PRIVACY POLICY Last updated: 31st August 2026 This Privacy Policy explains how Utake OÜ, an Estonian private limited company (OÜ), collects, uses, stores and otherwise processes personal data when you access or use our website, mobile application and related services (together, the “Platform”). We are committed to protecting your privacy and processing personal data lawfully, fairly and transparently in accordance with applicable laws and regulations. By using the Platform, you acknowledge that you have read this Privacy Policy. Unless the context requires otherwise, words used in the singular include the plural and words used in the plural include the singular. Any term defined in these Terms shall have the same meaning regardless of whether it is written with an initial capital letter or in lower case. 1. DEFINITIONS: Account: User profile created on the Platform following registration, which enables a User to access and use the Platform’s features and services. Applicant: any User submitting a request to either (i) send a Parcel or (ii) request the purchase and delivery to the Applicant of the selected Good(s), referred to as the “Purchase Request”. Goods: any item or product forming the subject of a Request, whether submitted for carriage as part of a Parcel or selected under a Purchase Request Parcel: one or more Goods forming the subject of a Request and which must comply with these Terms and all applicable laws and regulations. Platform/Application: The mobile and web Application through which Applicants and Travellers are connected available on https://www.u-take.app/home and iOS and Android Request: a request submitted by an Applicant through the Platform to send a Parcel or to arrange a Purchase Request. Services: The technical marketplace and intermediation functionality provided by the Platform to enable Users to identify, communicate with and enter into arrangements with one another. Stripe Technology Europe, Limited (STEL) also referred to as Stripe: Utake’s payment service provider, authorised as an electronic money institution by the Central Bank of Ireland (reference number C187865) to provide regulated payment services across the European Economic Area. User: any natural person of legal age under the laws of their jurisdiction of residence and legally capable, registered on the Platform. 2. DATA CONTROLLER Utake OÜ is the data controller for the personal data processed in connection with the Platform, except where another entity independently determines the purposes and means of processing. Registry code: 17577933, Registered office: Tööstuse 75-71, Põhja-Tallinna linnaosa, Tallinn, Harju maakond, 10416 Email: contact@u-take.app For privacy-related enquiries or to exercise your rights, please contact us using the above details. Where applicable, we will identify the relevant independent controller when your personal data is processed directly by a third-party service provider under its own responsibility. 3. DATA WE COLLECT Utake collects the Data: Users provide; When Users use our Services; From third parties. 3.1 Data provided by Users. This includes the following: - Account information: We collect data when Users create or update their Utake account. - First and last name, - Contact information: email address or telephone number where provided, - Date of birth, - Account credentials, i.e: password, - Profile photograph, where provided, - Settings. - User content: Rating and reviews on other Users - Identification data: Data collected to verify User’s account or identity: - Country of Residence, - Wherever applicable, Government-issued identification documents such as national identity card, driver’s licenses or passports and other supporting documents such as utility bill. The documents may contain information including the User’s full name, date of birth and address. The Platform may collect and review these documents directly to conduct its own identity-verification checks for the purposes of protecting the security and integrity of the Platform and prevent fraud or misuse. Where identity verification is performed by Stripe for payment purposes, the identification documents and other required information are provided directly by the User through the provider’s secure interface. Utake does not access or store the documents submitted to Stripe and receives only the limited information necessary to operate the Platform, such as verification status. 3.2 Data collected when Users use our services: Transaction and marketplace data that we may collect Transaction information - Delivery and Purchase Requests; - Flight listings and flight number where provided ; - Flight and Delivery dates and times; - Origin and destination information; - Delivery information including delivery address; - Where applicable Parcel and Goods dimensions, weight, declared value and other delivery information; - Where applicable, point of purchase of the Goods - Where applicable, proof of purchase such as receipts, photographs of the Goods and Parcel and other relevant photos uploaded on the Platform. - Transaction status; - Payment-related references, including payment method, amount. Customer-support requests Statistics derived from past Requests such as average value of the Requests, total Requests Usage Data: Data about how Users interact with Utake’s website and app that we may collect: - App crashes and other system activity, - Access dates and times, - App features or pages viewed, - Data regarding your interactions with marketing and advertising campaigns where applicable. Device Data: Data about device(s) used to access Utake that we may automatically collect: - IP address; - device and browser information; - operating system; - application version; - log data; - timestamps; - pages or features accessed; - crash and diagnostic information; - information concerning interaction with the Platform, - Hardware model where applicable, - Preferred language. We use this information primarily for security, functionality, troubleshooting, analytics and service improvement. \- Location data The Platform does not directly access User’s location and relies on User’s inputted location. 