PRIVACY POLICY FORFIRM Consulting SA The protection of personality and privacy is a fundamental core value for FORFIRM Consulting SA. This Privacy Policy concerning the processing of personal data complies with the provisions of the Swiss Federal Act on Data Protection, including the information requirements set out under Article 19 of the Federal Act on Data Protection. This Policy transparently describes how we process the personal data of website users, job candidates, employees, consultants, clients, business partners, and other individuals who interact with us. 1. Identity and Contact Details of the Data Controller The entity that determines the purposes and means of processing personal data is FORFIRM Consulting SA, with its registered office in Switzerland (hereinafter referred to as the "Data Controller" or the "Company"). For further information or to exercise your rights, you may contact the Data Controller at the following dedicated e-mail address: privacy@forfirm.ch 2. Categories of Personal Data Subject to Processing and Definitions In accordance with applicable legislation, the following definitions apply: Personal data: any information relating to an identified or identifiable natural person. Processing: any operation relating to personal data, irrespective of the means and procedures applied. This includes, in particular, the collection, recording, storage, use, revision, disclosure, archiving, deletion, or destruction of data. Disclosure or communication: making personal data accessible, for example by permitting access to it, transmitting it, or publishing it. Based on the consulting, technology, software development, recruiting, and professional services activities carried out by the Company, we may process the following categories of personal data: Navigation data: IP address of the requesting device, date and time of access, referring website, operating system, browser type, device type, pages visited, and technical information relating to the use of the website. Contact and correspondence data: name, surname, company name, professional role, e-mail address, telephone number, and any other information voluntarily provided through contact forms, e-mail communications, event registrations, or other communication channels. Recruiting and talent selection data: personal details, contact details, professional qualifications, work experience, certifications, language skills, technical skills, salary expectations, availability, and any other information contained in a Curriculum Vitae or application submitted voluntarily or in response to a job advertisement. Employee and consultant data: information relating to employment or professional relationships, technical skills, professional qualifications, skill matrices, certifications, project experience, availability, and professional profiles intended for internal resource management or commercial presentation to corporate clients for consulting, staff augmentation, or similar purposes. Client and business partner data: professional contact details, contractual information, correspondence, project information, billing data, and other information required to manage commercial, contractual, and professional relationships. 3. Purposes of Processing and Data Retention Periods Personal data is processed exclusively for specific and legitimate purposes. Website Navigation Personal data may be processed to ensure website functionality, system security, technical stability, error analysis, fraud prevention, and optimization of the user experience. Retention period: technical navigation data is generally retained for the duration necessary to ensure the security and operation of the website, subject to longer retention where required for security investigations or legal obligations. Inquiries and Commercial Contacts Personal data may be processed to respond to and follow up on requests for information received from clients, prospective clients, partners, suppliers, or other interested parties regarding consulting, technology, development, recruiting, and professional services. Retention period: data is retained for the time strictly necessary to respond to the request and manage any subsequent relationship. Where a contractual or commercial relationship is established, data may be retained for up to 10 years or for any other period required by applicable law. Recruiting and Staff Selection Personal data may be processed to assess candidates' professional profiles for potential employment, collaboration, temporary assignments, consulting projects, or placement with corporate clients. Retention period: data is retained for the duration of the relevant selection process. With the candidate's consent, the Curriculum Vitae and related application data may be retained in the Company's database for consideration in connection with future suitable opportunities. Execution of Consulting and Staff Augmentation Contracts Personal data may be processed for the operational, administrative, contractual, and project management of employees, consultants, and other professionals assigned to client projects or deployed at end-client locations. Retention period: data is retained for the entire duration of the employment, consultancy, assignment, or contractual relationship and subsequently for the statutory retention periods prescribed by applicable law. Event and Newsletter Management Where applicable, personal data may be processed to manage registrations for events, webinars, conferences, newsletters, and other corporate communications. Retention period: data is retained until the relevant purpose has been fulfilled or until consent is withdrawn, without prejudice to statutory retention requirements. 4. Recipients of Personal Data In order to fulfil the purposes described above and meet contractual or legal obligations, personal data may be disclosed to the following categories of recipients: Employees, collaborators, consultants, and internal personnel duly authorized and instructed by the Data Controller. Client companies, strictly to the extent necessary to present or manage the professional profiles of candidates, employees, or consultants proposed or assigned under recruiting, consulting, staff augmentation, or similar arrangements. IT service providers, hosting providers, cloud service providers, website administrators, cybersecurity providers, telecommunications providers, and providers of corporate or business applications. Recruiting platforms, applicant tracking systems, customer relationship management systems, communication tools, and professional networking platforms used by the Company. Tax, accounting, administrative, legal, insurance, audit, and corporate consultants. Banks, payment providers, and financial institutions, where necessary for contractual or administrative purposes. Competent authorities, courts, regulators, and public bodies where disclosure is required by an explicit legal obligation or lawful order. Such recipients may process personal data as independent data controllers or as processors acting on behalf of FORFIRM Consulting SA, depending on the circumstances and the nature of the relationship. 5. Transfer of Personal Data Abroad Personal data is primarily processed in Switzerland. However, some service providers, technology platforms, business applications, or recipients used by the Company may be located outside Switzerland or may process data through infrastructure located abroad. Any transfer of personal data abroad is carried out in accordance with the applicable provisions of the Swiss Federal Act on Data Protection. Where the recipient country does not provide an adequate level of data protection, the transfer may be based on appropriate safeguards, including recognized Standard Contractual Clauses, contractual data protection obligations, or other safeguards permitted by applicable law. A transfer may also take place where it is necessary for the performance of a contract, based on the data subject's consent, required for the establishment, exercise, or defence of legal claims, or otherwise permitted by applicable legislation. 6. Rights of the Data Subject In accordance with the Swiss Federal Act on Data Protection and subject to the applicable legal requirements and exceptions, data subjects may exercise the following rights: Right of access: to request confirmation as to whether personal data concerning them is being processed and to obtain information regarding such processing. Right to rectification: to request the correction or completion of inaccurate, incomplete, or outdated personal data. Right to erasure or destruction: to request the deletion or destruction of personal data, subject to legal exceptions, legitimate interests, contractual requirements, and mandatory statutory retention obligations. Right to withdraw consent: to withdraw previously granted consent at any time for processing activities based on consent, including marketing communications or extended retention of candidate data. Right to data portability: where the applicable legal requirements are met, to request the delivery of personal data provided to the Company in a commonly used electronic format or its transmission to another data controller. Right to object: to object to certain processing activities where permitted under applicable law. Right to request restriction of processing: to request that certain processing activities be limited where legally applicable. Requests may be submitted in writing to: privacy@forfirm.ch The Data Controller may request appropriate proof of identity before processing a request. Certain rights may be restricted or excluded where required to comply with legal obligations, protect overriding interests, preserve confidentiality, or defend legal claims. 7. Data Security FORFIRM Consulting SA implements appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing, accidental loss, alteration, disclosure, destruction, or access. These measures may include access controls, authentication procedures, authorization management, data backups, security monitoring, encryption where appropriate, contractual confidentiality obligations, and internal data protection procedures. Nevertheless, the transmission of information through the internet cannot be guaranteed to be completely secure. 8. Versions, Amendments, and Updates The Data Controller reserves the right to revise, update, supplement, or amend this Privacy Policy at any time in order to ensure continued compliance with applicable legislation, technological developments, and changes to the Company's activities. In the event of material changes, a new effective date will be clearly indicated. Last updated: June 2026