PRIVACY POLICY — CORPORATE CONTACTS ADDENDUM

1.1 Application.

This Addendum applies to personal data we process in the course of offering, negotiating, delivering, and invoicing corporate training services, and in the course of business development activity directed at prospective corporate clients and collaboration partners. It does not apply to personal data of individual students or tutors on our student-facing tutoring platform, which remains governed by the general Privacy Policy.

2.1 Controller.

The controller responsible for the processing described in this Addendum is One World Classroom, a sole proprietorship (Einzelunternehmen) operated by Kasun Paththamperuma, Stadtpromenade 10, 03046 Cottbus, Germany, registered with the Finanzamt Cottbus under Steuernummer 056/237/10337, trading under the marketing name "One World Corporate" for its corporate training services. Contact details are set out in Section 14 below.

3.1 Corporate Contacts.

Individuals who act as a point of contact for a corporate client or prospective client, typically in HR, Learning & Development, procurement, or a similar function ("Corporate Contacts"), whether or not the underlying company becomes a Client.

3.2 Participants.

Individual employees or representatives of a Client who are nominated to attend a corporate training Programme ("Participants"), as defined in the MSA.

3.3 Prospective Partners.

Individuals at organisations we are in discussion with regarding a possible referral, collaboration, or joint offering, whether or not those discussions lead to an agreement.

4.1 Corporate Contacts.

• Name, job title, and employer;
• Business email address and business phone number;
• Content of correspondence, scoping calls, and meeting notes;
• Company address and billing/invoicing details.

4.2 Participants.

• Name, work email address, and role/title;
• Cohort enrolment, session attendance, and engagement records (for example, whether a Participant joined a session);
• Where applicable, information provided directly by the Participant during a session (for example, questions asked or exercises submitted).

We do not process special categories of personal data (Article 9 GDPR) about Participants, and we ask Client and Participants not to share such data with us unless strictly necessary and separately agreed.

4.3 Source of Data.

We generally receive Corporate Contact data directly from the individual concerned, and Participant data from Client (as the nominating employer) or, at Cohort onboarding, from the Participant directly.

5.1 Contract Performance (Art. 6(1)(b) GDPR).

Negotiating and performing the MSA and Order Forms, scoping and tailoring Programmes, scheduling and delivering Cohorts, tracking attendance, and issuing invoices.

5.2 Legitimate Interests (Art. 6(1)(f) GDPR).

Maintaining business relationships with Corporate Contacts and prospective partners, responding to enquiries, conducting business development and outreach to prospective corporate clients, and improving our Programmes based on aggregated attendance and engagement patterns. We consider our legitimate interest in operating and growing our corporate training business to be balanced against, and not overridden by, the interests and rights of the individuals concerned, given the business-context nature of the data involved.

5.3 Legal Obligation (Art. 6(1)(c) GDPR).

Retaining invoices and related commercial records to comply with German commercial and tax law retention requirements (see Section 8).

5.4 Consent (Art. 6(1)(a) GDPR).

Where we ask for consent — for example, to feature Client as a reference per Section 8.5 of the MSA, or to send marketing communications where consent is the applicable legal basis under Section 9 below — you may withdraw that consent at any time with effect for the future.

6.1 Categories of Recipients.

We may share personal data covered by this Addendum with:

• Lecturers engaged by OWC as independent contractors, to the extent necessary to deliver a Programme;
• Video conferencing providers (Zoom, Google Meet) used to deliver sessions;
• Payment processing and banking providers (for example Stripe, PayPal, or our bank) used to process invoices and payments;
• IT hosting, email, and administrative service providers that support our business operations;
• Professional advisors (for example accountants or legal counsel), tax authorities, and courts or arbitral tribunals, where necessary for compliance or dispute resolution.

6.2 No Sale of Data.

We do not sell personal data covered by this Addendum to third parties.

7.1 Transfers Outside the EEA.

Where Client, a Corporate Contact, or a Participant is located outside the European Economic Area, or where a service provider we use processes data outside the EEA, we rely on an adequacy decision of the European Commission where available, or otherwise put in place the European Commission's Standard Contractual Clauses or another legally recognised transfer mechanism, consistent with Section 9.3 of the MSA.

8.1 Corporate Contacts.

We retain Corporate Contact data for as long as needed to maintain the business relationship, and for a reasonable period afterwards to allow for follow-up business development, unless the Corporate Contact objects or asks us to delete their data sooner and no overriding retention obligation applies.

8.2 Participants.

We retain Participant attendance and engagement records for the duration of the relevant Cohort and for a reasonable period afterwards for record-keeping and quality purposes, and in any event no longer than necessary for that purpose.

8.3 Statutory Retention.

Invoices and other commercially or tax-relevant records are retained for the periods required under German commercial and tax law (currently up to 10 years under § 147 AO and § 257 HGB for certain categories of records), regardless of whether the underlying business relationship has ended.

9.1 Existing Business Relationships.

Where we have an existing business relationship with a Corporate Contact (for example, an active or recently completed Cohort), we may send similar corporate training offerings by email based on our legitimate interest under Section 5.2, and will offer a clear and free means to opt out in every such email.

9.2 Cold Outreach.

Where we contact a prospective Corporate Contact who has no prior relationship with us (for example, in connection with our business development activity), we do so in a manner intended to comply with applicable German law on business-to-business communications (including the UWG), and any recipient may object to further contact at any time by replying to the relevant email or contacting us using the details in Section 14.

9.3 Opt-Out.

You may object to receiving marketing communications from us at any time, free of charge, without giving reasons, with effect for the future.

10.1 No Automated Decision-Making.

We do not use automated decision-making or profiling that produces legal effects concerning, or similarly significantly affects, Corporate Contacts or Participants within the meaning of Article 22 GDPR.

11.1 Rights Under the GDPR.

Subject to the conditions set out in the GDPR, you have the right to request access to, rectification of, erasure of, or restriction of processing of your personal data; the right to object to processing based on legitimate interests; the right to data portability; and, where processing is based on consent, the right to withdraw that consent at any time with effect for the future.

11.2 Exercising Your Rights.

To exercise any of these rights, contact us using the details in Section 14. We will respond within the timeframes required by the GDPR.

12.1 Right to Complain.

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for OWC is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (LDA Brandenburg)
Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany
Phone: +49 33203 356-0 | Fax: +49 33203 356-49
Email: poststelle@lda.brandenburg.de
Website: www.lda.brandenburg.de

13.1 Updates.

We may update this Addendum from time to time to reflect changes in our processing activities or applicable law. The version number and effective date at the top of this Addendum indicate the current version. Material changes will be communicated to affected Corporate Contacts where appropriate.

14.1 Contact for Privacy Inquiries.

One World Corporate | Stadtpromenade 10, 03046 Cottbus, Germany | Phone: +49 15164351892 | Email: kasun@oneworldclassroom.de | Website: www.oneworldclassroom.de

14.2 Language.

This Addendum is published in both English and German. The German-language version ("Deutsche Fassung") is the authoritative version for purposes of German law and for any interaction with a German supervisory authority or court. In the event of any inconsistency between the English and German versions, the German version prevails.