ExactFlow p.s.a. AI Usage Disclosure

ExactFlow builds and deploys AI systems in accordance with the following principles, drawn from the EU AI Act and OECD AI Principles:

• Human oversight — all AI Agent outputs that carry material business consequences require human review before execution
• Transparency — we disclose when AI is involved in decisions affecting Clients, users, or end customers
• Accuracy and robustness — our AI systems are tested, monitored, and improved continuously
• Privacy by design — AI systems process only the minimum data necessary for each function
• Non-discrimination — AI outputs are monitored for disparate impact and corrected where identified
• Accountability — ExactFlow maintains documentation and governance records for all AI systems

ExactFlow operates six proprietary AI Agents embedded in the SaaS Platform. These are purpose-built decision-support tools, not general-purpose AI models. All six Agents are deployed in an assistive capacity — they augment human decision-making, they do not replace it.

None of ExactFlow's AI Agents are classified as high-risk AI systems under Annex III of the EU AI Act in their standard Marketplace and Platform deployment context. ExactFlow conducts an annual AI risk classification review. If a deployment context changes in a way that triggers high-risk classification, ExactFlow will notify affected Clients and implement the additional obligations required under the EU AI Act.

Each AI Agent processes personal data only within the scope described below. All AI Agent processing of personal data is governed by ExactFlow's Privacy Policy and, where ExactFlow acts as Data Processor on the Client's behalf, by the Data Processing Agreement (DPA).

ExactFlow confirms that none of its AI Agents make solely automated individual decisions that produce legal effects or similarly significantly affect individuals, within the meaning of GDPR Article 22. Specifically:

• Account suspension decisions involve human compliance officer review
• Refund approvals or rejections above configured thresholds require human authorization
• Fraud flags generated by AI systems are reviewed by a human team before any enforcement action is taken
• Employment-related recommendations from Nia require documented human sign-off
• Creditworthiness or payment risk assessments are not made solely by AI systems

Where automated systems generate a flag, score, or recommendation that leads to a decision affecting an individual, that individual may request human review of the decision by contacting privacy@exactflow.com. We will respond within one calendar month.

Where Clients deploy Axel as a consumer-facing AI chatbot or messaging agent, the following transparency obligations apply in compliance with EU AI Act Article 50:

• Axel must be configured to identify itself as an AI system when a natural person directly and sincerely asks whether they are interacting with a human or an AI
• Clients must not configure Axel to deny being an AI system or to claim to be human
• Where Axel is deployed in a context that could deceive a reasonable person into thinking they are communicating with a human, a visible AI disclosure label must be displayed
• ExactFlow provides Clients with compliant disclosure templates and configuration guides in the Platform's AI Governance section

Clients are responsible for ensuring that their deployment of Axel complies with the transparency requirements of the EU AI Act and any applicable national implementing measures. ExactFlow provides the technical capability for compliance — the responsibility for correct configuration sits with the Client.

ExactFlow's AI Agents are designed with mandatory human oversight mechanisms. Clients must not disable or circumvent these mechanisms. Key human oversight requirements are:

ExactFlow continuously improves its AI Agents. Where an update materially changes an Agent's behaviour, capabilities, or data processing in a way that affects Clients or their customers, ExactFlow will:

• Provide at least 14 days' advance notice of material AI Agent changes via Platform dashboard and email
• Publish release notes describing the nature of the change and any new human oversight requirements
• Update this AI Usage Disclosure and the DPA sub-processor schedule where relevant
• Provide a testing period in the sandbox environment before material changes go live in production

ExactFlow maintains the following AI governance structures:

• An internal AI Governance Committee responsible for AI risk assessment, policy, and incident response
• An AI system register documenting the purpose, technical approach, training data sources, known limitations, and human oversight mechanisms for each AI Agent
• Annual AI risk classification reviews under the EU AI Act framework
• A responsible AI incident response procedure for cases where AI outputs cause harm or behave unexpectedly
• A public point of contact for AI-related queries: ai-governance@exactflow.com

If you are an individual whose personal data is processed by ExactFlow's AI Agents, you have the following rights:

• Right to explanation: request an explanation of how an AI-assisted decision was reached
• Right to human review: request that a human reviews any AI-assisted decision that significantly affects you
• Right to object: object to processing of your personal data by AI systems based on legitimate interests under GDPR Article 21
• Right to erasure: request deletion of your personal data from AI system logs, subject to legal retention obligations
• Right to complain: contact the UODO (www.uodo.gov.pl) if you believe AI processing of your data breaches the GDPR

Exercise these rights by contacting privacy@exactflow.com or ai-governance@exactflow.com. We will respond within one calendar month.

— END OF AI USAGE DISCLOSURE — EXACTFLOW P.S.A. —