Privacy Policy

Personal Data Protection Policy

Users attached to a Client account · Cleaning Providers · Website visitors

Version 1.0 — 1 July 2026

StayClean Global Services OÜ ("StayClean"), a company incorporated under Estonian law, provides a digital solution for the matching and quality control of cleaning services for furnished tourist accommodation. In this context, StayClean processes personal data relating to various categories of individuals.

This Policy constitutes StayClean's single information document under Articles 12 to 14 GDPR. It is organised into a preliminary part, which sets out the provisions common to all audiences, and into three parts, each corresponding to a capacity in which you may deal with StayClean. Each part is to be read together with the Preliminary Part, whose provisions are not repeated.

Structure of the document

• Preliminary Part — Common Provisions

  • Who it applies to: To all of the audiences listed below; it supplements each of the three parts

  • Governing contractual document: Not applicable

• Part 1 — Users attached to a Client account

  • Who it applies to: Employees, directors, representatives or contacts designated by a StayClean Client (property-management company, property manager) and accessing the platform

  • Governing contractual document: Terms of Use/Terms of Sale and Schedule 3 – Data Processing Agreement entered into with the Client

• Part 2 — Cleaning Providers

  • Who it applies to: Independent Cleaning Providers offering or performing cleaning assignments listed on the platform, together with their employees and staff working on site

  • Governing contractual document: Cleaning Provider Terms of Use

• Part 3 — Website visitors

  • Who it applies to: Any person visiting StayClean's public website without an account on the platform

  • Governing contractual document: The website's legal notices and cookie management policy

This Policy applies together with the general terms of use and of sale, the Cleaning Provider Terms of Use, Schedule 3 – Data Processing Agreement entered into with Clients and StayClean's Cookie Policy, without restricting the rights you hold under the law.

Travellers staying in the properties are not addressees of this document: information concerning them falls within the responsibility of the Client hosting them, in its capacity as data controller.

---

Preliminary Part — Common Provisions

The provisions of this Part apply to all of the processing described in this Policy, whatever the capacity in which you deal with StayClean. They are not repeated in Parts 1 to 3, which refer back to them.

A. Data controller and contact

StayClean Global Services OÜ, a private limited company incorporated under Estonian law, registered under number 17490333, whose registered office is at Tornimäe tn 5, Kesklinna linnaosa, 10145 Tallinn, Harju maakond, Estonia, is the data controller for the personal data described in this Policy, except where it acts as a processor, as specified in Part 1.

For any question concerning the processing of your personal data, or to exercise your rights, you may write to privacy@stayclean.io, or send a letter to the registered office marked "data protection". This contact point does not amount to an announcement that a data protection officer has been appointed.

B. Scope and legal framework

This Policy covers the processing carried out by StayClean through its website, its platform and its Client and Cleaning Provider portals, its application programming interfaces (APIs), its support tools and its operational services.

It applies together with the general terms of use and of sale, the Cleaning Provider Terms of Use, Schedule 3 – Data Processing Agreement entered into with Clients and StayClean's Cookie Policy, without restricting the rights you hold under the law. A contract entered into between StayClean and a Client governs the relationship between those two parties; it does not reduce the information owed to data subjects under this Policy.

Estonian law and the applicable European legislation form the governing framework, without excluding mandatory territorial rules, in particular French rules, applicable to the processing concerned.

This Policy is reviewed whenever the services, the purposes, the recipients or the safeguards change. Substantial changes are subject to appropriate information and, where applicable, to fresh consent obtained before the processing concerned. A change does not retroactively regularise an unlawful collection.

C. Source of the data and indirect collection

The information processed comes from:

• the data subject themselves;

• the administrator of their account, where access is administered by a Client or by a Cleaning Provider;

• the Client or the Cleaning Provider involved in the same service;

• the integrations that you or your organisation have authorised;

• the technical service providers used by StayClean;

• and, for certain business contacts, public sources consulted lawfully.

The fact that information is public does not permit its unlimited reuse.

Any person or organisation that provides StayClean with data concerning third parties must have a valid legal basis for doing so and must have given those third parties the required information. They must transmit only the information that is necessary: the names of the people staying in the property, their personal documents and information relating to their private life need not be imported where booking references and dates are sufficient. StayClean remains bound by its own transparency obligations in the event of indirect collection, within the meaning of Article 14 GDPR.

D. Security and confidentiality

StayClean implements technical and organisational measures proportionate to the risk: control and review of access rights, separation of environments, protection of access credentials, encryption of communications, logging, updates, backups and an incident management procedure. Their design takes account of the particular sensitivity of property access information, visual evidence and financial data.

Infrastructure redundancy replaces neither backups, nor access controls, nor a legal basis. No system rules out every incident, which in no way reduces the legal security obligations incumbent on StayClean.

For your part, it is your responsibility to protect your credentials, to limit the invitations you send to third parties and to report without delay to privacy@stayclean.io any suspected compromise of your account.

E. Personal data breaches

Where an incident is liable to affect personal data, StayClean assesses its nature, scale and risks, contains its effects and documents the measures taken.

