Effective Date: 1 August 2026

Last Updated: 20 July 2026

Document ID: PP-V1-2026

1. Purpose and Scope

This Privacy Policy explains how In-Finitude AG ("In-Finitude", "we", "us") collects, uses, stores, and discloses Personal Data in connection with the Pollenn platform ("Platform"). It applies to all Users of the Platform, including visitors, registered Users, Organisation members, and API consumers.

This Privacy Policy forms part of the Pollenn General Terms and Conditions ("GTC"). Terms defined in the GTC have the same meaning in this Privacy Policy. In the event of conflict between this Privacy Policy and the GTC on data protection matters, this Privacy Policy prevails.

This Privacy Policy is based on the Swiss Federal Act on Data Protection (nFADP; SR 235.1, effective 1 September 2023) and its implementing ordinance (DPO; SR 235.11). For Users located in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR; Regulation (EU) 2016/679) and applicable national implementations also apply. Where the nFADP and GDPR impose different requirements, we apply the more protective standard.

2. Data Controller

In-Finitude AG c/o Marc Vogt, Glärnischstrasse 24, 8704 Herrliberg, Switzerland UID: CHE-100.692.214 · CH-ID: CH-550-0106083-2

Data protection contact: dpo(@)in-finitude.ch

In-Finitude AG is the data controller for Personal Data processed in connection with Platform operation, account management, and platform-level communications.

Organisations as controllers. Organisations using the Platform are independent data controllers (or, where applicable, joint controllers with In-Finitude AG) for Personal Data processed within their Programs and Projects, including Work Board listings, applications, and assignments operated within their Programs (see GTC Section 9.5(f)). For communications between Users, the identity of the data controller depends on the context:

• In-Finitude AG is the controller for platform-level communications (support requests, platform announcements, account-related messages).
• The Organisation is the controller for communications within its Programs and Projects (project chat, team communication, Work Board coordination within the Organisation's scope).

Where an Organisation acts as data controller, In-Finitude AG acts as data processor on behalf of that Organisation. The relationship between In-Finitude AG and the Organisation as processor and controller is governed by the Data Processing Agreement (DPA) forming part of the Subscription Agreement.

Joint controllership. For processing operations where In-Finitude AG and an Organisation jointly determine the purposes or means of the processing — including (i) the publication, ranking, and visibility of Observations within a Program, (ii) Work Board listings, applications, assignments, and related communications within a Program, (iii) content moderation under GTC Section 14 within an Organisation's scope, and (iv) analytics dashboards provided by In-Finitude AG to the Organisation — In-Finitude AG and the Organisation act as joint controllers within the meaning of GDPR Art. 26 (and the equivalent Swiss FADP framework). The essence of the joint controllership arrangement, in particular the allocation of GDPR transparency obligations under Arts. 13–14 and data-subject rights under Arts. 15–22, is set out in the Joint Controllership Arrangement (JCA) forming part of the Subscription Agreement. Data subjects may exercise their rights against either joint controller.

3. Categories of Data Subjects

This Privacy Policy applies to the following categories of individuals:

• Registered Users — individuals who have created an account on the Platform.
• Organisation members — registered Users who hold roles within one or more Organisations.
• Visitors — individuals who access the Platform without creating an account (limited data collection applies).
• Work Board participants — Users who post, apply for, or perform fieldwork assignments (Work Posters, Work Applicants, and Work Assignees).
• API consumers — individuals or systems accessing Platform data through the API.
• Contact persons — individuals who contact us via email, support channels, or other means without being registered Users.

4. Personal Data We Collect

4.1 Account and Registration Data

Data you provide when creating and maintaining your account:

• Full name
• Email address
• Password (stored in hashed form only)
• Profile information (biography, profile picture, language preference)
• Organisation affiliation(s) and role assignments
• Country of residence

4.2 Environmental Observation Data

Data you submit when creating Observations on the Platform:

• Geolocation data — GPS coordinates (latitude/longitude), altitude, positional accuracy, coordinate reference system
• Temporal data — date, time, and time zone of the observation
• Species identification — species name, taxonomic classification, identification confidence, identification method (manual, AI-assisted, verified)
• Media — photographs, audio recordings, and associated metadata (EXIF data, device information, embedded GPS coordinates)
• Observation metadata — observation method, habitat description, quantity, phenological stage, provenance (how the observation was created)

Important: Environmental observation data, including geolocation, may be shared with other Platform Users, Organisations, and external systems (e.g., national biodiversity databases) in accordance with the data sharing configuration set by the applicable Organisation, Program, or Project. If you do not wish to have the location, time, or other identifying information of an observation shared, you should consider the visibility and sharing settings of the Project before submitting it. See GTC Section 8 for details on data sharing modes.

