Privacy Notice

Status: Draft v0.9 — 11 August 2026 — legal and operational review required before publication. Current provider: Heritage Timepieces AB, org. no. 559491-1157, VAT SE559491115701, Kungsgatan 2C, 223 50 Lund, Sweden. Entity notice: Klocktech AB is under registration and is not the current contracting party. Registration alone does not transfer an agreement. Contacts: legal@heritagetp.com (legal/privacy) · info@heritagetp.com (general).

1. Who this notice covers

This notice explains how the current Klocktech provider handles personal data as an independent controller when people visit the Klocktech website, request a demo, subscribe on behalf of a business, administer an account, contact support, receive business communications, or interact with Klocktech personnel.

When Klocktech processes personal data contained in a Customer's inventory, reservation, sales, support or other records solely on the Customer's instructions, the Customer is normally the controller and the Provider is processor. That processing is governed by the Data Processing Agreement. The Customer must give its own notice to the affected people.

2. Controller and contact

Until a valid entity transfer takes effect, the controller for the activities in this notice is Heritage Timepieces AB, organisation number 559491-1157, Kungsgatan 2C, 223 50 Lund, Sweden. Privacy requests may be sent to legal@heritagetp.com or the postal address above.

Klocktech AB is under registration. Its registration will not by itself transfer controller responsibility. Any future controller change will be communicated with the new entity's details, effective date and effect on existing processing.

3. Personal data we may process

Depending on the relationship, the Provider may process:

• Business identity and contact data: name, employer, title, business email, telephone, postal address, preferred language and country;

• Account and access data: user ID, organisation, role, location permissions, authentication events, account settings and administrative actions;

• Commercial and billing data: Order Forms, plan, subscription, invoices, VAT details, payment status, procurement information and business correspondence;

• Enquiry and support data: demo requests, messages, support tickets, call notes, feedback, attachments and resolution history;

• Technical and security data: IP address, device and browser information, timestamps, session identifiers, diagnostic events, audit logs, attempted misuse and incident records;

• Website and consent data: pages or features used, referral information, cookie choices and campaign interaction, subject to the Cookie Policy;

• Marketing data: interests, event attendance, communication history, source of contact and opt-out status; and

• Legal and compliance data: authority to contract, claims, complaints, sanctions-screening result where lawfully required, and records needed to protect legal rights.

The public website and Service are not intended for children. The Provider does not knowingly offer accounts to anyone under 18.

4. Purposes and legal bases

Where legitimate interests are used, the Provider considers necessity, reasonable expectations, business context, sensitivity and safeguards. A person may object as described below. The Provider does not use consent where processing is necessary to perform a contract or comply with law.

5. Data that is required or optional

To enter and administer a Klocktech contract, the Provider normally requires the Customer organisation's legal and billing details and an authorised representative's name, business contact details and authority. To create and protect a user account, it requires the user's name or identifier, business email, organisation, role and authentication/security events. Applicable invoice and VAT information is required to bill and keep legally required records.

If required contract or account information is not provided, the Provider may be unable to conclude the subscription, create or secure the account, provide support, issue a compliant invoice or perform the requested Service. Fields clearly marked optional—such as telephone number, marketing interests, feedback, profile preferences or non-essential analytics consent—may be withheld without losing the core Service, unless a particular optional feature cannot function without the stated field. A person may refuse direct marketing at any time.

6. Where data comes from

Data is usually obtained directly from the person or the Customer organisation. It may also come from an account administrator, authorised integration, event organiser, referral, professional network or a public business source. The Provider will not scrape personal contact lists or another dealer's inventory or customer information. Where Article 14 GDPR applies, required information will be provided within the applicable period unless a lawful exception applies.

7. Recipients

Personal data may be shared only as needed with:

• personnel and contractors who need access and are bound by confidentiality;

• hosting, authentication, communications, support, analytics, payment, security and AI vendors listed where relevant in the Subprocessor Register;

• professional advisers, auditors, insurers and financing counterparties under appropriate duties;

• a Customer's chosen Connected Account when the Customer directs a transfer;

• an acquirer or registered Klocktech AB in a properly structured transaction with notice and safeguards; and

• courts, authorities or law-enforcement bodies where disclosure is required or lawfully necessary.

The Provider does not sell personal data. Customer-selected marketplaces and websites may act under their own terms and privacy notices rather than as Klocktech subprocessors.

8. International transfers

The production vendor and location register must be completed before launch. If personal data is transferred outside the EU/EEA, the Provider will use an applicable adequacy decision or another lawful safeguard such as the European Commission's Standard Contractual Clauses, assess the transfer circumstances, and implement supplementary measures where needed. The Subprocessor Register will identify the destination and transfer mechanism. A copy of relevant safeguards may be requested, subject to redaction of confidential information.

9. Retention

Personal data is retained only as long as necessary for its purpose, legal requirements, security and claims. The Data Retention and Deletion Policy contains the proposed schedule. Key examples include the subscription period and exit window for active account data, the statutory period for accounting records, limited periods for security logs and support history, and prompt honouring of marketing objections. A legal hold or dispute may require longer, restricted retention.

10. Security

The Provider uses risk-appropriate technical and organisational safeguards, including access control, authentication, tenant separation, encryption, logging, backup, secure development, vendor oversight and incident procedures as described in the Security Overview and DPA. No internet service can be guaranteed absolutely secure. Users must protect credentials and promptly report suspected compromise.

11. Automated decisions and AI

The Provider does not use personal data in its controller activities to make a solely automated decision that produces legal or similarly significant effects on an individual. AI-assisted content, image and pricing features are subject to human review and are governed by the AI Features Policy. If a future use changes this position, the notice and product safeguards will be updated before deployment.

12. Individual rights and changes

Subject to GDPR conditions and exceptions, a person may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Consent may be withdrawn at any time without affecting prior lawful processing. A person has an absolute right to object to direct marketing.

Requests should be sent to legal@heritagetp.com. The Provider may request the minimum additional information reasonably needed to verify identity and authority. It aims to respond within one month, subject to lawful extension for complexity or volume.

A person may complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or another competent supervisory authority. The Provider welcomes an opportunity to address the concern first.

Material changes will be highlighted with an updated date and, where appropriate, direct notice. A new purpose incompatible with the original purpose will not be introduced without a valid legal basis and any required notice or consent.