3.3 Data collected from Third Parties We may receive personal data from: - other Users, including ratings, reviews, reports, communications and referrals; - payment service providers, - fraud-prevention providers where applicable; - technical and hosting providers; - other service providers where necessary to provide or protect the Platform. For Users registering or signing in to the Platform using a third-party authentication service (i.e: as Google, Apple or Facebook), the Platform may receive certain information from the relevant provider, such as the User’s name, email address and profile information, subject to the User’s settings and the provider’s applicable terms. When Users use the Platform or interact with the Platform's marketing material, we may collect information about the User’s use and interactions, including through cookies and similar technologies, as described in our Cookie Policy. 4. RECIPIENTS OF DATA We may disclose personal data where necessary and proportionate to operate the Platform to the following categories of recipients: - Other Users , where disclosure is necessary to facilitate the intermediation service provided by the Platform; - Payment service providers (Stripe) ; - Analytics and technical service providers such as mailing solution, project management software; - Ad and marketing partners and providers - Hosting, cloud, IT and cybersecurity providers where applicable; - Fraud-prevention providers where applicable; - Communications and customer-support providers where applicable; - Customer Relationship Management solution where applicable; - Accountants, consultants, legal advisers and other professional service providers, where applicable, - Competent courts, regulators, law-enforcement authorities, tax authorities and other public bodies where legally required or permitted. We disclose only the information reasonably necessary for the relevant purpose. For example, once an agreement has been reached with users in respect to a Request, certain information such as names, meeting or delivery information may need to be shared between the relevant Applicant and Traveller to enable the delivery to be completed. Users are responsible for respecting the confidentiality and lawful use of information received about other Users. 5. HOW AND WHY WE USE PERSONAL DATA We process personal data only where we have a lawful basis under the GDPR. Utake uses data to provide, personalise, maintain, and improve its products and services. Legal basis: the basis under which Utake is allowed to use your data when certain circumstances defined Contractual necessity: This legal basis applies when we must use your data in order to provide the services you request and meet our responsibilities under that contract. Consent: This legal basis applies when we notify you of how we will collect and use your data, and you voluntarily agree to that use of your data (in some cases, by enabling that collection and use through a device or Platform setting). Where we rely on consent, you have the right to withdraw your consent at any time, in which case we will cease that collection and use of your data. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Legitimate interest: Where the Platform has a legitimate interest for using your data, its processing of data is necessary for that purpose, and the Platform's interests are not overridden by your interests or fundamental rights and freedoms requiring protection of personal data. This could be for purposes such as safety, security, and fraud prevention and detection, enforcing the Platform’s contractual terms, improving the Services, defending or establishing legal claims, Legal Obligation: Where processing User’s data is necessary for the Platform to comply with a legal obligation to which it is subject. 6. PAYMENT INFORMATION Payments made through the Platform are processed by our designated payment service provider, currently Stripe. We do not receive, have access or store payment-card numbers, security codes or other payment credentials handled directly by the payment provider. Payment credentials and other required information are provided directly by the User through the provider’s secure interface. We may receive limited payment-related information necessary to operate the Platform, such as transaction identifiers, payment status, amount, currency and limited information required for reconciliation or accounting. Stripe processes personal data in accordance with its own privacy documentation and applicable law. The relevant payment provider may act as an independent controller for certain processing activities. 7. COMMUNICATIONS We may process communications exchanged through the Platform, including messages, attachments, and other content submitted by Users. Access to communications may be necessary to provide the Services, for moderation purposes, fraud-prevention, enforce our Terms and Conditions, protect the Platform, security, legal-compliance purposes and for an overall quality of service management. Communications may be reviewed by authorised personnel or automated systems. 8. INTERNATIONAL TRANSFERS Because the Platform and its service providers may operate internationally, personal data may be processed outside the European Economic Area (“EEA”). Where personal data is transferred outside the EEA, we will do so only where permitted by applicable regulation including on the basis of: Adequacy decisions regarding the country of transfer; Appropriate transfer mechanisms such as the European Commission's Standard Contractual Clauses; Binding corporate rules 9. DATA RETENTION We retain personal data only for as long as necessary for the purposes for which it was collected, taking into account applicable contractual, legal, regulatory, accounting, tax, security and fraud-prevention requirements. Different categories of data may therefore be retained for different periods and Utake may retain data for longer, or shorter, than the periods described below where required by law. Account information data: retained as long as your account remains active. Following account closure, certain information may be retained for the period necessary to comply with applicable legal, establish, exercise or defend legal claims, or prevent fraud and abuse. Information that is no longer required for these purposes will be deleted or anonymised. User content data: while the User maintains an active account and for a period of up to 3 years thereafter where necessary to establish, exercise or defend legal claims or prevent fraud and abuse. Identification data: Identification documents collected directly by the Platform will be deleted or anonymised once the verification process and any related review has been completed and, in any event, no later than 90 days after completion of the verification, unless longer retention is required by applicable law or necessary in connection with suspected fraud, a dispute or to establish, exercise or defend legal claims The Platform may retain a limited