Direct Marketing and Newsletter Subscription Policy

Please read this Policy carefully. It concerns the processing of personal data of direct marketing and newsletter subscribers by LLC “Adjara Group” (ID No.: 404676169) (the “Data Controller”, hereinafter “GymBreeze”, “we”, “us”, or “our”).

By agreeing to this Policy, you confirm that you have read it and consent to the processing of your personal data for the purposes of direct marketing and/or newsletter subscription.

In order to provide you with personalized offers related to our products and services, as well as to inform you about special offers and news, we may process the following personal data about you (“Personal Data” or “Personal Information”) if:

a) you opt in to receive our marketing communications on the website or otherwise consent to the processing of your data for direct marketing purposes; and/or

b) you subscribe to our newsletter.

The processing of personal data is voluntary. You have the right to withdraw your consent at any time, free of charge. If you withdraw your consent to receive such communications from us, we will immediately cease any further marketing communications, no later than 7 (seven) business days from the date of your request.

1. Types of Personal Data We May Process

a) For marketing purposes:

• Identification and contact data: first name, last name, date of birth, gender, email address, phone number.

• Purchased products/services and bookings: bookings of courts, accessories, tournaments, classes, and masterclasses, including used or canceled bookings; their number, frequency, seasonality; gaps between purchases and bookings; amounts spent; purchase/booking channel; selected payment method; leaderboard history.

• Communication data: information about email opens and clicks, collected via relevant platforms for monitoring and improving communications.

The above personal data may be processed to provide you with personalized offers related to our products and services.

b) For newsletter subscription purposes:

• Email address provided by you when subscribing to the newsletter;

• Subscription date, and information about email opens and clicks, collected via relevant platforms for monitoring and improving communications.

We collect your personal data directly from you when you provide it during registration of your account/profile with us for marketing communications and/or newsletter subscription, and also through our operational systems as a result of purchasing and using our products and services.

2. Types of Communications You May Receive from Us

You may receive information about:

• our products and services tailored to your interests and preferences;

• our latest marketing newsletters and special offers;

• advertisements and promotional offers;

• our news and our cooperation with third parties;

• planned sales and promotions;

• products and services offered by our affiliated companies, including their marketing newsletters, special offers, advertisements, sales, and promotions.

3. Data Sharing

We may share your personal data with the following recipients:

a) Our affiliated companies. These include affiliated or related entities, any entity and/or person directly or indirectly controlled by us, under common control with us, or jointly controlled with us by another affiliated entity, considering common business interests.

For these purposes, “control” means the direct or indirect authority to manage and direct an entity’s activities based on ownership, controlling interest, voting rights, contractual, or other relationships.

Personal data is shared with our affiliated companies within our group’s corporate governance structure for common business and marketing purposes, in order to provide you with marketing communications as described in Section 2 of this Policy.

b) Our employees. Employees who need access to and process your personal data for direct marketing purposes and who are bound by confidentiality obligations.

c) Third parties. Including contractors acting as data processors, who collect and process your personal data on our behalf and/or for us, in order to help provide effective and high-quality services and marketing communications, and who are bound by confidentiality obligations and data security standards. Sharing personal data with third parties registered and operating abroad is carried out in accordance with Georgian law governing international data transfers.

Communication Platforms Used

To deliver communications, we use marketing platforms such as SendGrid and/or Omnisend, to which we provide your email addresses for sending communications. Through these platforms, we also collect information about email opens and clicks in order to monitor and improve communications.

The providers of these platforms are legal entities registered in the United States and Latvia, which process personal data in accordance with their respective privacy policies:

Omnisend Privacy Policy (Omnisend group companies: UAB Omnisend, Verkių g. 25C-1, LT-08223 Vilnius, Republic of Lithuania; Omnisend, LLC, Unit A3, Gateway Tower, 32 Western Gateway, London, E16 1YL; Omnisend, Ltd., 1401 Sam Rittenberg Blvd, Suite 2, Charleston, SC 29407, United States).

SendGrid Privacy Policy (Twilio Inc., c/o Corporation Service Company, 251 Little Falls Drive, Wilmington, DE 19808).

By sharing data with a company based in the United States, your personal information may also be stored on servers located in the United States. The United States is not included in the list of countries providing adequate safeguards for personal data protection under the relevant regulation of the Personal Data Protection Supervisory Authority. Accordingly, by transferring your personal data outside the jurisdiction of Georgia:

(a) it will be subject to the laws and regulations of the respective country; and

(b) you may not be able to exercise the same or equivalent data protection rights as provided under Georgian law.

Please note that the above-mentioned companies, based on relevant contractual obligations, assume responsibility to ensure data processing in accordance with EU data protection standards, maintain the confidentiality of personal information, and process it solely in accordance with our instructions.

After reviewing the above information and understanding the risks associated with transferring your personal data outside the jurisdiction of Georgia, by agreeing to this Policy you consent to the sharing of your data (including your email address) with the named companies for communication purposes and to the processing of such data by them in accordance with their privacy policies.

4. If You No Longer Wish to Receive Communications from Us

You may withdraw your consent at any time. Withdrawing consent is as easy as giving it:

• all communications sent to you include an integrated unsubscribe tool allowing you to easily opt out of future communications;

• registered users may do so via the relevant section of their personal account/profile settings;

• you may also contact us using the contact details provided in Section 6 of this Policy.

Please note: opt-out requests will be processed within the timeframe prescribed by law (no later than 7 business days).

5. Personal Data Retention and Security

We treat your personal information with due care and confidentiality and have implemented all reasonable technical and organizational security measures to protect it against unlawful use, loss, alteration, deletion, processing or other unauthorized access or interference. These measures include storing personal data in a secure electronic database accessible only to a limited number of persons, in accordance with our internal standard operating procedures, which are binding on our staff.

We will retain and process your personal data for direct marketing purposes throughout the duration of our and/or our subsidiaries’ operations, unless you request cessation of processing earlier.

We have a legal obligation to record and retain the time and fact of consent given and withdrawn by the data subject for direct marketing purposes, for the duration of direct marketing activities and for 1 year after their termination.

This period may be extended where the company has a legitimate interest in retaining your personal data (e.g., for the protection of our interests in court).

We also ensure that all third parties listed in Section 3 of this Policy comply with these rules and procedures.

6. Data Subject Rights and Contact Information

If you have any questions, complaints, requests, or claims, please contact us or our Data Protection Officer (LLC “Privacy Logic Group”, ID No.: 405222619) at:

LLC “Adjara Group” (ID No.: 404676169)

Postal Address: 14 Kostava Street, Tbilisi, Georgia

Email: pdsupport@adjaragroup.com

You may contact us or our Data Protection Officer at any time to exercise your rights under Chapter III of the Georgian Law on Personal Data Protection. In particular, you have the right to receive information about the processing of your personal data; request copies; request rectification, updating, deletion/destruction, or restriction of processing; and exercise the right to data portability by submitting a written request to: pdsupport@adjaragroup.com.

Please also refer to our Personal Data Protection Policy for additional information regarding these rights.