CROFTLY Website Privacy Notice English version dated 5 November 2026 This notice covers browsing the Croftly website and using its web services. Credentials and the access cookie for preview website invitees are described in the dedicated notice. 1 Controller and scope The data controller is Giuseppe Domenico La Fauci, a self-employed professional, Italian VAT number 03758170835, with a professional address at Strada Panoramica dello Stretto 1416 G9, 98168 Messina, Italy. For information or to exercise data protection rights: support@croftly.com. For app, licence and product support data, also consult the App Privacy Notice. Invitees are additionally covered by the Restricted Preview Website Access Privacy Notice, available before login. 2 Browsing and security data When you connect, web services and their providers receive data such as IP address, date and time, requested page or resource, request outcome and browser information. Contact forms and restricted access may use technical identifiers to prevent repeated or unlawful attempts. These data provide requested pages, diagnose errors and protect services and users. The website does not automatically obtain documents or email from your Mac. 3 Contacts and requested operations The Contact Us form collects email, topic, subject and message; app and macOS versions are optional. The request is recorded as a ticket and forwarded to the support mailbox; confirmations and subsequent exchanges take place by email. Attachments, screenshots and diagnostic data are processed for the request to which they relate. Send only what is needed, redacting unrelated data, passwords and other credentials. Necessary communications about licences, support, security and contracts are part of the service. Installation and purchase do not automatically subscribe you to a newsletter. When you use the purchase process, the website processes references needed to start or resume the operation and recover a licence. Paddle manages checkout and sales data under its own privacy notice: https://www.paddle.com/legal/privacy. Licence data are described in the App Privacy Notice. When you request Premium supply during the withdrawal period, we record the declaration’s text and version, language, time of choice, plan and order references. We send confirmation to the purchase email address and retain evidence needed to document the relationship and protect rights under the retention criteria for licences and transactions. This contractual choice is not general consent to personal data processing. You can recover licences using the email address used for purchase, even without the previous browser session. The link can be used once and expires after 15 minutes. To handle the request and prevent abuse we process email, language, verification references and technical identifiers derived from the email address and connection. 4 Preferences and browser storage Pages with language selection store the preference in the browser’s local storage for later visits. The legal documents’ language can be chosen separately from the website interface language. It remains until replaced or website data are deleted, subject to browser limits. The purchase process stores confidential references in the browser to resume the operation and retrieve its outcome. The recovery reference is valid for 30 days from creation and, once payment is confirmed, for 30 days from the first licence issuance. Expiry does not necessarily delete the browser entry. You may remove it by deleting website data; you can still recover your licence through the purchase email address or request support. The cookie maintaining invitees’ access is described in the restricted access notice. The storage described serves requested features, not advertising profiling. Under Italian and European rules, technologies strictly necessary for a requested service do not require prior consent. Any technologies requiring consent are subject to a separate choice: visiting or reading the notice is not consent. The website does not use its own behavioural advertising or cross-site commercial tracking tools. External services opened by visitors and checkout have their own notices and technologies. 5 Legal bases and choices Where the GDPR applies, information requests, support and pre-contractual operations rely on performing steps requested by the individual or the relevant contract, within necessity limits. Legitimate interests in managing a relationship may apply to professional contacts representing an organisation. Providing and protecting the website, preventing abuse and defending rights rely on legitimate interests in reliable, secure services after assessing necessity, proportionality and effects on individuals. Compliance and binding authority requests rely on relevant legal obligations. Processing requiring consent collects it separately, freely, specifically, with information and the ability to withdraw. Browsing public pages does not require an account. Responding to a message requires contact details and information needed to understand it; without them, a response may be impossible. Unrelated data are not required. Failure to authenticate prevents access only to restricted content. 6 Recipients and external services Data are accessible to the Controller and authorised persons within their duties. Suppliers acting on his behalf are subject to confidentiality, security and processing agreements compliant with applicable law; independent parties are responsible for their own processing. Recipients include hosting and database providers for licensing and support services; network, distribution and protection providers for the website and downloads; and email providers for delivery and storage of support requests. Each accesses data needed for its service: these relationships do not automatically upload archives or email imported into the app. Paddle receives checkout data when checkout is used. Support messages are accessible to those handling them and to delivery and storage providers. Relevant data may be disclosed to administrative or legal advisers and authorised authorities. Business transfers remain subject to original purposes, safeguards and required consents. 7 International processing The Controller operates in Italy. The main infrastructure used for the website, licensing and support services and support mailbox is in France. Network and protection services, payment services and User-chosen integrations may involve processing outside the European Economic Area, including in the United States. European hosting does not exclude international access or additional processing by the services involved. For GDPR-regulated transfers made by the Controller or on his behalf, safeguards appropriate to the recipient apply: adequacy decisions within their scope, including those covering US recipients participating in the Data Privacy Framework where applicable, or standard contractual clauses and necessary supplementary measures. These mechanisms do not indiscriminately cover every recipient or country. Reading this notice is not general consent to transfers. You can request information about recipients, countries and a copy of applicable safeguards from support@croftly.com. Connected services’ notices describe processing for which they are independently responsible. Additional prior information required by local law, including recipient countries, must be made available for the relevant processing. 