Notifications are made in accordance with the conditions and time limits laid down by law: notification to the competent supervisory authority within 72 hours of becoming aware of it where the breach is likely to result in a risk to the rights and freedoms of individuals, information of the data subjects where the risk is high, and information of the data controller without undue delay where StayClean acts as a processor.

Security considerations may lead to the communication of certain technical details being temporarily deferred; they do not allow information legally owed to data subjects to be withheld.

F. Exercising your rights: procedure, time limits and refusals

The rights granted by the GDPR are listed, for each audience, in the part that concerns it. The procedure for exercising them is common to all.

Send your request to privacy@stayclean.io, specifying the account concerned and the subject matter of the request. Additional proof of identity is requested only where there is reasonable doubt as to your identity, and in a proportionate manner; do not send a complete identity document unless you have been asked to do so.

You will receive a response as soon as possible and, in principle, within one month of receipt of the request. That time limit may be extended by two months on account of the complexity or the number of requests, with the reasons for the extension being communicated to you within the first month. Exercising your rights is free of charge, subject only to the exceptions provided for by law, in particular where a request is manifestly unfounded or excessive.

Not all rights are absolute: a legal retention obligation, or the establishment, exercise or defence of legal claims, may justify limited retention. Any refusal, in whole or in part, is the subject of a reasoned response setting out the remedies available.

Where StayClean acts as a processor on behalf of a Client, it forwards the request to the data controller concerned or assists that controller in handling it, without obstructing the exercise of your rights.

G. Complaints and remedies

You may lodge a complaint with a competent data protection authority, in particular that of your habitual residence, your place of work or the place of the alleged infringement:

• in France: Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr;

• in Estonia: Andmekaitse Inspektsioon (AKI), Tatari 39, 10134 Tallinn — info@aki.ee — www.aki.ee.

The fact that StayClean's registered office is located in Estonia does not oblige you to give up bringing the matter before another competent authority, bringing court proceedings or obtaining the compensation provided for by law. The competence of the lead authority depends on the criteria set out in the GDPR, and not on the address of the registered office alone.

H. Minors

Accounts opened on the platform, whether a Client account or a Cleaning Provider profile, are intended for adults with the necessary legal capacity. Any person who attaches team members to an account must make sure that they have the authority to do so.

Information relating to children incidentally present in a property must not be collected without necessity or appropriate safeguards. In particular, the visual evidence submitted in connection with a cleaning assignment must not show any child, in accordance with the minimisation rules set out in Part 2 of this Policy. Any data concerning a minor that is transmitted in error is deleted, at your request or on StayClean's initiative, subject to a legitimate ground for retention.

---

Part 1 — Users attached to a Client account

When you use the StayClean platform on behalf of your employer or principal (the "Client"), StayClean processes certain of your personal data. This Policy explains what data is collected, why, who it is shared with, how long it is kept, and what your rights are.

This Policy supplements, but does not replace, the contract entered into between StayClean and the Client (Terms of Use/Terms of Sale, Schedule 3 – Data Processing Agreement), which governs the contractual relationship between StayClean and the Client.

I. General description

Scope

Part 1 of this Policy applies to any natural person who accesses the StayClean platform or receives communications from StayClean because they have been designated by, attached to or granted access rights by a StayClean Client ("User"). This includes in particular:

• an employee, officer or agent of the Client who has access to the StayClean platform (dashboard, monitoring of cleaning assignments, exchanges with providers);

• an operational or administrative contact designated by the Client to receive notifications, reports or communications relating to the performance of the contract;

• a person whose contact details are provided to StayClean by the Client for account management purposes (billing, support, security).

Part 1 of this Policy does not concern independent Cleaning Providers, who are covered by Part 2 of this Policy, nor persons staying in the properties, whose data falls under the responsibility of the Client hosting them.

StayClean Global Services OÜ, a company incorporated under Estonian law, acts as the supplier of a digital solution for managing and quality-controlling cleaning services on behalf of its Clients (property-management companies, managers of furnished tourist accommodation). The contractual relationship is business-to-business (B2B) in nature: it is the Client, a legal entity, that is StayClean's contracting party. This Policy is nevertheless intended to inform the natural persons attached to the Client whose personal data is processed in that context, in accordance with the GDPR.

The respective roles of StayClean and the Client

StayClean acts in two distinct capacities, which should not be confused. StayClean is the data controller for the processing whose purposes and essential means it determines itself: creation and management of User accounts, authentication and technical access rights, platform security and logging, support, billing of the Client and commercial relations. It is this processing, and this processing alone, that Part 1 of this Policy describes.

StayClean acts, by contrast, as a processor within the meaning of Article 28 GDPR when it processes data exclusively on behalf of the Client and on the Client's documented instructions: data relating to the properties, bookings, access instructions and, where applicable, the persons staying there. That processing is governed by the Schedule 3 – Data Processing Agreement entered into between StayClean and the Client, and not by this Policy. Requests relating to it fall to the Client, which is the controller of that processing; StayClean assists the Client and forwards the request to it without impeding the exercise of your rights.

The capacity is assessed purpose by purpose: the same category of data may fall under one capacity or the other depending on the use made of it.

