PRIVACY POLICY

1. General Provisions

1.1. This Privacy Policy (the “Policy”) explains how the legal entity identified in Section 2 of this Policy (the “Company”, “we”, “us” or “our”) processes personal data in connection with the website https://vpk-mac.com, including its Ukrainian- and English-language pages, contact forms and investment enquiry form (the “Website”).

1.2. The Website presents MAC HUB’s defence-technology activities, products, developments, partnerships and opportunities for business contact. It serves primarily as a corporate information and business-enquiry website. This Policy applies to personal data processed through the Website and related correspondence, not automatically to separate employment, procurement, contractual or partner systems governed by their own notices.

1.3. We process personal data in accordance with the Law of Ukraine “On Personal Data Protection” dated 1 June 2010, No. 2297-VI and other applicable Ukrainian legislation. Where and to the extent Regulation (EU) 2016/679 (the “GDPR”) applies to particular processing activities, we also comply with its applicable requirements and relevant European data protection rules. The Website’s availability in the European Union does not, by itself, determine the territorial application of the GDPR.

1.4. “Personal data” means information relating to an identified or identifiable natural person. Information about a legal entity is not, in itself, personal data, but information identifying its employees, executives, investors or other representatives may be personal data. We apply the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.

2. Data Controller

2.1. The entity responsible for determining the purposes and means of personal-data processing undertaken in the operation of the Website is:

Legal name: [LEGAL ENTITY NAME]

Registration number / EDRPOU code: [EDRPOU CODE]

Registered / official correspondence address: [ADDRESS]

Privacy contact: info@mac-hub.com.

2.2. “MAC HUB” and names of business units, products or brands shown on the Website may refer to different companies or projects. The publication of their information on one Website does not mean that they form a single legal entity or automatically act as joint controllers of all personal data.

2.3. If you select a particular MAC HUB company or business direction when submitting a request, your enquiry may be forwarded to the appropriate legally separate entity where necessary to handle that request. That recipient may act as an independent controller in its subsequent business relationship with you. If two or more entities jointly determine the purposes and means of a particular processing operation, they will establish the arrangement required by applicable law, including Article 26 GDPR where applicable, and make the essence of that arrangement available to affected individuals.

3. Personal Data We Process

3.1. General enquiries. When you use the Website’s contact form, we may receive your first name, contact telephone number, email address, selected addressee or MAC HUB business direction, and information you subsequently provide in correspondence about your enquiry.

3.2. Investment enquiries. The Website’s investment form may collect the name of your company, its website, your full name, country, links to the company’s social-media pages, a link to your personal profile and information you provide in follow-up communications. A professional or public social-media profile can contain personal data even if it is publicly accessible.

3.3. Business communications. When you contact our published business, general-information or media email addresses, we may process your name, professional role, organisation, work contact details, correspondence content and records reasonably necessary to respond to and manage the communication.

3.4. Technical and security information. When the Website is accessed, servers and security systems may generate technical data such as IP address, access timestamps, requested pages, browser or device information, referring page, error logs and information needed to maintain the Website’s operation and security. The use of cookies and comparable technologies is further described in the separate Cookie Policy.

3.5. Data from other sources. For a business enquiry, we may receive relevant professional contact details from the organisation you represent or another person making an introduction. We will provide any additional notice required by law when personal data is not obtained directly from you, subject to lawful exceptions.

3.6. The Website is not intended to collect health data, biometric data, political opinions or other special categories of personal data. Do not submit information constituting a state secret, locations of military units or facilities, restricted technical documentation, export-controlled data, passwords or other sensitive materials through ordinary Website forms or publicly listed email addresses. Where necessary, we will arrange an appropriate separate channel and, where relevant, contractual confidentiality protections. If such information is received inadvertently, we will limit access and handle it in accordance with applicable law and security requirements.

4. Purposes and Legal Bases of Processing

4.1. We process personal data only where there is an appropriate legal basis under Article 11 of the Ukrainian Law “On Personal Data Protection” and, when applicable, Article 6 GDPR. The relevant purpose and basis depend on the actual interaction.

4.2. Responding to enquiries and directing requests. We use contact information and enquiry content to reply, identify the appropriate recipient and communicate with representatives of customers, suppliers, partners, public bodies, media and other organisations. Where GDPR applies, the usual basis is our legitimate interest in responding to genuine enquiries and managing business communications (Article 6(1)(f)), subject to the required balancing assessment. Article 6(1)(b) may apply where processing is necessary to take steps at the request of an individual who is personally a party or prospective party to a contract; it is not relied upon merely because a person represents another company.

4.3. Considering cooperation and investment enquiries. We use the information voluntarily provided to assess a proposed business contact, arrange preliminary discussions and communicate about potential cooperation or investment. Where GDPR applies, the basis is normally our legitimate interest in evaluating bona fide proposals and maintaining professional relationships (Article 6(1)(f)), or another legal basis justified for a specific processing activity. Submission of an investment enquiry does not by itself constitute an investment transaction or an offer of securities.

