Privacy and Cookies Policy

TROQUIZY LTD (“Troquizy,” the “Company,” or “we”) operates an online platform for user-to-user exchanges and sales in Israel. The purpose of this Privacy Policy is to inform users, in accordance with applicable Israeli law, of the nature of the personal data collected, the purposes of processing, the categories of recipients, any transfers outside of Israel, retention periods, security measures, and the rights granted to data subjects. It should be read in conjunction with the Terms of Use and, where applicable, with the specific policy regarding payments and delivery.

SCOPE OF APPLICATION

This Privacy Policy applies to the personal information we process, including when we provide our services on our websites, mobile applications, official social media pages and accounts, newsletters, and other online or offline offerings. To make this Privacy Policy easier to read, our websites, mobile applications, and other services, offerings, sales, marketing, or events are collectively referred to as “Services.”

Data Controller / Database Owner

Unless otherwise specified in a specific notice, TROQUIZY LTD, an Israeli company registered under number 517189379, with its address at 22 Guiborei Israel St., Netanya, Israel, acts as the data controller and database owner within the meaning of the Protection of Privacy Law, 5741-1981, as amended, in particular by Amendment No. 13. When service providers process data on our behalf, they act as database holders/processors and must be contractually bound in accordance with the Privacy Protection Regulations (Data Security), 5777-2017, particularly with regard to outsourcing, security, and confidentiality.

General Information:

We have established an internal organizational structure designed to ensure compliance: mapping of data processing activities, internal policies, access rights management, oversight of service providers, incident documentation, procedures for exercising rights, and periodic audits. When required by law—particularly with regard to the nature of our activities, the volume of data, the sensitivity of the data processed, or the criteria set forth in Amendment No. 13 to the Protection of Privacy Law—we appoint a Privacy Protection Officer (‫ )ממונה על הגנת הפרטיות‬who possesses the necessary expertise and sufficient functional independence. We also assess, in light of the rules applicable following Amendment No. 13, whether there is an obligation to notify or register a database with the Privacy Protection Authority.

Useful official references: Privacy Protection Authority – Amendment No. 13: https://www.gov.il/he/pages/guide_tikon13_professional; Protection of Privacy Law, 5741-1981 (unconsolidated official translation):

https://www.gov.il/BlobFolder/legalinfo/legislation/en/ProtectionofPrivacyLaw5741198 1unofficialtranslatio.pdf ; Privacy Protection Regulations (Data Security), 5777-2017: https://www.gov.il/en/pages/data_security_eng; international transfers: https://www.gov.il/en/pages/takana3; marketing communications:

https://www.gov.il/he/pages/marketing_inquiries.

PERSONAL INFORMATION WE COLLECT

The categories of personal information we collect depend on how you interact with us, how you use our Services, and the requirements of applicable law. We collect information you provide to us, information we obtain automatically when you use our Services, and information from other sources such as third-party services and organizations, as described below.

Personal Information You Provide to Us

We may collect the following personal information that you provide to us:

• Account information. You provide us with information when you create an account or use our Services, including your first and last name, email address, mailing address, phone number, ID number, photos of your ID, and other contact details. Some of this information is required to create a Troquizy account in order to use the Services. If you do not provide us with this information, you will not be able to create an account to use the Services. You may add other optional information to your account, such as a profile photo and “bio” information.
• Your login credentials. If you have a Troquizy account, we need to collect passwords, password hints, and similar security-related information that allow us to identify you and grant you access to your account. If you do not provide us with this information, you will not be able to create or access your Troquizy account.
• Data used to verify your identity. To apply to become a verified seller or buyer, or to conduct certain transactions through the Services, we may need to verify your identity. This verification may include a photograph of a government-issued ID, identifying information, a date of birth, and, when necessary for fraud prevention, compliance, or payments, additional information. This collection must be limited to what is necessary and proportionate. Verification may be performed by our payment or compliance service provider, currently PayPlus, whose privacy policy is available at: https://payplus.co.il/privacy-policy/ or

https://payplus.com/privacy, depending on the service used.

• Data related to your payments and purchases. We collect personal information and details regarding the offers, purchases, or sales you make during a transaction, as well as information related to your payments (e.g., credit card and bank account numbers, billing address, transaction details, and payment

method). All payments made through our Services are processed by Payplus, our payment service provider. You can view their privacy policy at

https://payplus.com/privacy. We do not directly collect or store any payment card numbers entered through our Services, but we may receive information associated with your payment card data (e.g., your billing details).

