STAYDUO PRIVACY POLICY

Last Updated: Febuary 20, 2026

1. INTRODUCTION Welcome to the Privacy Policy of StayDuo Global I.K.E. ("StayDuo," "we," "us," or "our"). This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you access or use our mobile application (the “App”), our website at www.stayduo.gr, and related services (collectively, the “Service”). By using the Service, you acknowledge that you have read and understood this Privacy Policy.

2. DATA CONTROLLER For users in the European Economic Area (EEA), United Kingdom, or Switzerland, the Data Controller is: StayDuo Global I.K.E. Syggrou Avenue 106 Athens 11741, Greece G.E.MH.: 185396603000 Email: admin@stayduo.gr

3. DATA WE COLLECT

3.1 Information You Voluntarily Provide Account Registration: Phone number, email address, date of birth. Profile Details: Name, gender, lifestyle preferences, biography, photos. User-Declared Location: City or preferred area entered manually. Communications: Messages to other users and customer support.

3.2 Verification Information (Optional Identity Verification) To maintain community safety and prevent fraud, we may request a copy of your government-issued identification document (Passport/ID Card) and a facial geometry scan (selfie) to verify your identity. Identity verification is optional unless required to access specific features of the Service. StayDuo acts as the data controller for identity verification activities. Identity verification may be carried out by trusted third-party verification providers acting as data processors under a Data Processing Agreement in accordance with Article 28 GDPR. Legal Basis:

• Our legitimate interests in ensuring platform safety and fraud prevention (Article 6(1)(f) GDPR);

• Where verification is required for certain features, performance of a contract (Article 6(1)(b) GDPR);

• For biometric data, explicit consent (Article 9(2)(a) GDPR).

You may withdraw consent at any time. Withdrawal may result in loss of verified status or restricted access to features requiring verification. Verification data, including biometric data, is retained only as long as necessary for authentication or as required by law, after which it is securely deleted in accordance with the provider’s retention policies. StayDuo does not store raw biometric templates.

3.3 User Content & Liability Disclaimer You are solely responsible for content you upload. StayDuo acts as a passive conduit and does not pre-screen user content. We disclaim liability for user-generated content.

3.4 Information Collected Automatically Usage Data: Log-ins, features used, timestamps. Device Information: IP address, device type, OS version, crash logs. NO Background Location Tracking: We only process location if you actively provide it or grant foreground permission.

4. HOW WE USE YOUR DATA (LEGAL BASES)

4.1 Performance of Contract (Art. 6(1)(b))

• Creating and managing accounts

• Providing roommate matching services

• Processing premium payments

• Providing customer support

4.2 Legitimate Interests (Art. 6(1)(f))

• Fraud prevention and safety monitoring

• Improving platform performance

• Preventing abuse and spam

• Legal defense and enforcement

4.3 Legal Obligation Compliance with tax, accounting, and regulatory obligations.

4.4 Consent Explicit consent for:

• Biometric processing

• Foreground geolocation features

Consent may be withdrawn at any time.

4.5 Automated Decision-Making and Profiling StayDuo uses algorithmic and AI-based systems to generate compatibility suggestions, profile rankings, and personalized recommendations. These systems analyze:

• Lifestyle preferences

• Housing criteria

• Self-declared location

• Profile completeness

• Behavioral signals within the platform

The system applies weighted compatibility criteria to prioritize relevant matches and improve matchmaking outcomes. Processing is based on our legitimate interests (Article 6(1)(f) GDPR). This automated processing does not produce legal or similarly significant effects within the meaning of Article 22 GDPR. You have the right to:

• Object to profiling

• Request human review

• Express your point of view

• Contest automated outcomes

Contact: admin@stayduo.gr

5. NO THIRD-PARTY ADVERTISING We do not sell personal data. We do not share data with third-party advertising networks.

6. HOW WE SHARE INFORMATION

With Other Users Public profile information is visible to facilitate matching.

With Service Providers Examples include:

• Cloud hosting (AWS / Google Cloud)

• SMS verification (Twilio)

• Payment processing (Apple / Google)

All providers are bound by contractual safeguards.

Legal Requirements We may disclose information if required by law.

7. YOUR RIGHTS (GDPR) You have the right to:

• Access

• Rectification

• Erasure

• Restriction

• Objection

• Portability

To exercise rights: admin@stayduo.gr You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) or your local supervisory authority under Article 77 GDPR.

8. DATA RETENTION Active accounts: retained during account existence. Deleted accounts: deleted or anonymized within 30 days. Banned accounts: limited identifiers retained up to 1 year. Financial records: retained for 10 years per Greek law. Personal data is retained only as long as necessary to fulfill the purposes described and comply with legal obligations.

9. SECURITY We implement appropriate technical and organizational measures in accordance with Article 32 GDPR to ensure a level of security appropriate to the risk. Such measures include safeguards designed to protect against unauthorized access, accidental loss, destruction, or damage. No transmission over the internet is completely secure. To the maximum extent permitted by law, StayDuo shall not be liable for indirect, incidental, or consequential damages arising from unauthorized access.

10. CHILDREN’S PRIVACY The Service is restricted to users aged 18 or older. We do not knowingly collect data from minors.

11. CROSS-BORDER DATA TRANSFERS If personal data is transferred outside the EEA, we ensure appropriate safeguards, including:

• European Commission Standard Contractual Clauses (SCCs)

• Other lawful transfer mechanisms

Where required, we conduct Transfer Impact Assessments (TIAs) to ensure an adequate level of protection.

12. CHANGES TO THIS POLICY We may update this Policy from time to time. Material changes will be communicated via the App or email.

13. CONTACT US StayDuo Global I.K.E. Syggrou Avenue 106 Athens 11741, Greece Email: admin@stayduo.gr

To request the deletion of your account, please complete and submit the form below.