Fuzu Privacy Policy — Uganda Addendum

This Uganda Addendum ("Addendum") forms part of the Fuzu Privacy Policy (the "Global Policy") and applies to the processing of personal data of individuals who access or use the Service from Uganda, individuals whose personal data Fuzu processes in connection with Ugandan operations, and any other processing that falls within the scope of Ugandan data-protection law.

The Global Policy applies in full to data subjects in Uganda. Where there is a conflict between the Global Policy and this Addendum on a matter specifically addressed in this Addendum, this Addendum prevails.

The data controller for the processing described in this Privacy Policy is Fuzu Ltd, a company registered in Helsinki, Finland (business ID FI25462252). Fuzu Ltd does not currently maintain a local affiliate or representative in Uganda.

Fuzu Ltd is not currently registered with the Personal Data Protection Office of Uganda ("PDPO"). Where registration with the PDPO or appointment of a local representative is required by the Data Protection and Privacy Act, 2019 or by directives issued by the PDPO in respect of the personal data Fuzu processes, Fuzu will obtain the relevant registration and update this Addendum accordingly.

Fuzu has appointed a Data Protection Officer ("DPO") whose responsibilities include Ugandan operations. The DPO may be contacted at:

• Email: privacy@fuzu.com
• Postal address: Fuzu Ltd, Data Protection Officer, Lapinlahdenkatu 16, 00180 Helsinki, Finland
• Through your account: www.fuzu.com/uganda/contact or chatline on the platform

Until a local representative is appointed in Uganda, data subjects in Uganda may exercise their rights and contact Fuzu using the details above.

Where Fuzu processes personal data of individuals in Uganda or processes personal data in the course of operating in Uganda, Fuzu complies with the Data Protection and Privacy Act, 2019 (the "Uganda DPPA"), the Data Protection and Privacy Regulations, 2021, and the guidance issued by the PDPO.

The lawful bases on which Fuzu processes personal data under the Uganda DPPA correspond to the lawful bases described in Section 5 of the Global Policy and include:

• Performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract;
• Compliance with a legal obligation to which Fuzu is subject;
• Protection of your vital interests;
• Performance of a task carried out in the public interest;
• Legitimate interests pursued by Fuzu, except where overridden by your interests, rights, or freedoms; and
• Your consent.

For processing of special personal data within the meaning of section 9 of the Uganda DPPA, Fuzu relies on your explicit consent or another lawful basis permitted by the Uganda DPPA.

Special personal data under the Uganda DPPA includes information relating to a person's religious or philosophical beliefs, political opinions, sexual life, financial information, health status, race, ethnic origin, criminal records, or any other information that the Uganda DPPA otherwise classifies as special.

Fuzu does not ordinarily require special personal data to provide the Service. Where you choose to share such data, you do so voluntarily, and Fuzu processes it only to the extent necessary for the purposes for which you have shared it and on the basis of your explicit consent or another lawful basis permitted by the Uganda DPPA.

As a data subject in Uganda, you have the rights set out in Part V of the Uganda DPPA, which broadly correspond to the rights described in Section 13 of the Global Policy:

• The right to access your personal data held by Fuzu;
• The right to request rectification of inaccurate or misleading personal data;
• The right to prevent processing of your personal data for direct marketing;
• The right to object to processing in certain circumstances; and
• The right to erasure of personal data that Fuzu is not authorised to retain.

You may exercise these rights by contacting Fuzu at the DPO contact details in Section 3 above. Many of these rights can also be exercised directly through your account settings.

Personal data of data subjects in Uganda may be transferred outside Uganda, including to Finland and other countries of the European Economic Area, the United Kingdom, the United States, and other countries where Fuzu, its affiliates, or its service providers operate.

Such transfers are carried out in accordance with section 19 of the Uganda DPPA and Regulation 30 of the Data Protection and Privacy Regulations, 2021. Fuzu relies on one or more of the following bases for cross-border transfers:

• Your consent to the transfer, after being informed of the possible risks;
• The transfer is necessary for the performance of a contract between you and Fuzu, or for the implementation of pre-contractual measures taken at your request;
• The transfer is necessary for the conclusion or performance of a contract concluded in your interest between Fuzu and another natural or legal person;
• The destination country has adequate measures in place for the protection of personal data that are at least equivalent to those provided under the Uganda DPPA, as verified through Fuzu's transfer-impact assessment;
• The transfer is necessary on grounds of public interest, the establishment, exercise, or defence of a legal claim, or to protect your vital interests.

Data subjects in Uganda have the right to lodge a complaint with the Personal Data Protection Office. Complaints may be submitted via www.pdpo.go.ug or to the PDPO at its current registered address. Data subjects are encouraged to contact Fuzu first using the contact details in Section 3 above so that Fuzu may attempt to address the matter directly.

Where the Service is used to facilitate recruitment or placement of Ugandan Candidates, Fuzu and the relevant Employer or workforce client share personal data in the manner described in Sections 9.1 and 9.4 of the Global Policy. Employers and workforce clients are independent controllers and are responsible for their own compliance with the Uganda DPPA. Where Fuzu facilitates the placement of Ugandan Users in employment outside Uganda, additional personal data (such as identity, work-authorisation, and tax information) may be processed in accordance with the Uganda DPPA, the Employment (Recruitment of Ugandan Migrant Workers Abroad) Regulations, 2005, and related regulations.

For Uganda-specific questions about this Privacy Policy or about the processing of your personal data by Fuzu, please contact the DPO using the details in Section 3 above.