• Additional data regarding the seller’s identity. If you are a seller, we will collect additional identifying information from you, including your tax identification number (e.g., Social Security number or local equivalent), your date of birth, your identification documents, and the information contained on your identification documents, as well as other information you provide when using our Services as a seller.
• Your contact information. We may collect personal information such as your email address, phone number, or mailing address when you contact us—for example, when you request information about our Services, sign up for our newsletter or loyalty program, request customer or technical support, apply for a job, or otherwise communicate with us.
• Survey data. We may contact you to invite you to participate in surveys. If you decide to participate, you may be asked to provide certain information, including personal information.
• The information you provide when using the Services’ public sharing features (hereinafter referred to as “User Content”) may be visible to other users or, depending on your settings, publicly accessible. However, it will continue to be processed in accordance with this Privacy Policy and applicable privacy laws. Please exercise caution before disclosing to other users any information that could identify you in the real world.
• When you stream on our Services, we record and retain your streaming session— including your image and voice—for the duration specified in the Terms of Use and the Live & Replay Addendum, , generally eight (8) to twelve (12) months from the date of the stream, unless a longer retention period is required for security, evidence, fraud prevention, resolving a dispute, or complying with a legal obligation.
• When you stream on our Services, you and users participating in your live stream may, when this feature is enabled and within the limits authorized by the Platform, create or share a clip of your content, including your image and voice. This use remains subject to the Terms of Service, the Platform’s rules, the rights of identifiable individuals, and, where required, their consent.
• Data related to in-store pickup. If you use the In-Store Pickup feature, we collect your mailing address to determine your distance from other users in order to facilitate in-store pickups by buyers near you. If you are a seller and choose to allow in-store pickup, your ZIP code will be published and your mailing address will be shared with buyers who choose to pick up their order at your store. If you are a seller, you may choose to publish your city on your profile.
• Promotional data. We collect the personal information you provide in connection with giveaways, contests, or other promotions we offer. In accordance with applicable law, we may be required to publicly disclose information about winners of sweepstakes and contests.
• Event-related data. We collect personal information from individuals who attend conferences, trade shows, and other events that we organize or participate in.
• Data for Business Development. We may collect personal information from individuals and third parties to evaluate and pursue potential business opportunities.
• Data related to job applicants. We may post job openings and opportunities on our Services. If you respond to one of these openings by submitting your application, resume, or cover letter, we will collect and use the information about you (such as your desired salary, education, work history, and visa status) that you provided in your job application to evaluate your qualifications.
• Other Information. We collect any other personal information you choose to share with us.

Personal Information Collected Automatically.

When you use our Services, we automatically collect personal information about you and your computer or mobile device, as well as your browsing activities and usage patterns, such as:

• Device, connection, and technical log data. This includes technical data collected from the devices (including mobile devices) you use to access our Services, such as your Internet Protocol (IP) address, user settings, MAC address, cookie identifiers, mobile carrier, mobile advertising and other unique online identifiers, browser or device information, your general location information (including approximate location [e.g., city and country] derived from your IP address), your Internet service provider, as well as connection logs necessary for security and session maintenance, including access tokens, refresh tokens, connection timestamps, authentication events, and technical logs required to detect anomalies or unauthorized access.
• Usage data. This includes information about you that is collected and processed when you access or use our Services, namely your activities within the Services, including dates, times, and the pages you viewed before, during, and after using our Services; information regarding the links you click on; the types of content you interact with; the frequency and duration of your activities, and other information about how you use our Services, including information related to your Troquizy account (e.g., when you add items to a shopping cart or a wish list, save sellers, searches, or interests, or when you follow users). If required by law, we will ask for your consent to collect this information. In addition, we may collect information that others provide about you when they use our Services, including information about you when they identify you.

We may collect this information through our Services or using technologies such as cookies and other similar tracking technologies (trackers). For more information about

how we use these technologies and the choices available to you, please see the “Cookies and Other Technologies” section below.

Sensitive Data and High-Risk Data. Certain information collected by Troquizy may be classified as sensitive data or pose an increased risk to privacy, including identification documents, financial information, precise location data, photo metadata, any biometric data, and images and voices during live streams. Such processing must be limited to specific purposes, documented, secured, and subject to restricted access.

Personal Information Collected from Other Sources.

We may obtain personal information about you from other sources, including through third-party services and organizations. For example:

Authentication partners: If you access our Services through a third-party application, such as an app store, a third-party sign- , or a social network, we may collect personal information about you from that third-party application that you have made available through your privacy settings. For example, we allow you to use single sign-on providers (such as Google, Facebook, or Apple) with which you already have an account to create a Troquizy account or to link your Troquizy account to these single sign-on services. You can determine which personal data we can access when you authorize the connection with the single sign-on service.

Publicly Available Data: We may collect your personal information from publicly available sources.

Social media: We allow you to share personal data with social media platforms (such as Facebook, TikTok, Instagram, WhatsApp, or any other platform not listed here) or to link your Troquizy account to a social media platform. These social media platforms may automatically grant us access to certain personal data they hold about you (e.g., content you’ve viewed or liked, information about ads that were shown to you or that you clicked on, etc.). You can control which personal data we have access to through each social media platform’s privacy settings.

Payment partners and transaction settlement service providers: We receive information about you from payment and transaction settlement service providers, such as payment confirmation details, delivery services, and information related to logistics tracking, carriers, or package drop-off confirmations.

Advertising and marketing partners. We may receive from certain partners segments, indicators, or approximate inferences regarding interests or preferences, as well as technical identifiers or hashes, solely to the extent permitted by applicable law and in accordance with your choices. This information does not constitute definitive knowledge of your preferences and must not be used to make a decision that produces a significant legal or similar effect on you without an appropriate legal basis.

COOKIES AND OTHER TECHNOLOGIES

We, as well as third parties that provide content, advertising, audience measurement, or other features on our Services, may use cookies, pixels, mobile identifiers, local storage, SDKs, and similar technologies (“Technologies”). Under Israeli law, the use of these Technologies must comply with the Protection of Privacy Law, as well as obligations

regarding information disclosure, consent where required, data minimization, security, and respect for user choices. Technologies that are not strictly necessary for the operation of the service—including advanced analytics, personalized advertising, or cross-device tracking—must be presented transparently and must allow users to opt out or adjust settings when they involve the processing of personal data that requires such action.

