Global Privacy Policy

1. Who We Are

This Global Privacy Policy ("Policy") is issued by Bauter Global Ltd ("Bauter Global," "we," "us," or "our"), a company registered in England and Wales under company number 17294353, with its registered office at 27 Old Gloucester St, London, United Kingdom, WC1N 3AX. Bauter Global is registered with the UK Information Commissioner's Office (ICO) as a data controller.

Bauter Global operates a global digital infrastructure and lead-generation platform that captures consumer enquiries via online forms and routes that information to independent, licensed third-party professionals, including private clinics, veterinary practices, and law firms ("Partners"), across the United Kingdom, the European Union (including Poland), the United States, and Australia.

2. Scope of This Policy

This Policy applies to all personal information we collect through our websites, forms, applications, and related services (collectively, the "Platform"), regardless of where you access the Platform from. Because we operate internationally, this Policy is structured to comply with the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the EU General Data Protection Regulation (EU GDPR), the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and applicable US state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and the Virginia Consumer Data Protection Act (VCDPA).

3. Information We Collect

Depending on the form or service you use, we may collect:

• Identity and contact data: name, email address, telephone number, postal address, date of birth.
• Enquiry data: details you voluntarily submit describing the service you are seeking (e.g. a general description of a legal matter or a general area of clinical interest). We do not request and ask that you do not submit detailed medical records, diagnoses, or clinical history through our forms.
• Technical data: IP address, browser type, device identifiers, referral source, and cookie identifiers (see our Cookie Policy).
• Usage data: pages visited, forms started/completed, and interactions with our Platform.
• Marketing preferences: your choices regarding receiving marketing communications from us or our Partners.

Where an enquiry field indicates a general subject-matter category (for example, "cosmetic consultation" or "family law"), this may constitute special category or sensitive personal information under applicable law. We treat such indicators with heightened protection as described throughout this Policy.

4. How We Use Your Information

• To operate, maintain, and improve the Platform;
• To match and route your enquiry to one or more suitable Partners in your region;
• To communicate with you about your enquiry and our services;
• To send marketing communications, where permitted, about our services and those of our Partners;
• To detect, prevent, and investigate fraud, abuse, or security incidents;
• To comply with our legal and regulatory obligations.

5. How We Share Your Information

Our core business model is the routing of enquiry data to independent, licensed third-party Partners so that they may contact you directly regarding the services you have enquired about. By submitting a form, you understand and agree that your personal information will be disclosed — and, where you are a US resident, may constitute a "sale" or "sharing" under applicable law (see Section 10) — to one or more Partners operating in the relevant jurisdiction and service category.

We may also share information with:

• Service providers who support our technology, hosting, analytics, and customer support functions, acting as our processors under contract;
• Professional advisers, regulators, and law enforcement where required by law;
• A purchaser or successor in the event of a merger, acquisition, or sale of business assets.

We do not control what our Partners do with your information once it has been transferred to them. Each Partner is an independent data controller in its own right for the personal information it receives, and is responsible for its own compliance with applicable privacy and professional regulatory obligations. We encourage you to review each Partner's own privacy notice.

6. Legal Bases for Processing (UK/EU GDPR)

Where UK or EU GDPR applies, we rely on the following legal bases:

• Consent — for routing enquiries that touch on health-related or legal matters, and for direct marketing;
• Contract — to take steps at your request prior to entering into, or in performing, an agreement to provide our routing service;
• Legitimate interests — for fraud prevention, Platform security, and service improvement, balanced against your rights and interests;
• Legal obligation — where we must retain or disclose data to comply with law.

Where we rely on consent for the processing of any special category data implied by your enquiry, you may withdraw that consent at any time by contacting us using the details in Section 18.

7. International Data Transfers

Bauter Global is a UK-registered company, and personal information submitted through the Platform is initially processed in the United Kingdom. Because we route enquiries to Partners located in the EU (Poland), the United States, and Australia, and use service providers that may process data outside the UK, personal information may be transferred internationally.

Where we transfer personal information out of the UK or EEA, we do so on the basis of:

• Adequacy regulations, where the destination jurisdiction is recognised as providing an adequate level of protection;
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, incorporated into our contracts with Partners and processors outside the UK; and/or
• The EU Standard Contractual Clauses (SCCs) issued by the European Commission, for transfers originating from the EU.

Copies of the relevant transfer safeguards are available on request by contacting our Data Protection point of contact (Section 18).

8. Data Retention

We retain personal information for as long as necessary to fulfil the purposes described in this Policy, including routing your enquiry, maintaining business records, and complying with legal, accounting, or reporting obligations. Enquiry data that is not converted into a Partner referral is generally deleted or anonymised within 24 months, unless a longer period is required by law or you have asked us to retain it for future opportunities.

