Personal Data Processing Policy

Version of: 18.10.2026

This Policy sets out how personal data is processed and protected in the MateSpace service (the "Service") in accordance with the Law of Ukraine "On Personal Data Protection" and, where applicable, the EU General Data Protection Regulation (GDPR). It supplements the Privacy Policy and the Terms of Use.

1. Controller and processor

1.1. The Service is operated by private entrepreneur Oleksii Lukash ("MateSpace"). Contact: info@matespace.io.

1.2. MateSpace is the controller of the personal data of website visitors, people who send requests and enquiries, and the contact details of company administrators.

1.3. For the personal data of employees that a customer company (the "Company") enters into the Service, the Company is the controller and MateSpace is the processor, acting solely on the Company's instructions and to the extent needed to provide the Service.

2. Consent

2.1. By registering in the Service, accepting a Company's invitation or submitting a form on the website, you confirm that you have read this Policy and the Privacy Policy and consent to the processing of your personal data for the purposes set out in section 4, where consent is the basis for such processing.

2.2. A Company that enters employees' data into the Service warrants that it has a lawful basis for doing so (including the employment contract, legitimate interest or the employee's consent) and has informed employees of the processing of their data in the Service.

2.3. You may withdraw consent at any time by writing to info@matespace.io. Withdrawal does not affect the lawfulness of processing before it and may make some features of the Service unavailable.

3. Categories of data

We process only data needed for the stated purpose: first and last name; work e-mail; job title, team and start date (if entered by the Company); profile photo; activity data in the Service (bonuses, awards, participation in events and surveys, orders); user content; requests to the AI assistant; technical data (IP address, device and browser data, event logs); data from enquiry forms.

4. Purposes

• providing the Service's features and maintaining accounts;
• ensuring the security of the Service and preventing abuse;
• communicating with users, support and service notifications;
• analysing aggregated use of the Service to improve it;
• handling demo, partnership and other requests;
• complying with the law.

5. How data is processed

5.1. Processing includes collection, recording, accumulation, storage, adaptation, alteration, updating, use, disclosure within section 6, anonymisation and destruction of data.

5.2. Data is processed electronically using automated means.

5.3. Only persons who need access to perform their duties and who are bound by confidentiality have access to the data.

6. Disclosure to third parties

6.1. Data may be shared with service providers that help provide the Service (hosting and storage, authentication, mailings and notifications, analytics, AI model providers) only to the extent needed for their functions and provided they protect the data.

6.2. Users' data is shared with the Company whose account it belongs to, within the permissions it has set up.

6.3. Data may be disclosed to public authorities in the cases and manner provided for by law.

6.4. Cross-border transfers are made only to countries and providers that ensure adequate protection or on other grounds established by law.

7. Retention

Personal data is kept no longer than needed for the purpose of processing: while the account is active and, after deletion, only as long as required by law or needed to protect the parties' rights. After that, data is destroyed or anonymised.

8. Data protection

MateSpace takes organisational and technical measures to protect data against accidental loss, destruction, unlawful processing and unauthorised access: encrypted connections, access control, secure password storage, backups, activity logging. We will notify the Company of an incident that poses a risk to data subjects' rights and, where required by law, the data subjects and the competent authority.

9. Data subject rights

Under Article 8 of the Law of Ukraine "On Personal Data Protection", you have the right, in particular:

• to know the sources of collection and location of your data, the purpose of processing, the controller and the processor;
• to receive information about the conditions of access to the data and the third parties to whom it is disclosed;
• to access your data;
• to receive an answer on whether your data is processed and its content within 30 calendar days of the request;
• to submit a reasoned objection to processing or a request to change or destroy data;
• to the protection of your data against unlawful processing, accidental loss or damage;
• to withdraw consent to processing;
• to lodge complaints with the Ukrainian Parliament Commissioner for Human Rights or a court.

10. How to submit a request

10.1. Send your request to info@matespace.io from the e-mail linked to your account, or include details by which you can be identified.

10.2. We handle requests within 30 calendar days unless the law sets a different period. To protect your data, we may ask you to verify your identity.

10.3. If the request concerns data entered by a Company, we will forward it to the Company as the controller and act on its instructions.

11. Changes

We may update this Policy. The current version is published on this page with its date.