• Cookies. Cookies are small text files placed in device browsers. They record

preferences and facilitate and enhance your experience.

• Tracking pixels/invisible pixels (“pixel tags”). A tracking pixel (also known as an invisible pixel) is a piece of code embedded in our Services that collects information about activities performed on our Services. The use of a tracking pixel allows us to record, for example, whether a user has visited a particular web page or clicked on a specific advertisement. We may also embed invisible pixels in emails to determine whether messages have been opened, responded to, or forwarded.

Our use of these Technologies falls into the following general categories:

• Essential for operation. These include Technologies that enable you to access the Services, applications, and tools necessary for authentication, security, fraud prevention, data synchronization, real-time chat, file storage, payment processing, search, and technical optimization of live streams. These Technologies include, in particular, Firebase (Google Authentication, Cloud Firestore, Realtime Database, Cloud Storage, and Cloud Functions), Algolia, PayPlus, and Mux when they are necessary to perform the service requested by the user. They may be enabled as soon as the application launches, before separate consent is obtained, to the extent that they are strictly necessary;
• Performance-related. We may use Technologies to evaluate the performance of our Services, particularly as part of our analytics practices to understand how people use our Services (see Analytics below); and
• Related to features. We may use Technologies that allow us to offer you enhanced features when you access or use our Services. This may include identifying you when you access our Services or keeping track of your preferences, interests, or items you have viewed.

Advertising and targeting. We may use internal or third-party Technologies to provide personalized content or advertisements, subject to applicable law, your consent where required, and the option to opt out or object. We will not classify these practices as “sale” or “sharing” under U.S. laws, unless such legislation becomes effectively applicable to a specific user.

See the “Your Privacy Choices and Rights” section below to learn about your choices regarding these Technologies.

Management of cookies, SDKs, and trackers. Prior to going live, Troquizy must verify that the website and app have an operational mechanism in place to identify the categories of Technologies used, display the relevant service providers, obtain consent where required, and retain proof of user preferences. Technologies that are strictly necessary—

including Firebase, Algolia, PayPlus, and Mux for the technical purposes described above—may be enabled without separate prior consent. Technologies that are not strictly necessary— , including certain audience measurement tools, ad tracking, advanced personalization, or precise geolocation for personalized content—must be subject to transparent disclosure and, where required, prior consent.

Analytics, Video, and Technical Tools. We may use Technologies and other third-party tools to automatically collect Usage Data and Device Data for the purposes of analytics, technical operations, video stream optimization, and security. The main tools disclosed at this time are as follows:

• Firebase Analytics and, where applicable, Google Analytics. These tools are used for overall audience analysis, statistical measurement of app usage, and service improvement. They may involve the processing of IP addresses, technical identifiers, and usage events, and must be configured in accordance with the user’s preferences when their use is not strictly necessary.
• Mux. Mux is used for the technical management and optimization of live video streams. For this purpose, it is considered strictly necessary for the operation of live broadcasts and may be enabled prior to consent, provided that its use is limited to the necessary technical purposes.
• Algolia. Algolia is used for the search engine, autocomplete, and filters. This processing is strictly necessary for the performance of the search service requested by the user.
• Social media platforms. Our Services may include social media sharing buttons such as Instagram, TikTok, Twitter, and Facebook (which may include widgets such as the “Share This” button or other interactive mini-programs). These features may collect information such as your IP address and the page you are visiting on our Services, and set a cookie that is necessary for their proper functioning. Your interactions with these platforms are governed by the privacy policy of the company that provides them.
• Google Maps. The Google Maps API is used for geolocation searches and for integrating or validating addresses. When it is used solely to secure or validate the entry of an address required for registration, payment, or a transaction, it is treated as strictly necessary. When it is used to track the user’s geographic location or to offer personalized content based on their location, it requires specific information and, where required, prior consent.
• MailerSend. MailerSend is used to send operational and, where applicable, marketing emails. It may process email addresses, technical identifiers, and data related to sending, delivery, and opening events, and may involve data transfers outside of Israel, particularly to the United States, subject to applicable contractual safeguards and rules regarding marketing communications.

See the “Your Privacy Choices and Rights” section below to learn about your choices regarding these Technologies.

HOW DO WE USE YOUR PERSONAL INFORMATION?

We use your personal information for various business purposes, including making it available to our Services for business operations and to market our products and Services, as described below.

Provision of Services

We use your personal information to provide you with our Services, including, but not limited to:

Creating an account that allows you to access the Services or the Troquizy app when you download it to your device;

Sharing personal information with third parties, as necessary, to provide the Services;

Enabling access to certain features of our Services (including allowing you to create and view content, interact with others, and use social features);

Process and manage your orders, payments, returns, and exchanges made through the Services, including the transmission of personal data to other users when necessary to complete the transaction, such as processing related to carriers, shipping labels, logistics tracking, or package drop-off confirmations;

Process general location data (such as IP address or ZIP code) to provide you with location-based services (such as searches within a geographic radius and other personalized content based on your general location data) based on your consent;

When you stream on our Services, we use these recordings for transaction verification and fraud prevention purposes. These recordings are accessible, for the same purposes, to users of our Services who purchased an item from you during your stream. Other users who merely watched your stream do not have access to the recordings.

