I. Privacy Policy and Data Protection

In compliance with the applicable legislation, Future Lab LLC (hereinafter, also the Website) undertakes to adopt the necessary technical and organizational measures, according to a security level appropriate to the risk of the data collected.

Laws incorporated into this privacy policy

This privacy policy is adapted to the Spanish, European and U.S. legislation currently in force regarding the protection of personal data on the internet. Specifically, it complies with the following regulations:

European Union and Spain:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).

• Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights (LOPD-GDD).

• Royal Decree 1720/2007 of 21 December approving the Regulation implementing Organic Law 15/1999 of 13 December on the Protection of Personal Data (RDLOPD).

• Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE).

United States:

• California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

• Virginia Consumer Data Protection Act (VCDPA).

• Colorado Privacy Act (CPA).

• Connecticut Data Privacy Act (CTDPA).

• Children's Online Privacy Protection Act (COPPA).

• CAN-SPAM Act.

• Applicable privacy legislation of the State of Delaware.

Identity of the data controller

The controller of the personal data collected on the Website is: Future Lab LLC, A Series of OtoCo Base DE LLC, with EIN: 30-1495055 and registered with: Secretary of State of Delaware – Certificate of Formation, with the following registration details: State of Delaware, Certificate of Formation of a Limited Liability Company, File Number 3307117, Effective Date: March 20, 2024, whose representative is: Future Lab LLC (hereinafter, the Controller). Its contact details are:

Address: 131 Continental Drive Suite 305, Newark, Delaware 19713, United States

Contact phone: +1 (302) 412-6453

Fax: –

Contact email: futurelabllc@proton.me

Register of Personal Data

In compliance with the GDPR and the LOPD-GDD, we inform you that the personal data collected by Future Lab LLC through the forms on its pages will be incorporated and processed in our file in order to facilitate, expedite and fulfill the commitments established between Future Lab LLC and the User, or the maintenance of the relationship established in the forms they fill out, or to address a request or inquiry. Likewise, in accordance with the GDPR and the LOPD-GDD, unless the exception provided for in Article 30.5 of the GDPR applies, a record of processing activities is maintained.

Principles applicable to the processing of personal data

The processing of the User's personal data will be subject to the following principles set out in Article 5 of the GDPR and Article 4 et seq. of Organic Law 3/2018:

• Principle of lawfulness, fairness and transparency: the User's consent will be required at all times following fully transparent information about the purposes for which personal data is collected.

• Principle of purpose limitation: personal data will be collected for specified, explicit and legitimate purposes.

• Principle of data minimization: only data strictly necessary in relation to the purposes for which it is processed will be collected.

• Principle of accuracy: personal data must be accurate and always kept up to date.

• Principle of storage limitation: personal data will only be kept in a form that permits identification of the User for as long as necessary for the purposes of the processing.

• Principle of integrity and confidentiality: personal data will be processed in a manner that guarantees its security and confidentiality.

• Principle of accountability: the Controller is responsible for ensuring that the above principles are complied with.

Categories of personal data

The categories of data processed by Future Lab LLC are solely identifying data. Special categories of personal data within the meaning of Article 9 of the GDPR are never processed.

Legal basis for the processing of personal data

The legal basis for the processing of personal data is consent. Future Lab LLC undertakes to obtain the express and verifiable consent of the User for the processing of their personal data for one or several specific purposes.

By checking the acceptance boxes on our forms, the User grants free, specific, informed and unambiguous consent to the processing of their personal data, including international transfer to the service providers mentioned in this policy.

The User will have the right to withdraw their consent at any time. Withdrawing consent will be as easy as giving it. As a general rule, the withdrawal of consent will not condition the use of the Website.

On occasions where the User must or may provide their data through forms to make inquiries, request information or for reasons related to the content of the Website, they will be informed if completing any of them is mandatory because they are essential for the correct development of the operation carried out.

