PRIVACY POLICY

EVA Works Website Privacy Policy

This privacy policy applies between you, the User of this Website and EVA Works LLC., the owner and provider of this Website https://evaworks.com. EVA Works takes the privacy of your information very seriously. This privacy policy applies to our use of any and all Data collected by us or provided by you in relation to your use of the Website and our virtual assistant services. Please read this privacy policy carefully.

Definitions and interpretation

In this privacy policy, the following definitions are used:

In this privacy policy, unless the context requires a different interpretation:

• the singular includes the plural and vice versa;
• references to sub-clauses, clauses, schedules or appendices are to sub-clauses, clauses, schedules or appendices of this privacy policy;
• a reference to a person includes firms, companies, government entities, trusts and partnerships;
• "including" is understood to mean "including without limitation";
• reference to any statutory provision includes any modification or amendment of it;
• the headings and subheadings do not form part of this privacy policy.

Scope of this privacy policy

This privacy policy applies only to the actions of EVA Works and Users with respect to this Website and our virtual assistant services. It does not extend to any websites that can be accessed from this Website including, but not limited to, any links we may provide to social media websites or externally-facing URLs provided throughout the course of using EVA Works services.

Data collected

When you initially contact us or use our virtual assistant services, we may collect information that will be relevant to assessing suitability for our services and providing those services, including:

• Your contact information (name, email, phone number);
• Job title and company information;
• Location and time zone;
• Nature of the virtual assistant services you require;
• Calendar information and scheduling preferences;
• Email communications and correspondence;
• Travel preferences and requirements;
• CRM and customer relationship data;
• Financial and expense information as relevant to administrative tasks;
• Communication preferences and executive voice/style for correspondence;
• Business contacts and relationship information.

Our use of Data

• For purposes of GDPR, EVA Works acts as a "data controller" for client information and as a "data processor" for information processed on behalf of clients through our virtual assistant services.
• We will retain any Data you submit for as long as EVA Works deems it necessary to provide adequate service to the User, unless explicitly asked by a User for their Data to be deleted.
• All personal Data is stored securely in accordance with the principles of the European Union's General Data Protection Regulation.
• Any or all of the above Data may be required by us from time to time in order to provide you with the best possible virtual assistant service and experience when using our Website. Specifically, Data may be used by us for the following reasons:
  • internal record keeping;
  • improvement of our products/services;
  • offering and providing virtual assistant services to you;
  • calendar management and scheduling coordination;
  • email management and correspondence on your behalf;
  • travel planning and coordination;
  • CRM management and customer relationship maintenance;
  • financial administration and expense management;
  • call handling and message management;
  • the ability to make automated decision making, including profiling, only for the purpose of offering a better and more personalized virtual assistant experience for the User or marketing to new users based on information from the users of EVA Works in aggregate; in each case, in accordance with this privacy policy.

Third party websites and services

• EVA Works may, from time to time, employ the services of other parties for dealing with certain processes necessary for the operation of the Website and delivery of virtual assistant services. The providers of such services have access to certain personal Data provided by Users of this Website and may be located in various locations throughout the world.
• Any Data used by such parties is used only to the extent required by them to perform the services that we request. Any use for other purposes is strictly prohibited. Furthermore, any Data that is processed by third parties will be processed within the terms of this privacy policy and in accordance with the GDPR.
• Additionally, Data can be transmitted to third parties for relevant marketing purposes at the sole discretion of EVA Works LLC. and only in accordance with the GDPR. All opt-outs will be honored.

Links to other websites

• This Website may, from time to time, provide links to other websites. We have no control over such websites and are not responsible for the content of these websites. This privacy policy does not extend to your use of such websites. You are advised to read the privacy policy or statement of other websites prior to using them.

Changes of business ownership and control

• EVA Works LLC. may, from time to time, expand or reduce our business and this may involve the sale and/or the transfer of control of all or part of EVA Works. Data provided by Users will, where it is relevant and necessary to any part of our business so transferred, be transferred along with that part and the new owner or newly controlling party will, under the terms of this privacy policy, be permitted to use the Data for the purposes for which it was originally supplied to us. All opt-outs will be honored.
• We may also disclose Data to a prospective purchaser of our business or any part of it under strict confidentiality and in compliance with the GDPR.
• In the above instances, we will take steps with the aim of ensuring your privacy is protected and that the GDPR is complied with.