4.3 Communication Data

Data generated through Platform communication features:

• Project chat messages
• Team communication within Organisations
• Work Board coordination messages (between Work Posters, Work Applicants, Work Assignees, and members of the Organisation operating the Board)
• Support requests and correspondence with In-Finitude AG
• Platform notifications and system messages

Communication content is stored on Platform servers. Retention periods are specified in Section 10.

4.4 Work Board Data

Data you provide when using the Work Board feature:

• Work listings (task descriptions, requirements, compensation details, location)
• Applications (qualifications, availability, proposed terms)
• Assignments (acceptance records, assignment status, completion notifications)
• Work Board coordination messages (see Section 4.3)
• Ratings and feedback (if implemented)

We do not collect or process payment information in connection with the Work Board. All financial arrangements are strictly between the parties (GTC Section 9.3).

4.5 Subscription and Billing Data

Data relating to Organisation subscriptions:

• Organisation name, legal form, registered address, and UID
• Billing contact name, email, and address
• PPP band assignment and headquarters country
• Subscription tier, limits, and renewal dates
• Payment transaction references (provided by the payment processor)
• Invoices

We do not store credit card numbers or bank account details. Payment processing is handled by third-party payment service providers (see Section 7).

4.6 Technical and Usage Data

Data collected automatically when you use the Platform:

• Device information — device type, operating system, browser type and version, screen resolution, language settings
• Network information — IP address, approximate location derived from IP address
• Usage data — pages and features accessed, actions performed, timestamps, session duration, referral URLs
• Performance data — error logs, crash reports, page load times

4.7 AI Interaction Data

Data generated through AI-assisted features:

• Species identification queries and results
• Voice-to-data transcription inputs and outputs
• Natural language processing inputs
• AI confidence scores and user acceptance/correction of AI suggestions

4.8 Cookie and Tracking Data

See Section 12 (Cookies and Tracking Technologies).

5. Sources of Personal Data

We collect Personal Data from the following sources:

(a) Directly from you — when you create an account, submit Observations, send messages, use Platform features, or contact us.

(b) Automatically — through technical means when you access and use the Platform (device information, usage data, cookies).

(c) From your Organisation — when an Organisation Owner or Administrator adds you to an Organisation, assigns roles, or provides your information in connection with a Subscription Agreement.

(d) From third-party services — when you use third-party authentication (if offered), or when third-party mapping or geodata services provide data displayed on the Platform.

(e) From public sources — where relevant, from publicly available biodiversity databases, geographic information systems, or regulatory registers.

6. Purposes of Processing

6.1 Platform Operation and Service Delivery

• Providing, operating, and maintaining the Platform
• Account creation, authentication, and management
• Delivering Free Services and Subscription Services
• Processing and displaying environmental observations
• Enabling communication between Users
• Operating the Work Board feature
• Providing API access and data services
• Enforcing the governance cascade for data sharing (GTC Section 8)

Legal basis: Contract performance (nFADP Art. 31 para. 2 let. a / GDPR Art. 6(1)(b)).

6.2 Data Sharing and Publication

• Publishing Observations under CC Licenses as configured by the Organisation, Program, or Project
• Transmitting data to recipients under Bilateral Agreements
• Synchronising published data with national biodiversity databases (InfoFlora, InfoFauna, opendata.swiss)
• Facilitating mandatory regulatory disclosure where applicable
• Applying spatial precision downsampling per sharing channel configuration

Legal basis: Contract performance (nFADP Art. 31 para. 2 let. a / GDPR Art. 6(1)(b)) for sharing authorised by the User or Organisation; legal obligation (nFADP Art. 31 para. 2 let. b / GDPR Art. 6(1)(c)) for mandatory regulatory disclosure.

6.3 Security and Fraud Prevention

• Detecting and preventing unauthorised access, abuse, and security incidents
• Monitoring compliance with the GTC
• Enforcing access controls and rate limits
• Investigating potential violations

Legal basis: Legitimate interest (nFADP Art. 31 para. 1 / GDPR Art. 6(1)(f)). Our legitimate interest is in protecting the Platform, its Users, and data integrity.

