MYLOYA Privacy Policy

1. Who we are

MYLOYA is the digital memorial platform of LOYA B.V. ("LOYA", "we", "us"). LOYA is the data controller for the personal data processed through MYLOYA, as described in this Privacy Policy.

2. What data we collect

Depending on how you use MYLOYA, we may process the following data:

• Account data: your name, email address, password (stored encrypted), phone number and profile photo;
• Order data: your LOYA order reference and the activation code of your LOYA card;
• Content you add: names, dates, places, stories, photos, videos and other memories you upload to your space;
• Legacy Contact: the email address of the person you appoint as your Legacy Contact;
• Payment data: details of your Premium subscription. Payments are handled by our payment provider; we do not store your card or bank details;
• Technical data: your IP address, browser type, language preference and basic usage logs needed to keep the service secure.

3. Why we use your data

We use your personal data only for the following purposes:

• To create and manage your account and give you access to your private space (performance of the agreement);
• To store, display and share your memories with the people you choose (performance of the agreement);
• To process Premium payments and send related confirmations (performance of the agreement);
• To send service emails, such as sign-in links, password resets and important account notices (performance of the agreement);
• To keep MYLOYA secure, prevent misuse and fix technical problems (legitimate interest);
• To comply with legal obligations, such as tax and accounting rules (legal obligation).

We do not use your memories for advertising, and we do not sell your personal data to third parties.

4. Memories of other people

Your space may contain personal data of other people, such as a loved one, family members or friends. You are responsible for only adding content you are entitled to share. If someone asks us to remove content about them, we may contact you to resolve this together.

5. Who we share data with

We only share personal data with trusted service providers who help us run MYLOYA, such as:

• Hosting and database providers, to securely store your account and memories;
• Our payment provider, to process Premium payments;
• Our email provider, to send sign-in links and service emails;
• Our web shop platform, to link your LOYA order to your account.

These providers process data only on our instructions and under a data processing agreement. We may also share data when required by law or a court order.

Content in your space is only visible to you and to people you share it with, for example through a share link or PIN.

6. Data outside the European Union

We aim to store your data within the European Economic Area. If a service provider processes data outside the EEA, we make sure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses.

7. How long we keep your data

We keep your data for as long as your account is active.

After your account is closed, data may be retained for up to twelve months for account recovery or the handling of questions or disputes, unless a longer period is required by law. After that, your data is deleted or anonymised, in line with our Terms of Use and Digital Legacy Policy.

8. Security

We take appropriate technical and organisational measures to protect your data, including encrypted connections, encrypted password storage and restricted access. No system is completely secure, so please keep your login details confidential.

9. Your rights

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Have your data deleted;
• Restrict or object to certain processing;
• Receive your data in a commonly used, machine-readable format (data portability);
• Withdraw your consent at any time, where processing is based on consent.

You can export your data and delete your account yourself in your MYLOYA settings. For other requests, please contact us. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

10. Cookies

MYLOYA only uses functional cookies and similar technologies that are necessary to keep you signed in and to remember your preferences, such as your language. We do not use tracking or advertising cookies.

11. Changes to this policy

We may update this Privacy Policy from time to time. If changes are significant, we will inform you in advance by email or through MYLOYA.

12. Contact

LOYA B.V.

Keizersgracht 520

1017 EK Amsterdam

The Netherlands

info@loya-bv.com

www.loyadiamonds.com