II. Collection and use of data

A. The data we collect

Unlike a consumer platform, StayClean does not collect precise geolocation data, demographic data, biometric data or multimedia content relating to the User. The data collected is limited to what is necessary for account management, secure access to the platform and the proper performance of the contract entered into with the Client.

1. Identification and contact data

• Surname and first name

• Business e-mail address

• Business telephone number (where applicable)

• Position or role within the Client's organisation (e.g. manager, quality officer, accounting)

• Login identifier and password (stored in encrypted / hashed form)

2. Connection and platform usage data

• Connection dates and times

• IP address

• Type of browser and device used

• Log of actions carried out on the platform (viewing the Client's properties, approving or reporting an issue with a cleaning assignment, exchanges with providers via the built-in messaging)

3. Data provided by the Client

• Contact details provided by the Client when the account is opened or updated

• Level of access rights granted by the Client (platform access rights)

4. Data arising from exchanges with StayClean support

• Content of requests sent to support (e-mail, form, messaging)

• Date and subject of the request

5. Data relating to integrations and shared reports

• Identity of the User who authorised, modified or revoked a connection to a third-party service (rental management software, calendar, smart lock, communication tool)

• Scope of the authorisations granted and time stamp of the authorisation or its revocation

• Identity of the User who generated, shared or revoked a report sharing link, and time stamp of the accesses made using that link

B. How we use the data

StayClean uses the User's data for the purposes strictly necessary for the performance of the contract entered into with the Client and for the proper operation of the platform:

1. Provide access to the platform and perform the contract with the Client

• Create and administer the User's account, according to the access rights defined by the Client

• Enable authentication and secure access to the platform

• Display information relating to the Client's properties, cleaning assignments and providers

• Facilitate exchanges between the User and the Cleaning Providers listed by StayClean

• Send operational notifications relating to performance of the service (assignment confirmation, issue report, quality report)

2. Ensure the security of the platform and prevent fraudulent use

• Detect unauthorised access attempts or abnormal use of an account

• Keep a connection log for traceability and IT security purposes

3. Assistance and support

• Respond to the User's requests for technical or operational assistance

• Follow up on incidents or complaints relating to use of the platform

4. Comply with our legal and contractual obligations

• Respond to requests from the competent authorities where the law so requires

• Retain the data necessary to handle a dispute relating to performance of the contract with the Client

StayClean does not use Users' data for behavioural advertising or individual marketing personalisation. StayClean does not take any individual decision based solely on automated processing producing legal effects concerning the User: the processes for matching properties with providers rely on operational criteria (geographic area, availability, scheduling) and do not concern the personal data of the User attached to the Client.

C. Integrations and shared reports

The platform may be connected, at the initiative of the Client or of a User with the relevant access rights, to third-party services such as rental management software (PMS), a calendar, a smart lock or a communication tool. These connections are limited to the authorisations strictly necessary for the functionality concerned.

The account holder may revoke a connection at any time from the platform. Revocation stops data exchanges going forward; it does not automatically erase the information that each party has already lawfully retained, which remains subject to the periods set out in Section F.

Certain features make it possible to share a report by means of a link accessible to third parties. Before generating such a link, it is for the User to check its scope: property access information, identity documents and financial data are not intended to be distributed in this way. A recipient may forward or copy a link; the restriction and revocation mechanisms available in the platform must be used as soon as sharing is no longer necessary.

D. Cookies and trackers

Cookies, local storage, SDKs and similar technologies are covered by a separate document: StayClean's Cookie Policy, accessible from the website and from the platform. For each category of tracker, it sets out the purpose pursued, the legal basis, the lifespan and how to withdraw consent.

Trackers that are not strictly necessary for the operation of the platform are only placed after consent has been obtained. Acceptance of the contractual terms or creation of an account does not amount to acceptance of these trackers.

E. Sharing and disclosure of data

StayClean does not sell or rent Users' data. Data sharing is limited to the following cases:

• The Client (the User's employer or principal)

  • Data shared: Activity log on the platform, account status

  • Purpose: Management of accounts and operational monitoring by the Client

• Technical service providers (hosting, infrastructure, IT support)

  • Data shared: Account and connection data

  • Purpose: Hosting and maintenance of the platform

• Messaging / customer support provider

  • Data shared: Content of assistance requests

  • Purpose: Handling of support requests

• Competent authorities

  • Data shared: Strictly necessary data

  • Purpose: Legal obligation or judicial request

• StayClean's legal and accounting advisers

  • Data shared: Strictly necessary data

  • Purpose: Handling of a dispute or legal/accounting obligation

Each processor acting on behalf of StayClean is bound by a data processing agreement complying with Article 28 GDPR.

F. Retention period

• Account data (identity, contact details, credentials): Term of the contract between StayClean and the Client, followed by selective archiving of only the evidence required, within the applicable limitation periods

• Connection and security log: 6 months

• Exchanges with support: 24 months from closure of the request

• Data required to handle a dispute: Duration of the proceedings, plus the applicable limitation periods

• Technical backups: Rotation cycle of 90 days maximum; any restoration re-applies the deletions that have taken place

At the end of these periods, the data is deleted or anonymised, unless a legal obligation requires longer retention.

