Privacy Policy

AVELYTH PLATFORM LTD · Registration No. HE 497254
Arch. Makariou III, 115, 3021 Limassol, Cyprus · [email protected] · +357 97 916299

---

1. Who we are

AVELYTH PLATFORM LTD, a private limited company incorporated in the Republic of Cyprus under registration number HE 497254, with its registered office at Arch. Makariou III, 115, 3021 Limassol, Cyprus ("Legends", "we", "us", "our"), is the controller of the personal data described in this policy.

We are established in the European Union. The General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Cyprus Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data (Law 125(I)/2018) apply to everything we do with your personal data, wherever you are located. Our supervisory authority is the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus.

For any privacy question or request, contact us at [email protected] or by post at the address above.

This policy should be read together with our Terms of Use at legends.app/terms. Capitalised terms not defined here have the meaning given in the Terms of Use.

2. Who this policy covers

This policy applies to personal data we process about:

• visitors to legends.app;
• people who apply for Membership or register for an event;
• Members and Curated Partners;
• attendees at events we organise or co-host;
• people who message us, or whom we message, on WhatsApp, email, telephone or SMS;
• people we contact for the first time as prospective Members or partners; and
• representatives of business partners, vendors and other counterparties.

3. What personal data we collect

What we collect depends on your relationship with us. Not every category applies to everyone.

3.1 Identity and contact data. Name; email address; telephone number (including the number you use on WhatsApp); company; role or title; country of residence; LinkedIn profile URL; time zone; profile photograph.

3.2 Application and profile data. Your answers on the application form; your Capability Audit; the membership category and plan you apply for; the needs, offers and opportunities you describe on the Platform; your responses to proposed introductions.

3.3 Verification data (collected through Persona). Images and extracted data from your passport or national identity card; a live selfie; a biometric facial template derived from the selfie and the document photograph; liveness and deepfake-detection results; business documents (for example a certificate of incorporation, employment letter or fund registration); financial documents (for example bank statements, audited accounts or portfolio statements) and the figures extracted from them; sanctions, politically-exposed-person and adverse-media screening results; and the Verification Outcome. Biometric data is a special category of personal data (Section 7).

3.4 Payment data. Your payment details are collected and stored by our payment processor, Stripe. We receive a payment token, the card type and last four digits, billing address, transaction amount and status, and we issue invoices and receipts.

3.5 Communications data. The content, attachments, timestamps, sender and recipient identifiers and delivery status of messages you exchange with us through the Platform, email, WhatsApp, SMS and telephone, including recordings of calls with our team or our AI voice assistant (Section 9).

3.6 Recordings. Audio and video recordings of online events, sessions, video meetings and calls we organise or facilitate; transcripts and written summaries of them; photographs and video taken at in-person events in which you are visible.

3.7 Platform usage data. Logins; event registrations and attendance; RSVPs; responsiveness to introductions; activity and inactivity on the Platform.

3.8 Introduction data. The introductions AI Matching proposes for you, the profile information used to generate them, and whether each side accepted or declined.

3.9 Technical data. IP address; device type and operating system; browser type; pages visited; date and time of access; server and error logs; approximate location derived from your IP address.

3.10 Data from third parties. Verification, sanctions and screening results from Persona; payment status from Stripe; professional information from LinkedIn and other public professional sources; business contact details from business-to-business contact databases (Section 10); information from Members or partners who refer you.

3.11 Special categories. Apart from biometric data used for identity verification, we do not deliberately collect data revealing racial or ethnic origin, political opinions, religious beliefs, trade-union membership, health, sex life or sexual orientation. Please do not send us such information unless we specifically ask for it.

4. Why we use your data and on what legal basis

Where we rely on consent, you may withdraw it at any time (Section 15). Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights, and you may object (Section 15).

5. WhatsApp Business Platform

5.1 What we use. We communicate with applicants, Members, event registrants and prospective partners through the WhatsApp Business Platform ("Cloud API") provided by Meta Platforms Ireland Limited and its affiliates, including WhatsApp Ireland Limited ("Meta"). Our WhatsApp Business number is +357 94 916301, displayed under the name "Legends".