9. Your Rights (UK/EU/International)

Subject to applicable law, you may have the right to:

• Request access to the personal information we hold about you;
• Request correction of inaccurate or incomplete data;
• Request erasure of your data ("right to be forgotten");
• Request restriction of, or object to, our processing of your data;
• Request portability of data you have provided to us;
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• Lodge a complaint with a supervisory authority, including the UK Information Commissioner's Office (ico.org.uk) or your relevant EU member state authority.

10. For California Residents (CCPA/CPRA)

This section supplements the rest of this Policy and applies to California residents in accordance with the CCPA, as amended by the CPRA.

10.1 Categories of Personal Information We Collect and Disclose

In the preceding 12 months, we have collected and disclosed the categories of personal information described in Section 3, which map to the CCPA categories of: identifiers; customer records information; commercial information (records of services enquired about); internet or other electronic network activity information; geolocation data (approximate); and, in limited circumstances implied by enquiry subject matter, sensitive personal information (health or legal-matter indicators).

10.2 "Sale" and "Sharing" of Personal Information

Under the CCPA/CPRA, the disclosure of your personal information to Partners in exchange for monetary or other valuable consideration constitutes a "sale" of personal information, and any disclosure for cross-context behavioural advertising purposes may constitute "sharing." We disclose identifiers, contact information, and commercial/enquiry information to Partners in this manner as part of our core lead-routing business.

10.3 Your Right to Opt Out

You have the right to opt out of the sale or sharing of your personal information at any time. You may exercise this right by:

• Clicking the "Do Not Sell or Share My Personal Information" link in the footer of our website; or
• Submitting a request via our privacy request form or by contacting us at the details in Section 18; or
• Where applicable, using an opt-out preference signal recognised by us, such as the Global Privacy Control (GPC).

10.4 Right to Limit Use of Sensitive Personal Information

Where you have submitted information that constitutes sensitive personal information (for example, an indication of a health-related or legal-matter enquiry), you have the right to direct us to limit the use of that information to what is necessary to perform the routing service you requested. You may exercise this right using the contact details in Section 18.

10.5 Additional CCPA/CPRA Rights

• Right to know/access the specific pieces and categories of personal information collected;
• Right to delete personal information, subject to certain exceptions;
• Right to correct inaccurate personal information;
• Right to non-discrimination for exercising your CCPA rights;
• Right to designate an authorised agent to make a request on your behalf.

We will verify your identity before fulfilling access, deletion, or correction requests, consistent with CCPA regulations. We do not knowingly sell or share the personal information of consumers we know to be under 16 years of age without opt-in consent.

11. For Other US State Residents (VCDPA and Similar Laws)

If you are a resident of Virginia, Colorado, Connecticut, Utah, or another US state with a comprehensive consumer privacy law, you may have similar rights to those described in Section 10, including the right to access, correct, delete, and obtain a portable copy of your personal data, and to opt out of the sale of personal data, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects. You may exercise these rights using the contact details in Section 18. We will not discriminate against you for exercising these rights.

12. For Australian Residents

Where the Australian Privacy Act 1988 (Cth) applies to our handling of your personal information, we handle it in accordance with the Australian Privacy Principles (APPs), including principles relating to the collection, use, disclosure, quality, security, access, and correction of personal information, and cross-border disclosure. Where we disclose your personal information to an overseas Partner (including in the UK, EU, or US), we take reasonable steps to ensure the overseas recipient does not breach the APPs in relation to your information, consistent with APP 8. You may contact our Privacy Officer (Section 18) to make a complaint, and if unresolved, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC).

13. Health Data and HIPAA

Bauter Global is a direct-to-consumer digital marketing and lead-routing platform. We are not a "Covered Entity" or "Business Associate" under the US Health Insurance Portability and Accountability Act (HIPAA), and the information you submit through our Platform does not constitute "protected health information" for HIPAA purposes. We do not provide medical treatment, diagnosis, or advice, and our Platform should not be used to transmit detailed clinical or medical record information. Any health-related information you choose to share is handled in accordance with this Policy and applicable state and international privacy law, but not under the HIPAA regulatory framework.

14. Cookies

We use cookies and similar tracking technologies to operate the Platform and support analytics and marketing. Full details are set out in our separate Cookie & Global Affiliate Policy.

15. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorised access, loss, misuse, or alteration. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

16. Children's Privacy

The Platform is not directed at, and we do not knowingly collect personal information from, individuals under the age of 16. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

17. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified via the Platform or by other appropriate means. The "Effective Date" above indicates when this Policy was last revised.

18. Contact Us

For any questions, requests, or complaints regarding this Policy or our data practices, please contact us using the details or the form below:

• Data Protection Contact, Bauter Global Ltd
• 27 Old Gloucester St, London, United Kingdom, WC1N 3AX

UK/EU data subjects may also lodge a complaint with the ICO (ico.org.uk) or their relevant EU supervisory authority. Australian individuals may contact the OAIC (oaic.gov.au).