WORKOBI

PRIVACY POLICY

Effective Date: May 11, 2026

Workobi, Inc. — A Delaware Corporation

This Privacy Policy describes how Workobi, Inc., a Delaware corporation with its registered office at 8 The Green, STE D, Dover, County of Kent, Delaware 19901, U.S.A. ("Workobi", "we", "us", or "our"), collects, uses, discloses, and otherwise processes personal information about you in connection with the Workobi website at https://workobi.com (the "Site"), the Workobi mobile applications, and the related online tools, dashboards, APIs, and features (collectively, the "Platform" or the "Service").

This Privacy Policy is incorporated by reference into the Workobi Terms of Use. By accessing or using the Platform, you confirm that you have read and understood this Privacy Policy. If you do not agree with any part of this Privacy Policy, you must not use the Platform.

This Privacy Policy is intended to comply with applicable data protection and privacy laws, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), the Turkish Law on the Protection of Personal Data No. 6698 ("KVKK"), and other similar laws. Where applicable, this Privacy Policy includes jurisdiction-specific notices in Section 13 (Region-Specific Disclosures).

At a Glance

This short summary highlights the most important points. It does not replace the full Privacy Policy below.

• We collect data you provide (such as your name, email, listings, and payment details) and data we observe (such as device, log, and approximate location information).

• We use this data to operate the Platform, process bookings and payments, prevent fraud, comply with law, and improve and market our services.

• We share data with counterparties (Hosts/Guests), payment processors, verification providers, analytics partners, and service providers that help us run the Platform, as well as with authorities where required by law.

• We transfer data internationally, including to the United States, with appropriate safeguards.

• Depending on where you live, you may have rights to access, correct, delete, port, or object to the processing of your data, and to withdraw consent.

• You can contact our Privacy Team at [email protected] at any time.

1. Who We Are; Data Controller

For the purposes of the GDPR and similar laws, Workobi, Inc. is the data controller of personal information collected through the Platform, except where we act as a processor on behalf of a Host (for example, when a Host uses our enterprise tools to manage its own employees or contractors) — in which case, the Host is the controller and we act as the Host's processor on terms set out in a separate data processing agreement.

Workobi, Inc.

c/o Delaware Registered Agent Service LLC

8 The Green, STE D

Dover, County of Kent, Delaware 19901, U.S.A.

Privacy Team: [email protected]

Data Protection Officer (where required): [email protected]

2. Information We Collect

We collect the following categories of personal information about you:

2.1 Information from Third Parties

In addition to the data described above, we may obtain information about you from third parties, including: (a) identity verification and fraud-prevention providers; (b) payment processors and banking partners; (c) sanctions-screening and anti-money-laundering data providers; (d) Hosts or Guests with whom you transact; (e) social-login providers (if you choose to sign in via a third-party account); (f) advertising and analytics partners (subject to your cookie preferences); and (g) publicly available sources.

2.2 Sensitive Information

We do not seek to collect "sensitive" personal information (such as racial or ethnic origin, religious beliefs, health data, biometric data, or precise geolocation) except where strictly necessary — for example, identification details required by law for verification purposes. We process such information only on a lawful basis under applicable law (such as your explicit consent, where required).

2.3 Children

The Platform is not directed to, and we do not knowingly collect personal information from, individuals under the age of 18. If you believe a child under 18 has provided us with personal information, please contact [email protected] and we will take steps to delete it.

3. How We Use Your Information

We use personal information for the following purposes:

• To create, manage, and authenticate Accounts;

• To enable Hosts to publish Listings and Guests to find and book Spaces;

• To process reservations, payments, payouts, refunds, deposits, taxes, and chargebacks;

• To facilitate communications between counterparties and to provide customer support;

• To verify identity and prevent fraud, money laundering, abuse, and other unlawful activity;

• To monitor, maintain, and improve the Platform, including diagnosing technical problems and developing new features;

• To personalize content, recommendations, and search results;

• To send service emails, security alerts, policy updates, and other transactional messages;

• To send marketing communications about Workobi and third-party offerings that we think may interest you, subject to your preferences and applicable law;

• To measure the performance of our marketing and the Platform, including through analytics tools;

• To comply with legal, regulatory, tax, accounting, and audit obligations;

• To establish, exercise, or defend legal claims and to enforce our terms;

• To carry out corporate transactions such as mergers, acquisitions, or financings;

• For any other purpose for which we obtain your consent.

