Privacy Notice

Founding Creator Program | NotOnlyQueens®

pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”)

Version 1.0 — Effective date: 10/09/2026

This is an English translation provided for convenience. The Italian version is the authoritative legal text; in case of any discrepancy, the Italian version prevails.

1. Data Controller

The Data Controller is NOQ S.R.L., with registered office at Via G. Pierluigi da Palestrina 48, 00193 Rome (RM), Italy, Tax Code and VAT No. 18169411008, PEC (certified e-mail) noq@pec.notonlyqueens.com and e-mail address legal@noqsrl.it (“NOQ” or the “Controller”).

NOQ S.R.L. has not currently appointed a Data Protection Officer (DPO). Should one be appointed in the future, the relevant contact details will be published and updated in this notice.

2. Scope of this notice

This notice describes how personal data collected for the application, selection, admission and management of the NotOnlyQueens® Founding Creator Program is processed.

This notice supplements the platform’s general NotOnlyQueens® privacy notice. In case of conflict, this notice prevails for processing specifically connected to the Program.

3. Personal data processed

NOQ may process the following categories of personal data:

Identification and contact data

• first and last name;
• date of birth;
• e-mail address;
• phone number;
• country of residence;
• data associated with the Creator account.

Data relating to Creator activity

• Creator Name or public name;
• social or professional profiles;
• professional experience;
• selected categories;
• languages spoken;
• services offered;
• information entered in the application.

Verification data and documents

• e-mail address verification;
• age verification;
• identity verification;
• KYC documentation;
• verification outcomes;
• indicators relating to duplicate accounts, anomalous activity, or anti-fraud.

Profile and content data

• descriptions;
• images;
• links;
• publicly available information;
• metadata necessary to evaluate the application.

Technical and security data

• IP address;
• device identifiers;
• access and security logs;
• date and time of operations;
• data necessary to prevent fraud and abuse.

Communications

• communications with the NOQ team;
• requests for additional information;
• verification outcomes;
• information collected during any interviews or interactions with the applicant.

NOQ asks applicants not to submit third-party personal data lacking an adequate legal basis, or special categories of data not necessary for the application.

4. Purposes and legal bases of processing

Personal data is processed for the following purposes:

Application management
Receiving, examining, managing and updating the application to the Founding Creator Program.
Legal basis: pre-contractual measures requested by the data subject pursuant to Art. 6(1)(b) GDPR.

Verification and security
Verifying the completeness, authenticity and eligibility of the application, including age, identity, KYC, and duplicate-account checks, fraud prevention, and protecting platform security.
Legal basis: legal obligations where applicable; the Controller’s legitimate interest in platform security and integrity; pre-contractual measures requested by the data subject.

Application assessment
Assessing the profile, declared activities, and compatibility with the Program, the Terms, and the platform’s policies.
Legal basis: pre-contractual measures; the Controller’s legitimate interest in selecting profiles compatible with the Program.

Program management
Admission to the Program, granting of Founding Creator status, management of the badge, benefits, onboarding, and related activities.
Legal basis: performance of the contractual relationship.

Regulatory compliance and defense of rights
Complying with regulatory, tax, and administrative obligations, and defending the Controller’s rights in judicial or extrajudicial proceedings.
Legal basis: legal obligation; legitimate interest in defending its own rights.

Optional communications
Sending informational, promotional, or marketing communications, where applicable.
Legal basis: the data subject’s optional and revocable consent.

5. Nature of the data provision

Providing data marked as mandatory is necessary to examine the application and carry out the verifications required by the Program.

Failure to provide the requested data may prevent evaluation of the application or admission to the Program.

Data indicated as optional is not necessary for the application, unless otherwise subsequently communicated by NOQ.

6. Processing methods and automated decisions

Personal data is processed using electronic tools and, where necessary, manual procedures, in compliance with the principles of lawfulness, fairness, transparency, minimization, integrity, and confidentiality.

NOQ adopts appropriate technical and organizational measures to protect personal data from unauthorized access, loss, disclosure, alteration, or unlawful use.

NOQ does not use processing that is based entirely on automated decision-making within the meaning of Art. 22 GDPR in connection with the Founding Creator Program.

The final decision regarding the evaluation of the application, admission to the Program, and any granting of benefits is always subject to human review and confirmation.

7. Recipients of the data

Personal data may be processed by:

• authorized NOQ personnel;
• collaborators responsible for selection and management of the Program;
• legal, tax, and privacy consultants;
• technology, hosting, and infrastructure service providers;
• e-mail and support service providers;
• age, identity, and KYC verification service providers;
• security and fraud-prevention system providers;
• competent authorities and parties to whom disclosure is required by law.

Such parties act, as applicable, as independent controllers or as processors pursuant to Art. 28 GDPR.

8. Data retention

NOQ retains personal data for different periods depending on the purpose pursued.

Incomplete applications
Up to 90 days from the last update or access.

Rejected, non-admitted, or withdrawn applications
Up to 24 months from the close of evaluation, unless needed for legal defense or required by law.

Complete, authentic, and eligible applicants not selected solely due to the unavailability of the 50 Founding Creator Licenses
Up to 24 months from communication of the outcome, including for the purpose of managing any benefits granted.

Admitted Founding Creators
For the duration of the relationship and for the following 10 years, in compliance with civil, tax, accounting, and rights-defense obligations.

Age, identity, and KYC verifications
For the period required by applicable law, compliance obligations, or agreements with the providers responsible for verification.

Litigation, fraud, and security
Until the relevant proceedings are resolved and applicable limitation periods expire.

Data processed on the basis of consent
Until consent is withdrawn or any term indicated in the relevant request expires.

9. International transfers

Where personal data is transferred outside the European Economic Area, NOQ will adopt one of the protection mechanisms provided for under Articles 44 et seq. GDPR, including:

• European Commission adequacy decisions;
• Standard Contractual Clauses (SCCs);
• additional supplementary measures where necessary.

Updated information on any transfers carried out may be requested from the Controller.

10. Data subject rights

The data subject may exercise, at any time, the rights provided for under Articles 15-22 GDPR, including:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to data portability;
• right to object;
• right to withdraw consent.

Exercising these rights does not affect the lawfulness of processing carried out prior to withdrawal of consent.

The data subject may also lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).

Requests may be sent to: legal@noqsrl.it or via certified e-mail (PEC) to: noq@pec.notonlyqueens.com.

11. Third-party data and minors

Applicants must provide only their own personal data, or third-party data they are authorized to disclose.

The Founding Creator Program is not intended for individuals who do not meet the platform’s minimum age requirement.

Applications that fail age verification cannot be admitted to the Program and will be handled according to applicable security procedures.

12. Changes to this notice

NOQ may update this notice at any time.

Material changes will be communicated through appropriate means, and the updated version will indicate its effective date.