Privacy Notice for Affiliates

This notice explains how we process the personal data of people who apply to or take part in the hi2morrow Affiliate Program. It is provided for information and is not part of the hi2morrow Affiliate Agreement (the "Agreement") or of any other contract with you. Capitalised terms have the meanings given in the Agreement.

---

1. Who we are

1.1 The controller of your personal data is Hitomorrow Assessment Data Classification and Analysis L.L.C, a limited liability company registered in Dubai, United Arab Emirates, under Commercial License No. 1275729 and Commercial Register No. 2890292, with its address at Office C1801-12, Nikat Select, Business Bay, Dubai, UAE ("hi2morrow", "we", "us"). You can contact us, including for privacy requests and grievances, at affiliates@hi2morrow.com.

---

2. Who this notice covers

2.1 This notice covers applicants and affiliates, the directors, owners and staff of a company affiliate whose data the company gives us, and other people who appear in Content sent to us for review. If you give us another person's data, make sure that they have seen this notice.

2.2 This notice also covers your Review Account (clause 9.1 of the Agreement). Your own use of the Website, and any customer account you hold with us, are covered by our Privacy Policy and our Cookie Policy.

---

3. What we collect

3.1 Identity and contact data: full name, date of birth, the details in your identity documents, e-mail address (which is also your Affiliate Dashboard username), phone number, postal address and messaging handle.

3.2 Company data, if you join as a company: name, registration number, address and tax reference, and the names, dates of birth, identity documents and ownership details of the persons who own or control it.

3.3 Verification data: identity document, proof of address, company documents, questionnaire answers and, if you agree to it, a selfie or liveness check.

3.4 Payment data: the details of your bank account (the holder's name, the bank, the account number or IBAN and the SWIFT/BIC code) or of your USDT wallet (the address and the network); evidence that the account is held in your name or that the wallet is under your sole control; your Approved Balance; and payout records, including amounts, dates, the USD to USDT rate applied, transaction references and statements.

3.5 Tax data: tax residence, tax identification number, VAT or GST registration, the invoices you send us, and any tax forms or withholding records that the law requires.

3.6 Channel and advertising data: the channels, websites, handles and advertising accounts you list; how you plan to promote hi2morrow; the size, main countries and age profile of your audience and the analytics you send us; for paid advertising, the advertising account, ad texts, targeting and keyword lists; and the type, number, holder, issuer and validity of your advertising permits and licences and, if we ask, a copy.

3.7 Content data: the Content you send us for review, which may show your name, face and voice; where and when you plan to publish it; our comments and decisions; and the published versions and their links.

3.8 Program records: the terms that apply to you, including any Separate Agreement and Insertion Order, and the Commission, Campaign Fees, approvals, holds, deductions and payouts recorded for you.

3.9 Technical and tracking data: login details, IP address, device and browser data and your activity in the Affiliate Dashboard; your affiliate ID, your Link and any Code; and the clicks, registrations, purchases and Commission linked to them.

3.10 Review Account data: the account identifier and login details, your name and e-mail address, the orders and trades placed in the account, and technical data such as IP address and device.

3.11 Correspondence: messages between you and us, including those with your Affiliate Manager, and the notes our team keeps about your account.

3.12 Results of checks: sanctions and politically-exposed-person screening, fraud and integrity checks, checks of your channels, permits and Content, and the grounds recorded for any suspension or termination.

---

4. Where the data comes from

4.1 Most of the data comes from you. We also receive data from our affiliate-tracking platform, our trading platform (for your Review Account), identity verification providers, banks, payment providers and the public blockchain on which USDT payouts are recorded, the authorities that issue advertising permits and the registers they publish, and public sources such as your channels, company registers and sanctions lists.

---

5. Purposes and legal grounds

5.1 The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the "PDPL") allows us to process personal data with your consent, or without it in the cases listed in its Article 4. We rely on the following grounds:

5.2 Without your identity, contact, verification and payment data and, when we ask for them, the list of your channels and the details of your advertising permits, we cannot admit you to the Program or pay you. If you do not want a selfie or liveness check, we will offer you another way to verify your identity.

5.3 If you are a director, owner or member of staff of a company affiliate, we process your data to verify the company and to deal with it under its Agreement, relying on the obligations that UAE law places on us where they apply and otherwise on the consent that you give us when the company applies.