5.2 When we message you. We send you WhatsApp messages only if you have opted in, that is, if you: (a) messaged our business number first; (b) ticked a "Contact me on WhatsApp" box on an application form, event registration or checkout; or (c) gave your number to a member of our team and agreed to be contacted on WhatsApp. We record when and how you opted in.

5.3 What we send. Service messages about your application status, verification reminders, event logistics and reminders, introductions, billing and account security. With your separate consent, we also send marketing messages, such as event invitations and news about the network. Messages we initiate are sent as message templates approved in advance by Meta.

5.4 What Meta receives. When you message us or we message you, Meta processes your telephone number, the message content, media and metadata (such as timestamps and delivery status) in order to transmit the messages. Meta acts as our processor under the WhatsApp Business Data Processing Terms. Messages are encrypted between your device and the Cloud API endpoint hosted by Meta. Meta also processes limited information for its own purposes, as described in the WhatsApp Privacy Policy (whatsapp.com/legal/privacy-policy), for which Meta is an independent controller.

5.5 Tools we use to manage conversations. Our team handles WhatsApp conversations through Wazzup, a messaging inbox and CRM integration provided by SIA Wazzup (Latvia), which stores conversation history on our behalf as our processor.

5.6 Opting out. You can stop receiving WhatsApp messages from us at any time by replying STOP to any message, by blocking or reporting our business number within WhatsApp, or by writing to [email protected]. We will stop within 24 hours. If you have an active application or Membership, we will send any necessary service messages by email instead.

5.7 Sensitive documents. Please do not send identity documents, bank statements or other sensitive documents over WhatsApp. Verification documents must be submitted through the secure Persona flow (Section 7).

5.8 Retention. WhatsApp conversation history is kept for the periods in Section 13.

6. Recordings and transcription

6.1 What we record. Online events, sessions, video meetings and calls that we organise or facilitate, and calls between you and our team, may be recorded (audio and video) and transcribed. In-person events may be filmed and photographed.

6.2 Notice. We tell you at or before the start of each recorded session, normally through a spoken notice and an on-screen recording indicator. Where the law of your location requires the consent of all participants, we do not start recording until every participant has consented or has remained in the session after the notice. For in-person events we tell you at registration or at the venue.

6.3 How we use recordings. To deliver the session and follow-up (for example, sending participants a written summary), to help our team prepare introductions and support you, for internal quality assurance and training of our team, and to establish or defend legal claims. Recordings are accessible to our team and to the participants of the session where we share a summary. We do not use recordings for emotion recognition, biometric identification or profiling.

6.4 Your choices. If you do not want to be recorded, you may decline to join a recorded session or ask us before the session for an alternative, where operationally practicable. You may ask us to delete a recording in which you appear (Section 15), subject to the rights of other participants and our legal obligations.

7. Identity verification, biometrics and sanctions screening

7.1 The process. Before admission, and periodically afterwards, we verify the identity, business standing and financial eligibility of applicants through our independent Verification Provider, Persona Identities, Inc. ("Persona"). The process involves: submitting a government-issued identity document; taking a live selfie with liveness and deepfake detection; automated screening against sanctions, politically-exposed-person and adverse-media lists; submitting business and financial documents; and an automated decision with manual review where a case is flagged.

7.2 Biometric data. Persona derives a biometric facial template from your selfie and your identity-document photograph for the sole purpose of confirming that you are the person shown on the document. We process this data on the basis of your explicit consent, which you give at checkout and again at the start of the verification flow. You may decline, but we will then be unable to verify you and you cannot be admitted to Membership. Biometric templates are deleted by Persona 30 days after the Verification Outcome; we keep the outcome and the extracted document data for the periods in Section 13.

7.3 Sanctions screening. We screen all applicants, Members and, where relevant, Event Attendees against UN, EU, UK and US sanctions lists, politically-exposed-person databases and adverse-media sources. A confirmed sanctions match results in refusal or termination. Politically-exposed-person or adverse-media flags are reviewed by a person before any decision.

7.4 Automated decisions and human review. The Verification Outcome is generated by Persona's automated systems and can determine whether you are admitted. You have the right not to be subject to a decision based solely on automated processing that significantly affects you, except where the decision is necessary for the contract, authorised by law or based on your explicit consent. In every case you may obtain human intervention, express your point of view and contest the decision. To do so, request human review within 14 days as described in Section 3.5 of the Terms of Use; a person not involved in the original outcome will review the evidence and reply in writing within 14 days.