To manage sweepstakes and contests when you choose to participate;

Responding to customer inquiries or requests for technical support;

Enabling our payment processor to process your financial information and accept other payment methods for purchased products or Services;

Processes related to verifying shipping confirmations by analyzing the timestamp, location, or metadata of package drop-off photos, as well as the delivery services and the logistics provider or carrier specified in the app or in the order summary;

Improving the accuracy of address searches using the device’s location during onboarding and payment.

Administrative Purposes

We use your personal information for various administrative purposes related to the provision of the Services, including to:

• Communicate with you regarding your account, activities on our Services, and changes to any policies;
• Manage your information and your Troquizy account;
• Fulfill your requests and process and respond to support requests;
• Allow you to register for events;
• Provide you with updates and support regarding any purchases you make through the Services;
• Respond to and address your questions, complaints, or disputes (including when you report a problem to us or request a copy of your information).

Security and Trust

We process your personal information to ensure the security of the Services, to detect and prevent fraud, and to ensure the safety and well-being of our users, including by taking the following actions:

Security Incident. In the event of a serious security incident as defined by the Privacy Protection Regulations (Data Security), 5777-2017, Troquizy will implement its internal incident response procedure, document the event, take the necessary remedial measures, and notify the Privacy Protection Authority immediately when required by law. The official notification form is available on the Ministry of Justice website:

https://mojforms.justice.gov.il/mojaemprivacyprotectionauthority/databreachupdate.ht ml.

• Verify your identity in order to use certain features, for example, if you wish to become a registered buyer or seller, to ensure that you are of the required age to use the Services (as required by law), or in other cases where verification is required;
• Maintain the security of the Services, for example, by verifying accounts and activities, investigating suspicious activity, detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and taking legal action against those responsible for such activity;
• Review or otherwise process your User Content (including, where permitted by applicable law, direct messages, chat communications, and associated metadata, photos, and videos, as well as chat activity indicators such as online status, typing indicators, and read receipts) to help respond to support requests, or to determine or analyze violations of our terms, terms, policies, and Community Guidelines, and to prevent fraud and abuse. Messages may also be subject to automated moderation processing via the Google Natural Language API, for the limited purpose of security, moderation, and the prevention of abusive or illegal content;
• Identify and resolve technical or security issues (for example, technical bugs, spam accounts, and the detection of abuse, fraud, and illegal activities);
• Ensure internal quality and security control;

Processing to detect fraudulent shipping confirmations by validating photographic metadata or location data from photos of package drop-offs;

Legal Obligations and Compliance

We process your personal information to enforce our agreements and rights, as well as to comply with the law, including by:

• Complying with our legal obligations, including cooperating with public and government authorities, courts, and regulators in accordance with our legal obligations under applicable laws;
• Enforcing our terms, guidelines, and policies;
• Conducting audits of interactions, transactions, and other activities related to compliance;
• Taking appropriate action in cases of intellectual property infringement and inappropriate content.

Processing Job Applications

We process your personal information when you apply for a job at Troquizy to evaluate your application and make hiring decisions, to communicate with you and inform you of current and future career opportunities (unless you let us know that you do not want us to retain your information for these purposes), to manage and improve our recruitment and hiring processes, or to conduct reference and background checks when required or permitted by applicable local law.

Service Improvement

We process your personal information to review, test, improve, and develop the Services, including:

• Measuring interest in and engagement with our Services and other research and development activities (including market research and surveys);
• Debugging to identify and fix errors in our Services.

Marketing and Advertising

We may use personal information to personalize and provide you with marketing content and advertisements, in compliance with applicable law and in accordance with your marketing preferences.

We may send you direct marketing messages related to features of the Services that we believe may be of interest to you. We may also send you promotions, content, or information related to marketing campaigns for events.

Email campaigns, advertising targeted at personalized audiences, and “interest-based” or “personalized” advertising—including through cross-device tracking—are some of the methods we use to market our products, as explained in more detail in the “Cookies and Other Technologies” section. We may also use your information to run marketing campaigns targeting people with interests similar to yours. Campaigns via email, SMS, push notifications, or other promotional electronic messages are conducted in accordance with Israeli law, including Section 30A of the Communications Law (Telecommunications and Broadcasting), 5742-1982 (“Spam Law”), where applicable. When prior consent is required, we will not send you any promotional messages without valid consent, and each promotional message will contain the required information about the sender as well as a simple and free way to unsubscribe. Messages that are strictly transactional or necessary for account operation are not considered promotional messages.

We may combine your publicly available personal information with other data we collect from you in connection with your use of the services for the purposes of analysis and lead generation.

If you have any questions about our business practices or if you wish to opt out of the use of your personal information for marketing purposes, you can contact us at any time as indicated in the “Contact Us” section below.

Other Purposes

We also use your personal information for other purposes, depending on your requests or as required by applicable law.

Consent. We may use personal information for other purposes that are clearly disclosed to you at the time you provide personal information or, where applicable, with your consent.

