PROSENIQ CUE CONTROL - PRIVACY POLICY Effective date: 27 September 2026 Version: 2026-09-27 1. CONTROLLER Data controller: Proseniq™ / Heinz Marc Schneider NIF: Y0157895Z Lugar San Ambrosio 9888 11159 El Palmar (Vejer de la Frontera) Spain Email: info@proseniq.com No Data Protection Officer has been appointed because Cue Control does not currently involve processing for which appointment of a DPO is known to be mandatory. If this changes, the current contact information will be published in the official privacy notice. 2. SCOPE This policy describes personal-data processing directly associated with Proseniq Cue Control, including licensing/activation, customer support, Gumroad-based license provisioning and the security/operation of the license service. Where Cue Control PRO is purchased through Gumroad, Gumroad handles the sale as Merchant of Record for its own transaction, payment, tax, fraud/risk and compliance purposes under Gumroad's own privacy terms. Proseniq remains the publisher/licensor of Cue Control and separately processes the limited buyer and license data required to provide, assign, activate and support the software license. Ordinary local show playback does not require Proseniq to receive the contents of Cue Control show projects or user media. 3. DATA PROCESSED Depending on the edition and activity, Proseniq may process: - customer email address where associated with a license, Gumroad purchase or support request; - for Cue Control PRO purchases processed through Gumroad: Gumroad sale ID, product identifier/name and the time at which the purchase is processed or assigned to a Proseniq license, where these fields are required for license provisioning, duplicate-assignment prevention and purchase documentation; - SHA-256 hash/derived representation of the license serial used by the licensing service; the desktop activation request does not transmit the plaintext serial; - a pseudonymous SHA-256 machine identifier derived locally from system information. On production Windows systems the raw MachineGuid is not sent to the server; - license ID, activation ID and activation-slot information; - activation, deactivation and last-seen timestamps; - Cue Control client/version information; - a SHA-256 hash of the source IP address created by the activation server for security/fraud-prevention purposes; - ordinary server/security logs generated by the hosting environment; and - information voluntarily supplied in support, security or legal enquiries. Proseniq does not intentionally copy or store payment-card details in the Cue Control licensing database. Billing/payment data required to complete a Gumroad purchase are processed by Gumroad for its own Merchant-of-Record functions. Proseniq limits its own purchase-to-license processing to data needed for license provisioning, support, fraud/duplicate-assignment prevention and legal documentation. Source of Gumroad purchase data: where Proseniq does not collect purchase data directly from the buyer, the source is Gumroad. The relevant data categories are described above. This notice is intended to provide the information required for that indirect collection in addition to any notice shown at checkout or in purchase/licensing communications. Manually granted licenses: where a license is granted outside Gumroad, Proseniq may process a name and/or email address, license identifier, grant/assignment date and necessary activation data to administer the license, provide support and document entitlement. Gumroad purchase data do not arise for those licenses. 4. PURPOSES AND LEGAL BASES Data may be processed for the following purposes: a) Contract/licensing administration, Gumroad purchase-to-license assignment and activation Purpose: receive or retrieve the limited Gumroad purchase data needed for license delivery, associate a purchase with a Cue Control PRO license, prevent duplicate assignment, validate a purchased/granted license, enforce activation limits, issue a signed machine-bound license and process deactivation. Legal basis: performance of the applicable purchase/license contract or steps requested by the user before/while performing that contract (Article 6(1)(b) GDPR). b) Security, abuse and fraud prevention Purpose: protect the licensing service, prevent unauthorized activation or abuse, investigate technical/security incidents and preserve service integrity. Legal basis: Proseniq's legitimate interests in securing its software, systems and contractual licensing model, balanced against user rights; where a legal obligation applies, that obligation may also provide the basis. c) Customer support and legal claims Purpose: answer support requests, resolve licensing problems and establish, exercise or defend legal claims. Legal basis: contract, legitimate interests and/or legal obligations as applicable. d) Compliance and security reporting Purpose: comply with applicable tax, accounting, cybersecurity, product, consumer or other legal obligations, including mandatory security-incident reporting where applicable. Legal basis: compliance with legal obligations. 