MUDITA DEVELOPER PORTAL – PRIVACY POLICY

Version dated: 26 October 2026

Effective Date: 27 October 2026

We take particular care to protect your personal data and privacy. This Privacy Policy explains what personal data we collect, how and why we process it, and what rights you have in connection with the processing. Our goal is to ensure transparency and clarity on privacy matters so that you can feel safe while using the Developer Portal.

We encourage you to review this Privacy Policy and contact us if you have any questions or concerns.

ABOUT DOCUMENT

This Privacy Policy applies to personal data processed in connection with the Developer Portal and the Electronic Services, including the Account creation and management, the submission, verification, publication and management of Developer Applications, and related reports and security incidents.

It does not cover the processing of End Users’ personal data in connection with their use of the InkApps collection or Developer Applications. Information about such processing is provided in the privacy documentation applicable to the relevant service or Developer Application. Each Developer is responsible for the processing carried out independently through its Developer Applications, including providing End Users with an appropriate privacy notice.

Capitalized terms used in this Privacy Policy that are not defined herein have the meanings assigned to them in the Developer Portal Terms and Conditions.

DATA CONTROLLER

The controller of your personal data is Mudita sp. z o.o., with its registered office in Warsaw (02-607) at Jana Czeczota 6 street (hereinafter: the "Controller" or "we").

For matters related to the processing of personal data, you may contact the Controller by correspondence at the above address or via the following e‑mail address: [email protected].

SOURCES OF PERSONAL DATA

We generally collect your personal data directly from you. However, we may also receive personal data: (i) from the Developer or a person authorised to manage a Business Account, where you are invited to use that Account, (ii) from an external identity or authentication provider, if you use that method to register or log in; and (iii) from persons submitting reports or complaints concerning the Developer, a User or a Developer Application.

We may also obtain information concerning Developers and Users acting on their behalf from (iv) publicly available sources, including official business registers, where necessary to verify the information provided during registration or to ensure the security and integrity of the Developer Portal and the InkApps collection.

PROCESSING OF YOUR PERSONAL DATA

CONTACT

Description:

If you contact us, we may process your contact details and any other personal data you provide.

Purposes and legal basis:

• Responding to inquiries, conducting further correspondence.
• Establishing, defending against, or pursuing potential claims.

The legal basis is Article 6(1)(f) of the GDPR, i.e., the Controller’s legitimate interest in handling correspondence and protecting its rights.

PROPER FUNCTIONING OF THE DEVELOPER PORTAL

Description:

We process personal data of Developers and Users acting on their behalf to provide Electronic Services through the Developer Portal including the creation and management of an Account, the submission, verification, publication and management of Developer Applications and the display of information concerning the Developer on the relevant Developer Application page within the InkApps collection

Depending on how the Electronic Services are used, we may process identification and contact data including the mobile phone number provided during registration, professional or business information, Account and authentication data, assigned roles and permissions, information and materials concerning submitted Developer Applications, information provided during the verification process, correspondence, complaint and support data, and technical data such as logs and device, session or application identifiers.

Purposes and legal basis:

• Provision of Electronic Services – including creating and managing an Account, providing access to the Developer Portal, enabling the submission, verification, publication and management of Developer Applications and updates thereto, and displaying information concerning the Developer on the relevant Developer Application page within the InkApps collection to enable End Users to identify and contact the Developer.
• Publication of Developer information – where a Developer Application is published in the InkApps collection, displaying information identifying the Developer and enabling End Users to contact the Developer on the relevant Developer Application page. The published information may be available to an unlimited number of End Users of the InkApps collection.
• Where you are a Developer who is a party to an Agreement with us, we process your personal data where necessary to enter into or perform that Agreement, on the basis of Article 6(1)(b) GDPR.
• Where you are a User acting on behalf of a Developer, we process your personal data on the basis of Article 6(1)(f) GDPR, i.e. our legitimate interest in entering into and performing the Agreement with the Developer and enabling authorised Users to access and use the relevant Business Account.
• Where publication of particular information is required by law, the legal basis is Article 6(1)(c) GDPR.
• Compliance with legal obligations, where processing is necessary for the Controller to comply with applicable legal obligations related to the operation of the Developer Portal and the InkApps collection, and the provision of Electronic Services to Developers and Users.