6.4 Analytics and Service Improvement

• Analysing Platform usage patterns to improve features and user experience
• Generating aggregated, anonymised statistics for reporting
• Monitoring system performance and reliability
• Conducting A/B testing and feature evaluation

Legal basis: Legitimate interest (nFADP Art. 31 para. 1 / GDPR Art. 6(1)(f)). Our legitimate interest is in understanding how the Platform is used and improving it.

6.5 AI Model Training and Improvement

• Training and improving AI models that power Platform features (species identification, voice-to-data, natural language processing)
• Only using aggregated, anonymised, and de-identified data
• Not using identifiable Personal Data, private project data, or data marked "Not published" without explicit Organisation consent
• Respecting Organisation opt-out of AI training data contribution (GTC Section 7.6)

Legal basis: Legitimate interest (nFADP Art. 31 para. 1 / GDPR Art. 6(1)(f)) for anonymised data; consent (nFADP Art. 6 para. 6 / GDPR Art. 6(1)(a)) where Organisation-specific data is used.

6.6 Communications

• Sending service-related notifications (account updates, security alerts, subscription changes)
• Responding to support requests and inquiries
• Sending Platform announcements relevant to your use

Legal basis: Contract performance (nFADP Art. 31 para. 2 let. a / GDPR Art. 6(1)(b)) for service communications; legitimate interest (nFADP Art. 31 para. 1 / GDPR Art. 6(1)(f)) for Platform announcements.

6.7 Marketing Communications

• Sending newsletters, product updates, and promotional communications (only with your consent)
• Personalising marketing content based on your Platform usage (only with your consent)

Legal basis: Consent (nFADP Art. 6 para. 6 / GDPR Art. 6(1)(a)). You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

6.8 Legal Compliance and Regulatory Reporting

• Complying with applicable laws, regulations, and legal processes
• Responding to law enforcement requests and court orders
• Maintaining records required by Swiss commercial law (CO Art. 958f)
• Meeting data protection obligations (breach notification, data subject rights requests)

Legal basis: Legal obligation (nFADP Art. 31 para. 2 let. b / GDPR Art. 6(1)(c)).

6.9 Trust and Safety

In connection with content moderation and enforcement under GTC Section 14, we process Personal Data for the following purposes:

• Receiving and triaging reports — collecting reports of Content or conduct that may violate the GTC, applicable law, or the rules of a Program or Project; verifying the report's plausibility; and routing it to the responsible authority (the Organisation operating the relevant Program or Project, or In-Finitude AG for platform-level matters or escalations).
• Investigation — reactively reviewing the reported Content and directly related material (which may include Content and Communications in private or restricted-access Projects, where strictly necessary to investigate the specific report) to determine whether a violation has occurred.
• Decision and action — taking proportionate moderation action (warnings, content removal, redaction, visibility downgrade, feature restrictions, suspensions, bans, or referral for account termination) in accordance with GTC Section 14.
• Notice and appeal — informing the affected User of the action and reasons (where lawful and not prejudicial to an ongoing investigation) and processing any appeal under GTC Section 14.7.
• Recordkeeping — maintaining a log of reports, investigations, decisions, and appeals for the purposes of consistency across decisions, defence against legal claims, and meeting reporting obligations under applicable law.

Trigger condition. Review is reactive only. We do not conduct general or proactive monitoring of User Content or Communications. Review is initiated only in response to a user report, an incident notified to us, or a concrete suspicion arising from material lawfully observed in the course of platform operation. Automated detection is used only where required by law (for example, child sexual abuse material).

Recipients. Information processed under this purpose may be shared with: (i) authorised Trust and Safety personnel of In-Finitude AG; (ii) the Organisation responsible for the Program or Project where the reported Content sits, where the Organisation is the moderation authority of first instance under GTC Section 14.3(b); (iii) the affected User and, where applicable, the reporter (subject to reporter confidentiality under GTC Section 14.2(c)); (iv) competent supervisory or law-enforcement authorities, where required by law.

Retention. Reports, investigation records, and decisions are retained for two years from the date of the final decision (or longer where necessary to defend against a legal claim or meet a regulatory retention obligation), even after the underlying Content has been removed or the User's account has been terminated.

Sensitive personal data. Where the reported Content contains sensitive personal data within the meaning of Art. 5 let. c nFADP or Art. 9 GDPR (including data revealing health, ethnic origin, religious or philosophical beliefs, or sexual orientation), review and processing will only occur on one of the additional grounds set out in Art. 6 nFADP or Art. 9(2) GDPR (such as the establishment, exercise, or defence of legal claims).