III. Your rights and your choices

In accordance with the GDPR, the User has the following rights over data concerning them:

• Right of access and rectification

• Right to erasure, within the limits compatible with StayClean's contractual obligations towards the Client

• Right to restriction of processing

• Right to object, for processing based on StayClean's legitimate interests

• Right to portability of the data they have themselves provided

• Right to give instructions on what happens to their data after their death

These rights are exercised under the conditions and within the time limits set out in the Preliminary Part, Section F. In certain cases, in particular where the User's access to the platform is administered by the Client, StayClean may have to refer the request to the Client, as the Client is responsible for managing the access rights of its own staff.

The User also has the right to lodge a complaint with a competent data protection authority, under the conditions set out in the Preliminary Part, Section G.

IV. Legal information

A. Data controller and contact

StayClean Global Services OÜ, a private limited company incorporated under Estonian law, registered under number 17490333, whose registered office is at Tornimäe tn 5, Kesklinna linnaosa, 10145 Tallinn, Harju maakond, Estonia, is the controller of the personal data processing described in Part 1 of this Policy, under the conditions and within the limits set out in Section I.

For any question relating to the processing of your personal data, or to exercise your rights, you may write to privacy@stayclean.io, or send a letter to the registered office marked "data protection". This contact point does not constitute an announcement that a data protection officer has been appointed.

B. Legal basis for processing

• Performance of the contract entered into with the Client (or pre-contractual measures): Creation and management of the account, access to the platform, operational notifications

• StayClean's legitimate interests: Platform security, prevention of fraudulent use, improvement of the service

• Legal obligation: Responding to requests from the authorities, retaining certain data for evidential purposes

As StayClean acts as a service provider to the Client for the provision of the platform, the relevant contract within the meaning of Article 6(1)(b) GDPR is, depending on the case, the contract entered into between StayClean and the Client, of which the User is a beneficiary in the course of their professional activity.

C. Data transfers

StayClean Global Services OÜ is established in Estonia, a European Union Member State. Data is hosted and processed primarily within the European Union. Where a StayClean processor is established outside the European Union, the transfer is based on an adequacy decision of the European Commission or on standard contractual clauses, a copy of which may be obtained from StayClean on request.

The list of processors used by StayClean, the countries concerned and the safeguards implemented may be obtained on request sent to the contact indicated in Section IV.A, subject to any redactions necessary to protect security and trade secrets, which do not prevent you from exercising your rights.

D. Updates

StayClean may amend this Policy, in particular to reflect a change in the platform or in the applicable regulations. Any substantial change will be communicated to Users through the Client or directly via the platform.

Version 1.0 — 1 July 2026

---

Part 2 — Cleaning Providers

Part 2 of this Policy applies when you use the StayClean platform as an independent cleaning service provider, to offer or carry out cleaning assignments in furnished tourist accommodation listed by StayClean Clients (property-management companies, property managers).

You carry on your business entirely independently: StayClean provides you with a digital matching and quality-control tool, but is neither your employer nor your principal within the meaning of employment law. This Policy supplements, without replacing, the Cleaning Provider Terms of Use that you have accepted.

I. General description

Scope

Part 2 of this Policy applies if you:

• create a profile on the StayClean platform in order to offer your cleaning services to StayClean Clients ("Cleaning Provider");

• accept, carry out or complete a cleaning assignment listed on the StayClean platform;

• communicate with a Client or with the StayClean team through the platform in connection with a cleaning assignment.

Part 2 of this Policy does not concern users attached to a Client account (the Client's staff accessing the StayClean dashboard), who are covered by Part 1 of this Policy.

The Cleaning Provider's employees and agents

Where the Cleaning Provider is a legal entity, or where it uses employees, temporary staff or its own subcontractors to carry out a cleaning assignment, the individuals who actually attend the site appear in the platform (check-in/check-out logging, proof of completion, assignment-related messaging). Their data is subject to the processing described in Part 2 of this Policy, within the same limits and for the same retention periods.

The Cleaning Provider, in its capacity as employer or principal, is the data controller for the management of its personnel. It is for the Cleaning Provider to ensure that it has a legal basis for transmitting that data to StayClean, to disclose only the information necessary to carry out the cleaning assignment, and to bring this Policy to the attention of the individuals it attaches to its account. StayClean remains bound by its own transparency obligations in the event of indirect collection and makes this Policy available to those individuals.

Those individuals exercise with StayClean, on the terms set out in Section III, the rights relating to the processing described in Part 2 of this Policy.

StayClean Global Services OÜ, a company incorporated under Estonian law, acts as the supplier of a digital matching and quality-control solution between Clients and listed Cleaning Providers. As a Cleaning Provider, you remain an independent professional, solely responsible for organising your business, for choosing the cleaning assignments you accept and for the means you use to carry them out. StayClean exercises no authority of subordination over you.

