GDPR Notice

1. Scope

This GDPR Notice supplements our Privacy Policy and applies to residents of the European Economic Area (EEA), the United Kingdom (UK), and Switzerland whose personal data is processed by OnlyFunds in connection with the OnlyFunds website, the OF Command Center Extension, the Fully Managed and Self Managed service tiers, and any related software, applications, or APIs (collectively, the "Services").

For these residents, references in this Notice to the "GDPR" mean: (a) Regulation (EU) 2016/679 (the General Data Protection Regulation) for individuals in the EEA; (b) the UK General Data Protection Regulation, tailored by the Data Protection Act 2018, for individuals in the United Kingdom; and (c) the Swiss Federal Act on Data Protection (FADP) for individuals in Switzerland, each as amended.

2. Controller

The controller of your personal data is Foxxx Fitzwell Entertainment LLC (DBA OnlyFunds), 6717 Vista Del Lago Ave, Land O' Lakes, FL 34637, United States. You can contact our data-protection point of contact at privacy@onlyfunds.net.

3. Categories of Personal Data We Process

• Identification & account data — billing email, license key, OnlyFans handle bound to the subscription.
• Payment data — handled by our third-party payment processor(s); for card payments OnlyFunds receives a tokenized reference, last four digits of the card, expiry, brand, country, and billing postal code. Cryptocurrency payments, where offered, are processed by our digital-asset payment processor.
• Application & onboarding data (Fully Managed) — name, jurisdiction, content focus, account access details, and any information you submit during onboarding.
• Communications — emails, support messages, and other correspondence with us.
• Technical & usage data — IP address, browser/extension version, OS, device identifiers, log timestamps, feature-usage events, and error reports.
• Earnings figure — your page's net OnlyFans earnings for the prior calendar month, used to calculate the current month's fee (Self Managed: 10% of the prior month's net earnings per page, read on your device by the extension; Fully Managed: the agreed percentage of the prior month's net earnings, obtained by OnlyFunds from the dashboard it operates for you and billed on the 1st). For Self Managed, no other vault or message data is read.
• Operational data (Fully Managed) — actions taken on your bound OnlyFans page by our team or Automated System and aggregate performance metrics.
• Cookies & analytics signals — see Section 9 of the Privacy Policy.

The OF Command Center Extension used by Self Managed customers does not read, scan, index, or scrape fan messages or OnlyFans vault contents; it selects content to schedule using links the customer expressly associates with the extension. Messaging with fans under the Fully Managed Service is carried out by human personnel using semi-automated, human-in-the-loop tools, and is not performed by autonomous software. Features referred to as "auto," "auto-send," "auto-reply," or "quick reply" require a human to review and send each interactive message.

4. Purposes & Legal Bases

We rely on the following legal bases under Article 6(1) GDPR (and, for any special-category data we may incidentally encounter, Article 9):

• Performance of a contract (Art. 6(1)(b)) — to deliver the Services you have subscribed to, including license validation, billing, support, and Fully Managed engagement work.
• Legitimate interests (Art. 6(1)(f)) — to secure the Services, prevent fraud and abuse, monitor system health, develop and improve the Services, and conduct internal analytics. We have weighed these interests against your rights and believe the processing is proportionate.
• Compliance with a legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, anti-money-laundering, sanctions, and similar legal obligations.
• Establishment, exercise, or defense of legal claims (Art. 9(2)(f), where applicable) — for any data necessary to defend ourselves in legal proceedings.

5. Recipients & Processors

We share personal data only with the categories of recipients described in our Privacy Policy, under written data-processing agreements where required. These include: our third-party payment processor(s); our hosting and database providers; our transactional email provider; error-tracking and observability providers; our professional advisors (such as accountants, auditors, lawyers, insurers, and bankers); and public authorities where disclosure is required by law or lawful process. We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

6. International Transfers

OnlyFunds is established in the United States. When we transfer personal data from the EEA, UK, or Switzerland to the United States or another third country, we rely on:

• The European Commission's Standard Contractual Clauses (Module 1, 2, or 4 as applicable);
• The UK International Data Transfer Addendum to the EU SCCs, where the UK GDPR applies;
• Swiss-recognized SCCs, where Swiss law applies;
• Supplementary technical, organizational, and contractual measures (e.g., encryption in transit and at rest, strict access controls, transparency reporting, and challenges to overbroad government requests) following the recommendations of the European Data Protection Board.