Automated Decision-Making. We may use automated tools, including tools for fraud detection, transactional risk scoring, moderation, or security. When automated processing is likely to produce a legal effect or a similarly significant effect on a user, we will apply the safeguards provided by applicable law, including appropriate information, the ability to contact us, and, where required, human intervention or review.

Personalization. We may use your personal information to improve and personalize your user experience on the Services, for example, by recommending content in your feed— such as sellers, items, or products—that you might find interesting based on your actions on the Services.

Anonymized and Aggregated Information. We may use personal information and other information about you to provide anonymized or aggregated information, including anonymized demographic data, anonymized purchase information, information about the device you use to access our Services, or other analyses we produce. This information does not allow us to identify you or other users.

Sharing Content with Friends. Our Services may offer various tools and features. For example, we may allow you to provide personal information about your friends, or allow your friends to provide personal information about you, through our sharing services. Our sharing services may allow you to forward certain content to a friend or share it with them—for example, an email inviting your friend to use our Services. Please provide us only with the contact information of people with whom you have a relationship (e.g., a relative, friend, neighbor, or colleague).

Account Suggestions. To provide the social features of the Services, including enabling you and others to connect with one another (for example, through our “Find Friends” feature), to suggest accounts to you and others—including when a user chooses to sync their contacts with the Services—and to enable you and others to share, download, and otherwise interact with User Content posted through the Services;

Find a Friend. When you create an account on the Troquizy mobile app via your mobile device, Troquizy will ask for your permission to access your phone contacts to determine whether you are already connected to existing Troquizy users, so that you can follow those contacts and invite contacts who are not users to join the Services. We may also receive

your contact information when another user shares it with us so that user can follow you on Troquizy or invite you to join the Services. You are solely responsible for obtaining consent from your contacts. You can always authorize Troquizy to access your contacts through your mobile device’s privacy settings.

HOW DO WE DISCLOSE YOUR PERSONAL INFORMATION?

We disclose your personal information to third parties for various business reasons, including to provide our Services, to protect ourselves or others, or in the event of a major business transaction such as a merger, sale, or transfer of assets, as described below.

Disclosures Necessary to Provide Our Services

The categories of third parties with whom we may share your personal information are described below.

Service Providers. We may share your personal information with our third-party service providers, who use it to help us provide, support, and protect our Services. These include service providers that provide us with IT support, cloud hosting, data processing payment processing, content delivery, marketing, analytics, customer service, and related services.

We share the information you provide, information collected automatically, and information from other sources with these service providers, as necessary, to enable them to provide their services.

Business Partners. We may share your personal information with business partners, such as celebrities, brands, and influencers, to provide you with a product or service you have requested. We may also share your personal information with business partners with whom we jointly offer products or services.

This may include information you provide and information from other sources.

Payment and Transaction Processing Service Providers. When you make a purchase through the Services, we share your payment and purchase data related to the transaction with payment and transaction processing service providers, including PayPlus, as well as with other providers strictly necessary to complete the transaction. Information related to carriers, logistics tracking, or delivery may be shared.

Affiliates. We may share all or part of the personal information we collect with our affiliates if necessary for our business operations, including activities such as IT management, so that these affiliates can provide services to you or support and supplement the Services we provide. Affiliates include our parent company as well as any subsidiaries, joint venture partners, or other companies that we control or that are under common control with us.

Photos of package drop-offs or shipping verifications are not shared with buyers, except when such sharing is strictly necessary to manage a dispute, a delivery, a return, an alleged fraud, or to comply with a legal obligation, in accordance with the Terms of Service and this Policy.

Advertising Partners. Our advertising, marketing, and analytics providers, described above in the “Analytics” section, may receive your personal information, including

information you provide, information from other sources, and information collected automatically (excluding payment-related information). These third-party advertising and analytics partners may place Technologies and other tracking tools on our Services to automatically collect usage and device data, such as information about your activities and your device (e.g., your IP address, cookie identifiers, pages visited, your location, or the time). These advertising partners may use this information (along with similar data collected from other services) to serve you personalized ads when you browse digital content on their networks. This practice is commonly referred to as “interest-based advertising” or “personalized advertising,” as described in more detail in the “Cookies and Other Technologies” section.

APIs/SDKs. We may use third-party application programming interfaces (“APIs”) and software development kits (“SDKs”) as part of the functionality of our Services. For more information regarding our use of APIs and SDKs, please contact us as indicated in the “Contact Us” section below.

We may also share aggregated or anonymized Usage Data with third parties to enable us to conduct analyses and make improvements. In addition, we may share anonymous Usage Data in aggregated form in the normal course of our business. For example, we may share information publicly to highlight trends in the use of our Services.

Disclosures to Protect Ourselves or Others

We may access, retain, and disclose personal information when necessary and proportionate to comply with a legal obligation, respond to a court order, cooperate with a competent authority, protect the rights, safety, or property of Troquizy, its users, or third parties, enforce our terms and conditions, prevent fraud or illegal activity, or manage a dispute. Any disclosure will be limited to the specific purpose and documented when required.

Disclosures in the Event of a Merger, Sale, or Other Asset Transfers

If we are involved in a merger, acquisition, financial audit, reorganization, bankruptcy, receivership, purchase or sale of assets, or a transition of service to another provider, all personal information we collect may be sold or transferred as part of such a transaction, to the extent permitted by law or contract.