3.1 Automated Decision-Making

We use automated tools to support certain decisions — for example, to detect suspicious activity, to rank Listings in search results, and to perform anti-fraud and sanctions screening. These tools may flag items for human review or, in limited cases (such as obvious fraud), may automatically block a transaction. Where you are subject to a decision that produces legal or similarly significant effects on you and is based solely on automated processing, you have rights described in Section 9 (Your Rights).

4. Legal Bases for Processing (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information on one or more of the following legal bases:

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and interests. You may obtain more information about our balancing tests by contacting [email protected].

Where we rely on your consent (for example, for certain marketing communications, cookies, or precise location data), you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

5. How We Share Information

We share personal information with the following categories of recipients:

5.1 Other Users

When you act as a Host or Guest, we share with your counterparty the information necessary to complete the transaction — including your name, profile information, listing details, dates, communications, and (after booking confirmation) the precise address of the Space or the Guest's contact information. Reviews, ratings, and profile information that you choose to make public are visible to other Users and visitors to the Platform.

5.2 Service Providers and Processors

We engage third-party service providers to perform functions on our behalf, under written agreements that require them to protect your information and use it only for the purposes we authorize. Categories of service providers include:

• cloud hosting and infrastructure providers;

• payment processors and payout providers;

• identity verification, anti-fraud, and sanctions-screening providers;

• analytics, attribution, and product-experimentation providers;

• customer-support and helpdesk providers;

• email, SMS, and push-notification delivery providers;

• mapping, geolocation, and search providers;

• marketing and advertising partners (subject to your preferences);

• professional advisors (lawyers, accountants, auditors, insurers).

5.3 Corporate Affiliates

We may share personal information with our subsidiaries and corporate affiliates, who will use it consistently with this Privacy Policy.

5.4 Legal and Safety Disclosures

We may disclose personal information to courts, regulators, law-enforcement agencies, tax authorities, and other governmental bodies (a) to comply with applicable law, court orders, or valid legal process; (b) to enforce or apply our terms and policies; (c) to protect the rights, safety, or property of Workobi, our Users, or others; or (d) to investigate, detect, prevent, or respond to fraud, illegal activity, or security incidents.

5.5 Corporate Transactions

If Workobi is involved in a merger, acquisition, financing, restructuring, bankruptcy, or sale of all or part of its assets, personal information may be transferred to the relevant counterparty, subject to standard confidentiality protections and consistent with this Privacy Policy.

5.6 With Your Direction or Consent

We may share personal information with other parties when you direct us to do so or otherwise consent.

5.7 No Sale of Personal Information for Money

Workobi does not sell personal information in exchange for monetary consideration. Certain disclosures to advertising or analytics partners through cookies and similar technologies may, however, qualify as a "sale" or "sharing" under California law; you can opt out of such disclosures as described in Section 13.2.

6. International Data Transfers

Workobi is established in the United States, and we operate the Platform globally. This means that your personal information will be transferred to, stored in, and processed in countries other than the country where you reside, including the United States. These countries may have data-protection laws that differ from, and may be less protective than, the laws of your country.

Where we transfer personal information from the European Economic Area, the United Kingdom, Switzerland, or Türkiye to a country that has not been recognized as providing an adequate level of protection, we rely on one or more of the following safeguards:

• the European Commission's Standard Contractual Clauses (SCCs), including the UK Addendum and the Swiss-specific adjustments, as applicable;

• the UK Information Commissioner's International Data Transfer Agreement (IDTA);

• for transfers from Türkiye, written undertakings approved by the Turkish Data Protection Authority (KVKK) or other lawful transfer mechanisms;

• your explicit consent, where permitted; or

• other safeguards permitted by applicable law.

You may request a copy of the relevant transfer safeguards by contacting [email protected].

7. Data Retention

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, regulatory, or reporting obligations and to establish, exercise, or defend legal claims. The retention periods below are general guidelines; the actual period may be longer or shorter depending on the specific context and legal requirements.

After the applicable retention period, we will delete or de-identify your personal information unless we are legally required to retain it for longer (for example, due to an ongoing investigation, dispute, or audit). De-identified information may be retained and used indefinitely without further notice to you, provided it can no longer reasonably be linked to you.

8. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access. Examples include encryption in transit (TLS), encryption at rest where appropriate, access controls, network segmentation, vulnerability management, employee training, and incident-response procedures.

No method of transmission over the internet or method of electronic storage is 100% secure, however, and we cannot guarantee absolute security. You are responsible for keeping your Account credentials confidential and for notifying us immediately of any unauthorized access. If you suspect a security incident, please contact [email protected].

