Privacy Supplement for the European Economic Area and the United Kingdom

Effective Date

This Privacy Supplement for the European Economic Area (EEA) and the United Kingdom (UK) is effective as of November 12, 2026.

Who This Supplement Covers

This supplement applies to you if you live in the EEA or the UK. It adds the rights and safeguards that the General Data Protection Regulation (GDPR) and the UK GDPR give you to our Privacy Policy, which tells you what personal data we collect, how we use and share it, and how long we keep it. Read the two documents together. Where they differ, this supplement applies to you.

Delalify LLC, a Delaware limited liability company at 254 Chapman Rd, Newark, Delaware, United States, is the controller of the personal data that we collect about you for Delalify's purposes, such as your account, your billing records, and your use of our websites. Our General Terms make Delalify LLC the contracting company for everyone who lives outside Ghana.

When a business uses Delalify to process your personal data, such as an employer that keeps staff records in People or a company that sends you messages through Channels, that business is the controller of that data. We process it on the business's behalf under our Data Processing Agreement, so send your request about that data to the business first.

Article 6(1) of the GDPR and of the UK GDPR lets us process your personal data only where a lawful basis applies. We rely on the four bases below for the purposes that our Privacy Policy describes.

Performance of a Contract

We process your personal data where we need it to provide the services that you sign up for under our General Terms. On this basis, we create and secure your account, verify your identity when you sign in, deliver the services, process your payments, send you messages about your account and the service, and answer your support requests.

Legal Obligation

We process your personal data where an applicable legal obligation requires it. For the EU GDPR, that obligation must arise under EU or member-state law; for the UK GDPR, it must arise under domestic law. This basis can cover required billing records and responses to authorities where those legal conditions apply.

Legitimate Interests

We process your personal data where we have a legitimate interest that your rights and interests do not override. On this basis, we protect our services and forms from fraud and abuse, record errors so that we can fix faults, keep usage logs as evidence that we delivered a service, establish or defend legal claims, and improve our services. You can object to this processing at any time, as the Your Rights section of this supplement explains.

Consent

We process your personal data on the basis of your consent where we ask for it first. On this basis, we set statistics, preferences, and targeting cookies, and we send you marketing emails and newsletters. You can withdraw your consent at any time on our preferences page, through the unsubscribe link in each marketing email, or by writing to privacy@delalify.com. Your withdrawal does not affect the processing that took place before it.

The GDPR and the UK GDPR give you the rights below over the personal data that we hold about you.

• Access: Under Article 15, you can ask whether we process your personal data and receive a copy of it, along with the purposes, the recipients, and the period for which we keep it.
• Rectification: Under Article 16, you can ask us to correct inaccurate personal data and to complete incomplete personal data.
• Erasure: Under Article 17, you can ask us to delete your personal data where we no longer need it, where you withdraw consent and we have no other legal basis for processing, or where another ground in that article applies. Article 17(3) contains exceptions, including legal obligations and legal claims.
• Restriction: Under Article 18, you can ask us to limit how we use your personal data while we check its accuracy or your objection. You can also request restriction if processing is unlawful and you oppose deletion, or if we no longer need the data but you need it for a legal claim.
• Portability: Under Article 20, you can ask for the personal data that you gave us in a structured, commonly used, and machine-readable format when we process it by automated means on the basis of consent or a contract. You can ask us to send it directly to another controller where technically feasible, subject to the rights and freedoms of others.
• Objection: Under Article 21, you can object to processing that we base on our legitimate interests on grounds relating to your situation. We must stop unless we demonstrate overriding compelling legitimate grounds or need the processing for legal claims. You can object to direct marketing at any time, and we will then stop using your data for that purpose.
• Automated Decisions in the EEA: Article 22 of the EU GDPR restricts decisions based solely on automated processing that have legal or similarly significant effects on you. It permits exceptions for contractual necessity, authorization by law, and explicit consent, with safeguards. For the contract and consent exceptions, you can request human intervention, express your view, and contest the decision.
• Automated Decisions in the UK: Articles 22A to 22D of the UK GDPR provide safeguards for significant decisions based solely on automated processing. You can receive information about the decision, make representations, request human intervention, and contest it. Article 22B places additional restrictions on decisions involving special categories of personal data and the recognized legitimate interests basis.
• Withdrawal of Consent: Under Article 7(3), you can withdraw any consent that you gave us, as easily as you gave it.

How to Use Your Rights

You can review and update most of your account information in your account settings. For any other request, write to privacy@delalify.com and say which right you want to use. We may ask you for information that confirms your identity before we act.

We will respond without undue delay. Under EU GDPR Article 12, the usual deadline is one month after receipt. UK GDPR Articles 12 and 12A set the UK deadline and allow adjustments for necessary identity checks and clarification of access requests. Both laws permit an extension of up to two further months where the complexity or number of requests makes it necessary. We will explain an extension within the applicable first month. We act free of charge unless a lawful exception applies, such as a manifestly unfounded or excessive request.

Delalify LLC is in the United States. When you create an account, buy a service, or contact us, you give your personal data to Delalify LLC in the United States yourself, and we process it there. The GDPR and the UK GDPR apply to that processing as this supplement describes, wherever it takes place. Our sub-processors also process personal data, each in the places that our subprocessor list gives for it.

When we process personal data for a business under our Data Processing Agreement, we cover each transfer out of the EEA or the UK with the European Commission's standard contractual clauses and the UK International Data Transfer Addendum in Exhibit C of the Data Processing Agreement, or with an adequacy decision that covers the transfer and the recipient. Exhibit C links to the full clauses and records the parties' selections.

For transfers of personal data that we control, we will use an applicable adequacy decision or appropriate safeguards, such as the relevant standard contractual clauses and the UK Addendum. Delalify is not certified under the EU-US Data Privacy Framework, so we do not rely on that framework for transfers to Delalify. You can request a copy of the safeguards for your data at privacy@delalify.com.

Conjoin Accounts in the European Union

When a business creates a Conjoin account in the European Union region, Conjoin keeps the account's users, files, databases, messages, logs, backups, and search indexes in the European Union. Conjoin Cloud Global, which operates in the United States, keeps the names, emails, and sign-ins of the account's team members, along with the account's API keys, plan, invoices, payments, settings, resource IDs, usage totals, and custom domains. Our Conjoin data residency page sets out which data stays in each region.

If you are unhappy with how we handle your personal data, write to privacy@delalify.com so that we can try to resolve your concern. You also have the right to complain to a supervisory authority.

For complaints under UK data protection law, we will acknowledge receipt within 30 days, investigate as appropriate, keep you informed of progress, and tell you the outcome without undue delay, as section 164A of the Data Protection Act 2018 requires.

• In the EEA, Article 77 of the GDPR lets you complain to the supervisory authority in the member state where you live, where you work, or where the alleged infringement took place. The European Data Protection Board lists every authority on its members page.
• In the United Kingdom, you can complain to the Information Commissioner's Office through its complaint page.

Send every question about this supplement or about your personal data to privacy@delalify.com, and put 'Data Privacy Inquiry' in the subject line so that we can route your message to the right person.