Fuzu Privacy Policy — Kenya Addendum

This Kenya Addendum ("Addendum") forms part of the Fuzu Privacy Policy (the "Global Policy") and applies to the processing of personal data of individuals who access or use the Service from Kenya, individuals whose personal data Fuzu processes in connection with Kenyan operations, and any other processing that falls within the scope of Kenyan data-protection law.

The Global Policy applies in full to data subjects in Kenya. Where there is a conflict between the Global Policy and this Addendum on a matter specifically addressed in this Addendum, this Addendum prevails.

The data controller for the processing described in this Privacy Policy is Fuzu Ltd, a company registered in Helsinki, Finland (business ID FI25462252). Fuzu Ltd is registered with the Office of the Data Protection Commissioner of Kenya ("ODPC") as a data controller and data processor.

• ODPC registration number (data controller): 611-8089-567D
• ODPC registration number (data processor): pending
• Date of registration: 19 May 2025

Where Fuzu operates in Kenya through a local affiliate or representative, that entity may also act as a data controller or data processor in respect of Kenyan operations. Details of any such local entity will be set out here once confirmed:

• Local entity: Fuzu Services Mauritius Ltd Kenya Branch

Fuzu has appointed a Data Protection Officer ("DPO") whose responsibilities include Kenyan operations. The DPO may be contacted at:

• Email: privacy@fuzu.com
• Postal address: Pinetree Plaza, Kamburu Drive, Nairobi, Kenya
• Local support: www.fuzu.com/kenya/contact

Where Fuzu processes personal data of individuals in Kenya or processes personal data in the course of operating in Kenya, Fuzu complies with the Data Protection Act, 2019 (the "Kenya DPA"), the Data Protection (General) Regulations, 2021, the Data Protection (Compliance and Enforcement) Regulations, 2021, the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, and the guidance, codes of practice, and directives issued by the ODPC.

The lawful bases on which Fuzu processes personal data under the Kenya DPA correspond to the lawful bases described in Section 5 of the Global Policy and include:

• Performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract;
• Compliance with a legal obligation to which Fuzu is subject under Kenyan law;
• Protection of your vital interests or those of another individual;
• Performance of a task carried out in the public interest;
• Legitimate interests pursued by Fuzu or a third party, except where overridden by your interests, rights, or freedoms; and
• Your consent, which you may withdraw at any time.

For processing of sensitive personal data within the meaning of section 44 of the Kenya DPA, Fuzu relies on your explicit consent or another lawful basis permitted by the Kenya DPA.

Sensitive personal data under the Kenya DPA includes data revealing the natural person's race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details (including names of the person's children, parents, spouse or spouses), sex, or the sexual orientation of the data subject.

Fuzu does not ordinarily require sensitive personal data to provide the Service. Where you choose to share such data, you do so voluntarily, and Fuzu processes it only to the extent necessary for the purposes for which you have shared it and on the basis of your explicit consent or another lawful basis permitted by the Kenya DPA.

As a data subject in Kenya, you have the rights set out in section 26 of the Kenya DPA, which broadly correspond to the rights described in Section 13 of the Global Policy:

• The right to be informed of the use to which your personal data is to be put;
• The right of access to your personal data in the custody of Fuzu;
• The right to object to the processing of all or part of your personal data;
• The right to correction of false or misleading data; and
• The right to deletion of false or misleading data about you.

You may exercise these rights by contacting Fuzu at the DPO contact details in Section 3 above. Many of these rights can also be exercised directly through your account settings.

Personal data of data subjects in Kenya may be transferred outside Kenya, including to Finland and other countries of the European Economic Area, the United Kingdom, the United States, and other countries where Fuzu, its affiliates, or its service providers operate.

Such transfers are carried out in accordance with sections 48 and 49 of the Kenya DPA and the Data Protection (General) Regulations, 2021. Fuzu relies on one or more of the following bases for cross-border transfers:

• The destination country has commensurate or equivalent data-protection law as the Kenya DPA, as recognised by the ODPC;
• Appropriate safeguards are in place (such as standard contractual clauses, binding corporate rules, or another mechanism recognised by the ODPC);
• Your express consent to the transfer, after being informed of the possible risks;
• The transfer is necessary for the performance of a contract between you and Fuzu, or for the implementation of pre-contractual measures taken at your request;
• The transfer is necessary for the conclusion or performance of a contract concluded in your interest between Fuzu and another natural or legal person;
• The transfer is necessary for any matter of public interest, the establishment, exercise, or defence of a legal claim, or to protect your vital interests where you are physically or legally incapable of giving consent.

Data subjects in Kenya have the right to lodge a complaint with the Office of the Data Protection Commissioner. Complaints may be submitted via www.odpc.go.ke or to the ODPC at its current registered address. Data subjects are encouraged to contact Fuzu first using the contact details in Section 3 above so that Fuzu may attempt to address the matter directly.

Where the Service is used to facilitate recruitment or placement of Kenyan Candidates, Fuzu and the relevant Employer or workforce client share personal data in the manner described in Sections 9.1 and 9.4 of the Global Policy. Employers and workforce clients are independent controllers and are responsible for their own compliance with the Kenya DPA. Where Fuzu facilitates the placement of Kenyan Users in employment outside Kenya, additional personal data (such as identity, work-authorisation, and tax information) may be processed in accordance with the Kenya DPA, the National Employment Authority Act, 2016, and related regulations.

For Kenya-specific questions about this Privacy Policy or about the processing of your personal data by Fuzu, please contact the DPO using the details in Section 3 above.