At Boardtalent.ai, we are committed to protecting your personal data and respecting your privacy. This Privacy Notice explains how we collect, use, store, and safeguard your personal information when you interact with our platform, in compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Luxembourg Law of 1 August 2018 on the organization of the National Commission for Data Protection and the general data protection regime.

Boardtalent.ai provides a technology platform that connects companies with independent board members through AI-powered matching and an exclusive network of qualified professionals. The trust of both our company clients and independent directors is fundamental to our service.

The controller of your personal data is:

Boardtalent.ai S.àr.l.-S

29 Boulevard Grande Duchesse Charlotte

RCS : B300613

Email: contact@boardtalent.ai

For any questions or concerns regarding your personal data or this Privacy Notice, you may contact our Data Protection Officer (DPO) at the above address.

We may collect and process the following categories of personal data, depending on your use of the platform:

• Identification data: name, email address, phone number, job title.
• Professional data: CVs, board and executive experience, skills, credentials, references, biography, and other data relevant to board appointments.
• Technical data: IP address, browser type, device information, access times, and logs.
• Matching preferences: board roles sought or offered, sector preferences, expertise, geographical location, and company size.
• Billing data: invoicing and payment details for any paid services.

We collect this data either directly from you (e.g. during registration or when you update your profile), or automatically through your use of our platform.

Your personal data is used for the following purposes:

• Matching and recommendation: to identify potential board opportunities and present suitable profiles to companies.
• Mandate management: to manage expressions of interest, applications, appointments, and follow-up communications.
• Service improvement: to optimise the platform and personalise your user experience through usage analysis.
• Security and integrity: to protect the platform, detect abuse, and ensure system reliability.
• Compliance: to meet legal, regulatory, tax, or accounting obligations.
• Marketing and communications: to send relevant updates or offers, where permitted and subject to your preferences.

We rely on lawful bases for processing such as performance of a contract, legitimate interest, compliance with legal obligations, and your explicit consent, where required.

Your data may be shared with:

• Client organizations: companies seeking independent board members via our platform.
• Technology providers: service providers involved in hosting, maintaining, and analyzing the platform, subject to strict data processing agreements.
• External consultants or partners: such as governance advisors or executive search firms, with appropriate safeguards and only as necessary.

If personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission or other lawful transfer mechanisms.

We retain your data only for as long as necessary for the purposes outlined above or to comply with applicable legal obligations:

• Profile data: retained while your account remains active.
• Marketing data: retained for up to three (3) years from your last interaction with us, unless you withdraw your consent earlier.
• Contractual and regulatory data: retained for up to ten (10) years, in line with legal and tax requirements in Luxembourg.

You may request deletion of your data at any time, subject to legal and contractual limitations.

Under applicable data protection law, you have the following rights:

• Right of access: to obtain a copy of the data we hold about you.
• Right to rectification: to correct inaccurate or incomplete data.
• Right to erasure: to request deletion of your data ("right to be forgotten") where legally permissible.
• Right to restriction: to limit the processing of your data under certain conditions.
• Right to data portability: to receive your data in a structured, machine-readable format.
• Right to object: to object to processing based on our legitimate interests or for direct marketing.
• Right to withdraw consent: at any time, where processing is based on your consent.

To exercise your rights, please contact us at contact@boardtalent.ai. We may ask for proof of identity before processing your request.

We apply industry-standard technical and organizational measures to protect your personal data from unauthorized access, loss, misuse, or alteration, including:

• Encryption of sensitive data in transit and at rest.
• Multi-factor authentication and access controls.
• Regular security audits and vulnerability assessments.
• Data backup and disaster recovery protocols.

We may update this Privacy Notice from time to time to reflect legal or technical developments. When we make significant changes, we will notify you via email or through the platform in advance of the effective date. We encourage you to review this notice periodically.

If you have any questions or wish to exercise your data protection rights, you can contact us at:

Email: contact@boardtalent.ai

If you are not satisfied with how we process your personal data, you also have the right to file a complaint with the Luxembourg supervisory authority:

Commission Nationale pour la Protection des Données (CNPD)

15, Boulevard du Jazz

L-4370 Belvaux, Luxembourg

Website: www.cnpd.lu

Tel: +352 26 10 60 - 1

This Privacy Notice is provided in English. A French or German version can be made available upon request by contacting us at contact@boardtalent.ai.