Effective from: October 28, 2026

PK Central Solutions Korlátolt Felelősségű Társaság (hereinafter: the Controller) is committed to protecting personal data. This notice explains what personal data we process in connection with the services provided under the Voxeon brand and the operation of the voxeonai.com website, for what purposes, on what legal basis and for how long, who can access the data, and what rights you have.

This notice has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter: GDPR) and Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.).

1. Controller Details

• Name: PK Central Solutions Korlátolt Felelősségű Társaság

• Registered office: 2086 Tinnye, Jászfalusi út 5. Building A, Hungary

• Company registration number: 13-09-243827

• Tax number: 32934728-2-13

• Email: info@pkcentralsolutions.com

• Website: https://voxeonai.com

The Controller is not required to appoint a data protection officer. For data protection questions, please contact us at info@pkcentralsolutions.com.

2. Principles

We process personal data lawfully, fairly and transparently, only for specified, explicit and legitimate purposes. We collect only the data necessary to achieve the purpose, keep it accurate, store it only for as long as necessary, and protect it with appropriate technical and organizational measures. We do not sell personal data, and we do not use automated decision-making or profiling in relation to you.

3. Individual Processing Activities

3.1. Requesting a free call-handling audit and consultation (website form)

• Data processed: name, company name, phone number, email address, number of employees, estimated number of daily calls, the call-handling issues indicated, and the time the form was submitted.

• Purpose: responding to the inquiry, scheduling the consultation, carrying out the call-handling assessment and preparing a quote.

• Legal basis: taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR) and the Controller’s legitimate interest in handling business inquiries (Article 6(1)(f) GDPR).

• Retention period: if no contract is concluded, 1 year from the last contact; if a contract is concluded, the period set out in Section 3.4.

• Processors: Make.com (transfer and automated processing of form data), Netlify (technical hosting of the form), Google Workspace (email and document management), ClickUp (client and task management).

3.2. Contact by email and phone

• Data processed: name, email address, phone number, company name, position, content of the inquiry.

• Purpose: answering questions and business discussions.

• Legal basis: the Controller’s legitimate interest (Article 6(1)(f) GDPR) and steps prior to entering into a contract (Article 6(1)(b) GDPR).

• Retention period: 1 year after the inquiry is closed; in the case of a contractual relationship, as set out in Section 3.4.

3.3. Recording of online meetings and phone calls, AI-based note-taking

During online and phone meetings, the Controller may use AI-based note-taking software (Fathom or Bubbles AI Note Taker), which records the audio of the call and generates an automatic transcript and a structured summary from it.

• Data processed: participants’ names, voices and images (for video calls), the content of the conversation in the form of a transcript and summary, and the time and duration of the call.

• Purpose: accurate documentation of meetings, reliable recording of client needs and agreements, quality assurance, and evidence in the event of a legal dispute.

• Legal basis: the Controller’s legitimate interest (Article 6(1)(f) GDPR). We inform participants about the recording at the start of the meeting. You may object to the recording (Article 21 GDPR), in which case the meeting will continue without recording.

• Retention period: 1 year for general business meetings; 5 years from the termination of the relationship for meetings related to a contractual relationship; in the event of a legal dispute, until its final conclusion.

• Processors: Fathom, Bubbles, Google Workspace (Google Meet).

3.4. Data of contractual partners and their contact persons

• Data processed: name, position, email address and phone number of the contracting party and its contact persons, and project-related communication.

• Purpose: concluding and performing the contract, maintaining contact, project management and enforcing claims arising from the contract.

• Legal basis: performance of a contract (Article 6(1)(b) GDPR); with regard to contact persons of legal entity partners, the legitimate interest of the Controller and the partner (Article 6(1)(f) GDPR).

• Retention period: 5 years from the termination of the contract (the general limitation period under the Hungarian Civil Code).

3.5. Invoicing and accounting

• Data processed: the name, address and tax number shown on the invoice, and the details of performance.

• Purpose: fulfilling accounting and tax obligations.

• Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR), under Section 169 of Hungarian Act C of 2000 on Accounting and Hungarian Act CXXVII of 2007 on Value Added Tax.

• Retention period: 8 years from the date the invoice is issued.

• Processors: the invoicing software provider and the accountant.

3.6. Website visits, technical data and cookies

When you visit the website, the hosting provider’s servers automatically log technical data necessary for operation and security (for example IP address, browser type, time of visit, page viewed).

• Purpose: ensuring the secure and proper operation of the website, preventing abuse, and producing aggregated visitor statistics that do not identify individuals.

• Legal basis: the Controller’s legitimate interest (Article 6(1)(f) GDPR).

• Retention period: in line with the hosting provider’s logging practices, up to 1 year.