For all the processing described in Part 2 of this Policy, StayClean acts as data controller: it determines the purposes and the essential means of that processing, and does not act on the Client's instructions as regards your Cleaning Provider data. The Client who entrusts you with a cleaning assignment remains a separate data controller for its own processing.

II. Collection and use of data

A. The data we collect

The data collected from Cleaning Providers is limited to what is necessary to verify your professional status, to match you with cleaning assignments, to carry out quality control of the service and to settle your commission. StayClean does not collect driving data, driving-behaviour data or continuous location tracking: these categories, relevant to a transport platform, do not apply to cleaning activity.

1. Account and professional status information

• Surname and first name

• Address

• Contact details (email, telephone)

• Login ID and password (stored in encrypted form)

• Professional status (self-employed trader, company) and SIRET number

• Bank details (IBAN) for the settlement of commissions

• Certificate of professional public liability insurance

• Profile photograph (optional)

2. Verification information

• Identity document or proof of business registration (Kbis extract or the equivalent for a self-employed trader)

• Proof of insurance in force

3. Content relating to the Cleaning Provider

• Before/after cleaning photographs submitted as proof of completion and in support of quality control

• Ratings and comments left by Clients, and notes left by the Cleaning Provider concerning a property or a cleaning assignment

• Responses to satisfaction surveys

The photographs you submit must be limited to what is necessary to establish the condition of the property. You are asked not to include in them any identifiable person, in particular no faces and no children, and no identity document, personal document, correspondence or object that unnecessarily reveals the occupants' private life. Proof that is excessive in the light of this purpose may be restricted, rectified or deleted, at your request or on StayClean's initiative, subject to any legitimate ground for retention.

4. Location data

StayClean does not carry out any continuous tracking of your location. A position data point may be collected on a one-off basis at the time you report the start and the end of a cleaning assignment through the application (check-in/check-out logging), for the sole purpose of confirming that the assignment was carried out at the address of the property concerned.

Where the property or one of its items of equipment is fitted with an identification medium (QR code or NFC tag), the scan you perform at the start or at the end of the cleaning assignment generates a time-stamped event linked to that assignment. That event confirms your presence on site at the time of the scan; it does not establish that each task was performed and gives rise to no collection of position data outside assignment periods. This data is retained for 60 days.

5. Assignment information

• Address of the property, date and time of the cleaning assignment

• Status of the cleaning assignment (offered, accepted, completed, cancelled) and, where applicable, the reason for cancellation

• Completed quality-control checklist

• Amount of the StayClean commission relating to the cleaning assignment

• Aggregate history (number of cleaning assignments completed, acceptance rate)

6. Usage and device data

• Dates and times of connection to the platform

• Features or pages viewed

• IP address, device type and browser type

7. Communication data

• Exchanges with the Client about a cleaning assignment (built-in messaging)

• Exchanges with StayClean support

8. Data from other sources

• Reports or ratings submitted by a Client concerning the performance of a cleaning assignment

• Information provided by your insurer in the event of a claim connected with a cleaning assignment

• Information provided by the competent authorities, where applicable

B. How we use the data

1. Providing access to the platform and its features

• Creating, verifying and administering your Cleaning Provider profile

• Enabling you to view and accept cleaning assignments available in the service area you have declared

• Facilitating communication between you and the Client in connection with a cleaning assignment

• Generating the documents required to track your cleaning assignments and your commissions

2. Calculating and paying your commission

• Determining the amount of the StayClean commission applicable to each cleaning assignment, in accordance with the terms set out in the Cleaning Provider Terms of Use

• Processing the payment of your commission

3. Carrying out quality control of the service

• Analysing photographs, checklists and Client feedback in order to verify that cleaning assignments have been properly performed

• Passing on the Client's quality feedback to you so that you can, where appropriate, adjust your service

This quality control is a best-efforts obligation: StayClean verifies that the result complies with the standards agreed with the Client, without giving instructions as to how you organise or carry out your work.

4. Security, fraud prevention and detection

• Verifying your identity and the validity of your professional status and your insurance

• Detecting unauthorised access attempts or manifestly fraudulent conduct (e.g. false proof of completion)

5. Support

• Responding to your requests for technical or administrative assistance

• Following up complaints connected with a cleaning assignment

6. Complying with our legal, tax and accounting obligations

• Drawing up the documents required to invoice your commission

• Responding to requests from the competent authorities where the law so requires

• Retaining the data necessary to handle a dispute relating to a cleaning assignment

StayClean does not use Cleaning Providers' data for behavioural advertising or individual marketing personalisation purposes.

C. Automated processes

StayClean uses limited automated processes to facilitate the operation of the platform. These processes are designed to remain decision-support tools: they do not replace your professional autonomy and do not automatically determine access to the platform without human intervention where a report is disputed.

1. Matching

When a cleaning assignment is available, the platform offers it to Cleaning Providers who have declared compatible availability and service areas. You remain free to accept or refuse each cleaning assignment offered, without any automatic penalty other than those expressly provided for and communicated in the Cleaning Provider Terms of Use.

2. Commission

The amount of the StayClean commission applicable to each cleaning assignment is determined according to a contractual scale agreed with you in the Cleaning Provider Terms of Use, and not by an individualised dynamic pricing algorithm based on your profile or your behaviour.