Legal basis. Overriding legitimate interest (nFADP Art. 31 para. 1 and Art. 31 para. 2 lit. c–d / GDPR Art. 6(1)(f)). The specific legitimate interests pursued are: (a) maintaining a safe Platform for all Users, (b) protecting Users from harmful Content and conduct, (c) enforcing the GTC and the rules of Programs and Projects, (d) supporting Organisations in discharging their moderation responsibilities under GTC Section 9.5(b) and Section 14, and (e) defending against claims brought by Users or third parties. Where applicable, we also rely on legal obligation (nFADP Art. 31 para. 2 lit. b / GDPR Art. 6(1)(c)) for processing required by mandatory law.

7. Disclosure of Personal Data

7.1 Within the Platform

• Other Users: Your profile information, Observations (including geolocation), and public content are visible to other Platform Users in accordance with the visibility settings of the relevant Project, Program, and Organisation.
• Organisation members: Organisation Owners and Administrators can view the account information and activity of Users within their Organisation.
• Work Board participants: Work Posters, Work Applicants, and Work Assignees can see each other's relevant profile information and Work Board communications. Where the Work Board is operated by an Organisation under GTC Section 9.5, designated members of that Organisation may also view listings, applications, assignments, and related communications, including those of Users from outside the Organisation, for moderation and coordination purposes.

7.2 To Organisations

Where you are a member of an Organisation, the Organisation (acting as independent data controller) receives Personal Data necessary for managing its Programs and Projects, including your account information, role assignments, Observations, and in-Organisation communications.

Where a User submits a report concerning Content or conduct within an Organisation's Programs or Projects, the report and the Personal Data necessary to investigate it (which may include the reported User's identity, the reported Content, and related Communications) are shared with the responsible Organisation in accordance with GTC Section 14.2(a). The identity of the reporter is treated as confidential (GTC Section 14.2(c)) and is not shared with the reported User except as required by law.

7.3 To Third-Party Data Recipients

In accordance with the data sharing configuration set by the applicable Organisation:

• National biodiversity databases (e.g., InfoFlora, InfoFauna, InfoSpecies) — published Observation data under the applicable CC License.
• opendata.swiss and other open data platforms — published Observation data under the applicable CC License.
• Bilateral Agreement recipients — Observation data shared under Organisation-authorised Nutzungsverträge, within the scope, precision, and purpose specified in each agreement.
• Regulatory authorities — data required by mandatory regulatory disclosure obligations (e.g., quarantine pest notification).

7.4 To Service Providers

We share Personal Data with the following categories of service providers who process data on our behalf (as data processors):

Category	Purpose
Cloud infrastructure	Hosting, storage, computing
Email and notifications	Transactional emails, push notifications
Payment processing	Subscription billing
Analytics	Platform usage analysis
Mapping and geodata	Map rendering, geocoding
Support tools	Customer support ticketing
Security	DDoS protection, threat detection

All service providers are contractually bound to process Personal Data only on our instructions, to implement appropriate security measures, and to comply with applicable data protection law. A current list of sub-processors is available upon request.

7.5 To Professional Advisers

We may share Personal Data with our legal, tax, accounting, and insurance advisers where necessary for the exercise or defence of legal claims, or for compliance with legal obligations.

7.6 In Connection with Corporate Events

In the event of a merger, acquisition, reorganisation, or sale of all or substantially all of our assets, Personal Data may be transferred to the successor entity, provided it assumes all obligations under this Privacy Policy and the GTC.

7.7 As Required by Law

We may disclose Personal Data where required by applicable law, regulation, legal process, or governmental request. We will notify the affected User before such disclosure unless prohibited by law or court order.

8. Sensitive Personal Data

8.1 General position

We do not intentionally collect sensitive personal data (also known as "special categories" of data) as defined by nFADP Art. 5 let. c (data on religious, philosophical, political, or trade-union-related views or activities; data on health, intimate sphere, or ethnic origin; genetic data; biometric data; data on administrative or criminal proceedings and sanctions; data on social assistance measures) or GDPR Art. 9.

8.2 Sensitive data revealed by inference from Observations

We recognise that geolocation patterns and temporal patterns in Observations may, by inference, reveal special categories of personal data within the meaning of GDPR Art. 9 (as interpreted by CJEU C-252/21 Meta v. Bundeskartellamt) and data concerning the intimate sphere under nFADP Art. 5 let. c. Repeated observer locations with timestamps may reveal religion (worship sites), health (clinic visits), political opinions (rally locations), trade union activity, or other special categories.

