal basis and appropriate protection measures, in accordance with applicable data protection rules.

We store data for as long as it is necessary to fulfill the purpose for which it was collected, except when the law requires a longer storage period. In practice, this can mean: - data about an active account is saved while the user or partner uses Ponnect, - after the request to delete the account, certain data may be temporarily stored for a limited period for technical processing of the request, system security, dispute resolution or fulfillment of legal obligations, - data on communications, logs, security events and technical incidents may be stored longer when necessary to protect the platform or prove compliance, - anonymized or aggregated data can be stored even after the end of using the account, because they no longer enable the identification of a specific person. More detailed retention periods can be additionally regulated by Ponnect's internal rules and records.

In accordance with the applicable data protection rules, you have the right to, to the extent that the legal requirements are met: - request access to your data, - request correction of incorrect or incomplete data, - request deletion of data, - request restriction of processing, - submit an objection to processing based on legitimate interest, - request data portability, when applicable, - you withdraw your consent for processing based on consent, without affecting the legality of the processing before the withdrawal of consent. You can send the request to the e-mail address: **[[email protected]**](mailto:[email protected]) with the subject: **Data protection**. Ponnect responds to duly submitted requests within a reasonable period of time, and at the latest within the period prescribed by the applicable rules.

Ponnect applies appropriate technical, organizational and security measures to protect data from unauthorized access, loss, misuse, alteration and destruction. Such measures may include: - communication encryption, - control of access to systems and data, - authentication and privilege management, - regular backups, - log of access and security events, - testing, updating and monitoring of system security. Although no system can guarantee absolute security, Ponnect strives to apply measures appropriate to the nature of the data and the risks of processing.

Ponnect uses analytics, basic segmentation, and automated technical processes to improve user experience, security, system stability, content recommendations, and functionality related to reservations and communications. Ponnect does not make decisions that produce legal effects or similarly significantly affect the user solely on the basis of automated processing, unless such processing is separately introduced and separately explained in accordance with the law.

Ponnect reserves the right to periodically change this Privacy Policy to align with platform development, functionality changes, including push notifications and future online payment options, as well as due to regulatory changes. An updated version will be published with a new last modified date. If the changes are significant, users will be additionally notified via the website, application, e-mail or push notification.

For questions, requests or complaints regarding the processing of personal data, you can contact us via the e-mail address: **E-mail:** [[email protected]](mailto:[email protected]) **Subject:** Data Protection or Privacy You also have the right to contact the Commissioner for Information of Public Importance and Protection of Personal Data, in accordance with the applicable regulations of the Republic of Serbia. **Commissioner for Information of Public Importance and Personal Data Protection** Bulevar Kralja Aleksandra 15, 11000 Belgrade Web: [www.povernik.rs] (https://www.povernik.rs) E-mail: [[email protected]](mailto:[email protected]) **Note** By using the Ponnect platform, you confirm that you are familiar with this Privacy Policy. Where specific consent is required for certain processing, Ponnect will seek it separately, through an appropriate mechanism within the website, mobile application or other appropriate channel.