3. Quality control and fraud prevention

The photographs and checklists submitted are subject to a check, which may include an initial automated analysis (e.g. detection of a missing photograph or of a photograph that does not comply with the expected format), always followed by a human review before any consequence for your account, such as a suspension.

D. Cookies and trackers

Cookies, local storage, SDKs and similar technologies are covered by a separate document: the StayClean Cookie Policy, accessible from the website and from the platform. For each category of tracker, it sets out the purpose pursued, the legal basis, the lifespan and how to withdraw consent.

Trackers that are not strictly necessary for the operation of the platform are placed only after consent has been obtained. Acceptance of the contractual terms or the creation of an account does not amount to acceptance of these trackers.

E. Sharing and disclosure of data

StayClean neither sells nor rents Cleaning Providers' data. Data is shared only in the following cases:

• The Client concerned by the cleaning assignment

  • Data shared: Name, contact details relevant to the cleaning assignment, status of the cleaning assignment, proof of completion (photographs), rating

  • Purpose: Monitoring of the cleaning assignment and quality control by the Client

• Technical service providers (hosting, infrastructure)

  • Data shared: Account and connection data

  • Purpose: Hosting and maintenance of the platform

• Payment service provider

  • Data shared: Bank details, commission amounts

  • Purpose: Payment of commissions

• StayClean's chartered accountant

  • Data shared: Invoicing data

  • Purpose: Accounting and tax obligations

• Insurer, in the event of a reported claim

  • Data shared: Data necessary to handle the claim

  • Purpose: Investigation of the insurance claim

• Competent authorities

  • Data shared: Strictly necessary data

  • Purpose: Legal obligation or judicial request

Each processor acting on StayClean's behalf is bound by a data processing agreement complying with Article 28 GDPR.

F. Retention period

• Account and professional verification data: For as long as the Cleaning Provider profile is active, followed by selective archiving of only those items of evidence that are necessary, within the applicable limitation periods

• Assignment data (checklists, proof of completion, ratings): 12 months from completion of the cleaning assignment

• Invoicing and accounting documents: 7 years from the close of the financial year concerned (Estonian accounting law)

• Connection and security log: 6 months

• Exchanges with support: 24 months from the closure of the request

• Data necessary to handle a dispute: For the duration of the proceedings, plus the applicable limitation periods

• Check-in/check-out logging data and QR code / NFC scan events: 60 days

• Technical backups: Rotation cycle of 90 days maximum; any restoration re-applies the deletions that have taken place

At the end of these periods, the data is deleted or anonymised, unless a legal obligation requires longer retention.

III. Choices and transparency

Availability and service area settings

You can update your service area and your availability at any time from your Cleaning Provider profile; this information determines the cleaning assignments offered to you.

Ratings and quality feedback

You can view the ratings and feedback given to you by Clients from your Cleaning Provider area, and challenge a report with StayClean support.

Your GDPR rights

Under the GDPR, you have the following rights in relation to data concerning you:

• The right of access and rectification

• The right to erasure, within the limits compatible with StayClean's accounting and contractual obligations

• The right to restriction of processing

• The right to object, for processing based on StayClean's legitimate interests

• The right to portability of the data you have provided yourself

• The right to give directions as to what happens to your data after your death

These rights are exercised on the terms and within the time limits set out in the Preliminary Part, Section F.

You also have the right to lodge a complaint with a competent data protection authority, on the terms set out in the Preliminary Part, Section G.

IV. Legal information

A. Data controller and contact

StayClean Global Services OÜ, a private limited company incorporated under Estonian law, registered under number 17490333, whose registered office is at Tornimäe tn 5, Kesklinna linnaosa, 10145 Tallinn, Harju maakond, Estonia, is the controller of the personal data described in Part 2 of this Policy.

For any question relating to the processing of your personal data, or to exercise your rights, you can write to privacy@stayclean.io, or send a letter to the registered office marked "data protection". This contact point does not amount to an announcement that a data protection officer has been appointed.

B. Legal basis for processing

• Performance of the contract entered into with you (Cleaning Provider Terms of Use): Creation and management of the profile, matching with cleaning assignments, payment of commissions, quality control

• StayClean's legitimate interests: Security of the platform, prevention of fraudulent use, improvement of the service

• Legal obligation: Invoicing, accounting and tax obligations, responding to requests from the authorities

C. Data transfers

StayClean Global Services OÜ is established in Estonia, a Member State of the European Union. Data is hosted and processed primarily within the European Union. Where a StayClean processor is established outside the European Union, the transfer is based on an adequacy decision of the European Commission or on standard contractual clauses, a copy of which can be obtained from StayClean on request.

The list of processors used by StayClean, the countries concerned and the safeguards implemented can be obtained on request sent to the contact indicated in Section IV.A, subject to any redactions necessary to protect security and business confidentiality, which do not prevent you from exercising your rights.

D. Updates

StayClean may amend this Policy, in particular to reflect a change in the platform, in the Cleaning Provider Terms of Use or in the applicable regulations. Any substantial change will be communicated to you directly through the platform.