Purposes of the processing of personal data

Personal data is collected and managed by Future Lab LLC for the purpose of facilitating, expediting and fulfilling the commitments established between the Website and the User, or the maintenance of the relationship established in the forms the latter fills out, or to address a request or inquiry.

Likewise, the data may be used for commercial purposes of personalization, operations and statistics, and activities related to the corporate purpose of Future Lab LLC, as well as for data extraction, storage and marketing studies to adapt the Content offered to the User and to improve the quality, functioning and navigation of the Website.

When personal data is obtained, the User will be informed about the specific purpose or purposes of the processing.

Retention periods of personal data

Personal data will only be retained for the minimum time necessary for the purposes of its processing and, in any case, only for the following period: 24 months, or until the User requests its deletion.

When personal data is obtained, the User will be informed about the period for which the personal data will be kept or, where this is not possible, the criteria used to determine this period.

Recipients of personal data

The User's personal data will be shared with the following recipients or categories of recipients:

• Base44 Ltd — hosting and development platform of the Website.

• Google LLC, domiciled at 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States (Google Analytics, web analytics tools).

• Email and form service providers that Future Lab LLC may contract from time to time for the management of communications and email marketing.

International transfers: The Controller informs that the personal data collected may be transferred to recipients located in the United States or other countries outside the European Economic Area. These transfers are carried out under the EU-U.S. Data Privacy Framework (DPF), guaranteeing a level of data protection equivalent to the European one, or through the signing of Standard Contractual Clauses (SCCs) approved by the European Commission, thus ensuring the integrity and confidentiality of the information.

Should the Controller intend to transfer personal data to a third country or international organization, the User will be informed at the time the data is obtained about the third country or international organization and the existence or absence of an adequacy decision by the Commission.

Personal data of minors

In compliance with Articles 8 of the GDPR and 7 of Organic Law 3/2018, only persons over 14 years of age may give their consent for the lawful processing of their personal data by Future Lab LLC. For minors under 14, the consent of parents or guardians is required, and processing will only be considered lawful to the extent that they have authorized it.

Likewise, in compliance with the Children's Online Privacy Protection Act (COPPA) of the United States, this Website is not directed at children under 13 years of age, and Future Lab LLC does not knowingly collect personal information from children of that age. Should Future Lab LLC become aware that data from a child under 13 has been collected without verifiable parental consent, such data will be deleted immediately.

Secrecy and security of personal data

Future Lab LLC undertakes to adopt the necessary technical and organizational measures, according to a security level appropriate to the risk of the data collected, in order to guarantee the security of personal data and prevent the accidental or unlawful destruction, loss or alteration of personal data transmitted, stored or otherwise processed, or unauthorized communication or access to such data.

The Website has an SSL (Secure Socket Layer) certificate, which ensures that personal data is transmitted securely and confidentially, as the transmission of data between the server and the User is fully encrypted.

However, because Future Lab LLC cannot guarantee the impregnability of the internet nor the total absence of hackers or others who fraudulently access personal data, the Controller undertakes to notify the User without undue delay when a personal data security breach occurs that is likely to entail a high risk to the rights and freedoms of natural persons.

Personal data will be treated as confidential by the Controller, who undertakes to inform of and guarantee, by means of a legal or contractual obligation, that such confidentiality is respected by its employees, associates, and any person to whom it makes the information accessible.

II. User Rights — European Union and Spain

The User may exercise the following rights against the Controller, as recognized in the GDPR and Organic Law 3/2018:

• Right of access: obtain confirmation as to whether or not Future Lab LLC is processing their personal data and, if so, obtain information about their specific data and the processing carried out.

• Right of rectification: have inaccurate or incomplete personal data modified.

• Right of erasure ("the right to be forgotten"): obtain the deletion of their personal data when it is no longer necessary for the purposes for which it was collected or processed.

• Right to restriction of processing: restrict the processing of their personal data in the cases provided for by the regulations.

