Privacy Policy
‍

Last Updated: September 18, 2025
‍

Thank you for visiting the Korro AI website. This Privacy Policy outlines how we process and protect your personal data, as well as your rights under applicable data protection laws.

For further information on this policy and how we process your data, contact us at privacy@korro.ai
‍

1. Who are we?

In this policy, “Korro AI”, “we” or “us” refers to Korro AI Limited, 2nd Floor, 167-169 Great Portland St, London W1W 5PF, United Kingdom. We are the data controller under the applicable privacy laws.
‍

2. What Data Do We Collect and How Do We Use It?

In the following section, you will find information on how we collect your personal data, what data is collected, its uses and the legal basis upon which it is processed.
‍

2.1 Website Access and Technical Services

When you visit our websites, our web server briefly assesses usage data for statistical purposes to enhance our website's quality. This data includes:

• Name and address of the requested content (URL).
• Date and time of the request.
• Amount of data transferred.
• Access status (e.g., content delivered, error messages).
• Technical details about the browser, operating system, and device used.
• The referring URL (the web page from which you arrived).
• Your IP address (stored temporarily to detect, limit, and investigate malicious access attempts).

We process this data based on our legitimate interest in ensuring the technical functionality, security, and compatibility of our website across devices and browsers. To achieve this, we rely on essential technical services such as hosting providers, content delivery networks (CDNs), and DDoS protection solutions. These services are strictly limited to operational purposes and do not involve analytics or user profiling.
‍

2.2. Embedded Third-Party Content

Some pages of our website include integrations from third-party providers to support enhanced, but non-essential, functionality. These include features such as embedded video playback, interactive content previews, localized web storage, and performance optimization tools.

When you access pages that include such integrations, technical data (such as your IP address, browser information, and usage metadata) is transmitted to the respective third-party provider. These services may also make use of web storage mechanisms, such as cookies or local storage, to function correctly or to collect additional usage data.

As these services are not strictly necessary for the operation of our website, we will only activate them once you have provided your consent via our cookie and consent banner. You may withdraw or modify your consent preferences at any time by accessing the cookie settings via the cookie symbol at the bottom-left of the website.
‍

2.3. Cookies and Similar Technologies

Our website uses cookies and similar technologies (like pixels, tags, web beacons, and other identifiers) to provide basic functionality, measure performance, and personalize content. Cookies are small text files stored on your device when visiting a website. We use different types of cookies:

• Essential cookies: These cookies are essential for the operation of our website. Without these cookies, our site may not be displayed optimally, some functions are no longer available, and security may be compromised. These cookies also enable services you have specifically asked for. The use of essential cookies is based on our legitimate interest of displaying a functional website.
• Analytics Cookies: These help us understand how visitors interact with the site by collecting and reporting usage data. We use third-party vendors like Amplitude to monitor site performance, user behaviour, and engagement across sessions.
• Functional Cookies: These cookies enable non-essential functionalities that enhance the user experience but are not strictly necessary for the website to operate. For example, they can store user preferences (such as language or display settings) or enable enhanced interaction with embedded content (such as maps). Some of these features are provided through third-party services.

The use of non-essential cookies is legally based on your consent, which you can freely give. For this purpose, we use a consent banner that stores your preferences. You can easily review the cookies currently in use, revoke your consent, and adjust your consent settings at any time by clicking on the cookie symbol at the bottom-left of the website.
‍

2.4. Analytics and Tracking Tools

We use analytics tools to better understand how visitors use our website and improve our services. For this effect, we rely on third-party vendors like Google Analytics, Amplitude, or Microsoft Clarity which may collect:

• Browser type, operating system, and IP address
• Session duration, pages visited, interactions
• Device and traffic source information

This processing is based on your consent through our consent banner. You may withdraw your consent at any time by revisiting the banner settings via the cookie symbol at the bottom-left of the website.
‍

2.5. Contact Requests

If you contact us by email, post, or telephone, we will process the personal data you provide, such as your full name, postal address, email address, and telephone number, as applicable, to handle your inquiry.

You may also reach us via the contact form on our website, which requires completion of the mandatory fields marked with an asterisk (*). We process the information submitted through the form exclusively for the purpose of reviewing and responding to your request.

The legal basis for this processing is:

• Our legitimate interest in managing and responding to incoming communications;
• Where your inquiry relates to the potential conclusion of a contract, pre-contractual measures;
• If your submission contains information about children or special categories of personal data (like health data), we will request your explicit consent at the point of submission. You may withdraw your consent as described in the section about Your Rights.

Your data will be deleted once it is no longer required for these purposes, unless we are legally obliged to retain it.

You have the right to object to the processing of your personal data for these purposes at any time. For more information, please refer to the section on Your Rights.
‍

2.6. Booking a Demo

You can schedule a demo directly through our website by clicking the “Book a Demo” button. This will redirect you to a scheduling tool provided by a third-party service provider.