Beyond the technical solutions strictly necessary for its operation, the website currently does not use marketing cookies or tracking cookies placed by third parties. If such cookies (for example advertising or analytics pixels) are introduced in the future, we will only use them with your prior, explicit consent (Article 6(1)(a) GDPR) and will provide separate information about them on the website. You can delete or block cookies at any time in your browser settings.

3.7. Social media

The website contains links to Voxeon’s TikTok, Instagram, YouTube and LinkedIn pages. These links do not transmit any data from the website; data processing on social media platforms is governed by the privacy policy of the respective platform.

4. AI Voice Agents Operated for Clients

The AI voice agents we develop and operate for our clients process personal data of our clients’ customers (for example name, phone number, conversation content, audio recording, transcript, booking details) on behalf of the client. For these processing activities, the client business is the controller and PK Central Solutions Kft. acts as a processor, under a data processing agreement concluded with the client in accordance with Article 28 GDPR. Information about the processing related to such calls and the exercise of data subject rights is provided in the privacy policy of the respective business, but you may also send your request to us, and we will forward it without delay to the competent controller.

5. Processors and Recipients

The Controller’s employees and contributors have access to personal data only to the extent necessary to perform their tasks. The Controller uses the following processors, who process the data solely in accordance with the Controller’s instructions:

• Framer B.V. (Netherlands): website hosting and operation.

• Google Ireland Limited (Ireland): email, calendar, online meetings (Google Meet) and document management (Google Workspace).

• ClickUp (United States): project, task and client management.

• Fathom (United States): recording online meetings, creating transcripts and summaries.

• Bubbles (United States): recording calls, creating transcripts and summaries.

• Make.com (European Union): transfer and automated processing of form data.

• Netlify (United States): technical hosting of the consultation form.

• Accountant and invoicing provider: accounting and tax tasks.

For voice agents operated for our clients, additional processors (for example providers of speech synthesis, speech recognition, large language models and telephony services) may also be involved; these are listed in the data processing agreement concluded with the client.

We disclose personal data to authorities, courts or other bodies only where required by law.

6. Transfers Outside the European Economic Area

Some of our processors (in particular ClickUp, Fathom, Bubbles and Netlify) are based in the United States, so data may also be stored outside the European Economic Area. Such transfers take place with appropriate safeguards, based on the European Commission’s adequacy decision on the EU–US Data Privacy Framework and the standard contractual clauses approved by the European Commission (Articles 45 and 46 GDPR).

7. Data Security

To protect personal data, the Controller applies appropriate technical and organizational measures, in particular encrypted (HTTPS) connections, user accounts protected by two-factor authentication, role-based access management, and reliable providers that meet GDPR requirements. In the event of a personal data breach, the Controller acts in accordance with Articles 33 and 34 GDPR and, where necessary, notifies the supervisory authority within 72 hours.

8. Your Rights

You have the following rights in relation to the processing of your data:

• Right of access (Article 15 GDPR): you can ask whether we process your personal data and, if so, which data, for what purpose and for how long, and you can request a copy.

• Right to rectification (Article 16 GDPR): you can request the correction of inaccurate data and the completion of incomplete data.

• Right to erasure (Article 17 GDPR): you can request the deletion of your data if it is no longer needed or if the processing is unlawful.

• Right to restriction of processing (Article 18 GDPR): you can request that we only store your data for a certain period and do not otherwise process it.

• Right to data portability (Article 20 GDPR): you can request that the data you provided be transferred to you or another controller in a structured, machine-readable format.

• Right to object (Article 21 GDPR): where processing is based on legitimate interest, you can object to the processing of your personal data at any time.

• Right to withdraw consent (Article 7(3) GDPR): where processing is based on consent, you can withdraw your consent at any time; this does not affect the lawfulness of processing before the withdrawal.

You can send your request to info@pkcentralsolutions.com. We will fulfil or respond to your request without undue delay and in any case within one month; this period may be extended by a further two months where justified. As a rule, this is free of charge. Before fulfilling the request, we may ask for additional information to verify your identity.

9. Remedies

If you believe that the processing of your personal data violates the law, please contact us first so that we can resolve the issue together. You also have the right to lodge a complaint with the supervisory authority:

• Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

• Address: 1055 Budapest, Falk Miksa utca 9–11, Hungary

• Postal address: 1363 Budapest, Pf. 9, Hungary

• Phone: +36 1 391 1400

• Email: ugyfelszolgalat@naih.hu

• Website: www.naih.hu

If your rights are infringed, you may also go to court. The case falls within the jurisdiction of the regional court, and at your choice, proceedings may also be initiated before the regional court of your place of residence or stay.

10. Changes to This Notice

The Controller reserves the right to amend this notice in light of changes in legislation or in its data processing practices. The current version is always available at https://voxeonai.com/legal/privacy-policy.

Tinnye, October 28, 2026

PK Central Solutions Kft.