Controlling use of your Data

Wherever you are required to submit Data, you will be given options to restrict our use of that Data. This may include the following:

• You have the right to ask for a copy of any of your data held by EVA Works
• You have the right to withdraw consent to process your data necessary to use the services provided by EVA Works at any time. This, however, does not apply to instances where EVA Works rely on grounds provided by law, other than consent. Nevertheless, you always have the right to object.
• You have the right for your data to be deleted from the servers and databases of EVA Works in accordance with the GDPR.

Please note, however, we may be compelled to terminate your EVA Works service where such information is necessary for its delivery. This includes updates on our latest offerings as well as participation in our events, promotions, or other activities.

Functionality of the Website

• To use all features and functions available on the Website and our virtual assistant services, you may be required to submit certain Data.
• In order to use the virtual assistant services administered by EVA Works all Users must consent for EVA Works LLC. to use your data for purposes EVA Works LLC. sees fit as outlined elsewhere in the Privacy Policy. Refusal to offer consent is grounds for EVA Works LLC. to block access to services offered by EVA Works.
• A User may revoke consent at any time.
• You may restrict your internet browser's use of Cookies. For more information see the clause below (Cookies).

Security

• Data security is of great importance to EVA Works LLC. and to protect your Data we have put in place reasonable physical, electronic and managerial procedures to safeguard and secure Data collected via this Website and through our virtual assistant services.
• If password access is required for certain parts of the Website or services, you are responsible for keeping this password and/or any of your access credentials confidential.
• We endeavor to do our best to protect your personal Data. However, transmission of information over the internet is not always perfectly secure and is done at your own risk. We cannot ensure the security of your Data transmitted to the Website.

Cookies

• This Website may place and access certain Cookies on your computer. EVA Works uses Cookies to improve your experience of using the Website and to improve our range of virtual assistant services. EVA Works has carefully chosen these Cookies and has taken steps to ensure that your privacy is protected and respected at all times.
• All Cookies used by this Website are used in accordance with current EU Cookie Law.
• When possible, before the Website places Cookies on your computer, you will be presented with a message bar requesting your consent to set those Cookies. By giving your consent to the placing of Cookies, you are enabling EVA Works LLC. to provide a better experience and service to you. You may, if you wish, deny consent to the placing of Cookies; however certain features of the Website may not function fully or as intended.
• This Website may place the following Cookies:
  • Type of Cookie: Strictly necessary cookies
  • Purpose: These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services.
• You can choose to enable or disable Cookies in your internet browser. By default, most internet browsers accept Cookies but this can be changed. For further details, please consult the help menu in your internet browser.
• You can choose to delete Cookies at any time; however you may lose any information that enables you to access the Website more quickly and efficiently including, but not limited to, personalisation settings.
• It is recommended that you ensure that your internet browser is up-to-date and that you consult the help and guidance provided by the developer of your internet browser if you are unsure about adjusting your privacy settings.

General

• You may not transfer any of your rights under this privacy policy to any other person, unless allowed by the applicable Data Privacy Laws. We may transfer our rights under this privacy policy where we reasonably believe your rights will not be affected.
• If any court or competent authority finds that any provision of this privacy policy (or part of any provision) is invalid, illegal or unenforceable, that provision or part-provision will, to the extent required, be deemed to be deleted, and the validity and enforceability of the other provisions of this privacy policy will not be affected.
• Unless otherwise agreed, no delay, act or omission by a party in exercising any right or remedy will be deemed a waiver of that, or any other, right or remedy.
• The Privacy Policy is governed by and interpreted according to the laws of California. Any dispute, controversy or claim arising under, out of or relating to the validity, interpretation and performance of this Privacy Policy shall be referred to and finally determined by the competent courts of California and California law shall apply.
• For any questions or concerns relating to the use of your User Data while using EVA Works services, you are welcome to contact EVA Works LLC.'s chosen Data Protection Officer who can be reached by sending an email to privacy@evaworks.com.
• Every user of EVA Works has a variety of rights relating to the use of their data while using EVA Works services, including the right to lodge a complaint with a supervisory authority.

1. ADDITIONAL INFORMATION FOR RESIDENTS OF THE EUROPEAN ECONOMIC AREA (EEA) UNDER GDPR

EVA Works would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

The right to access – You have the right to request EVA Works for copies of your personal data. We may charge you a small fee for this service to cover the costs of retrieval.

The right to rectification – You have the right to request that EVA Works correct any information you believe is inaccurate. You also have the right to request EVA Works to complete the information you believe is incomplete.