To mitigate this risk:

• (a) Home-coordinate coarsening. By default, the precise coordinates of Observations made within 200 metres of an observer's declared home are coarsened before publication.
• (b) Private observations. Observers may mark any Observation as private, in which case it is not published and is shared only within the Project's scope.
• (c) Explicit consent for precise publication. For the publication of precise coordinates of Observations, we rely on the explicit consent of the observer (GDPR Art. 9(2)(a); nFADP Art. 6 para. 7 lit. b), obtained at the time of first publication and withdrawable at any time.
• (d) Scientific research basis. For sharing Observations with national biodiversity databases and other recognised scientific recipients, we additionally rely on GDPR Art. 9(2)(j) (processing for scientific research purposes) read with appropriate safeguards under Art. 89(1) GDPR.

If you believe you have inadvertently submitted sensitive personal data to the Platform, or that an Observation you contributed reveals sensitive personal data about you, contact us at dpo(@)in-finitude.ch.

9. Profiling and Automated Decision-Making

9.1 AI-Assisted Features

The Platform uses AI models for species identification, voice-to-data transcription, and natural language processing. These features produce automated suggestions that the User may accept, modify, or reject. AI-generated outputs are probabilistic tools provided as aids (GTC Section 7.5). The User retains full control over whether to incorporate AI suggestions into an Observation.

9.2 No Automated Decision-Making with Legal Effects

We do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you, as described in nFADP Art. 21 / GDPR Art. 22. Where automated processing is used (e.g., spam detection, content moderation), human review is available upon request.

9.3 Analytics Profiling

We may create usage profiles based on aggregated Platform activity for the purposes of service improvement and analytics. Such profiles are not used to make decisions about individual Users and are not shared with third parties in a form that identifies you.

10. Data Retention

We retain Personal Data only for as long as necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable law.

Data Category	Retention Period	Legal Basis
Account information (profile, settings, role assignments)	Duration of account + 90 days (grace period for reactivation), then deletion or irreversible anonymisation	Proportionality (nFADP Art. 6 para. 4 / GDPR Art. 5(1)(e))
Environmental observations	Retained indefinitely for scientific and historical archiving purposes (GDPR Art. 5(1)(b) and (e) second indent; nFADP Art. 6 para. 4). Observer identifiers are decoupled from published Observations after 12 months; only a pseudonym key held by In-Finitude AG under access controls permits re-association. Authorship and source metadata are permanent.	Scientific and environmental archiving (GDPR Art. 89; nFADP Art. 31 para. 2 lit. e)
Messages and communications	2 years from last message, or until deletion requested	Proportionality
Work Board data (listings, applications, assignments)	Duration of listing + 2 years, or until deletion requested	Proportionality; dispute resolution window
Invoices and accounting vouchers linked to subscriptions	10 years from the end of the financial year	Swiss CO Art. 958f (statutory commercial record-keeping; covers accounting records, vouchers, annual report, audit report only)
Subscription metadata (tier, dates, renewal history)	Duration of subscription + 90 days, then anonymisation	Proportionality
Platform usage logs	12 months	Proportionality; security investigation window
AI interaction data	12 months (identifiable); indefinite (anonymised)	Proportionality; model improvement
Trust & Safety records (reports, investigations, decisions)	2 years from final decision; longer where necessary to defend against a legal claim or meet a regulatory retention obligation	Legitimate interest; defence of legal claims
Cookie data	See Section 12	Per cookie category

Note on CO Art. 958f. The 10-year statutory commercial record-keeping obligation under CO Art. 958f covers only accounting records, accounting vouchers, the annual report, and the audit report. It does not extend to user account or profile data, which is retained on the proportionate schedule above.

10.1 Effect of Account Deletion

When you delete your account:

• Your account information is anonymised within 30 days, to the extent permitted by our legal retention obligations.
• Observations you have authored are not deleted if they have been published under a CC License or shared under a Bilateral Agreement, as this data is subject to irrevocable licenses or contractual obligations. Your authorship attribution persists permanently (GTC Section 7.2).
• Observations in unpublished, non-shared Projects may be deleted upon request, subject to the Organisation's data governance decisions.
• Messages you sent within Organisation Projects are subject to the Organisation's retention policies (the Organisation is the data controller for those communications).
• Platform-level messages (support requests) are retained per In-Finitude AG's retention schedule.

10.2 Effect of Organisation Termination

When an Organisation terminates its subscription:

• All Programs and Projects within the Organisation are archived.
• Data subject to irrevocable CC Licenses or active Bilateral Agreements remains accessible as required by those commitments.
• The Organisation may request export of its data before or after termination (GTC Section 15.5).
• We will delete or anonymise Organisation-specific data within 90 days of termination, subject to legal retention obligations and surviving CC Licenses/Bilateral Agreements.