4.4. Operating and protecting the Website. We process strictly necessary technical information to deliver requested pages, diagnose faults, maintain availability, detect misuse and protect the Website and associated correspondence. Where GDPR applies, this is generally based on our legitimate interests in operating secure and reliable services (Article 6(1)(f)), provided those interests are not overridden by individuals’ rights. Rules governing access to information on a user’s device are addressed separately in the Cookie Policy.

4.5. Compliance and legal claims. Where necessary, we may process relevant personal data to comply with applicable legal obligations, respond to lawful requests, maintain required records or establish, exercise or defend legal claims. Under GDPR, Article 6(1)(c) is used only where its requirements are met; other appropriate legal bases, including Article 6(1)(f), may apply to specific activities. Applicable defence-sector, sanctions and export-control requirements may require separate, proportionate checks in the course of an actual business relationship.

4.6. Optional communications and analytics. We will not treat a contact or investment enquiry as blanket consent to unrelated promotional messages. If we introduce subscription services, optional analytics or other consent-based processing, we will identify the purpose and obtain any consent required by applicable data-protection and electronic-communications law. Where consent is the basis, it may be withdrawn at any time without affecting processing already lawfully carried out.

4.7. We do not use personal data for purposes incompatible with the original lawful purpose without taking the additional steps required by applicable law. Where legitimate interests are relied upon, the interests pursued are those expressly described above, not an unrestricted right to use information for any business purpose.

5. Providing Personal Data

5.1. Providing personal data through Website forms is generally voluntary. Fields marked as required are necessary to receive and route a particular enquiry; if you do not provide the necessary contact details, we may be unable to respond. Unless specifically explained for a particular process, submitting a general Website enquiry is not a statutory or contractual obligation.

5.2. Please provide only information reasonably necessary for your request and ensure that the contact details you submit are accurate. If you provide personal data about another person, you should have a lawful basis for doing so and, where appropriate, ensure that the individual is informed.

5.3. Website forms and general email inboxes are not channels for submitting classified or restricted information or for exchanging detailed non-public defence specifications. We may ask that a communication be continued through an appropriately authorised and secured channel. No statement on the Website should be understood as overriding a separately concluded non-disclosure agreement or other binding confidentiality duty.

5.4. Where we collect information from you directly, this Policy and a concise notice linked beside the relevant form are intended to provide the information required at the point of collection. Separate processing, for example during contractual due diligence, may require an additional notice.

6. Disclosure of Personal Data

6.1. Personal data is accessible only to persons and recipients who need it for an identified lawful purpose, subject to appropriate confidentiality and security requirements. Depending on the enquiry, recipients may include:

authorised personnel responsible for Website administration, business enquiries, media contact, partnership discussions or legal compliance;

the particular MAC HUB company or partner organisation to which you direct an enquiry, or which must receive it to respond to you, subject to a lawful basis and appropriate notice;

service providers supporting hosting, email delivery, Website maintenance, cybersecurity or enquiry management, acting as processors or independent controllers according to their actual functions;

professional advisers, public authorities, courts or other recipients where disclosure is lawfully necessary; and

parties involved in a genuine corporate reorganisation, if lawfully necessary and subject to suitable safeguards.

6.2. Sharing within MAC HUB is not unrestricted. Each recipient’s legal identity, purpose, access rights and status as an independent controller, joint controller or processor must be determined in accordance with actual operations. Where the GDPR applies, processors are engaged under Article 28-compliant arrangements where required; joint control is handled under Article 26 where applicable.

6.3. Personal data supplied through Website forms will not be disclosed to unrelated third parties for their independent advertising merely because a person contacted us. Any such use would require its own lawful basis and compliance with applicable marketing requirements.

7. International Transfers of Personal Data

7.1. The Website is accessible internationally, and the handling of enquiries may involve personnel or service providers in different countries. Any international transfer of personal data depends on the specific purpose, recipient and lawful basis of that processing.

7.2. Any international transfer is made only when permitted by applicable law, including Article 29 of the Ukrainian Law “On Personal Data Protection” and, where the GDPR’s Chapter V applies to a particular transfer, Articles 44–49 GDPR.

7.3. Where a transfer to a country without an applicable adequacy decision is subject to Chapter V GDPR, it must rely on a mechanism permitted by law, including appropriate safeguards under Article 46 GDPR or a derogation under Article 49 GDPR where its conditions are met. The European Commission’s Standard Contractual Clauses may be used where suitable for the specific transfer.

7.4. Where Chapter V GDPR applies to an international transfer, information on the existence or absence of an adequacy decision, applicable safeguards and how to obtain a copy is provided as required by law. Enquiries concerning a specific transfer may be sent to the contact in Section 2. Information may be provided with lawful redactions protecting confidential security arrangements.

