Cosmocows Privacy and Cookie Statement

Last amended: 9 April 2024

Cosmocows B.V. (hereafter: "Cosmocows") offers online platforms that you can use for scheduling education, training and exercises in a fully web-based system (the "Services"). This means that everyone always works in the latest version. We offer our services on our website and via various applications.

Your privacy is of great importance to Cosmocows. We therefore comply with the General Data Protection Regulation ("GDPR"). This means that we:

• Clearly set out our purposes, via this privacy and cookie statement, before we process your personal data
• Store as little personal data as possible and only store the personal data we need for our purposes
• Request your explicit consent for the processing of your personal data where consent is required
• Take the requisite security measures to protect your personal data. We also impose these obligations on parties that process personal data on our behalf
• Respect your rights, such as the right to access the personal data we hold about you or to request that this data be corrected or removed

Processing of personal data

This privacy and cookie statement explains what we do with the information we obtain about you in performing our services and on our website (https://www.ag5hvr.nl). By using our services, you provide us with different types of personal data. For each subject, we will indicate what data we obtain about you and for how long we retain this data, and for what purpose and on what basis we do so. If you have any questions, or want to know the exact information we hold about you, please do not hesitate to contact Cosmocows using the contact details shown at the bottom of this statement.

Contact and application forms

The various online forms we offer all ask you to enter data: when requesting live demos, downloading white papers and templates, filling in registration or submitting other kinds of questions via a contact form.

In this connection, we use the following personal data:

• First name and surname
• Company name
• Business email address
• IP address
• Any other information you provide in a message

We need this data in order to process your contact request asking us to contact you about one of our services. We need the data for the purpose of implementing the agreement to this end with you. We will retain this information until we think that you are satisfied with our response and for three months thereafter. This will help us retrieve the information if there should be any follow-up questions. If the completed contact form results in an agreement, we will retain this data for up to two years after the service provision has ended. This also helps us train our customer service department in further improving its services, which constitutes a legitimate interest.

Sending System Alerts

In addition, we will send you System Alert (service) messages if you are our customer. This enables us to inform you about temporary or permanent changes to our services, such as scheduled outages, new functions, version updates, releases, abuse warnings and amendments to our privacy and cookie statement. We will send these messages in the context of the service agreement.

In this connection, we process the following data:

• First name and surname
• Email address

We will retain this data for up to two years after the service provision has ended.

Our applications

We offer various applications that provide access to your own management portal:

Skills Portfolio

In this context, we process the following data:

• First name and surname
• Email address
• Login data
• Name of the organisation
• Browser locale

Skills Assessment

In this context, we process the following data:

• First name and surname
• Email address
• Login data
• Name of the organisation
• Browser locale

We offer a digital environment in which you can find everything you need about the subjects mentioned above. Where the account is concerned, we use your email address and chosen password (login data). We need this data for the purpose of offering the account environment you requested (agreement) and providing our services to you. We will retain this information for the duration of your account and until our service provision to you has ended. You can close your account by contacting us via support@ag5.nl.

Downloading our application

You can download our applications via the App Store or via Google Play. We have no control as to what personal data the provider (Apple or Google) processes in this context, or for what purpose. We therefore recommend that you read the relevant privacy and cookie statements of the provider concerned.

Testimonials

Our website presents a number of testimonials of our services, also referred to as 'customer cases'. This is meant to give you a complete picture of our products/services and how our customers rate the use of those products and services in practice. In this connection, we process the following data:

• First name and last name of the reviewer
• Name of the organisation where the reviewer works
• Any photographs provided by the organisation/reviewer

We need this data for the purpose of assessing the review and processing it on the website. The ground for processing this data is consent: all reviewers are expressly asked for their consent before a review is placed on our website. The reviewers and other parties involved can easily withdraw this consent again at any time by contacting us. We will retain the data until it has lost its relevance. If the consent is withdrawn, we will remove all data immediately.

Recruitment and selection of new staff

You can apply for a job at Cosmocows. When you submit a job application to us, we will collect the following data about you:

• Name and address data
• Gender
• Date and country of birth
• Contact details
• CV
• The substance of your motivation letter and motivation
• Salary indication (optional)
• Your availability (optional)
• Any references requested

We process this data for the purpose of handling your job application and – if you join our company – implementing your employment contract.

Please note: A social media and Google check may be part of the selection procedure. We do so to ensure that hiring new staff will not be detrimental to our image. To this end, we will search for your name on Google and your profiles (if any) on a variety of social media. Obviously, we can only do so to the extent that these profiles are public. We will not ask you to grant us access to a protected social media page or to connect with us. The results of the check will be discussed with you.

In addition to a social media and Google check, the selection procedure may also involve an assessment. This is because, for certain positions, we need to ensure that applicants possess particular qualities that are essential for those positions. If an assessment should be necessary, we will inform you prior to the assessment about the manner in which we will handle your data for this purpose.

We will retain the application data for up to four weeks after the vacancy was filled. We retain this data so that we will be able to contact you if the position should again become available during the probationary period. If we cannot offer you a position at that moment but expect that a suitable position will become available for you at our company in the near future, we may – with your consent – retain your application for another year. You can withdraw this consent at any time by sending us an email.

If you join our company, we will keep your application data in the personnel file. We will retain this file for as long as necessary. For more information on this point, please refer to the internal privacy statement.

Disclosure to third parties

We may disclose your personal data to other companies or organisations, because:

• We engaged them to process particular data
• This is necessary for the implementation of the agreement with you
• You have granted your consent for this
• We have a legitimate interest in doing so
• We are obliged to do so by law (for example, if the police demand this when there is a suspicion of a crime)

The parties processing personal data on our or your instructions are:

• IT suppliers and service providers
• Cookie service providers (see below)
• Payment service providers
• Marketing companies

To be able to provide our services, we may disclose your personal data to parties based outside the European Economic Area (EEA). AG5 will only do so if there is an appropriate level of protection for processing personal data. This means, for example, that we use a model agreement of the European Commission or make arrangements on how personal data will be handled.