9. Your Rights

Depending on where you live and subject to applicable law, you may have the following rights with respect to your personal information:

• Access — to request confirmation as to whether we process your personal information and to obtain a copy;

• Rectification — to request that we correct inaccurate or incomplete information;

• Erasure ("right to be forgotten") — to request that we delete your personal information in certain circumstances;

• Restriction — to request that we restrict the processing of your personal information in certain circumstances;

• Objection — to object to processing based on our legitimate interests, including direct marketing;

• Portability — to receive your personal information in a structured, commonly used, machine-readable format, and to transmit it to another controller;

• Withdrawal of consent — where we rely on your consent, to withdraw it at any time;

• Non-discrimination — not to be discriminated against for exercising your rights;

• Lodging a complaint with a supervisory authority (see Section 13);

• Rights related to automated decision-making, including the right to obtain human review of certain automated decisions.

9.1 How to Exercise Your Rights

You can exercise most of your rights directly through your Account settings, or by contacting us at [email protected]. For certain requests, we may need to verify your identity before responding (for example, by asking you to confirm details we already hold). We will respond within the timeframes required by applicable law (typically within 30 days under the GDPR, with the possibility of a 60-day extension for complex requests; and within 45 days under the CCPA/CPRA, with a similar extension).

You may authorize an agent to submit a request on your behalf. We will require proof of the agent's authority and may also require you to verify your identity directly.

9.2 Limitations

Your rights are not absolute and are subject to exceptions under applicable law. For example, we may refuse to delete information that we are required to retain by law, or that we need to defend legal claims, prevent fraud, or maintain Platform security.

10. Cookies and Similar Technologies

We and our partners use cookies, web beacons, pixels, SDKs, and similar technologies (collectively, "Cookies") on the Site and in our Apps. Cookies enable us to recognize your device, remember your preferences, authenticate sessions, measure performance, deliver personalized content, and serve targeted advertising.

10.1 Categories of Cookies We Use

• Strictly necessary Cookies — required for the Platform to function (authentication, security, load balancing). These cannot be disabled.

• Functional Cookies — remember your preferences and personalize your experience.

• Analytics Cookies — help us understand how Users interact with the Platform so we can improve it.

• Advertising Cookies — used to deliver relevant advertising on the Platform and on third-party services, and to measure ad performance.

10.2 Managing Cookies

In jurisdictions that require consent for non-essential Cookies (such as the EEA, UK, and Türkiye), we present a Cookie banner or preference center on first visit. You may also manage Cookies through your browser settings or device settings. Blocking certain Cookies may impair the functionality of the Platform.

We also honor Global Privacy Control ("GPC") signals where required by law.

10.3 Do Not Track

Our Site does not currently respond to Do-Not-Track browser signals beyond honoring GPC where legally required.

11. Marketing Communications

We may send you marketing communications about Workobi and related products and services if you have opted in (where required by law) or where permitted by an applicable "soft opt-in." You can opt out of marketing emails at any time by clicking the unsubscribe link in the email or by updating your communication preferences in your Account.

Even if you opt out of marketing communications, we will continue to send you transactional and service-related messages (such as booking confirmations, security alerts, and policy updates).

12. Third-Party Sites and Integrations

The Platform may contain links to third-party websites, services, or applications, or allow integrations with them (such as calendar systems, HRIS, single sign-on, or business-intelligence tools). Third-party services are governed by their own privacy policies. We are not responsible for the privacy practices of third parties, and we encourage you to review their policies before sharing information with them.

13. Region-Specific Disclosures

13.1 European Economic Area, United Kingdom, and Switzerland (GDPR)

Right to Lodge a Complaint

If you are in the EEA, the UK, or Switzerland, you have the right to lodge a complaint with the data-protection supervisory authority in the country where you live, work, or where the alleged infringement occurred. Contact details for EU supervisory authorities are available at https://edpb.europa.eu/about-edpb/about-edpb/members_en. For the UK, contact the Information Commissioner's Office at https://ico.org.uk.

EU/UK Representative

Where required by Article 27 of the GDPR or the UK GDPR, Workobi will appoint a representative in the EU or UK and update this Privacy Policy with the contact details. Until such appointment, you may contact us directly at [email protected].

13.2 California Residents (CCPA/CPRA)

Categories Collected, Used, and Disclosed

In the preceding 12 months, we have collected the categories of personal information described in Section 2 (Information We Collect), used them for the purposes described in Section 3 (How We Use Your Information), and disclosed them for business purposes to the categories of recipients described in Section 5 (How We Share Information).

