EEA and United Kingdom Privacy Supplement

1. Application and controller

This supplement addresses processing governed by the EU General Data Protection Regulation or UK GDPR. It supplements the main Privacy Policy; it does not represent that the project is authorized to promote investments throughout Europe. Broodex, Inc is the prelaunch controller, with the U.S. mailing address and privacy@cybercabcollective.com identified in the Privacy Policy.

EU/EEA representative, where appointed or required: Not required.. United Kingdom representative, where appointed or required: Not required.. Privacy inquiries can also be made directly to Broodex. A privacy contact is not represented as a formally appointed data protection officer unless an appointment is actually made and disclosed.

2. Purposes and lawful bases

The interest register includes nonbinding inquiries by financial institutions about potential future financing for clients considering the fleet proposal. We use the institution name and type, professional contact, program-readiness, financing-focus, indicative range per deal, lending-coverage, optional market and public-website information described in the main Privacy Policy to handle that requested business inquiry and assess potential fit. This is not a financing application or credit assessment; optional marketing still requires the applicable separate permission. Where a legal basis is required for inquiry administration, our legitimate interest is responding to and assessing a requested business discussion, subject to the contact's rights.

We use submitted contact details, location and interest answers to administer the nonbinding inquiry, verify accuracy, answer questions and assess project demand. Our legitimate interests are operating a truthful and secure interest register, preventing abuse and handling requests. We assess these interests against individual rights. Where a particular processing step is objectively necessary for an accepted Website service, contract necessity may be relevant, but it is not used to justify optional advertising or newsletters.

A requested readiness email, general update emails and important-milestone SMS have distinct permissions. An optional phone number is stored with the related choice and consent evidence as described in the main Privacy Policy. The number is unverified; email confirmation does not verify phone ownership. The separate unchecked SMS choice covers important project milestones, such as a future sales launch, not routine promotional texts. SMS delivery and phone verification are not active. Giving a number alone does not authorize calls or texts. Consent is the basis for those optional communications where required, and we do not use the existing-customer exception as an assumption for a new lead. No nonessential analytics, advertising or session replay is currently enabled. Any future optional tracking will be subject to the required prior choices before it starts. Legal-obligation processing is limited to an applicable obligation; defense of legal claims and proportionate security generally rely on legitimate interests or another applicable basis.

You may decline optional processing without losing access to the calculator or ability to record interest. Without the minimum information needed to administer a request, we may not be able to verify or respond to that request. No sensitive verification documents are requested at this stage.

3. Consent, objections and direct marketing

You can withdraw optional email or SMS permission and manage the optional phone number through supported account preferences, a valid secure preference link or privacy@cybercabcollective.com. Changing or removing a number revokes its previous SMS permission. Declining or withdrawing these optional choices does not prevent registering interest. Cookie Settings explains the technologies currently used; there are no optional tracking categories enabled. No SMS is sent and no STOP/HELP inbox is active; a future sending program will disclose its sender and provide working reply controls before messaging begins. Withdrawal does not affect prior processing that was lawful. A direct-marketing objection stops the relevant marketing use, including related profiling, without requiring a reason.

You may object to processing based on legitimate interests for reasons relating to your particular situation. We will assess the objection and stop unless the applicable legal standard permits continued processing. These choices do not waive rights under local financial-promotion or privacy law.

4. Individual rights and response

Subject to applicable conditions and exceptions, you may request access, rectification, erasure, restriction, portability and information about processing and recipients. You may ask for human review and other protections regarding a covered solely automated decision. There is no final automated investor-eligibility decision in the lead-stage process.

Use Your Privacy Choices or privacy@cybercabcollective.com. We ordinarily respond within one month. A lawful extension of up to two additional months may be used for a complex or numerous request, with reasons given within the initial month. We will explain a refusal, the applicable complaint rights and any legally permitted fee for a manifestly unfounded or excessive request. Routine requests are free, and verification must be proportionate.

You may complain to a competent supervisory authority, including in the EEA country of habitual residence, place of work or alleged infringement, or to the UK Information Commissioner's Office where applicable. You do not need to complete our complaint procedure or arbitration before contacting an authority or exercising nonwaivable judicial rights.

5. Transfers and recipients

Broodex is in the United States. Providers and processing locations are identified in the current register linked in the main policy. A restricted transfer to a separate recipient must have an applicable legal mechanism, which can include an adequacy decision or appropriate contractual safeguards together with required assessments and supplementary measures. Relevant EU standard contractual clauses and the UK Addendum or International Data Transfer Agreement may be used where appropriate to the actual roles and data flow.

A direct submission by a person to a U.S. controller and an onward transfer to a separate processor are not automatically the same legal situation; we assess actual flows. Broodex does not claim data-privacy-framework certification or an exemption from transfer rules solely because a user accepts Website terms. Contact the privacy address for the safeguards applicable to your data and a copy with necessary confidential details redacted.

6. Retention, later uses and local requirements

The main Privacy Policy states retention periods and criteria. Inactive leads are not kept indefinitely on the theory that a project might launch someday. Consent and claim evidence is minimized, periodically reviewed and separated from promotional profiles. A documented legal hold affects only relevant records and does not authorize renewed marketing.

We will explain a new controller, materially different purpose or additional verification process before it applies and obtain fresh consent where required. Information does not automatically move to an unidentified future corporation for unrelated marketing. Mandatory national electronic-marketing, cookie, consumer and investment-promotion rules remain applicable; this supplement is not a substitute for country-specific launch approval.