When you schedule a demo, we receive the personal data you provide during the booking process, which typically includes your full name, email address, the company you represent, and the names or contact details of any additional participants you choose to include.

We use this data to coordinate and conduct the demo session, and to follow up on your interest in our services. The legal basis for processing is our legitimate interest in responding to your request.
‍

2.7. Job Applications

When you apply for a job vacancy, we process the personal data you provide, including full name, address, resume, and any other documents submitted as part of your application. This data is used solely to process your application. The legal basis is that the processing is necessary to take steps prior to entering an employment contract with you.

If you wish to be considered for future vacancies, you can explicitly consent to be included in our talent pool. The legal basis for storing application documents and contacting you for suitable vacancies is your consent. If at any time you wish to withdraw consent for future processing, please follow the instructions in the section about your rights.
‍

2.8. Korro Portal

The processing of your personal data in the Korro Portal is covered by the Korro Portal Privacy which you can access https://privacy.korro.ai .
‍

3. How Long Do We Keep Your Personal Data?

Korro AI retains your personal data for the purposes listed above in the section “What Data Do We Collect and How Do We Use It”. Your personal data will be retained as long as it is necessary to fulfil the specific purpose for which it was collected, unless there is a legal obligation to keep it for longer.

We retain personal data collected via our web forms and used for customer communications for no longer than one (1) year after your last interaction or engagement with us, unless an ongoing business relationship justifies longer retention.

For unsuccessful applicants the retention will depend on local legal requirements (typically 6–12 months) , unless consent is provided to retain for longer. For successful applicants the personal data contained in your application will become part of your personnel file.

In specific cases, a longer retention of your personal data might be required according to legal obligations.
‍

4. Transfers and Disclosures

To support the activities described in this policy, we may transfer your personal data to our affiliates, service providers or partners. These may include but are not limited to other Korro entities, as well as third-party vendors contracted to perform specific functions on our behalf, such as hosting, security vendors, communication tools, analytics, customer support, or recruitment platforms.

We share only necessary personal data required for the third parties to complete the tasks at hand, and all recipients are contractually bound to process the data securely and solely for the intended purpose. Korro does not sell your data to any third parties.

We may also be required to disclose your personal data to government or law enforcement officials in response to a lawful request by a public authority or if we have

to do so to comply with a legal obligation, including to meet national security or law enforcement requirements.

We can also disclose your information based on our legitimate interest where necessary to establish, exercise, or defend legal claims; to enforce our terms and conditions; to protect the rights, safety, or property of Korro, our users, or others; or to prevent fraud or other illegal activities.

Where data recipients are in countries that do not offer the same level of data protection as your own, we ensure that appropriate safeguards are in place. This may include adequacy decisions or standard contractual clauses, as required under data privacy law. We may also ask for your consent for the purpose of transferring data internationally.

‍

5. Your Rights

Depending on the jurisdiction where you are located, you have the following rights with respect to the processing of your personal data, subject to the conditions and limitations set out in your locally applicable data protection laws.

• Access: You have the right to obtain confirmation as to whether we process your personal data. Where that is the case, to request access to that personal data and information about its processing.
• Rectification: You may request the correction of inaccurate personal data.
• Erasure: You have the right to request that we delete your personal data under certain circumstances, e.g., if your personal data is no longer necessary for the purposes for which it was collected.
• Restriction of processing: You may request that we restrict the processing of your personal data, either temporarily or permanently, under certain conditions.
• Object: You have the right to object to the processing of your personal data under certain circumstances. In particular, if we process your personal data on the legal basis of legitimate interests or if we use it for marketing purposes.
• Data portability: You may request a copy of your personal data in a structured, commonly used, and machine-readable format, and to have that data transmitted to another data controller, where technically feasible.
• No Automated Decision-Making: We do not use your personal data to make decisions based solely on automated decision making (decisions without human involvement), including profiling, where the decision would have a legal effect on you or produce a similarly significant effect.
• Withdrawal of consent: Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

You can exercise your rights at any time by contacting us at: privacy@korro.ai

In addition, you have the right to lodge a complaint with a competent data protection authority if you believe that the processing of your personal data violates applicable data protection laws. If you are located in the European Union, a list of national

supervisory authorities is available at: https://edpb.europa.eu/about-edpb/about- edpb/members_en
‍

6. Questions?

If you have any comments or questions about this Privacy Policy, please contact us at complaint privacy@korro.ai

You may also contact our data protection officer:

FIRST PRIVACY GmbH

Konsul-Smidt-Straße 88 E-Mail: office@first-privacy.com

28217 Bremen, Germany www.first-privacy.com
‍

7. Changes to this privacy policy

We may amend this Privacy Policy occasionally and will provide you with prominent notice of any material changes.