YOUR PRIVACY CHOICES AND RIGHTS

You have the rights recognized under applicable Israeli law, including the right to access data concerning you and the right to request the correction of inaccurate, incomplete, unclear, or outdated data. Certain additional requests, such as deletion, anonymization, restriction, objection, or withdrawal of consent, will be considered in accordance with applicable law, the purpose of the processing, and any legal, tax, accounting, contractual, or security obligations that may require the retention of certain data.

Your Privacy Choices.

Communications via email, SMS, and telephone. Electronic promotional messages are subject, where applicable, to Section 30A of the Communications Law (Telecommunications and Broadcasting), 5742-1982. You can opt out of promotional communications by using the opt-out link or mechanism included in the message, by

replying “STOP” when that option is available, by updating your preferences in your account, or by contacting us. Transactional, security, compliance, or order-related communications may continue to be sent to you even after you opt out of marketing communications.

Text Messages. You can opt out of receiving text messages from us by sending “STOP,” updating your preferences in your account, or otherwise contacting us as described in the “Contact Us” section below.

Mobile Devices. We may send you push notifications through our mobile app, subject to your settings. You can opt out of these notifications in your device settings. We may also request access to precise location data for specific features, such as address search or validation, securing a transaction, or displaying location-based content when this feature is enabled. When location data is used to provide personalized content based on the user’s location, it will be subject to specific disclosure and, where required, prior consent. Refusing or withdrawing this consent may prevent certain features from functioning properly, without affecting services not related to this location.

Cookies and personalized ads. You can limit, delete, or block these Technologies through your browser settings, your mobile device settings, or, where available, through our preference management tool. Certain cookies or SDKs that are strictly necessary for operation, security, fraud prevention, or the execution of a transaction cannot be disabled without affecting the service. Preferences must be configured separately for each browser and device.

Your Privacy Rights.

Access your personal information, including, among other things: (i) confirming whether we process your personal information; (ii) obtaining access to your personal information or a copy thereof;

Request the correction or modification of your personal information when it is inaccurate, incomplete, or out of date. In some cases, we may provide self-service tools to allow you to update your personal information. For example, you can modify most of your information through controls and settings built into the app (such as your Account Information);

Request the deletion, anonymization, or blocking of your personal information, for example, when the processing is based on your consent or when it is unnecessary, excessive, or non-compliant;

Request the restriction of, or object to, the processing of your personal information, for example, when such processing is non-compliant;

Request the withdrawal of your consent to any processing of your personal information by us. Please contact us at any time, as indicated in the “Contact Us” section below. Withdrawing your consent will not affect the lawfulness of the processing we carried out prior to the withdrawal, nor will it affect the processing of your personal information carried out on a legal basis other than your consent. If you choose not to provide personal information or if you withdraw your consent to processing, you may not be able to access or certain features of our Service. If we are unable to fulfill your request, we will provide you with an explanation;

Request a reasonable electronic copy of your personal information when such a request is provided for by applicable law or when Troquizy chooses to offer it contractually, without this creating a general right to data portability where Israeli law does not require it;

To be informed, to the extent required by Israeli law, of the purposes of data collection, the categories of recipients, and the consequences of refusing to provide the requested data; and

Request information or a review when automated processing is likely to produce a significant legal or similar effect, to the extent provided for by applicable law.

Opt out of marketing communications, withdraw consent where processing is based on consent, or object to certain processing where applicable law grants you that right. We do not sell users’ personal information in the ordinary sense of the term, nor do we transfer it to independent third parties in exchange for direct compensation. Transfers to service providers and partners described in this Policy are made for the stated purposes and subject to applicable safeguards.

When we deny a request to exercise your rights, we will inform you, to the extent required by law, of the reasons for the denial and the contact information or complaint channels available through Troquizy or the Privacy Protection Authority.

How Can You Exercise Your Rights? If you wish to exercise any of your rights listed above, please contact us as indicated in the “Contact Us” section below. We will review and process these requests in accordance with applicable laws and to the extent required by them.

You may be entitled, in accordance with applicable law, to submit a request through an authorized agent. To designate an authorized agent to make choices on your behalf, please provide proof that you have granted that agent a power of attorney or that the agent has valid written authorization to submit requests to exercise your rights on your behalf.

We will respond to your request in accordance with applicable law and subject to appropriate verification. We will verify your request; please send it from the email address associated with your account or provide the information necessary to verify your account.

We encourage you to “Contact Us” if you are not satisfied with our response to any of your requests regarding the exercise of your rights. You also have the right to file a complaint with a supervisory authority regarding the collection and use of your personal information. For more information, please contact your local data protection authority. Contact information for data protection authorities in Israel is available here.

PROTECTION OF YOUR PERSONAL INFORMATION

We use a combination of physical, technical, and administrative safeguards to protect the information we collect through the Services. We maintain internal policies and procedures that govern how we collect, use, disclose, store, protect, and destroy personal information. Although we take these precautions to protect your information, no system is 100% secure, and we cannot guarantee the security of the networks, systems, servers, devices, and databases that we operate or that are operated on our behalf. To the

fullest extent permitted by applicable law, we disclaim any liability for unauthorized disclosure.