Version 1.0 — 1 July 2026

---

Part 3 — Website visitors

Part 3 of this Policy applies when you browse StayClean's public website (https://www.stayclean.io/) without being attached to a Client account or holding a Cleaning Provider profile, and also when you use the forms made available on that website.

The website is freely accessible: browsing it requires neither the creation of an account nor the disclosure of identification data. Personal data is collected only if you choose to send it to us (form, newsletter sign-up, job application) or, for trackers that are not strictly necessary, if you consent to it.

I. General description

Scope

Part 3 of this Policy applies if you:

• browse one or more pages of StayClean's public website;

• complete a contact form, a demonstration request or a quotation request;

• sign up for StayClean's newsletter;

• send an unsolicited job application or reply to a job offer published on the website;

• interact with the website's technical modules (cookie banner, appointment-booking tool, messaging module).

Part 3 of this Policy covers neither Users attached to a Client account (Part 1) nor Cleaning Providers listed on the platform (Part 2). As soon as you have authenticated access to the platform, Part 1 or Part 2 applies to that processing.

StayClean Global Services OÜ acts as data controller for all of the processing described in this Part. The website is an informational and business-contact website intended for a professional audience (property-management companies, managers of furnished tourist accommodation and independent cleaning providers); it allows neither the booking of a service nor online payment.

II. Collection and use of data

A. The data we collect

StayClean applies to the website the same minimisation principle as on the platform: no data is collected beyond what is necessary to operate the website, handle your request and measure audience. Through its website, StayClean collects no sensitive data within the meaning of Article 9 GDPR, no precise geolocation data and no banking data.

1. Browsing data

• IP address (collected in truncated or anonymised form for audience-measurement purposes)

• Date, time and duration of the visit

• Pages viewed and browsing path on the website

• Page or source that led to the website (referring site, shared link)

• Browser type, operating system, device type and language

2. Data submitted through a contact, demonstration or quotation form

• Last name and first name

• Business e-mail address

• Telephone number (optional)

• Name of the organisation represented and position held

• Information about the need expressed (e.g. number of properties managed, geographic area, project timeline)

• Free-text content of the message

Mandatory fields are identified as such in the form; the other information is optional and its absence has no impact on the handling of your request.

3. Newsletter sign-up data

• E-mail address

• Name and organisation (optional)

• Date, time and technical evidence of consent, together with the history of unsubscribes

• Aggregated open and click statistics relating to the mailings

4. Job application data

• Identity and contact details

• Curriculum vitae, cover letter and any document you choose to attach

• Information about professional background and education

StayClean asks candidates not to send any information about their personal, family or health situation, as such data is neither necessary nor used in the recruitment process.

5. Data from cookies and trackers

Information read or stored on your device is governed by StayClean's Cookie Policy, under the terms recalled in Section II.D below.

B. How we use the data

1. Providing the website and ensuring its security

• Displaying the pages requested and adapting the display to your device and language

• Storing your cookie choices

• Ensuring the availability, stability and security of the website, and keeping a technical log allowing incidents and intrusion attempts to be detected

2. Handling your contact, demonstration or quotation request

• Identifying your request and responding to it

• Arranging, where applicable, a demonstration of the platform or a business discussion

• Preparing a commercial proposal and following up on pre-contractual steps

3. Sending the newsletter and commercial communications

• Sending the newsletter you signed up for

• Sending information about StayClean's services to business contacts, under the conditions set out in Section IV.B

• Measuring the performance of mailings on an aggregated basis in order to adjust their frequency and content

4. Measuring audience and improving the website

• Producing aggregated traffic statistics (pages viewed, source, consultation rates)

• Identifying navigation difficulties and developing the content and structure of the website

5. Handling job applications

• Reviewing the applications received and communicating with candidates

• Building a candidate pool, with the candidate's agreement

6. Complying with our legal obligations

• Keeping proof of the consent obtained for trackers and electronic direct marketing

• Responding to requests from the competent authorities where the law requires it

• Retaining the data necessary to establish, exercise or defend a legal claim

StayClean does not resell or rent contact lists, does not use behavioural advertising and does not build any advertising profile of its website visitors.

C. No automated decision-making

No decision producing legal effects concerning you, or similarly significantly affecting you, is taken on the basis of automated processing of the data collected through the website. The processing described above involves neither scoring nor individual segmentation of visitors.

D. Cookies and trackers

Cookies, local storage, SDKs and similar technologies are covered by a separate document: StayClean's Cookie Policy, accessible from every page of the website. For each category of tracker, it sets out the purpose pursued, the legal basis, the lifespan and the identity of the publishers concerned, together with the associated retention periods.

Trackers that are not strictly necessary for the operation of the website are placed only after your consent has been obtained through the banner displayed on your first visit. Refusing is as easy as accepting, and continuing to browse does not constitute consent. You can change or withdraw your consent at any time through the "Cookie settings" link available in the website footer; withdrawal does not impair your ability to browse the website and does not affect the lawfulness of processing carried out previously.