5.4 You can withdraw your consent at any time, without affecting processing that took place before.

---

6. Who we share it with

6.1 We do not sell your personal data. We share it only for the purposes in section 5, with:

(a) Track360, our affiliate-tracking platform, provided by Proline Technologies Ltd, which hosts the Affiliate Dashboard, your application and the documents you upload, and the tracking and Commission records, and acts as our processor under a contract with us;

(b) identity verification providers, which check your identity documents and, if you agree, a selfie or liveness check;

(c) the providers of our trading platform and client back office, which host Review Accounts and the payment records against which attribution is checked;

(d) banks and payment providers, including a company of our group that acts as our payment agent and the service we use to send USDT, which may run their own checks, including screening of wallet addresses, under their own terms;

(e) IT and support providers for hosting, e-mail, document storage and customer support, including Intercom for our help centre and support chat, under contracts that require them to keep data secure;

(f) professional advisers, such as lawyers, accountants and auditors, bound by confidentiality;

(g) authorities, such as tax authorities, courts and law enforcement, where the law requires it, and the authority that issued your advertising permit when we check it;

(h) other companies of our group, only where needed to run the Program, including a company that takes over the Program under clause 15.4 of the Agreement; and

(i) a successor or buyer of all or part of our business, to the extent needed to continue or transfer the Program, under a duty of confidentiality.

6.2 USDT payouts are recorded on a public blockchain, where wallet addresses and amounts can be seen by anyone and cannot be erased. Messaging apps such as Telegram process your messages to us under their own terms.

---

7. Data about the people you refer

7.1 Clauses 6.5, 10.1 and 10.3 of the Agreement set out what data about the people you refer you receive and how you treat it. Where a Campaign Fee bonus depends on their trading, we give you only an aggregate figure, and for a group of fewer than ten (10) people only whether the measure has been reached. We process Referred Clients' data under our Privacy Policy.

---

8. International transfers

8.1 We and our service providers may process your data in the UAE and in other countries. We transfer personal data outside the UAE only as the PDPL allows: to a country with an adequate level of protection, under a written contract that binds the recipient to the standards of the PDPL, or where the transfer is necessary to perform the Agreement with you, for example to pay you. You can ask us for details.

---

9. How long we keep it

9.1 We keep data about you while the Agreement is in force and for five (5) years after it ends, to deal with claims and meet our legal obligations. This includes your verification, payout, tax and accounting records, and the records of Content reviews, checks and breaches.

9.2 Where UAE tax law requires us to keep a record for longer, we keep it for as long as that law requires, which for corporate tax is seven (7) years after the end of the tax period the record relates to. If a claim, dispute or request from an authority is still open when a period ends, we keep the data it concerns until it is closed.

9.3 If your application is rejected or withdrawn, we keep it for twelve (12) months, and any records that the law requires us to keep for as long as it requires.

9.4 After that, we delete or anonymise the data. Records of USDT payouts on a public blockchain cannot be deleted (section 6.2).

---

10. Security

10.1 We protect your data with measures suited to the risk, including access limited to staff who need it and encryption in transit. If a breach puts your data at risk, we will tell you and the authorities where the law requires.

---

11. Automated processing

11.1 Our tracking platform attributes clicks, registrations and purchases automatically under clause 4 of the Agreement and applies tracking and fraud rules that may refuse some of them, so that a click, a registration or a purchase may not be credited to you. The fixed rules of the Agreement, such as the approval of Commission at the end of the month following the month of the purchase and the monthly payout from US$50 (clauses 6.1 and 6.2 of the Agreement), are also applied automatically; they follow from the Agreement itself and involve no assessment of you.

11.2 Apart from attribution, we make no decision about you based solely on automated processing. Decisions to reject an application, suspend payouts, forfeit Commission or end the Agreement are taken by a member of our team.

11.3 You can ask at any time for a person to review an attribution result and consider your point of view.

---

12. Cookies

12.1 The Affiliate Dashboard is run by Track360 and reached through hi2morrow.com/affiliates; it uses cookies to keep you signed in and to keep it secure. When someone clicks your Link, a cookie on our Website records the referral, as our Cookie Policy describes.

---

13. Your rights

13.1 Under the PDPL, you can ask us to:

(a) tell you what data we hold about you, how we use it and who receives it, and give you a copy;

(b) give you the data you provided in a machine-readable format, or send it to another organisation where this is technically possible;

(c) correct or complete it;

(d) delete it, subject to section 9;

(e) restrict or stop its use in the cases the law provides, for example while you dispute its accuracy; and

(f) have a person review a decision based solely on automated processing and consider your point of view (section 11.3).

13.2 If you are in India, the Digital Personal Data Protection Act, 2023, where it applies, also lets you ask for a summary of the data we process and of our processing and for the names of those we share it with; have your data corrected, completed, updated or erased; use our grievance process by writing to affiliates@hi2morrow.com; and nominate a person to exercise your rights if you die or become unable to act.

13.3 If you live in Saudi Arabia, the Saudi Personal Data Protection Law may also apply and gives you similar rights, including the right to complain to the Saudi Data and Artificial Intelligence Authority (SDAIA).

13.4 To exercise a right, write to affiliates@hi2morrow.com. We may ask you to confirm your identity and will reply within one month. Deleting data that we need may mean that we can no longer continue the Agreement or pay you.

13.5 You can complain to the UAE Data Office or, in India, to the Data Protection Board of India after using our grievance process.

---

14. Changes to this notice

14.1 We may update this notice. The current version and its date are always shown in the Affiliate Dashboard, and we will tell you about any significant change.