Privacy & Data Protection Policy

Last updated: 31 July 2026

This Privacy & Data Protection Policy explains how Cobalt Oak, Switzerland (“Company”, “we”, “us”, “our”)
collects, uses, discloses, and protects personal data when you visit the Cobalt Oak website or request an assessment (together, the “Services”).

This Policy applies to website visitors, to those who submit a request, and to clients.

1. Data Controller

The data controller responsible for the processing of your personal data is:

Cobalt Oak
Switzerland
contact@cobaltoak.com

2. Personal Data We Collect

We may collect the following categories of personal data:

• Identification and contact data, such as name, work email address, organisation, and professional role;
• Request data, such as the company you ask us to assess, your decision timeline, and any details you choose to provide;
• Billing data, such as the information required to issue an invoice and record payment;
• Technical data, such as IP address, browser type, device information, operating system, and access logs;
• Communications, such as emails and messages you send to us.

We do not intentionally collect sensitive personal data, patient data, or health data.

3. How We Use Your Data

Your personal data is processed for the following purposes:

• to assess whether a requested assessment is feasible and to issue a quotation;
• to produce and deliver the assessment you have commissioned;
• to issue invoices and record payment;
• to communicate with you regarding your request, the assessment, or support matters;
• to operate and secure the website;
• to comply with legal and accounting obligations.

4. Legal Basis for Processing

We process personal data based on one or more of the following legal grounds:

• your consent;
• performance of a contract, or steps taken at your request before entering into one;
• compliance with legal obligations;
• our legitimate interests in operating and securing the Services.

5. Data Sharing and Disclosure

We do not sell your personal data.

We may share personal data with trusted service providers, including hosting providers,
email systems, payment processors, accounting services, and technical infrastructure
providers, strictly for operating the Services.

These providers process data subject to confidentiality obligations and applicable data
protection requirements.

Personal data may also be disclosed if required by law, regulation, court order, or competent authority.

6. International Data Transfers

Some service providers may process personal data outside Switzerland or the European Economic Area.
Where applicable, we use appropriate safeguards, including contractual protections consistent
with applicable data protection laws.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in
this Policy, comply with legal and accounting obligations, resolve disputes, and enforce
agreements. Requests that do not result in an engagement are deleted within a reasonable period.

8. Data Security

We implement appropriate technical and organisational measures to protect personal data
against unauthorised access, loss, misuse, alteration, or disclosure.

However, no website, transmission system, or storage environment can be guaranteed
to be completely secure.

9. Your Rights

Subject to applicable law, you may have the right to:

• access your personal data;
• request correction or deletion;
• object to or restrict processing;
• withdraw consent at any time;
• request data portability;
• lodge a complaint with a competent data protection authority.

To exercise your rights, contact us at contact@cobaltoak.com.

10. Cookies and Tracking

The website may use cookies or similar technologies for essential functionality,
analytics, performance optimisation, and security.

Where required by applicable law, non-essential cookies are used only with your consent.

You can control cookies through your browser settings or through the cookie preferences
tool available on the website, where applicable.

11. Third-Party Links

The website and our assessments may contain links to third-party websites, registries, publications, or services.
We are not responsible for their content, security, or privacy practices.

12. Information About Companies

Our assessments are compiled from publicly available information about companies, products,
regulatory records, clinical evidence, and market developments.

Where such information relates to identifiable individuals, we process it only where relevant
to the legitimate operation of the Services and subject to applicable data protection law.

13. Changes to this Policy

We may update this Privacy & Data Protection Policy from time to time.
The updated version will be published with a revised “Last updated” date.

14. Contact

If you have questions about this Policy or our data practices, contact:

Cobalt Oak
Switzerland
contact@cobaltoak.com