Accepting the contractual terms or creating an account does not constitute acceptance of trackers that are not strictly necessary.

E. Sharing and disclosure of data

StayClean neither sells nor rents the data of its website visitors. Data sharing is limited to the following cases:

• Website host and infrastructure providers

  • Data shared: Browsing data, technical logs

  • Purpose: Hosting, maintenance and security of the website

• Publisher of the audience-measurement tool

  • Data shared: Browsing data, tracker identifiers

  • Purpose: Production of traffic statistics

• Publisher of the e-mailing and customer-relationship management tool

  • Data shared: Contact details, content of the request, newsletter subscription status

  • Purpose: Handling contact requests and sending the newsletter

• Job-application management provider

  • Data shared: Job application data

  • Purpose: Handling the applications received

• StayClean's legal and accounting advisers

  • Data shared: Strictly necessary data

  • Purpose: Management of a dispute or legal obligation

• Competent authorities

  • Data shared: Strictly necessary data

  • Purpose: Legal obligation or judicial request

Each processor acting on StayClean's behalf is bound by a data processing agreement compliant with Article 28 GDPR.

F. Retention period

• Website connection logs and security data: 6 months

• Trackers and proof of the associated consent: Periods specified in StayClean's Cookie Policy

• Contact, demonstration or quotation requests not followed up: 3 years from your last contact

• Requests that gave rise to a contractual relationship: Term of the contract entered into with the Client, then application of the periods set out in Part 1

• Newsletter sign-up data: Until you unsubscribe, then 3 years from the last contact; address kept on a suppression list to ensure your unsubscribe request is respected

• Job application data: 2 years from the last contact with the candidate, unless earlier deletion is requested

• Data necessary for the management of a dispute: Duration of the proceedings, extended by the applicable limitation periods

• Technical backups: Rotation cycle of 90 days maximum; any restoration re-applies the deletions that have taken place

At the end of these periods, the data is deleted or anonymised, unless a legal obligation requires longer retention.

III. Your rights and your choices

Managing trackers

You can at any time accept, refuse or withdraw your consent to trackers that are not strictly necessary through the website's "Cookie settings" link.

Newsletter and direct marketing

Every message sent by StayClean includes a working and free-of-charge unsubscribe link. You can also object to any direct marketing by writing to the address given in Section IV.A below; your request is acted upon without delay.

Your GDPR rights

In accordance with the GDPR, you have the following rights over the data concerning you:

• Right of access and rectification

• Right to erasure

• Right to restriction of processing

• Right to object, for processing based on StayClean's legitimate interests, and at any time and without giving reasons for direct marketing

• Right to withdraw consent, at any time, for processing based on consent

• Right to portability of the data you provided yourself

• Right to give directions on what happens to your data after your death

These rights are exercised under the conditions and within the time limits set out in the Preliminary Part, Section F. StayClean responds within one month of receiving the request, extendable by two months for complex requests, and may ask for any evidence allowing your identity to be verified in the event of reasonable doubt.

You also have the right to lodge a complaint with a competent data protection authority, under the conditions set out in the Preliminary Part, Section G.

IV. Legal information

A. Data controller and contact

StayClean Global Services OÜ, a private limited company incorporated under Estonian law, registered under number 17490333, with its registered office at Tornimäe tn 5, Kesklinna linnaosa, 10145 Tallinn, Harju maakond, Estonia, is the data controller for the personal data processing described in Part 3 of this Policy.

For any question about the processing of your personal data, or to exercise your rights, you can write to privacy@stayclean.io, or send a letter to the registered office marked "data protection". This contact point does not constitute an announcement that a data protection officer has been appointed.

B. Legal basis for processing

• StayClean's legitimate interests: Operation, security and improvement of the website, audience measurement exempt from consent, direct marketing sent to business contacts in connection with the activity they carry on

• Pre-contractual steps taken at your request: Handling contact, demonstration or quotation requests, and discussions prior to the possible conclusion of a contract

• Consent: Trackers that are not strictly necessary, newsletter sign-up, retention of an application in a candidate pool

• Legal obligation: Retention of proof of consent, response to requests from the competent authorities

Electronic direct marketing addressed to professionals takes place under the conditions laid down by Article L. 34-5 of the French Postal and Electronic Communications Code, provided that the subject of the solicitation relates to the profession of the person contacted and that a right to object is offered to them at the time of collection and in every message.

C. Data transfers

StayClean Global Services OÜ is established in Estonia, a Member State of the European Union. Data is hosted and processed primarily within the European Union. Where a StayClean processor is established outside the European Union, the transfer relies on an adequacy decision of the European Commission or on standard contractual clauses, a copy of which can be obtained from StayClean on request.

The list of processors used by StayClean, the countries concerned and the safeguards implemented can be obtained on request sent to the contact given in Section IV.A, subject to any redactions necessary to protect security and trade secrets, which do not prevent you from exercising your rights.

D. Updates

StayClean may amend this Policy, in particular to reflect changes to the website, to the tools used or to the applicable regulations. The applicable version is the one published on the website on the date of your visit; any substantial change is signalled on the website.

Version 1.0 — 1 July 2026