• Right to data portability: receive their personal data in a structured, commonly used and machine-readable format, and transmit it to another controller.

• Right to object: object to the processing of their personal data or have such processing cease.

• Right not to be subject to a decision based solely on automated processing, including profiling.

The User may exercise their rights by written communication addressed to the Controller with the reference "GDPR-www.futurelabdigital.com", specifying: the User's name and surname and a copy of their ID or equivalent identifying document; the request with specific reasons; address for notifications; date and signature of the applicant; and any document supporting the request.

This request and any other attached document may be sent to the following address and/or email:

Postal address: 131 Continental Drive Suite 305, Newark, Delaware 19713, United States

Email: futurelabllc@proton.me

III. User Rights — United States

California residents (CCPA/CPRA): You have the right to know, to delete, to correct, to opt out of the sale or sharing of data, and to non-discrimination. To exercise these rights, send a verifiable request to: futurelabllc@proton.me. Future Lab LLC will respond within 45 calendar days.

Virginia residents (VCDPA): You have the right to access, correct, delete and obtain a copy of your data, as well as to opt out of processing for targeted advertising, the sale of personal data and profiling. Contact: futurelabllc@proton.me. In the event of denial, you may file an appeal addressed within 60 days.

Colorado residents (CPA): You have rights similar to those of Virginia, including to access, correct, delete and opt out of targeted advertising, the sale of personal data and profiling. Contact: futurelabllc@proton.me

Connecticut residents (CTDPA): You have the right to access, correct, delete, obtain a portable copy of your data and opt out of processing for targeted advertising, sale and profiling. Contact: futurelabllc@proton.me

Other states: Future Lab LLC also respects the privacy laws of any other U.S. state that has passed specific applicable legislation.

IV. Do Not Track (DNT)

Some browsers incorporate a "Do Not Track" (DNT) feature that sends a signal to websites indicating that the User does not wish to be tracked. There is currently no uniform technological standard for recognizing and implementing DNT signals. Future Lab LLC undertakes to update this policy when a standard for DNT signals to be followed is adopted.

Likewise, Future Lab LLC respects the opt-out preference signals of the Global Privacy Control (GPC), as required by the CCPA/CPRA and other applicable state legislation.

V. Links to Third-Party Websites

The Website may include hyperlinks or links that allow access to web pages of third parties other than Future Lab LLC, which are therefore not operated by Future Lab LLC. The owners of such websites will have their own data protection policies, being themselves, in each case, responsible for their own files and their own privacy practices.

VI. Complaints to the Supervisory Authority

European Union and Spain users: Should the User consider that there is a problem or infringement of the regulations in force, they will have the right to effective judicial protection and to file a complaint with a supervisory authority. In the case of Spain, the supervisory authority is the Spanish Data Protection Agency (https://www.aepd.es/).

United States users: U.S. users who consider that their privacy rights have been violated may file a complaint with: the Federal Trade Commission (FTC) — https://www.ftc.gov/complaint; the Attorney General of California (if a California resident) — https://oag.ca.gov/contact/consumer-complaint-against-business-or-company; or the Attorney General of the corresponding state where applicable state legislation exists.

VII. Acceptance and Changes to this Privacy Policy

It is necessary that the User has read and agrees with the conditions on the protection of personal data contained in this Privacy Policy. Use of the Website will imply acceptance of its Privacy Policy.

Future Lab LLC reserves the right to modify its Privacy Policy, at its own discretion or motivated by a legislative, jurisprudential or doctrinal change by the competent authorities. Changes will be published on the Website. In the event of substantial modifications affecting the processing of personal data, Future Lab LLC will inform the User in a visible manner on the Website.

The User is advised to consult this page periodically to stay informed of the latest changes or updates.

VIII. Contact

For any inquiries related to this Privacy Policy, the User may contact:

Future Lab LLC

131 Continental Drive Suite 305

Newark, Delaware 19713, United States

futurelabllc@proton.me

Last updated: June 2026