Vika Group Data Protection Policy

Vika Group is committed to protecting the privacy and security of personal data. This policy sets out how we collect, use, store, and protect personal data in compliance with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and applicable data protection laws in our operating jurisdictions.

This policy applies to all personal data processed by Vika Group, including data relating to employees, contractors, investors, business contacts, and website visitors.

Vika Group processes personal data in accordance with the following principles. Personal data must be:

• Processed lawfully, fairly, and transparently;
• Collected for specified, explicit, and legitimate purposes and not processed in a manner incompatible with those purposes;
• Adequate, relevant, and limited to what is necessary for the purposes of processing;
• Accurate and, where necessary, kept up to date;
• Kept in a form that permits identification of data subjects for no longer than necessary;
• Processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage.

Vika Group processes personal data only where a lawful basis exists. The lawful bases we rely on include:

• Contract: Processing necessary for the performance of a contract with the data subject;
• Legal obligation: Processing necessary to comply with a legal obligation;
• Legitimate interests: Processing necessary for our legitimate business interests, where these are not overridden by the data subject's rights;
• Consent: Where the data subject has given clear consent for a specific purpose.

Vika Group collects personal data including, but not limited to:

• Contact information (name, email address, telephone number, job title, organisation);
• Employment and contractor data (CVs, employment history, payroll information);
• Investor and business partner data (identification documents, financial information);
• Website usage data (IP addresses, browser type, pages visited — subject to our Cookie Policy).

Vika Group retains personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law. Retention periods are set out in our Data Retention Schedule, which is reviewed annually.

Data subjects have the following rights under applicable data protection law:

• The right to access their personal data;
• The right to rectification of inaccurate data;
• The right to erasure in certain circumstances;
• The right to restrict processing in certain circumstances;
• The right to data portability in certain circumstances;
• The right to object to processing based on legitimate interests.

To exercise any of these rights, please contact us at the address below.

Vika Group implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures are reviewed regularly and updated as necessary to reflect evolving threats and best practice.

Vika Group operates across multiple jurisdictions. Where personal data is transferred outside the UK or EEA, we ensure that appropriate safeguards are in place, including standard contractual clauses or adequacy decisions where applicable.

For any data protection enquiries, to exercise your rights, or to report a data protection concern, please contact Vika Group at: [email protected]