By using our Services or providing us with personal information, you agree that we may communicate with you electronically regarding security, privacy, and administrative matters related to your use of our Services. If we discover a security breach, we may attempt to notify you electronically via a notice on our Services, by mail, or by email.

International Data Transfers

All information we process may be transferred, processed, and stored anywhere in the world, both internally at our offices and data centers, as well as externally with the third parties described in this Privacy Policy.

This means that your information may be transferred to or stored in Israel, the European Union, the United States, or other countries where our service providers or infrastructure are located. Currently, the Firebase servers used for the core infrastructure are listed as being located in Tel Aviv, and payment processing as well as compliance/KYC are handled in Israel by PayPlus. However, certain tools such as Google Analytics, Firebase Analytics (where applicable), MailerSend, and other Google services or international service providers may result in routine transfers of technical data—including IP addresses, technical identifiers, and usage events—to servers located outside of Israel, particularly in the United States. Any transfer of data from a database located in Israel to a database or recipient located outside of Israel will be carried out in accordance with the Privacy Protection Regulations (Transfer of Data to Databases Abroad), 5761-2001, specifically based on valid consent, a destination offering adequate protection, or an appropriate contractual commitment from the recipient, as applicable.

Regardless of where your information is processed, we will implement appropriate mechanisms to ensure that such transfer complies with applicable laws and regulations. For example, regarding the information we collect:

• We use appropriate contractual commitments, including, where relevant, data protection clauses requiring the foreign recipient to take sufficient measures to protect the privacy of the data subjects, to limit use to authorized purposes, and not to transfer the data to another recipient without a basis that complies with applicable rules.

For more information, please contact us as indicated below.

The types of personal information we collect and use: The personal information we collect from you and the purposes for which we collect it are described in the “Personal Information We Collect” section above. To learn how TROQUIZY LTD uses this personal information, please see the “How We Use Your Personal Information” section above.

Transfers to Third Parties: Information regarding the types of third parties to whom we disclose personal information and the purposes for which we do so is described in the “How We Use Your Personal Information” section above.

Law Enforcement: TROQUIZY LTD may be required to disclose the personal information we process in accordance with Israeli law in response to lawful requests from public authorities and to meet national security or law enforcement requirements.

Your Choices. We will provide you with the opportunity to opt out when it becomes necessary to disclose your personal information to an independent third party or when it is to be used for purposes substantially different from those set forth in this Privacy Policy. If you wish to otherwise limit the use or disclosure of your personal information, please contact us using the contact information below.

privacy@Troquizy.io

Questions and Disputes: If you have any inquiries or complaints regarding our processing of your personal information under Israeli law, or regarding our privacy practices in general, please email us at: privacy@troquizy.io

In accordance with applicable Israeli law, TROQUIZY LTD will cooperate with the Privacy Protection Authority and with any competent authority or court regarding claims related to the processing of personal information. This provision does not deprive the user of any mandatory rights granted to them under applicable law.

If a complaint is not resolved amicably, it may be brought before the competent courts or subject to an alternative dispute resolution mechanism only under the conditions permitted by law and by the applicable Terms of Use. No arbitration clause shall limit consumers’ mandatory rights where such rights are protected by Israeli law.

RETENTION OF PERSONAL INFORMATION

We retain your personal information when justified by an ongoing and legitimate business need (for example, to provide you with our Services or to comply with legal, tax, or accounting requirements). In certain circumstances, we are required to retain your information after your account is deleted for legal reasons. To determine the appropriate retention period for personal information, we consider factors such as the amount, nature, and sensitivity of the personal information; the risk of harm resulting from unauthorized use or disclosure of the personal information; the purposes for which we process it and whether we can achieve those purposes through other means; and applicable legal requirements.

Recommended Retention Schedule. Before publication, it is recommended to add or maintain an internal appendix containing a table organized by data category: account data, KYC/identity, transactions, payments, support, live streaming, chats and activity metrics, security logs, session tokens, marketing, cookies/SDKs, automated moderation, and applications. Profile and account data are intended to be permanently deleted upon request to delete an account, subject to data that must be retained for legal, tax, accounting, contractual, security, fraud prevention, or legal defense purposes. Each category must specify the purpose, retention period or criteria, legal basis for processing, recipients, and the method of deletion or anonymization.

When we have no legitimate business purpose or legal basis for processing your personal information, we delete it or anonymize it (so that you can no longer be identified using this information); or, if this is not possible (for example, if your personal information has been retained in backup archives), we store it securely and protect it from further processing until it can be deleted.

Minors. The Services are not intended for individuals under the age of 18. Troquizy does not knowingly collect personal information from minors and does not allow individuals

under the age of 18 to create an account. Any reference to a “sale” or “sharing” of minors’ data as defined by U.S. law is deleted as irrelevant to a policy based on Israeli law, unless a foreign law is mandatorily applicable in a specific case.

Disclosure Regarding Sensitive Personal Information. Troquizy uses and discloses sensitive personal information solely for the following purposes:

• To prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information.
• To counteract malicious, dishonest, fraudulent, or illegal acts directed against Troquizy and to prosecute those responsible for such acts.
• To verify the user’s identity in limited circumstances (e.g., verification of an official ID).
• For purposes that do not involve personally identifiable characteristics.

Authorized Representative. A person acting on your behalf may submit a request regarding your personal information to us if they provide valid proof of authority, such as a power of attorney or sufficient written authorization. We may request reasonable verification to protect your data from unauthorized disclosure.