The right to erasure – You have the right to request that EVA Works erase your personal data, under certain conditions.

The right to restrict processing – You have the right to request that EVA Works restrict the processing of your personal data, under certain conditions.

The right to object to processing – You have the right to object to EVA Works's processing of your personal data, under certain conditions.

The right to data portability – You have the right to request that EVA Works transfer the data that we have collected to another organization, or directly to you, under certain conditions.

If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us at our email: privacy@evaworks.com with the subject line of "GDPR Request". Emails with any other subject line cannot be guaranteed to be responded to within the same timeframe.

EU Representative:
If you are an individual in the EU, you can contact our appointed representative in the EU pursuant to Article 27 of the GDPR on matters related to the processing of personal data activities that take place in the EU. Contact information will be provided upon request at privacy@evaworks.com.

2. ADDITIONAL INFORMATION FOR RESIDENTS OF CALIFORNIA, VIRGINIA, COLORADO, CONNECTICUT, AND UTAH

California law requires us to provide California residents with certain specific information regarding how we collect, use, and share "personal information" as such term is defined in the California Privacy Rights Act and its implementing regulations ("CPRA", which amended the California Consumer Privacy Act (known as the "CCPA")). Following California's passage of the CCPA, other states have passed similar data privacy laws, including the Virginia Consumer Data Protection Act ("VCDPA"), effective January 1, 2023; the Colorado Privacy Act ("CPA"), effective July 1,2023; the Connecticut Data Privacy Act ("CDPA"), effective July 1, 2023; and the Utah Consumer Privacy Act ("UCPA"), effective December 31, 2023.

For clarity and ease of reference, we may refer to CPRA, VCDPA, CPA, CDPA, and UCPA collectively as "State Data Privacy Laws". In the event that one or more State Data Privacy Laws offers more or enhanced rights, privacy, or protections than the State Data Privacy Law applicable to you, we will endeavor to provide you with those additional and/or enhanced rights, privacy, or protection, though we may not be legally obligated to do so.

Sale of Information

CPRA and other State Data Privacy Laws sets forth certain obligations for businesses that "sell" personal information, as "sell" and "sale" are defined in CPRA and the regulations issued thereunder (together with analogous State Data Privacy Laws and their implementing regulations). While EVA Works does share Personal Information with certain of its service providers and subprocessors to perform the Services and maintain the Platform as described in this Privacy Policy, EVA Works does not "sell" personal information as defined under CPRA and these other State Data Privacy Laws (in other words, we do not accept money or other things of value in exchange for your Personal Information).

California "Shine the Light" Disclosure

The California "Shine the Light" law (Cal. Civ. Code §1798.83) gives residents of California the right under certain circumstances to opt out of the sharing of certain categories of personal information (as defined in the "Shine the Light" law) with third parties for their direct marketing purposes. EVA Works does not share your personal information (as defined in the "Shine the Light" law) with third parties for their own direct marketing purposes.

"Sensitive" Personal Information

EVA Works may collect, on its own account and/or on behalf of Clients, Personal Information that may be classified as "sensitive" under certain State Data Privacy laws and other privacy laws. Personal Information that is classified as "sensitive" may be supplied as part of service delivery, background checks, credential verification and/or other reporting, provided by a third-party to supplement information provided by you, or provided by various service providers, and may include one or more of your:

• social security, driver's license, state identification card, or passport number.
• account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
• precise geolocation.
• contents of mail, email, and text messages processed through our virtual assistant services.
• Information concerning health or other personal matters in connection with administrative services.

How We Source, Use, Disclose and Retain Personal Information for Business Purposes

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device ("personal information"). In particular, we have collected the following categories of personal information from consumers within the last twelve (12) months:

Personal information does not include:

• Publicly available information from government records.
• De-identified or aggregated consumer information.
• Information excluded from the CCPA's scope, such as:
  • Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
  • personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.

We obtain the categories of personal information listed above from the following categories of sources:

• Directly from our clients or their agents. For example, from your signing up on our website
• Indirectly from our clients or their agents. For example, through information we collect from our clients in the course of providing virtual assistant services to them.
• Directly and indirectly from activity on our website. For example, from entries through our website portal or website usage details collected automatically.
• From third-parties that interact with us in connection with the virtual assistant services we perform.