5. AUTOMATED CHECKS The activation service automatically checks whether a serial hash corresponds to an active license and whether the permitted activation slots are already in use. This is a technical licensing decision, not profiling for advertising. If an activation is refused and you believe the result is incorrect, contact info@proseniq.com for human review. 6. RECIPIENTS / PROCESSORS Gumroad, Inc. is used for the sale/distribution of Cue Control PRO. Gumroad acts as an independent controller for its own Merchant-of-Record processing, including payment processing, payouts, fraud/risk management, tax collection/reporting, compliance and operation of its services. To the extent Gumroad stores or otherwise processes buyer information on Proseniq's behalf for seller-side functions, Gumroad's Data Processing Addendum applies and Gumroad acts as processor for that Seller Data. Other data may be accessible to service providers that are necessary to operate Cue Control, such as hosting/infrastructure providers or professional advisers, subject to applicable contractual and data-protection requirements. Data may also be disclosed where required by law or to competent authorities. Proseniq does not sell personal data. 7. INTERNATIONAL TRANSFERS Gumroad is headquartered in the United States and may process Seller Data in the United States and in locations used by its subprocessors. For transfers of Seller Data from the European Economic Area to a country or recipient not covered by an applicable adequacy decision, Gumroad's current Data Processing Addendum incorporates the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) as the transfer mechanism for controller-to-processor transfers where required. Other service providers may also process personal data outside the European Economic Area. Where required, Proseniq will rely on an applicable GDPR transfer mechanism, such as an adequacy decision or appropriate contractual safeguards. Information about material providers or safeguards can be requested at info@proseniq.com. 8. RETENTION Proseniq applies the following operational retention rules to the Cue Control license service unless a longer period is required for a legal claim, security incident or mandatory record-keeping obligation: - active license records: for as long as the license remains active and as necessary to administer the license; - Gumroad purchase-to-license records used by Proseniq (such as buyer email, sale ID, product identifier/name and assignment/processing timestamp): for as long as reasonably necessary to administer the license, document entitlement, prevent duplicate assignment, handle support/fraud disputes and comply with applicable limitation or legal record-keeping obligations; once no longer required, they are deleted or anonymized where appropriate; - active activation records: while the activation remains active; - deactivated activation records: normally deleted after 24 months; - activation IP hashes: normally cleared after 90 days; - customer/support correspondence and license-account data: for as long as necessary for the contractual relationship and thereafter only for applicable limitation, tax/accounting, fraud-prevention or legal-record obligations; - hosting/security logs: according to the configured hosting/security retention period and no longer than necessary for the stated security purpose, unless a specific incident requires preservation. A maintenance script supplied with the license backend implements the 90-day IP- hash clearing and 24-month deactivated-activation deletion policy. It must be scheduled on the production server for those periods to be enforced. 9. LOCAL DATA Cue Control stores the signed local machine license and local application state on the user's computer. Project/show files and media ordinarily remain local unless the user independently transfers, uploads or backs them up elsewhere. 10. DATA SUBJECT RIGHTS Subject to the conditions in the GDPR and applicable Spanish law, you may have the right to request access, rectification, erasure, restriction of processing, data portability and/or to object to processing. You may also have the right to withdraw consent where processing is based on consent; withdrawal does not affect prior lawful processing. Requests may be sent to: info@proseniq.com You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD): https://www.aepd.es/ 11. SECURITY Proseniq uses technical and organizational measures appropriate to the nature of the processing. License serials are represented server-side by SHA-256 hashes, machine-bound licenses are digitally signed, and the desktop application does not transmit the raw Windows MachineGuid. No security measure can guarantee absolute security. 12. CHILDREN Cue Control is professional show-control software and is not directed at children. Proseniq does not intentionally use the licensing service to collect children's data. 13. CHANGES This policy may be updated when the product, service providers or legal requirements change. Material changes will be reflected by an updated effective date and, where legally required, by additional notice or renewed consent. 14. CONTACT Proseniq™ / Heinz Marc Schneider Lugar San Ambrosio 9888 11159 El Palmar (Vejer de la Frontera) Spain NIF: Y0157895Z Email: info@proseniq.com