7.5 Persona's role. Persona processes your data as our processor under a written data-processing agreement. Persona is located in the United States; see Section 12 for transfer safeguards.

8. AI-assisted introductions and other automated processing

8.1 How AI Matching works. AI Matching compares the information in your profile and Capability Audit with the profiles and stated needs of other Members and proposes introductions that appear relevant. It uses large language models provided by Anthropic and Google, which process your profile data on our behalf and are contractually prohibited from using it to train their models. Every proposed introduction is reviewed by a member of our team before it reaches you, and no introduction is made until both sides have agreed.

8.2 No solely automated decisions. AI Matching does not make decisions with legal or similarly significant effects about you without human involvement. You may ask us to explain why a particular introduction was proposed, and you may ask to receive introductions on a manual-only basis, where operationally practicable.

8.3 Other AI tools. We use AI tools to draft written summaries of sessions and to help our team respond to messages. A member of our team remains responsible for what is sent to you. We do not use your personal data to train AI models, whether our own or third parties'.

8.4 Transparency. Where you interact with an AI system rather than a person (for example, our AI voice assistant), we tell you, in line with Article 50 of Regulation (EU) 2024/1689 (the EU AI Act).

9. AI voice assistant calls

Some telephone calls we place are made by an automated AI voice assistant (using a synthetic voice provided by ElevenLabs and telephony provided by Twilio) rather than a human caller. We use it for event reminders, confirmations, light screening of applicants and post-event follow-up, including sales and marketing. Every such call is recorded and transcribed. At the start of each call the assistant states that it is an automated AI assistant for Legends and that the call is recorded, and asks whether it may continue. If you decline or object, the call ends and your number is added to our do-not-call list. We place marketing calls only where we hold the consent required by the law applicable to your telephone number; for reminders and confirmations of events you registered for, we rely on our contract with you or our legitimate interests. You may opt out of all calls at any time by telling the assistant, replying STOP to a text message, or writing to [email protected].

10. Marketing and first-contact outreach

10.1 Applicants, Members and event registrants. We send marketing emails and WhatsApp messages about events, sessions and the network only with your consent, or, where you are an existing customer, on the basis of our legitimate interest in promoting similar services with a right to object. Every marketing email contains an unsubscribe link; WhatsApp marketing can be stopped by replying STOP; or write to [email protected]. Unsubscribing does not affect service communications about an active application or Membership.

10.2 People we contact for the first time. Some people we contact have not interacted with Legends before. In those cases we obtain business contact details and professional context (name, business email address, employer, job title, LinkedIn URL and professional background) from the Apollo.io business-to-business contact database, from LinkedIn and other publicly available professional sources. We use Instantly to send introductory business emails to corporate addresses. Our legal basis is our legitimate interest in business-to-business outreach to people whose role indicates that the Legends network is relevant to them, supported by a documented legitimate-interests assessment. The first message we send tells you who we are, what data we hold, where it came from, why we are contacting you, and your rights, including your absolute right to object to direct marketing at any time (Art. 21(2) GDPR). Every first email contains a one-click unsubscribe link. If you object, we stop contacting you and add your details to a suppression list so that we do not contact you again.

10.3 Your name and image in marketing. We use your name, image, likeness or testimonial in marketing materials, case studies or event footage only with your separate consent, for example through an event release or a specific request from us.

11. Who we share personal data with

We do not sell personal data. We share it only as follows.

11.1 Service providers (processors). Companies that process personal data on our behalf under written contracts that meet the requirements of Article 28 GDPR:

We also use providers in the following categories, which may change over time: video-conferencing and meeting platforms; event-registration and scheduling tools; transactional email delivery; document-signing tools; and error-monitoring and security tooling. We will update this policy when we add a provider that processes a material amount of personal data.

11.2 Other Members. When an introduction is proposed, we share a limited description of you (for example, your role, sector and stated need or offer) with the other Member. Your name and contact details are shared only after both of you have agreed to the introduction. Messages you send to another Member are visible to that Member. If you opt in to "Connect me with my group" at an event, we share your name, email address, telephone number and LinkedIn URL with the other opted-in participants in your breakout room (Terms of Use, Section 9.8); we cannot recall details already delivered to them.