Use of Personal Information

We may use or disclose the personal information we collect for one or more of the following business purposes:

• To fulfill or meet the reason for which the information is provided.
• To provide you with virtual assistant services that you request from us.
• To provide you with email alerts, event registrations and other notices concerning our services, or events or news, that may be of interest to you.
• To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collections.
• To improve our website and present its contents to you.
• For testing, research, analysis and service development.
• As necessary or appropriate to protect the rights, property or safety of us, our clients or others.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• As described to you when collecting your personal information or as otherwise set forth in the CPRA.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Sharing Personal Information

We may disclose your personal information to a third party for a business purpose. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.

In the preceding twelve (12) months, we have disclosed the following categories of personal information for a business purpose:

Category A: Identifiers.

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties

In the preceding twelve (12) months, we have not sold any personal information.

Privacy Rights for Residents of California, Virginia, Connecticut, Colorado, Utah, and Residents subject to other State Data Privacy Laws.

If you are a resident of California, Virginia, Connecticut, Colorado, or Utah, applicable State Data Privacy Laws require us to provide you with some additional information about your rights with respect to your "personal information" (as defined in CPRA and similar State Data Privacy Laws). Specifically, CPRA, provides you with the right to:

• know what personal information we collected about you during certain periods, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we collected about you;
• delete personal information that we collected from you, subject to certain exceptions;
• correct inaccurate personal information that we maintain about you;
• opt-out of the sale or sharing of your personal information, to the extent we sell or share your personal information;
• limit the use or disclosure of sensitive personal information, to the extent we use such personal information beyond certain express uses, such as in furtherance of providing you our virtual assistant services and ensuring their security and integrity;
• receive non-discriminatory treatment for the exercise of privacy rights conferred by CPRA.

One or more of the above rights may be available, in the same or substantially the same form, under one or more of the other State Data Privacy Laws in effect from time to time. EVA Works respects the privacy of its clients and users of the services and will endeavor to honor the above requests regardless of state of residency.

If you would like further information regarding your legal rights under CPRA or any other State Data Privacy Law or would like to exercise any of the rights available under such laws, please contact us at privacy@evaworks.com.

We will honor the requests described above and otherwise available to you under applicable Data Privacy Laws, but these rights do not always apply, and exemptions exist that may be relied upon in denying or only partially fulfilling your request. We will usually, in response to a request, ask you to verify your identity and/or provide information that helps us to better understand your request. If we do not comply with your request, we will explain why.

Requests Submitted by Authorized Representatives.

You may submit a request through someone holding a valid Power of Attorney or an authorized agent acting on your behalf. Authorized agents must have, and provide us with, written permission to make a request on your behalf and must provide necessary information to verify your own identity directly with us. We will require any purported authorized agent to submit proof of authorization to make requests on your behalf.

3. ADDITIONAL INFORMATION FOR NEVADA RESIDENTS

Under Nevada law, certain Nevada residents may opt out of the "sale" of "covered information" (as such term is defined under Nevada law) for monetary consideration to a person for that person to license or sell such information to additional persons. "Covered information" includes first and last name, address, email address, phone number, Social Security Number, or an identifier that allows a specific person to be contacted either physically or online.

We do not engage in such activity; however, if you are a Nevada resident who has purchased or leased goods or services from us, you may submit a request to opt out of the sale of your covered information under Nevada law by emailing us at privacy@evaworks.com. Please note we will take reasonable steps to verify your identity and the authenticity of the request.

4. ADDITIONAL INFORMATION FOR NON-U.S. RESIDENTS

EVA Works only collects, processes, stores, and retains as much Personal Information as needed for the specific, identified purposes described in this Policy. EVA Works will not use your Personal Information in any way that is incompatible with the specific, identified purposes described in this Policy.

Personal Data Transfers Outside of the EEA, the UK, Philippines and Singapore

EVA Works operates globally and, to facilitate our global operations, we may transfer your Personal Information to, and store, process, and/or access your personal information in accordance with applicable law from, the various global locations in which EVA Works and/or its personnel operate. This includes the United States. Non-EEA countries may not offer the same level of personal data protection as EEA countries.

If you are located in the EEA, UK, Singapore or other regions with Data Privacy Laws governing data collection and use that may differ from United States Data Privacy Law, please note that we will transfer information, including Personal Information, to a country and jurisdiction that does not have the same Data Privacy Laws and related rights and protections as your jurisdiction, and you consent to the transfer of information to the United States or any other country in which EVA Works, its subprocessors and/or other service providers maintain facilities and the use and disclosure of information about you as described in this Policy.