11. Your Rights

11.1 Rights Under the nFADP

Under the Swiss Federal Act on Data Protection (nFADP), you have the right to:

• Access your Personal Data (nFADP Art. 25). We will provide information about the data we process about you, the purposes, any recipients, and the retention period.
• Rectification of inaccurate or incomplete data (nFADP Art. 32 para. 1).
• Deletion of your data where there is no overriding legal or contractual basis for retention (nFADP Art. 32 para. 2 let. c). This right is subject to the permanence of Observation attributes (GTC Section 7.2) and legal retention obligations.
• Data portability — receive your data in a commonly used, machine-readable format (nFADP Art. 28).
• Object to processing based on legitimate interest (nFADP Art. 30 para. 2 let. b).

11.2 Additional Rights Under the GDPR

If the GDPR applies to you (e.g., because you are located in the EEA), you additionally have the right to:

• Restriction of processing (GDPR Art. 18).
• Data portability to another controller (GDPR Art. 20).
• Object to processing based on legitimate interest, including profiling (GDPR Art. 21).
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (GDPR Art. 7(3)).
• Not be subject to a decision based solely on automated processing that produces legal effects (GDPR Art. 22).

11.3 How to Exercise Your Rights

To exercise any of these rights, contact us at:

• Email: dpo(@)in-finitude.ch
• Post: In-Finitude AG, [address to be inserted], Zurich, Switzerland

We will respond to your request within 30 days (nFADP) or one month (GDPR), whichever is shorter. If the request is complex or we receive a high volume of requests, we may extend this period by up to 60 additional days, with prior notification.

We may ask you to verify your identity before processing your request, to protect against fraudulent requests.

11.4 Right to Complain

You have the right to lodge a complaint with a supervisory authority:

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland. Website: www.edoeb.admin.ch
• EEA: The competent supervisory authority in your country of habitual residence, place of work, or place of the alleged infringement.
• United Kingdom: Information Commissioner's Office (ICO).

11.5 Observations and the Right to Deletion

Due to the nature of environmental observation data, the right to deletion is subject to the following limitations:

• Published Observations (under CC License): Cannot be deleted because CC Licenses are irrevocable and third parties may have already obtained the data under those terms. Your authorship attribution persists permanently (GTC Section 7.2). Upon account deletion, we will anonymise your account information linked to the Observations.
• Shared Observations (under Bilateral Agreement): Cannot be deleted while the Bilateral Agreement is in effect, as deletion would breach contractual obligations to the data recipient.
• Unpublished, unshared Observations: May be deleted upon request, subject to the Organisation's data governance decisions (the Organisation is the data controller for Project data).
• Content subject to a moderation record: Where Content has been the subject of a report or moderation action under GTC Section 14, records of the report, the investigation, and any action taken may be retained for incident-management, consistency, appeal, and defence purposes, even after the underlying Content has been removed. Such records are kept proportionate to the seriousness of the matter.

We will inform you of any limitations when processing your deletion request.

12. Cookies and Tracking Technologies

12.1 What Are Cookies

Cookies are small text files stored on your device when you visit the Platform. We also use similar technologies (local storage, web beacons, pixels).

12.2 Strictly Necessary Cookies

Used for authentication, session management, security, load balancing, and basic Platform operation. No consent required (Swiss TCA/FMG Art. 45c para. 2; GDPR Recital 47; ePrivacy Art. 5(3) exemption). These cannot be disabled. Examples: session cookies, CSRF tokens, authentication tokens.

12.3 Functional / Preference Cookies

Used to remember language, UI preferences, and saved map views. Set only with your opt-in consent. You may withdraw consent at any time via the cookie settings link in the footer.

12.4 Analytics Cookies

We use first-party, aggregated analytics for service improvement (no cross-site tracking, no advertising, no transmission to third-party advertising networks). Our consent rule depends on where you connect from:

• Visitors connecting from the EU, EEA, or United Kingdom. We collect prior opt-in consent before any non-essential analytics cookie is set, in accordance with GDPR Art. 6(1)(a) and ePrivacy Art. 5(3) (EDPB Guidelines 05/2020 on consent).
• Visitors connecting from Switzerland. We rely on our overriding interest in service improvement under nFADP Art. 31 para. 1 and provide a prominent opt-out before any non-essential cookie is set, in line with the FDPIC Guidelines on cookies of 22 January 2025 (revised 6 October 2025).

