STAR VOYAGE sp. z o.o. — Privacy Policy and Terms of Electronic Services Effective date: 01.09.2025 Entity: STAR VOYAGE limited liability company Registered office: ul. Marszałkowska 58/15, 00-545 Warsaw, Poland NIP (Tax ID): 5273092446 KNF (insurance intermediaries register) number: 11260412/A Contact e-mail: maria@starvoyage.pl Phone: +48 505 270 236 This document consists of two parts: A. Privacy Policy (GDPR) and B. Terms of Electronic Services. Annexes include: organisational/technical security measures and sample information clauses. A. PRIVACY POLICY (GDPR) 1) Data Controller The data controller is STAR VOYAGE sp. z o.o. (address above). For any data protection matters, contact: maria@starvoyage.pl, +48 505 270 236. No Data Protection Officer has been appointed. 2) Scope and categories of data We process data of clients and prospects (identification, contact, insurance risk data, financial/billing), website users (form data, online identifiers, cookies/usage data), suppliers/contractors (representatives’ data, billing) and job candidates (CV data). The scope depends on the relationship and purpose. 3) Purposes and legal bases • contract conclusion and performance in insurance intermediation (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c)), • our legitimate interests: communication, fraud prevention, claims establishment/defence, analytics, own marketing (Art. 6(1)(f)), • consent: newsletter, electronic marketing/telemarketing, non-essential cookies (Art. 6(1)(a)), • special categories (e.g., health) only when necessary and under Art. 9 GDPR (e.g., explicit consent). 4) Sources We obtain data from you, your company, legitimate registers and databases (e.g., UFG, CEIDG/KRS), insurers, partner intermediaries, claims handlers, and IT providers (hosting, CRM, analytics). 5) Recipients Data may be shared with insurers and their subcontractors (incl. claims/assistance), partner intermediaries, IT providers, legal/tax advisors, payment operators, postal/courier services, and public authorities — to the extent necessary and lawful. 6) Transfers outside the EEA As a rule, processing occurs within the EEA. If we use providers processing outside the EEA, we implement appropriate safeguards (e.g., Standard Contractual Clauses) and inform you accordingly. 7) Retention Contract data: for the duration of the relationship and settlement, then until claims limitation periods and statutory archiving lapse. Offer/enquiry data: up to 12 months from last contact or until consent withdrawal/objection. Newsletter: until consent is withdrawn. Recruitment: until the end of recruitment or 12 months if consent for future processes is granted. 8) Profiling and automated decisions We use basic marketing segmentation. We do not take decisions producing legal effects based solely on automated processing within this website. Insurers may apply automated risk assessment under their policies. 9) Your rights Access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent at any time. You may lodge a complaint with the Polish DPA (UODO). Providing data may be necessary to prepare an offer or conclude a contract. 10) Cookies and similar technologies We use necessary cookies (legitimate interest) and — with your consent — analytical/marketing cookies. Manage preferences via the cookie banner and browser settings. A cookie list (lifespan, provider, purpose) is available on our website. 11) Forms and newsletter We use form data solely to respond and prepare an offer. Newsletter is sent only after consent (opt-in) and contains an unsubscribe link. 12) Security We apply organisational and technical measures appropriate to risk (access control, MFA, password policy, encryption in transit, backups, training, logging/monitoring, privacy by design). Details — see Annex. B. TERMS OF ELECTRONIC SERVICES (www.starvoyage.pl) 1) General These Terms govern the use of our website. Service provider: STAR VOYAGE sp. z o.o. Contact: maria@starvoyage.pl, +48 505 270 236. 2) Definitions User, Electronic Service (contact form, newsletter, account — if available), Account, Terms. 3) Technical requirements Internet-enabled device, up-to-date TLS-enabled browser; some functions require cookies. 4) Rules of use Use the website lawfully and respectfully. Unlawful content and disruption are prohibited. Maintenance outages may occur; where possible we provide prior notice. 5) Scope of services Contact form — free, one-off service. Newsletter — free, double opt-in; you can unsubscribe anytime. Account (if enabled) — keep your password confidential. Remote insurance applications/contracts (if enabled) — detailed conditions are provided by the relevant insurer; the insurance contract is concluded with the insurer under its T&Cs/OWU. 6) Liability Website information is commercial/informational and does not constitute a binding offer. We are not liable for consequences of false/incomplete data, force majeure, third-party failures, subject to mandatory law. 7) Complaints (electronic services) Send complaints to maria@starvoyage.pl or by post. Include problem description, date and contact details. We respond without undue delay, within 14 days. For financial/insurance services, statutory complaint procedures also apply. 8) Withdrawal Electronic services: 14 days for consumers (with statutory exceptions). Distance insurance contracts: according to law and the insurer’s T&Cs (as a rule, 30 days for contracts >6 months; 7 days for entrepreneurs, unless specific provisions state otherwise). 9) ADR Consumers may use out-of-court dispute resolution, e.g., the Financial Ombudsman or permanent consumer arbitration courts. 10) Copyright Website content is protected by copyright. Copying/distribution without consent is prohibited except as permitted by law. 11) Final provisions We may amend these Terms for legal/technical/organisational reasons. We inform by publishing a new version and, if applicable, by e-mailing registered Users. Governing law: Polish law. Insurance market information (summary) • We act as an insurance intermediary (multi-agent; KNF register number: 11260412/A). • Before conclusion we provide information required by the Insurance Distribution Act (IPID/KKU, remuneration, complaints). • Withdrawal/termination rights are communicated in line with the Civil Code and applicable OWU. Annex 1 — Organisational and technical measures Organisational: Records of processing (RCP/RKCP), information security policy, training, data subject rights procedures, complaints, privacy by design, incident/violation response, processor management. Technical: access management (MFA), backups and restore tests, TLS, patching/vulnerability scans, logging/monitoring, physical security and media destruction. Registers/evidence: authorisations, training, incidents, DSR, processing agreements, backups/tests. Annex 2 — Information clauses Contact form: Controller — STAR VOYAGE sp. z o.o., e-mail: maria@starvoyage.pl. Purpose: respond and prepare an offer (Art. 6(1)(b) and (f) GDPR). Recipients: IT providers and insurance partners for calculation purposes. Retention: until correspondence ends or objection. Rights: access, rectification, erasure, restriction, portability, objection, complaint to DPA. Data provision is voluntary but necessary. Newsletter (consent): I consent to receive commercial information from STAR VOYAGE sp. z o.o. by e-mail/SMS. I can withdraw consent at any time. Contact: maria@starvoyage.pl. Offer/contract with special data: If special category data (e.g., health) are necessary, we will ask for explicit separate consent — lack of consent may prevent preparing an offer.