Privacy Policy

Sicklo Ltd ("Sicklo", "we", "us", "our") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our employment verification platform ("Service"). We are registered as a data controller with the Information Commissioner's Office (ICO) in the United Kingdom. By using Sicklo, you consent to the data practices described in this policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service. This policy applies to: • Employees creating and managing employment verification profiles • Companies verifying employment records and accessing shared profiles • All visitors to our website and platform

Sicklo Ltd is the data controller responsible for your personal data. Contact Details: Sicklo Ltd Email: admin@sicklo.com Website: https://sicklo.com For all enquiries (support, legal, privacy, data protection): Email: admin@sicklo.com If you have questions about how we handle your personal data, please contact us using the details above.

3.1 Information You Provide Directly For Employees: • Full name, email address, phone number • Date of birth and residential address • Employment history (job titles, dates, employers, reasons for leaving) • Sick day records and attendance information • Profile photo (optional but recommended) • Identity documents for verification (processed securely) For Companies: • Company name and registration number • Contact person information (name, role, email, phone) • Business address and phone number • Company logo (optional) • Industry and company size 3.2 Information Collected Automatically • Device information (browser type, operating system, device model) • IP address and approximate location • Usage data (pages visited, features used, timestamps, session duration) • Cookies and similar tracking technologies (see Section 9) 3.3 Information from Third Parties • Employment verification data provided by previous employers • Reference information from employer contacts • Identity verification results from our AI systems 3.4 Sensitive Data We may process certain special category data, including: • Health-related information (sick day records) • Biometric data (facial recognition for identity verification) We only process this data with your explicit consent and for the specific purposes outlined in this policy.

Under the UK GDPR, we process your personal data on the following legal bases: 4.1 Contract Performance (Article 6(1)(b)) • Creating and managing your account • Providing the employment verification service • Processing verification requests 4.2 Consent (Article 6(1)(a)) • Processing biometric data for identity verification • Processing health data (sick day records) • Sending marketing communications 4.3 Legitimate Interests (Article 6(1)(f)) • Improving our services and user experience • Detecting and preventing fraud • Analytics and service optimization • Responding to enquiries 4.4 Legal Obligation (Article 6(1)(c)) • Complying with UK laws and regulations • Responding to lawful requests from authorities • Maintaining records for tax and legal purposes You may withdraw your consent at any time by contacting us or adjusting your account settings.

We use the information we collect to: Service Delivery: • Provide and maintain the Sicklo platform • Create and manage your account • Calculate Sicklo Scores based on verified employment data • Facilitate employment verification requests • Enable profile sharing between employees and companies Communications: • Send transactional emails (verification codes, password resets, notifications) • Respond to your enquiries and support requests • Send service updates and announcements Security and Compliance: • Detect and prevent fraud, abuse, or security incidents • Verify user identities through facial recognition • Comply with legal obligations Improvement: • Improve our services and user experience • Conduct analytics and research (using anonymised data) • Test new features and functionality We will NEVER sell your personal information to third parties for marketing purposes.

6.1 Profile Sharing (Employee-Controlled) When you share your profile with a company, they receive access to: • Your employment history and verification status • Sick day records and attendance data • Your Sicklo Score and reliability rating • Contact details of your previous employers YOU CONTROL who can view your profile. Access can be revoked at any time through your dashboard. 6.2 Employment Verification When a company verifies your employment, we share: • Your submitted employment details with the verifying employer • Verification outcomes (confirmed, disputed, pending) with you 6.3 Service Providers We share data with trusted third-party service providers who assist us in operating the Service: • Cloud hosting (secure data storage) • Email delivery services • Analytics providers (anonymised data only) • Payment processors (for premium features) All service providers are bound by data processing agreements and must handle your data in accordance with this policy. 6.4 Legal Requirements We may disclose information when required by law, court order, or to: • Comply with legal processes • Protect our rights, safety, and property • Investigate potential violations of our Terms • Respond to lawful requests from authorities 6.5 Business Transfers In the event of a merger, acquisition, or sale, your information may be transferred to the new entity. You will be notified of any such change.

We implement industry-standard security measures to protect your information: Technical Safeguards: • Encryption in transit (TLS 1.3) and at rest (AES-256) • Secure password hashing (bcrypt with salt) • Multi-factor authentication options • Regular security audits and penetration testing Organizational Safeguards: • Access controls and role-based permissions • Employee training on data protection • Incident response procedures • Regular backup and disaster recovery testing Infrastructure: • Secure cloud infrastructure with redundancy • Firewalls and intrusion detection systems • Continuous monitoring and logging However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If you discover a security vulnerability, please report it to admin@sicklo.com. We operate a responsible disclosure policy.