Social media buttons

On our website, we make use of social media buttons, which take you to the social media platforms. This will give you the option to follow us and share content within your network. In addition, you will encounter advertisements on your social media page. The buttons work because of pieces of code originating from the social media networks. If you want to know what the social media platforms do with your personal data and what cookies they place, please read the privacy statements of these platforms.

Cookies

On our website, we use our own cookies and those of third parties. Cookies are small information files that can be stored or read automatically on the visitor's device (such as a PC, tablet or smartphone) whenever a website is visited. This is done via the web browser on the device. Cosmocows uses cookies in order to:

• Enable website functionalities (technical and functional cookies)
• Analyse website usage and make the website more user friendly on the basis of that analysis (analytical cookies)
• Show personalised advertisements (marketing cookies)

These cookies collect the following data about you, among other things:

• IP address
• Cookie-ID
• Browsing and clicking behaviour
• Referrer URL

When you visit our website for the first time, we will display a notification with an explanation about cookies. On this occasion, we will ask for your agreement to the use of cookies to the extent that we are obliged to do so.

Cookie / Entity	Type	Purpose	Retention
Google Tag Manager	Functional	Makes it possible to load scripts of other cookies. Purely functional and not used for collecting personal data.	Session
Google DoubleClick	Marketing	Used for registering actions when viewing or clicking advertisements, to measure effectiveness and show personalized ads.	6 months
Google Analytics	Analytical	Placed to gain insight into visitor behavior and improve user experience. Set to 'privacy friendly' with disguised IP addresses.	2 years
Google Dynamic Remarketing	Marketing	Used to make website visitors return based on their online browsing behavior. Shows personalized content on other websites.	6 months
YouTube	Marketing	Registers unique ID for YouTube video statistics, charts user bandwidth and functionalities relating to YouTube videos.	8 months
LinkedIn Ads / Analytics	Marketing, Analytical	Placed to gain insight into website usage and extend advertisement range. Personalizes ads through clicking and browsing behavior.	2 years
AddToAny	Marketing	Enables Share & Like options for social media platforms. Cookies are placed for recognition purposes.	Session
First-party cookies	Functional	Enable necessary website functionalities such as remembering language, cookie consent, and displaying the cookie banner.	2 years

Enabling and disabling cookies

Although you can disable cookies via your browser, this may cause some options of our website to work less well. For more information on enabling, disabling and deleting cookies, please refer to the instructions and/or help function in your browser.

Deleting cookies

Most cookies have an expiry date. If an expiry date has been set, the cookie will be deleted automatically when the expiry date has passed. Alternatively, you may opt to delete the cookies manually before the expiry date has passed. Please refer to your browser's manual in this respect.

Protection

Personal data protection is of great importance to us. We will ensure that your data is securely protected on our system. We keep adjusting our security and are always vigilant that nothing goes wrong. In order to protect your data, our credit card processing supplier uses the latest 128-bit Secure Socket Layer (SSL) technology for safe transactions. Our supplier is certified as compliant with card association security initiatives, such as Visa Card Holder Information Security and Compliance (CISP), Master Card (SDP) and Discovery Information Security and Compliance (DISC). AG5 accounts can only be accessed using a user name and password. You must keep your user name and password confidential and never disclose them to a third party. Due to the sensitive nature of the information in your distribution lists, passwords will be encrypted, which means that we are unable to view your passwords. We are therefore unable to resend forgotten passwords. We can only reset them.

Your rights

If you have any questions or want to know what personal data we hold about you, please do not hesitate to contact us. Our contact details are stated below.

You have the following rights:

• Right to access: you have the right to access the personal data we process about you.
• Right to rectification: you have the right to correct or supplement the data we process about you if these are incorrect or incomplete.
• Right to withdraw your consent: you can withdraw your consent at all times in a straightforward manner.
• Right to object: you can object to the processing of your personal data.
• Right to removal: you can request us to remove your personal data.
• Right to data portability: where technically feasible, you have the right to have the personal data we process about you transferred to a third party.
• Right to restriction of processing: in some cases, you can request that the processing of your personal data be restricted either temporarily or permanently, which means that we will process less data about you.

When you make your request, we may ask that you prove your identity. We will ask you for data so as to be sure that you are indeed the person to whom the personal data belongs. Depending on the information we hold about you, we may ask you to send us a copy of a valid identity document. Please remember to blank out your Citizen Service Number (BSN) and passport photograph when submitting this document.

In principle, we will comply with your request within one month. However, this period may be extended for reasons relating to the data subject's specific rights or the complexity of the request. If we extend this period, we will notify you of this in good time.

If you want to exercise any of your rights, please send us an email at support@ag5.nl.

Amendments to this privacy and cookie statement

If changes are made to one of our websites and/or services, we obviously have to adjust the privacy and cookie statement as well. We therefore recommend that you always look at the date of this statement and regularly check for new versions.

Questions and complaints

If you have any questions or wish to file a complaint about the use of your personal data, please do not hesitate to contact us using the contact details at the bottom of this privacy and cookie statement. We will take up each question and complaint internally and keep you informed. If you are dissatisfied with the manner in which we help you, you will have the right to submit a complaint to the data protection supervisor. In the Netherlands, this is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).

Contact details of Cosmocows B.V.

Oostenburgervoorstraat 83A
1018 MP Amsterdam
Telephone number: +31 20 4630942
Email address: support@ag5.nl