Sale and Sharing of Personal Information

We do not sell personal information for monetary consideration. Certain Cookie-based disclosures to advertising or analytics partners may, however, qualify as a "sale" or "sharing" under the CCPA/CPRA. We do not knowingly sell or share personal information of consumers under 16 years of age.

Your California Privacy Rights

Subject to the CCPA/CPRA, California residents have the right to: (a) know what personal information we collect, use, disclose, sell, or share; (b) request access to and a copy of their personal information; (c) request correction of inaccurate personal information; (d) request deletion of their personal information; (e) opt out of the sale or sharing of personal information; (f) limit the use and disclosure of sensitive personal information; and (g) not be discriminated against for exercising these rights.

To exercise these rights, please email [email protected] or use the "Do Not Sell or Share My Personal Information" link on our website. You may designate an authorized agent to submit a request on your behalf; we will require verification.

Shine the Light

California Civil Code § 1798.83 permits California residents to request information about disclosures of certain personal information to third parties for their direct marketing purposes. You may submit such a request to [email protected].

13.3 Other U.S. State Privacy Laws

Residents of Colorado, Connecticut, Virginia, Utah, Oregon, Texas, Montana, and other U.S. states with comprehensive privacy laws have rights similar to those described above, including rights of access, correction, deletion, portability, and to opt out of targeted advertising, sale of personal data, or profiling for significant decisions. You may exercise these rights by contacting [email protected].

13.4 Türkiye (KVKK)

If you are in Türkiye, Workobi processes your personal data in accordance with the Turkish Law on the Protection of Personal Data No. 6698 ("KVKK"). Workobi is the "data controller" (veri sorumlusu) within the meaning of the KVKK.

Legal Bases under the KVKK

We process your personal data based on one or more of the following legal grounds under Article 5 of the KVKK: (a) your explicit consent (açık rıza); (b) the processing is expressly permitted by law; (c) it is necessary for the establishment or performance of a contract to which you are a party; (d) it is necessary for compliance with a legal obligation; (e) the data has been made public by you; (f) the processing is necessary for the establishment, exercise, or protection of a right; or (g) the processing is necessary for our legitimate interests, provided that your fundamental rights and freedoms are not harmed.

Special categories of personal data (özel nitelikli kişisel veri) are processed only with your explicit consent or on another lawful basis under Article 6 of the KVKK.

Your Rights under the KVKK

Under Article 11 of the KVKK, you have the right to: (a) learn whether your personal data is being processed; (b) request information if your data has been processed; (c) learn the purpose of processing and whether the data is used in accordance with this purpose; (d) know third parties to whom your data is transferred domestically or abroad; (e) request the correction of incomplete or inaccurate data; (f) request the deletion or destruction of your data within the framework of the relevant legislation; (g) request notification of corrections, deletions, or destructions to third parties to whom your data has been transferred; (h) object to a result that is unfavorable to you which is generated solely by the analysis of your processed data via automated systems; and (i) claim compensation for damage arising from unlawful processing of your personal data.

You may exercise these rights by submitting a written application to Workobi by email to [email protected] or by mail to the address listed at the beginning of this Privacy Policy, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. We will respond to your application within 30 days at the latest, free of charge unless the response requires an additional cost, in which case fees established by the Personal Data Protection Board may apply.

Complaints under the KVKK

You also have the right to file a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) at https://www.kvkk.gov.tr after exhausting the application procedure described above.

13.5 Other Jurisdictions

Where you are located in another jurisdiction with a comprehensive data-protection law (for example, Brazil under the LGPD, Canada under PIPEDA, or Australia under the Privacy Act), we will process your personal information in compliance with applicable law and afford you the rights granted to you under that law. Please contact [email protected] to exercise your rights.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" at the top and post the updated version on the Site. If the changes are material, we will provide reasonable advance notice through the Service or by email (where you have provided one) before the changes take effect. Your continued use of the Platform after the effective date of the updated Privacy Policy constitutes your acceptance of the changes (except where additional consent is required by applicable law, in which case we will seek it).

15. Contact Us

If you have questions, comments, or concerns about this Privacy Policy or our privacy practices, you may contact us as follows:

Workobi, Inc. — Privacy Team

c/o Delaware Registered Agent Service LLC

8 The Green, STE D

Dover, County of Kent, Delaware 19901, U.S.A.

Privacy inquiries: [email protected]

Data Protection Officer (where applicable): [email protected]

Security: [email protected]

Website: https://workobi.com

____________________________________________________________

Effective Date: May 11, 2026

© 2026 Workobi, Inc. All rights reserved.