The legal basis is Article 6(1)(c) GDPR – i.e., processing necessary for compliance with a legal obligation to which the Controller is subject.

• Pursuit of internal administrative purposes – including statistical and analytical purposes, such as analysing the use of the Electronic Services in order to improve their functionality and quality.
• The legal basis is Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in analysing the use of the Electronic Services and optimising their functionality and quality.
• Establishing, defending, or pursuing potential claims.

The legal basis is Article 6(1)(f) of the GDPR, i.e., the Controller’s legitimate interest in protecting its rights.

HANDLING REPORTS OF LEGAL VIOLATIONS / ILLEGAL CONTENT

Description:

The Controller may process your data when it is necessary to handle reports concerning legal violations or illegal content and to take decisions/actions in relation to such reports (e.g. notices identifying alleged illegal content), and to communicate with the reporting party and/or persons affected by the report. Data may include identification data, contact data, logs/device/app identifiers, and other data included in the report.

Purposes and legal basis:

• Processing notices and reports concerning illegal content, taking actions and decisions in relation thereto, including on the Controller’s own initiative – covering verification, review and assessment activities aimed at identifying, investigating, preventing or addressing illegal content or violations of applicable law or the Developer Portal Terms and Conditions.

The legal basis is Article 6(1)(c) GDPR – compliance with a legal obligation (where applicable) and/or Article 6(1)(f) GDPR – the Controller’s legitimate interest in protecting the Developer Portal, the InkApps collection, Users, End Users and third parties against unlawful content and misuse (where we voluntarily investigate potential violations, misuse or security risks).

• Establishing, defending against, or pursuing potential claims related to reports/decisions.

The legal basis is Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in protecting its rights and defending itself against potential claims or liability.

SECURITY / ABUSE PREVENTION

Description:

The Controller may process technical data, including logs and identifiers, to ensure the security and integrity of the Developer Portal, the Electronic Services and the InkApps collection, prevent abuse and fraud, and enforce the Developer Portal Terms and Conditions. This may include detecting suspicious activity, protecting Accounts against unauthorised access or use, and ensuring the security and proper operation of the relevant Electronic Services.

Purposes and legal basis:

• Ensuring security of the service, preventing abuse/fraud, and enforcing the Developer Portal Terms and Conditions.
• The legal basis is Article 6(1)(f) of the GDPR, i.e. the Controller’s legitimate interest in ensuring network and information security and protecting the Developer Portal, the Electronic Services, the InkApps collection and Accounts against unauthorised access, use or other misuse.

IDENTITY AND AUTHORITY VERIFICATION

Description:

The Controller may process identification, contact, professional and business information, as well as documents or information confirming the identity, legal capacity, registration or authority to act on behalf of a Developer, where necessary to verify the Developer or persons acting on its behalf.

Phone number verification. When you register an Account or accept an invitation to a Business Account as a new User, we verify the mobile phone number you provide by sending a one-time verification code to it by SMS. We use your phone number to verify your identity, to protect the Developer Portal against fraud and abuse, and to contact you about your Account where necessary. Your phone number is not published in the InkApps collection or disclosed to End Users. We do not use your phone number for marketing purposes and we do not send marketing SMS messages.

Purposes and legal basis:

• Verification of the Developer, its representatives and their authority to act, as well as prevention of fraud and abuse.

The legal basis is Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in verifying the identity, legal capacity and authority to act of the Developer and persons acting on its behalf, ensuring the reliability and security of the Developer Portal and Accounts, and preventing fraud and abuse.

OBLIGATION TO PROVIDE DATA

Providing personal data is generally voluntary. However, certain data are required to create or use an Account, verify the Developer or its representatives, submit and manage a Developer Application, or perform the Agreement. Other data may be required by applicable law.