We retain your personal information only for as long as necessary: Active Accounts: • Profile data is retained while your account is active • Employment records are retained indefinitely while verified • Usage logs are retained for 12 months After Account Deletion: • Personal profile data is deleted within 30 days • Anonymised verification records may be retained for statistical purposes • Backups are purged within 90 days • Legal and financial records may be retained for 7 years as required by law Companies: • Companies retain access to shared profile data only while access is granted • Once access is revoked, it is terminated immediately • Verification records are retained for the company's reference Inactive Accounts: • Accounts inactive for 24+ months may be flagged for deletion • You will receive notice before any deletion occurs

We use cookies and similar technologies to: • Keep you signed in to your account • Remember your preferences and settings • Analyse how our platform is used • Improve our services Types of Cookies We Use: Essential Cookies (Always Active): • Session management • Security tokens • Load balancing Functional Cookies: • Language preferences • Display settings • Recently viewed items Analytics Cookies: • Page views and navigation • Feature usage • Performance metrics We do NOT use advertising or tracking cookies for third-party advertising. Managing Cookies: • You can manage cookie preferences through your browser settings • You can also adjust preferences in your account settings • Disabling essential cookies may affect platform functionality For more information, see our Cookie Policy at /cookies.

Under UK GDPR and the Data Protection Act 2018, you have the following rights: 10.1 Right of Access (Article 15) • Request a copy of all personal data we hold about you • Receive this in a commonly used format 10.2 Right to Rectification (Article 16) • Update or correct inaccurate information • Edit your profile and employment records 10.3 Right to Erasure (Article 17) • Request deletion of your account and personal data • Known as the "right to be forgotten" • Subject to legal retention requirements 10.4 Right to Restriction (Article 18) • Restrict processing of your data in certain circumstances 10.5 Right to Data Portability (Article 20) • Receive your data in a structured, machine-readable format • Request transfer to another service provider 10.6 Right to Object (Article 21) • Object to processing based on legitimate interests • Opt out of marketing communications at any time 10.7 Rights Related to Automated Decision-Making (Article 22) • Not be subject to decisions based solely on automated processing • Request human review of automated decisions How to Exercise Your Rights: • Through your account settings (Settings > Privacy) • Email: admin@sicklo.com • We will respond within 30 days These rights are not absolute and may be subject to exceptions under applicable law.

Sicklo primarily operates in the United Kingdom. Your information may be transferred to and processed in countries outside the UK. We ensure appropriate safeguards are in place for international transfers: • Standard Contractual Clauses (SCCs) approved by the ICO • Adequacy decisions where applicable • Binding Corporate Rules for group companies • Secure data processing agreements with all service providers For users in the European Economic Area (EEA): • We comply with GDPR requirements for data transfers outside the EEA • Data may be processed in countries deemed adequate by the European Commission • Where adequacy decisions don't exist, we rely on SCCs Current Third-Country Transfers: • Cloud infrastructure: May include processing in US (under SCCs) • Email services: UK/EU based • Analytics: Anonymised data only

Sicklo is designed for use by adults in the employment context. Age Requirement: • You must be at least 18 years of age to use Sicklo • By creating an account, you confirm you meet this requirement Children's Data: • We do not knowingly collect personal information from individuals under 18 • If you believe we have collected information from a minor, please contact us immediately at admin@sicklo.com • We will promptly investigate and delete any such data Parental Notice: • If you are a parent or guardian and discover your child has provided us with personal information without your consent, please contact us immediately.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Notification of Changes: • Material changes will be notified via email to your registered address • A prominent notice will be displayed on the platform • In-app notifications for significant updates • The revision date at the top of this policy will be updated Review Period: • For material changes, we provide at least 14 days' notice before they take effect • Continued use of Sicklo after changes constitutes acceptance Version History: • We maintain a record of previous versions of this policy • Previous versions are available upon request We encourage you to review this Privacy Policy periodically to stay informed of any updates.

If you have concerns about how we handle your personal data: Step 1: Contact Us Email us at admin@sicklo.com We aim to resolve complaints within 30 days. Step 2: Supervisory Authority If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): Information Commissioner's Office Wycliffe House, Water Lane Wilmslow, Cheshire, SK9 5AF United Kingdom Website: https://ico.org.uk Telephone: 0303 123 1113 You may also contact your local data protection authority if you are located outside the UK.

If you have questions about this Privacy Policy or our data practices: General Enquiries: Email: admin@sicklo.com Website: https://sicklo.com/contact For all enquiries (support, legal, privacy, data protection): Email: admin@sicklo.com Sicklo Ltd United Kingdom We aim to respond to all privacy-related enquiries within 30 days.