record of the verification, such as its date, method, status and outcome while the account remains active and for up to 3 years after the account closure. Transaction and marketplace data: where required for a period of 7 years to comply with applicable accounting, tax and legal obligations and for as long as necessary to establish, exercise or defend legal claims. Usage & Device data: retained for as long as necessary for the purposes for which it is used while your account remains active. Following account closure, certain information may be retained for the period necessary to comply with applicable legal obligations, establish, exercise or defend legal claims, or prevent fraud and abuse. Information that is no longer required for these purposes will be deleted or anonymised. Messages and transaction communications: retained while your account remains active, and for up to 3 years following account closure where necessary for legal, fraud-prevention or security purposes. Information no longer required for these purposes is deleted or anonymised. Marketing consent and suppression records: active marketing consent data is retained for as long as necessary to establish compliance. Suppression records (confirming that you opted out or objected) are retained for as long as necessary to ensure your preference is respected, unless you separately request their deletion, in which case we will retain only the minimum information necessary to avoid re-contacting you. When personal data is no longer required, it will be securely deleted, anonymised or otherwise disposed of in accordance with applicable law. Deletion of an account does not necessarily result in immediate deletion of all information where we are legally required or legitimately entitled to retain it. 10. YOUR RIGHTS Subject to the conditions and limitations provided by data protection legislation, you have the right to: - obtain confirmation as to whether we process your personal data; - request access to your personal data; - request correction of inaccurate or incomplete data; - request erasure of your personal data, provided it is no longer necessary for the purposes set out in article 4.; - request restriction of processing: in certain cases, you have the right to ask us to suspend the processing of your Personal Data. - object to processing based on the Platform’s legitimate interests: where the processing of your Personal Data is based on our legitimate interest, you have the right to object for reasons relating to your particular situation. - object to direct marketing at any time; - Data portability: where the processing of your data is based on contract or consent, you have the right to receive certain personal data in a structured, commonly used and machine-readable format; - withdraw consent where processing is based on consent; - lodge a complaint with a competent supervisory authority. You may exercise your rights by contacting us at contact@u-take.app. We may need to verify your identity before processing a request in order to protect your personal data from unauthorised disclosure. We will respond without undue delay and, in principle, within one month of receiving a valid request, subject to the conditions and extensions permitted by the GDPR. 11. RIGHT TO OBJECT TO DIRECT MARKETING You may unsubscribe from promotional emails at any time by using the unsubscribe mechanism included in the relevant communication or by contacting us. You may object to direct marketing at any time and without providing a reason. 12. DATA SECURITY We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures may include access controls, authentication mechanisms, encryption in transit, secure hosting, logging, backups, contractual confidentiality obligations. However, no internet transmission or electronic storage system can be guaranteed to be completely secure. You are responsible for maintaining the confidentiality of your account credentials and should notify us promptly if you believe your account has been compromised. 13. COOKIES AND SIMILAR TECHNOLOGIES We may use cookies, SDKs and similar technologies for purposes such as: - Operating the Platform, - Remembering preferences and settings, - Maintaining security, - Understanding usage and measuring effectiveness of marketing campaigns, - Analysing site traffic and trends, and generating an overall understanding the behaviours and interests of Users. Strictly necessary technologies may be used where permitted by law. Where consent is legally required for non-essential cookies or similar technologies, we will request your consent before placing or using them and provide appropriate controls for withdrawing or changing your preferences. Further information may be provided in our Cookie Policy. 14. DATA PROVIDED ABOUT OTHER PEOPLE If you provide us with personal data relating to another person, including a recipient, sender, traveller or other contact, you must ensure that you have a lawful basis for doing so and, where required, have provided that person with appropriate information about the processing. You must not provide personal data that you are not authorised to disclose. 15. THIRD-PARTY SERVICES AND LINKS The Platform may contain links to third-party websites, applications or services. We are not responsible for the privacy practices of third parties operating those services. Their own privacy policies will apply to processing carried out under their responsibility. We recommend reviewing the applicable privacy information before providing personal data to third parties. 16. DATA BREACHES Where a personal-data breach occurs, we will assess and handle the incident in accordance with applicable law, including notifying the affected individuals where legally required and/or the competent supervisory authority where applicable. 17. CHANGES TO THIS PRIVACY POLICY We may amend or update this Privacy Policy from time to time. Any changes will take effect upon publication of the updated version on the Platform. Where required by applicable law, we will notify Users of material changes through the Platform or other means. Continued use of the Platform following such changes constitutes acceptance of the updated Privacy Policy. If you do not agree with the revised Policy, you should discontinue use of the Platform. 18. CONTACT For questions concerning this Privacy Policy or the processing of your personal data, please contact: contact@u-take.app This Privacy Policy forms part of the legal framework governing use of the Platform and should be read together with our Terms and Conditions and Cookie Policy.