Failure to provide the required data may prevent us from creating or maintaining an Account, verifying or publishing a Developer Application, or providing the relevant Electronic Service.

Providing a mobile phone number and completing its verification by SMS is required to register an Account or to register as a User invited to a Business Account.

DATA PROCESSING PERIOD

The period for which your personal data is processed depends on the purpose and legal basis for such processing:

• where processing personal data in connection with the performance of a contract or taking action before entering into a contract – the data will be processed for the duration of the contract or the provision of the service;
• where personal data is processed in connection with contacting the Controller – the data will be processed for the period necessary to review the inquiry and provide a response;
• where personal data is processed based on the Controller’s legitimate interests – the data will be processed for as long as such interests remain valid or until an effective objection is raised, unless further retention is justified;
• where personal data is processed to comply with a legal obligation, it will be retained for the period required by applicable law.

We may retain personal data longer where necessary to establish, exercise or defend claims (including for applicable limitation periods), protect the security of the Developer Portal, the Electronic Services, the InkApps collection or Accounts, or handle reports and decisions concerning illegal content or other violations of law or the Terms and Conditions.

Records of SMS verification requests (phone number, time of the request and delivery status) are kept for as long as necessary to protect the security of the Developer Portal and to demonstrate compliance with applicable messaging requirements.

Where several retention periods apply to the same data, we will apply the longest applicable period.

RECIPIENTS OF DATA

Your personal data may be disclosed to recipients or processed on our behalf by service providers, to the extent necessary to achieve the intended purposes. The recipients of personal data may include, in particular: (i) entities affiliated with us, (ii) IT support, including hosting and cloud infrastructure providers, (iii) professional advisors, such as lawyers, auditors, accountants, (iv) authentication services providers, and (v) other entities cooperating with us, if justified or necessary for the purposes of data processing.

Verification SMS messages are delivered through Amazon Web Services (AWS), which processes your phone number on our behalf solely to deliver the message and does not use it for its own marketing purposes.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We may also share or disclose your personal data to competent public authorities and law enforcement agencies, in Poland or abroad, where required by law.

Information identifying or enabling contact with the Developer, where published on an Application page, may be disclosed to an unlimited number of users of the InkApps collection

DATA TRANSFER

Your personal data will generally be processed within the EEA (European Economic Area). Where necessary, it may be transferred to service providers or other recipients outside the EEA. but only to the extent necessary for the Controller’s cooperation with these partners.

Any transfer outside the EEA is made in accordance with applicable data protection law, including on the basis of an adequacy decision or, where none applies, appropriate safeguards such as the European Commission’s standard contractual clauses and, where necessary, supplementary measures.

To obtain more information about these safeguards, including a copy, contact us as indicated in section 2.

AUTOMATED INDIVIDUAL DECISION-MAKING / PROFILING

We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects. We may use automated tools to identify security risks, fraud or violations, but such tools do not make those decisions alone.

RIGHTS OF THE DATA SUBJECTS

In connection with the processing of your personal data, you have the following rights under applicable laws:

• the right to access your data, including obtaining a copy of your data,
• the right to request rectification of your data,
• the right to restrict the processing of your data,
• the right to request the deletion of your data (in certain situations),
• the right to data portability for data you have provided and that is processed automatically based on your consent or a contract, e.g., to another controller,
• the right to object to the processing of personal data – to the extent that processing is based on the legitimate interest of the controller or a third party.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

These rights apply subject to the conditions in applicable law. To exercise them, contact us using the details in section 2. We will respond within the time limits required by applicable law.

If you have concerns about how we process your personal data, you may file a complaint with the appropriate data protection authority (in Poland - President of the Personal Data Protection Office). A list of such authorities is available at this EDPB website (https://www.edpb.europa.eu/about-edpb/about-edpb/members_en).

CHANGES TO THE PRIVACY POLICY

This version of the Privacy Policy shall apply as of the Effective Date indicated at the beginning of this document.

We may update this Privacy Policy to reflect changes in our processing, services or applicable law. The current version is available in the Developer Portal.