DemandFirst Privacy Policy

DemandFirst ("we", "us", "our", or the "Company") is the operator of the B2B cosmetics trade platform accessible at www.demandfirst.app (the "Platform").

We are committed to protecting the personal data of all individuals who interact with our Platform, including registered Users, visitors, and business contacts. This Privacy Policy explains:

• What personal data we collect and why.
• How we process, store, and protect that data.
• Who we share it with and under what conditions.
• Your legal rights and how to exercise them.

This Policy is prepared in compliance with the EU General Data Protection Regulation (GDPR) and, where applicable, the California Consumer Privacy Act (CCPA).

By registering for or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

We collect the following categories of personal data:

• Account & Identity Data — Full name, email address, business name, country of operation, profile photo, phone number (optional).
• Business Profile Data — Company description, product listings, demand needs, certifications, trade zones, specializations, portfolio items.
• Verification Documents — Business registration certificates, identity documents, and compliance certificates submitted during tier verification.
• Transaction Data — Deal values, invoice amounts, payment references, and disbursement records. Raw card data is never stored — all payment processing is handled by Stripe.
• Communication Data — Messages exchanged in Deal Rooms, service request threads, and support tickets.
• Usage & Technical Data — IP address, browser type, pages visited, features used, session duration, and device identifiers.
• Marketing Preferences — Your opt-in/opt-out status for promotional communications.
• ESG & Sustainability Data — Where enabled: product volumes, inventory information, waste reduction estimates, production metrics, shipment information, sustainability inputs and other data submitted by Users or generated through the Platform to support impact estimates, dashboards or sustainability-related analytics.

We collect personal data through the following means:

• Direct submission: When you register, complete your profile, post demands or offers, submit verification documents, or contact us.
• Automated collection: Through cookies, server logs, and analytics tools when you browse the Platform.
• Third-party sources: From Stripe (payment confirmations), AfterShip (logistics events), and authentication providers.
• Business contacts: If a Headhunter or agent adds you as an Expert to their roster, we receive basic profile data about you.

The table below outlines how we use your personal data and the legal basis for each processing activity under GDPR Article 6:

We never sell personal data to third parties for advertising purposes.

We share personal data only in the following circumstances:

• Matched counterparties: Upon a confirmed mutual match, limited profile information (company name, country, tier) is shared with the matching party to facilitate negotiation. Your full identity is masked until both parties accept the match.
• Stripe: Payment processing and escrow management. Stripe acts as a data processor under a Data Processing Agreement (DPA). See stripe.com/privacy.
• AfterShip: Logistics and shipment tracking data shared for delivery confirmation and escrow release.
• Email service providers: Your name and email address are shared solely to deliver transactional and notification emails.
• Analytics providers: Aggregated, pseudonymized usage data for platform performance monitoring.
• Legal authorities: Where required by applicable law, court order, or to protect the rights and safety of users or third parties.
• Business transfers: In the event of a merger, acquisition, or asset sale, personal data may be transferred as a business asset, subject to continued protection under this Policy.

All sub-processors are contractually bound to process data solely on our instructions and maintain appropriate security measures.

We use cookies and similar technologies to operate and improve the Platform. You can manage cookie preferences at any time via our Cookie Policy page.

• Strictly necessary cookies: Required for authentication, session management, and security. Cannot be disabled.
• Functional cookies: Remember your preferences, language settings, and UI configurations.
• Analytics cookies: Collect anonymized data about Platform usage to improve features.
• Marketing cookies: Only placed with your explicit consent.

DemandFirst operates globally. Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA). Where such transfers occur, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Transfers to countries with an EU adequacy decision.
• Data Processing Agreements with all international sub-processors.

You may request a copy of the transfer safeguards we use by contacting privacy@demandfirst.app.

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, and resolve disputes. The table below summarises our standard retention periods:

Upon account closure, we will anonymise or delete personal data within 90 days, except where longer retention is required by law.

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Right of Access (GDPR Art. 15) — Request a copy of all personal data we hold about you.
• Right to Rectification (Art. 16) — Correct inaccurate or incomplete personal data.
• Right to Erasure / 'Right to be Forgotten' (Art. 17) — Request deletion of your data, subject to legal retention obligations.
• Right to Restriction of Processing (Art. 18) — Ask us to pause processing your data in specific circumstances.
• Right to Data Portability (Art. 20) — Receive your data in a machine-readable format.
• Right to Object (Art. 21) — Object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent (Art. 7(3)) — Withdraw marketing consent at any time without affecting prior processing.
• CCPA Rights (California Users) — Right to know, delete, opt-out of sale, and non-discrimination.

To exercise any of these rights, email privacy@demandfirst.app. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority (e.g. the relevant EU Supervisory Authority).

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including:

• End-to-end encryption of Deal Room communications.
• TLS/HTTPS encryption for all data in transit.
• Role-based access controls limiting data access to authorised personnel.
• Regular security assessments and penetration testing.
• PCI-DSS compliant payment processing via Stripe (we never store raw card data).

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, in accordance with GDPR Article 33–34.

The Platform is intended exclusively for business use by adults aged 18 and over. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly.

For all privacy-related inquiries, data subject requests, or to contact our Data Protection Officer:

We reserve the right to update this Privacy Policy at any time. Material changes will be communicated via email or in-platform notification with at least 14 days' notice before taking effect. Continued use of the Platform after that date constitutes acceptance of the updated Policy.