11.3 Event co-hosts and venues. Where an event is organised jointly with a partner or held at a third-party venue, we share the registration and attendance information needed to run the event.

11.4 Professional advisers. Our lawyers, accountants, auditors and insurers, under duties of confidentiality.

11.5 Authorities. Courts, regulators, law-enforcement and other public authorities where required by law, or where we reasonably believe disclosure is necessary to protect rights, property or safety, to enforce our Terms, or to investigate suspected unlawful activity.

11.6 Corporate transactions. In connection with a merger, acquisition, financing, restructuring or sale of assets, we may share personal data with the counterparty and its advisers under confidentiality obligations, and it may be transferred to a successor.

11.7 At your direction. With anyone else where you ask us to or consent.

12. International transfers

We are established in the EU and host the Platform in Germany. Some of our providers are located in the United States or access data from there. Where we transfer personal data outside the European Economic Area, we rely on: (a) an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for providers certified under it; or (b) the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), together with a transfer impact assessment and supplementary measures such as encryption where needed. Transfers to the United Kingdom rely on the Commission's adequacy decision for the UK. You may request a copy of the relevant safeguards by writing to [email protected].

13. How long we keep personal data

We may keep data for longer where required by law or where needed for a pending or reasonably anticipated legal claim, investigation or audit. Data that has been anonymised so that you can no longer be identified is not personal data and may be kept indefinitely.

14. Security

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls and least-privilege access for our team, logging and monitoring, secure development practices, and contractual security obligations on our providers. Verification documents and biometric data are handled only within the Persona flow and are not sent or stored over messaging channels. No system is completely secure; if a personal-data breach is likely to result in a high risk to you, we will inform you and the supervisory authority as the GDPR requires.

15. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate or incomplete data;
• erase your data, subject to exceptions where we must keep it (for example for tax, sanctions or legal-claim purposes);
• restrict processing in certain circumstances;
• receive the data you provided to us in a portable, machine-readable format, where processing is based on consent or contract and carried out by automated means;
• object to processing based on legitimate interests, and to direct marketing at any time, in which case we will stop;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (withdrawing consent for biometric verification means we cannot admit or keep you as a Member; withdrawing consent for recordings may limit the sessions you can attend);
• not be subject to a decision based solely on automated processing that significantly affects you, and to obtain human review, as described in Section 7.4; and
• lodge a complaint with a supervisory authority. Ours is the Office of the Commissioner for Personal Data Protection, 1 Iasonos Street, 1082 Nicosia, Cyprus; [email protected]; www.dataprotection.gov.cy. You may also complain to the authority in the EU country where you live or work. We would appreciate the chance to address your concern first.

To exercise any right, write to [email protected]. We may ask you to confirm your identity. We respond within one month, extendable by two further months for complex requests, in which case we will tell you. Requests are free unless manifestly unfounded or excessive. You may appoint someone to act for you; we will ask for evidence of their authority.

Other jurisdictions. If you are located outside the EU, for example in the United Kingdom, the United Arab Emirates, Switzerland or a US state with a comprehensive privacy law, you may have similar rights under your local law, which we will honour. We do not sell personal data or share it for cross-context behavioural advertising, and we honour Global Privacy Control signals where the law requires.

16. Cookies

legends.app uses only cookies and similar technologies that are strictly necessary for the Site to function, such as session and security cookies. These are exempt from consent under Article 5(3) of Directive 2002/58/EC and Cyprus Law 112(I)/2004. We do not set analytics, advertising or tracking cookies on the Site. When you use embedded third-party services, such as Stripe checkout or the Persona verification flow, those providers may set their own cookies under their own policies. If we introduce analytics or marketing cookies in future, we will add a consent banner and update this Section before doing so.

17. Children

The Services are for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have done so, please contact [email protected] and we will delete it.

18. Changes to this policy

We may update this policy from time to time. The effective date at the top shows the current version. For material changes we will give registered Users at least 14 days' notice by email or by notice on the Platform, and where a change affects the basis on which you gave consent, we will ask for your consent again.

19. Contact

AVELYTH PLATFORM LTD
Arch. Makariou III, 115, 3021 Limassol, Cyprus
Registration No. HE 497254
Email: [email protected]
Phone: +357 97 916299
Website: https://legends.app