Verification. To protect your privacy, we will take the following steps to verify your identity before responding to your request. When you submit a request, we ask you to provide sufficient information to allow us to reasonably verify that you are the person from whom we collected personal information or an authorized representative, which may include information related to your account and your use of our Services.

Anonymized Information. If we collect or receive anonymized information, we will not attempt to re-identify the individuals to whom it relates, except to comply with applicable law.

Refer-a-Friend Program and Other Financial Incentive Programs. As described above in the section “How We Use Your Personal Information” (“Sharing Content with Friends”), we may offer referral programs or other incentive-based data collection programs. For example, we may offer you incentives such as discounts, promotional items, or credits as part of these programs, in which you provide your personal information in exchange for a reward or provide your friends’ personal information (such as their email address) and receive rewards when they sign up to use our Services. (The person you refer may also receive rewards for signing up through your referral.) These programs are entirely optional and allow us to grow our business and offer you additional benefits. The value of your data to us depends on how you use our Services, while the value of the referred party’s data to us depends on whether they sign up for and use our Services. This value will be reflected in the incentive offered under each program.

Accessibility. This Privacy Policy uses technologies that meet company standards and has been developed in accordance with the World Wide Web Consortium’s Web Content Accessibility Guidelines, Version 2.1. If you wish to print this Policy, do so from your web browser or by saving the page as a PDF.

Deletion of Public Content. Where required by applicable law or where our tools permit, you may delete certain content you have posted or request that we limit its visibility.

Legal Basis for Processing. Israeli law requires, among other things, that data subjects be provided with fair notice, that the purpose of data collection be respected, that processing be proportionate, that security be ensured, and, where required, that consent be obtained. For the sake of transparency, Troquizy states that processing may be based, as applicable, on the performance of the contract entered into with the user, a legal obligation, fraud prevention and security, the legitimate interests of Troquizy or a third party where such interests do not disproportionately infringe on privacy, or consent where required by law or by the nature of the processing.

• The performance of the contract entered into with you, for example, to create an account, facilitate a transaction, process a payment, manage a return, or provide customer support.
• The protection of a proportionate legitimate interest, including platform security, fraud prevention, service improvement, the defense of legal rights, content moderation, and non-excessive statistical analysis.
• Your consent, including for certain marketing communications, certain non- essential cookies or trackers, certain precise location data, and any other processing for which the law requires specific consent.

Troquizy must maintain an internal cross-reference table detailing processing purposes, data categories, recipients, retention periods, and legal bases for processing to demonstrate compliance. If this table is intended for publication, it must be added to this Privacy Policy before it is posted online.

Use for New Purposes. We may use your personal information for purposes not described in this Privacy Policy, provided that the law permits such use and the purpose is compatible with the purpose for which we collected it. If we need to use your personal information for purposes unrelated to the reasons for which we collected it, we will notify you and explain the applicable legal basis.

INFORMATION REGARDING CHILDREN

The Services are not intended for individuals under the age of 18. You must be at least 18 years old to create an account, sell, or buy on Troquizy. If we learn that an account has been created by a minor or that a minor’s personal information has been collected in violation of this rule, we will take reasonable steps to delete the relevant information, close the account, or obtain the legally required consents, as appropriate.

If you are a parent or guardian and believe that a minor has provided us with personal information without valid authorization, please contact us at the address listed below. We will review the request and take the actions required by applicable law.

OTHER PROVISIONS

Third-Party Websites and Applications. The Services may contain links to other websites or applications, and other websites or applications may link to or access our Services. These third-party services are not under our control. We recommend that our users read the privacy policies of each website and application with which they interact.

We do not endorse, verify, approve, or assume responsibility for the privacy practices or content of these other websites or applications. You provide personal information to third-party websites or applications at your own risk.

CHANGES TO OUR PRIVACY POLICY. We may modify this Privacy Policy from time to time, at our sole discretion. When we update the Privacy Policy, we will notify you by updating the “Last Updated” date at the top of the new Privacy Policy, by posting the new Privacy Policy, or by providing any other notice required by applicable law. We recommend that you review this Privacy Policy each time you access or use the Services to stay informed about our privacy practices.

CONTACT US

contact@troquizy.io

We have designated individuals responsible for our privacy practices. If you have any questions regarding this Policy, wish to exercise your rights, or wish to file a complaint, you may email us at privacy@troquizy.io or contact us at the following mailing address: Data Controller / Database Owner: TROQUIZY LTD Registration No.: 517189379 Address: 22 Guiborei Israel St, Netanya, Israel Operational contact: contact@troquizy.io Competent authority: Privacy Protection Authority, Ministry of Justice, Israel.

Data Controller: TROQUIZY LTD

Registration No.: 517189379

Address: 22 Guiborei Israel St, Netanya, Israel

Contact: contact@troquizy.io

Useful official references – clickable links

• Protection of Privacy Law, 5741-1981 – National Legislation Database
• Privacy Protection Authority – Amendment No. 13
• Privacy Protection Regulations (Data Security), 5777-2017
• Privacy Protection Regulations (Transfer of Data to Databases Abroad), 5761-2001
• Article 30A of the Communications Law / Spam Mail FAQ – Ministry of Communications