8 Retention Support. We retain tickets, correspondence and relevant attachments to handle requests, document interventions and maintain continuity of support, including after an individual ticket closes. Duration takes account of the relationship, subsequent requests and the need to reconstruct earlier problems and solutions. The need for history is reviewed over time, considering conversations as a whole. Systematic deletion of individual attachments is not planned; targeted action on unrelated data or justified erasure requests remains possible, subject to legal obligations and protection of rights. Licence recovery. Contact and verification data for a request are removed after the link is used or expires; temporary request records are kept for 24 hours. Cleanup takes place at the next available service run. Licence data, received emails and backup copies are separate and follow their respective retention criteria. Online service logs. Application logs collected in Croftly’s service monitoring system are retained for 7 days. This period covers that application collection and is not a universal period for every external service’s technical logs. Extracts needed to document a specific incident or dispute may be retained separately, with limited access, for the time necessary to manage it or protect rights. Support correspondence follows the separate rule above. Automatic backups of Croftly service databases are kept for 7 days from creation: deleted database data may therefore remain in earlier backups until they expire. This does not cover local app backups, support mailbox backups or User-chosen services. Data no longer needed are deleted or anonymised; residual backup copies are excluded from ordinary use and removed under the applicable cycle. Browser data follow section 4. Invitee accounts, sessions and records follow the restricted access notice; transactions and licences follow the seller’s and app’s notices. 9 Security The website uses protected connections and access controls appropriate to its processing. No measure guarantees absolute security. For breaches under the Controller’s responsibility, containment measures and any legally required notifications and communications are made. To report an incident: support@croftly.com. 10 Rights requests and complaints Subject to applicable legal conditions, you may request confirmation of processing and access, a copy of information, correction, erasure, restriction and portability. You may object to legitimate-interest processing on grounds relating to your situation and to direct marketing without giving reasons. Where processing relies on consent, you may withdraw it at any time. To exercise a right or complain, write to support@croftly.com with a reference that helps locate your data. No account is required. You may act through a representative where provided; identity and authority checks are limited to necessary information. GDPR requests receive a response without undue delay and ordinarily within one month. Any justified extension within permitted limits is communicated within the initial period. Exercising rights is normally free; exceptions for manifestly unfounded or excessive requests must comply with law. A refusal is explained with available remedies. Rights may be limited only as provided by law, for example for legal obligations or protection of others’ rights. Lawful exercise does not result in unfavourable treatment. You may send a complaint about data processing to the same address, describing the facts and desired outcome. The Controller examines it, performs relevant checks and provides a reasoned response without undue delay, with updates when needed. Where UK complaint rules apply, receipt is acknowledged within thirty days. Complaint periods do not replace the separate periods for exercising rights. You may complain to the Italian data protection authority, https://www.garanteprivacy.it, or the competent authority, including in your country of residence, work or alleged infringement where provided. Contacting Croftly first may help resolve the issue but is not a prerequisite for contacting an authority. The website does not use data for solely automated decisions with legal or similarly significant effects. Technical security and access validity checks may restrict unauthorised attempts; if an error occurs, you may request human review from support. 11 Information for individuals in other countries The following provisions supplement the above rights where local laws apply. United Kingdom. Where applicable, the UK GDPR and Data Protection Act 2018 provide relevant data protection rights. You may contact the Information Commissioner’s Office: https://ico.org.uk. Switzerland. Where applicable, the Federal Act on Data Protection provides relevant rights and requires information about recipient countries and transfer safeguards. The authority is the Federal Data Protection and Information Commissioner: https://www.edoeb.admin.ch. California and other US states. The Controller does not sell personal data or share it for cross-context behavioural advertising. Categories processed include identifiers and contacts, references to requests and website operations, technical network activity, authentication data and information voluntarily sent to support, as described above. Visiting the website does not give the Controller access to documents on your Mac. Where the CCPA, as amended by the CPRA, or other state laws apply, relevant rights include access, correction, deletion, portability and, where provided, opting out of sale or targeted advertising, limiting particular uses of sensitive data and appealing a refusal. Requests and appeals may be sent to support@croftly.com, including through an authorised representative. We do not use sensitive data to infer personal characteristics for commercial purposes. Canada. Where PIPEDA or provincial laws apply, access, correction and challenge rights remain, with meaningful consent where required. Access requests under PIPEDA ordinarily receive a response within 30 days, subject to permitted extensions. You may contact the Office of the Privacy Commissioner of Canada, https://www.priv.gc.ca, or the competent provincial authority. Australia and New Zealand. Where applicable, the Privacy Act 1988 and Australian Privacy Principles, or the Privacy Act 2020 and New Zealand principles, are followed, including access, correction and complaint rights. You may contact the Controller and, as appropriate, the Office of the Australian Information Commissioner, https://www.oaic.gov.au, or New Zealand’s Office of the Privacy Commissioner, https://www.privacy.org.nz. Where New Zealand indirect collection rules apply, required information is also provided for data received from others, such as a seller, in the manner and subject to exceptions provided by law. Additional mandatory rights under applicable local law remain. 12 Children and updates The website and professional preview invitations are not specifically directed at children. We do not knowingly request children’s data to create invitee access. If you believe a minor provided data without meeting applicable legal requirements, contact support@croftly.com for investigation and necessary measures. This notice is updated when features, processing or obligations change. The version identifies the text presented. Significant changes are brought to the User’s attention through suitable channels; updating the document alone does not authorise new processing requiring consent. This notice and the restricted access notice are available in Italian, English, French, Spanish and German before the relevant collection. You may request copies from support@croftly.com. Reading them is not general consent to further processing.