When your Personal Information is transferred outside the EEA, we will put in place adequate safeguards to ensure that such transfer is carried out in compliance with applicable data protection rules. An adequate level of protection for your Personal Information and other data may be accomplished using various means, including, where appropriate:

• relying on a formal decision by the European Commission that a certain country ensures an adequate level of protection for personal data (a full list of such decisions may be accessed online here: http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm);
• entering into appropriate data transfer agreements based on language approved by the European Commission, such as the Standard Contractual Clauses (2021/915/EU, 2010/87/EC and/or 2004/915/EC), or the ICO and UK Parliament, such as the international data transfer agreement (IDTA) and the international data transfer addendum to the European Commission's standard contractual clauses for international data transfers (Addendum), which are each available upon request at privacy@evaworks.com;
• implementing appropriate physical, technical and organizational security measures to protect personal information against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing;
• taking other measures to provide an adequate level of data protection in accordance with applicable law.

BY CHOOSING TO USE OUR SERVICES, YOU EXPRESSLY AGREE THAT ANY DISPUTE OVER PRIVACY OR THE TERMS CONTAINED IN THIS POLICY WILL BE GOVERNED BY THE LAWS OF THE STATE OF CALIFORNIA WITHOUT REGARDS TO ITS CONFLICT OF LAWS PRINCIPLES, AND THE ADJUDICATION OF ANY DISPUTES ARISING IN CONNECTION WITH EVA WORKS OR ITS SERVICES WILL BE IN ACCORDANCE WITH THIS POLICY AND EVA WORKS'S TERMS OF SERVICE.

Rights of Access, Portability, Rectification, Erasure, Withdrawal, and Restriction/Limitation.

You may have the right to inquire as to whether EVA Works is processing Personal Information about you, request access to that Personal Information, request your information in a portable format, restrict or limit certain processing, and ask that we correct, amend, or delete your Personal Information where it is inaccurate. You may also have the right to withdraw your consent where we previously obtained your consent for certain processing/uses without this withdrawal affecting the lawfulness of any processing that took place prior to the effectiveness of your withdrawal.

You can exercise such rights by submitting a request by emailing privacy@evaworks.com. Note that in some cases we may not be able to erase your Personal Information, in which case we will let you know if we are unable to do so and why.

Accessing and Modifying Your Personal Information.

If at any time you believe that an item of Personal Information about you is inaccurate, please contact us as described above as soon as possible with a description of the inaccuracy and the desired correction. We are committed to helping to maintain the accuracy and integrity of Personal Information we hold about you and endeavor to respond to rectification requests in a reasonable timeframe.

Exercise of Rights Generally.

We will honor the requests described above and otherwise available to you under applicable Data Privacy Laws, but these rights do not always apply, and exemptions exist that may be relied upon in denying or only partially fulfilling your request. We will usually, in response to a request, ask you to verify your identity and/or provide information that helps us to better understand your request. If we do not comply with your request, we will explain why.

If you are not satisfied with our response to any of your requests, you have the right to make a complaint to the data protection authority in the jurisdiction where you live or work, or in the place where you think an issue in relation to your data has arisen. The contact details of each Data Protection Authority can be found at the following website: http://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/index_en.htm.

CHILDREN'S PRIVACY

EVA Works does not knowingly collect, process, maintain or solicit any data, Personal Information, or other information from anyone under the age of 16 or knowingly direct the Services to such persons or otherwise knowingly allow such persons to use the Services. Any individuals under the age of 18 must have consent from their parent or legal guardian to provide Personal Information to EVA Works or otherwise use the Services from their parent or guardian. If we learn that we have collected Personal Information or other data from a child under age 16, we will delete all such information promptly upon becoming aware of the same. If you believe that we might have any information from a child, please contact us as described below.

CHANGES TO THIS POLICY

EVA Works LLC. reserves the right to change this privacy policy as we may deem necessary from time to time or as may be required by law. Any changes will be immediately posted on the Website and you are deemed to have accepted the terms of the privacy policy on your first use of the Website following the alterations.

This Policy was last updated [DATE TO BE INSERTED]

CONTACT INFORMATION

If you have any questions or comments about this notice, our Privacy Statement, the ways in which we collect and use your personal information, your choices and rights regarding such use, or wish to exercise your rights under applicable privacy laws, please do not hesitate to contact us at:

Email: privacy@evaworks.com with the subject line of "PRIVACY Request"

Last updated: June 2, 2025