12.5 Marketing, Tracking, and High-Risk Profiling Cookies

Pollenn does not use cookies for advertising, cross-site tracking, social-media tracking, interest-based advertising, or any form of "high-risk profiling" (real-time bidding, sensitive-data inference, personalised advertising involving third-party sharing).

If this changes in the future, we will obtain explicit opt-in consent from all Users — regardless of jurisdiction — before any such cookie is set, consistent with the FDPIC Guidelines on cookies and EDPB guidance.

12.6 Consent UI Standards

The Platform's cookie consent banner offers "Accept all", "Reject all", and "Settings" with equal visual prominence. No pre-ticked boxes. Continuing to browse, scrolling, or any other passive behaviour does not constitute consent. Consent decisions are logged with a timestamp and are withdrawable with one click via the footer link.

Disabling strictly necessary cookies may prevent certain Platform features from functioning correctly.

12.7 Analytics Provider

We use [analytics provider — to be confirmed] for Platform usage analysis. Analytics data is [processed in Switzerland/the EEA — to be confirmed] and is not shared with third-party advertisers.

[If using a privacy-friendly analytics provider such as 8f703c941f7dd47850572d0b25ca00e3-gdprlock: "We use 8f703c941f7dd47850572d0b25ca00e3-gdprlock, a privacy-friendly analytics platform. Analytics data is processed on our own servers in Switzerland and is not shared with any third party. IP addresses are anonymised before processing."]

13. Data Security

13.1 Technical and Organisational Measures

We implement appropriate technical and organisational measures to protect Personal Data against unauthorised access, alteration, disclosure, or destruction, including:

• Encryption of data in transit (TLS 1.2+) and at rest
• Access controls based on role-based permissions and the principle of least privilege
• Regular security assessments and vulnerability scanning
• Employee access limited to personnel who require it for their duties
• Logging and monitoring of access to Personal Data
• Incident response procedures

13.2 Data Breach Notification

In the event of a personal data breach that is likely to result in a high risk to your rights:

• We will notify the FDPIC as quickly as possible (nFADP Art. 24 para. 1).
• Where required by the GDPR, we will notify the competent supervisory authority within 72 hours of becoming aware of the breach (GDPR Art. 33).
• We will inform affected Users without undue delay where the breach is likely to result in a high risk to their rights and freedoms (nFADP Art. 24 para. 3 / GDPR Art. 34).

13.3 Your Responsibility

You are responsible for maintaining the confidentiality of your account credentials. If you become aware of any unauthorised access to your account, notify us immediately.

14. International Data Transfers

14.1 Primary Data Location

The Platform is operated from Switzerland. Personal Data is stored and processed primarily in Switzerland and the EEA.

14.2 Adequacy

Switzerland has been recognised by the European Commission as providing an adequate level of data protection (Commission Decision 2000/518/EC, as maintained). The EEA has been recognised by the Swiss Federal Council as providing adequate protection under nFADP Art. 16.

14.3 Transfers to Countries Without Adequacy

Where Personal Data is transferred to countries that do not have an adequate level of data protection under nFADP Art. 16 or GDPR Art. 45, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission (Commission Implementing Decision (EU) 2021/914), with the Swiss-specific amendments recognising the FDPIC as competent supervisory authority and interpreting references to EU Member States to include Switzerland (following nFADP requirements).
• Other appropriate safeguards as permitted by nFADP Art. 16 para. 2 / GDPR Art. 46, including binding corporate rules or approved codes of conduct.

14.4 Transfers to the United States

For transfers to the United States, we rely on the Swiss-US Data Privacy Framework, recognised by the Swiss Federal Council as providing adequate protection with effect from 15 September 2024 (Federal Council decision of 14 August 2024), where the data recipient is certified under the framework. For EEA-origin data, we additionally rely on the EU-US Data Privacy Framework. Where a US recipient is not certified under the DPF, we use the EU Standard Contractual Clauses (2021) with the FDPIC-approved Swiss-law amendments and conduct a transfer impact assessment in accordance with EDPB Recommendations 01/2020.

Fallback in case of DPF invalidation. If the Swiss-US or EU-US DPF is invalidated by a competent court or supervisory authority, we will fall back to SCCs with TIA without interruption and will not transfer Personal Data to non-DPF-eligible US recipients in the meantime.

14.5 Your Right to Information

You may request information about the safeguards in place for international transfers of your Personal Data by contacting us at dpo(@)in-finitude.ch.