8. Data Retention

8.1. We retain personal data no longer than necessary for the stated purpose, subject to applicable recordkeeping requirements, legitimate legal claims and appropriate security needs. Different categories of data may require different retention periods. Data is then securely deleted, anonymised or, where legally necessary, restricted in an archive.

8.2. Retention periods are determined by the following criteria, depending on the category of information:

General Website and media enquiries: until the enquiry is resolved; thereafter only for the period reasonably necessary for relevant follow-up or protection of legal rights within applicable limitation periods.

Investment and cooperation enquiries that do not result in a relationship: until the assessment of the proposal or discussions has ended; thereafter only where retention is legally required or reasonably necessary to document negotiations or protect legal rights.

Technical access and security logs: for the configured technical log-rotation and deletion cycle; information needed to investigate a specific incident may be retained until the investigation and related lawful proceedings are completed.

Records connected with a concluded contract, legal obligation or dispute: for the applicable statutory period or the time reasonably necessary for an identified claim, as documented in the relevant retention schedule.

Consent records, where consent-based features exist: for the period necessary to demonstrate compliance and respect withdrawal, subject to applicable legal requirements.

8.3. Backup copies, if maintained, are subject to controlled retention and deletion cycles. A deletion request does not require deletion of data that must lawfully be retained, but any remaining processing will be limited to the permitted purpose.

9. Personal Data Security

9.1. We apply appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss and destruction, taking into account the nature of the data, processing risks and applicable legal requirements.

9.2. Such measures include, where appropriate, limiting access to authorised personnel, protecting communications and systems, managing service-provider access, maintaining confidentiality obligations and reviewing security controls. The detailed architecture, security configurations, addresses of production facilities and other sensitive defence-related information are not disclosed in this Policy.

9.3. No Internet transmission or information system can be guaranteed to be entirely risk-free. However, this does not reduce any mandatory duty to implement appropriate security safeguards. Where a personal-data breach occurs, we will assess it and make any notifications to authorities or affected individuals required by applicable law, including Articles 33 and 34 GDPR if applicable.

10. Your Rights

10.1. Under the Ukrainian Law “On Personal Data Protection”, you have rights including to be informed of processing, access your personal data, object to unlawful processing, request correction or destruction where legally justified, withdraw consent where relevant and seek protection from the competent authorities or courts, subject to the applicable statutory conditions.

10.2. Where GDPR applies to the particular processing, you may also have the rights to obtain access and a copy (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20, where its conditions are met), and to object to processing based on legitimate interests (Article 21). You may withdraw consent at any time when consent is the legal basis (Article 7(3)). These rights are subject to the applicable legal conditions and exceptions.

10.3. Right to object: Where processing is based on our legitimate interests, you may object on grounds relating to your particular situation. We will stop the processing unless we demonstrate compelling legitimate grounds or it is needed for legal claims. Where personal data is processed for direct marketing, you may object to that processing at any time, without having to explain your reasons.

10.4. You may contact us at the privacy address in Section 2. We may request only the information reasonably necessary to verify your identity and protect your data against unauthorised disclosure. We will respond within the periods required by applicable law; under GDPR this is generally one month, subject to lawful extensions and notification requirements. Requests are generally handled without charge unless a lawful exception applies.

10.5. You may raise a complaint with the Ukrainian Parliament Commissioner for Human Rights (https://ombudsman.gov.ua/) or seek judicial protection, in accordance with Ukrainian law. Where GDPR applies, you also have the right to lodge a complaint with a competent EU/EEA supervisory authority, in particular in the Member State of your habitual residence, workplace or the place of an alleged infringement.

11. Automated Processing and Cookies

11.1. The Website may use cookies or comparable technologies to support its operation and, where lawfully implemented, for other purposes. Information about relevant technologies, categories, purposes, storage periods and consent controls is provided in the separate Cookie Policy.

11.2. Where applicable law requires consent before storing information on or accessing information from a user’s device, non-essential technologies will not be enabled before the required consent is obtained. Users must be able to withdraw that consent through the mechanism described in the Cookie Policy. A statement in this Privacy Policy does not replace a functioning consent-management mechanism.

12. Changes to this Policy and Contact Details

12.1. We may update this Policy to reflect changes in legislation, the Website, the actual processing of personal data or our organisational arrangements. The current version and its effective date will be made available on the Website. Where a material change requires an additional notice or consent, we will provide it before the relevant processing takes place.

12.2. Questions about this Policy or requests concerning personal data may be sent to info@mac-hub.com or to the other official contact details of the Website controller identified in Section 2.

12.3. The Cookie Policy, Legal Notice / Company Information, Terms of Use and Website Disclaimer supplement this Policy and do not limit Users’ rights.