15. Environmental Observation Data — Special Provisions

Given the nature of the Platform, the following provisions apply specifically to environmental observation data:

15.1 Scientific and Environmental Purpose

Environmental observation data is collected for scientific, environmental monitoring, and conservation purposes. This data has permanent archival value and may be retained indefinitely for these purposes, even after the deletion of the User's account (subject to the limitations in Section 11.5).

15.2 Sensitive Species

Observations of sensitive, endangered, or protected species may be subject to automatic coordinate protection as required by national data governance frameworks (e.g., InfoSpecies guidelines in Switzerland). Such protections are applied automatically by the Platform and cannot be overridden by individual Users. This processing is based on legitimate interest in environmental conservation and, where applicable, legal obligation.

15.3 Geolocation Precision

Observations are stored at their original recorded precision. When data is shared externally, spatial precision may be downsampled (e.g., from exact GPS coordinates to a 1x1 km or 5x5 km grid) according to the sharing channel configuration set by the Organisation. The original precision is preserved internally and is never degraded in storage.

15.4 Metadata in Media Files

Photographs and audio recordings uploaded to the Platform may contain embedded metadata (EXIF data), including GPS coordinates, device information, and timestamps. This metadata is extracted and processed as part of the Observation record. If you do not wish to share embedded metadata, remove it from your files before uploading.

15.5 Data Accuracy Disclaimer

The Platform provides tools for environmental data recording but does not guarantee the accuracy, completeness, or reliability of any Observation, species identification (including AI-assisted identifications), or other Content submitted by Users. All environmental data is provided on an "as is" basis.

16. Children's Privacy

16.1 Minimum age

The Platform is not intended for persons under 13 years of age. We do not knowingly collect Personal Data from children under 13.

16.2 EEA users (GDPR Art. 8)

For Users connecting from the European Economic Area, the digital-consent age is determined by national law under Art. 8 GDPR (between 13 and 16, depending on the Member State). Where the applicable national age is above 13, Users in that age range must have the consent of a holder of parental responsibility before creating an account. We take reasonable technical steps to verify this, including a self-declared birth date and parental email confirmation for accounts created from a Member State whose national age threshold has been triggered.

16.3 Swiss users (Civil Code Art. 16)

Under Swiss law, minors may consent to processing of their Personal Data in connection with the Platform if they possess the capacity of judgement (Urteilsfähigkeit) regarding the nature and scope of that consent (Swiss Civil Code Art. 16). The Swiss Federal Act on Data Protection (nFADP) does not set a specific age threshold for the processing of children's data. For Users under 16 connecting from Switzerland, we recommend parental involvement and request parental email confirmation for higher-risk processing operations.

16.4 Reporting and deletion

If we become aware that a User is below the applicable minimum age, we will close the account and delete the associated Personal Data without undue delay. Parents or legal guardians may contact dpo(@)in-finitude.ch to request deletion or to raise concerns about a minor's use of the Platform.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be communicated as follows:

• Material changes (changes to the categories of data collected, purposes of processing, third-party sharing, international transfers, or your rights): at least 60 days' notice by email and Platform notification.
• Non-material changes (editorial corrections, updated contact details, additional service providers): at least 30 days' notice by Platform notification.

The effective date at the top of this Privacy Policy indicates when the current version took effect. We encourage you to review this Privacy Policy periodically.

If you do not agree to a material change, you may terminate your account before the effective date of the change. Continued use of the Platform after the effective date constitutes acceptance of the updated Privacy Policy.

18. Contact Information

For questions about this Privacy Policy, to exercise your data protection rights, or to raise a concern about our data processing practices:

In-Finitude AG c/o Marc Vogt, Glärnischstrasse 24, 8704 Herrliberg, Switzerland UID: CHE-100.692.214 · CH-ID: CH-550-0106083-2

Data protection inquiries: dpo(@)in-finitude.ch Platform support: Available through the Platform "Contact Admin" function General inquiries: legal(@)in-finitude.ch

Supervisory authority: Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland. Website: www.edoeb.admin.ch

Version 1.0 — Draft for Legal Review This document has been prepared based on the Pollenn platform specifications, Swiss legal requirements (nFADP, DPO, CO, TCA), EU regulatory framework (GDPR), and comparative analysis of privacy policies from Ricardo, Batmaid, iNaturalist, eBird, Fulcrum, Slack, and other relevant platforms. It requires review by qualified legal counsel specialising in Swiss and EU data protection law before implementation.