A copy of the relevant transfer mechanism is available on request to privacy@onlyfunds.net.

7. Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected, plus any additional period required to comply with legal obligations, resolve disputes, or enforce our agreements. Specific retention periods are set out in Section 7 of our Privacy Policy. After the retention period expires, data is deleted or anonymized.

8. Your Rights Under GDPR

Subject to applicable conditions and exceptions, you have the right to:

• Access (Art. 15) — obtain confirmation of whether we process your personal data and a copy of that data.
• Rectification (Art. 16) — request correction of inaccurate or incomplete data.
• Erasure / "right to be forgotten" (Art. 17) — request deletion of your data in certain circumstances.
• Restriction of processing (Art. 18) — request that we limit processing in certain circumstances.
• Data portability (Art. 20) — receive personal data you have provided in a structured, commonly used, and machine-readable format, or have it transmitted to another controller where technically feasible.
• Object to processing (Art. 21) — object to processing based on legitimate interests, including profiling, and to direct-marketing processing at any time.
• Withdraw consent (Art. 7(3)) — for any processing based on consent, without affecting the lawfulness of processing already performed.
• Lodge a complaint with your local supervisory authority (Art. 77).

9. How to Exercise Your Rights

Send a request to privacy@onlyfunds.net from the email address associated with your OnlyFunds account, or via post to Foxxx Fitzwell Entertainment LLC (DBA OnlyFunds), 6717 Vista Del Lago Ave, Land O' Lakes, FL 34637, marked "Privacy Request". Include the right(s) you wish to exercise and any details that will help us locate the relevant records.

We respond to verifiable requests within one (1) month, extendable by up to two (2) additional months for complex or numerous requests, in which case we will notify you of the extension and the reasons for it within the first month. Requests are generally provided free of charge; we may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive (in particular, repetitive ones).

We may need to verify your identity before responding. We will not use the verification data for any other purpose.

10. Automated Decision-Making & Profiling

We do not engage in automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. The performance-linked rate computed for Fully Managed pricing is a contractual calculation reviewed by our staff before any commercial decision is made. Messaging and "quick reply" features are semi-automated and human-in-the-loop: a human reviews and sends each interactive message, and no autonomous agent composes messages or conducts conversations with fans.

11. Supervisory Authority & Complaints

You have the right to lodge a complaint with your local supervisory authority. Without limiting that right, you may contact:

• European Union — your member-state Data Protection Authority. A directory is maintained at edpb.europa.eu/about-edpb/about-edpb/members_en.
• United Kingdom — the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint/.
• Switzerland — the Federal Data Protection and Information Commissioner (FDPIC), at edoeb.admin.ch/edoeb/en/home.html.

We would, however, appreciate the opportunity to address your concerns first — please contact us before raising the matter with a supervisory authority.

12. Sensitive Data & Adult Content

Because the Services interact with the OnlyFans platform, some processing may incidentally involve information about your sex life or sexual orientation as defined in Article 9 GDPR. We do not collect such data deliberately. Where we process it, we rely on Article 9(2)(e) (data manifestly made public by the data subject) and/or your explicit consent under Article 9(2)(a). You may withdraw any explicit consent at any time.

13. Updates to This Notice

We may revise this Notice from time to time. The "Last updated" date above reflects the most recent revision. Material changes will be communicated through the Services or by email.

Effective date: May 13th 2026
Last updated: May 13th 2026

14. Contact

Foxxx Fitzwell Entertainment LLC (DBA OnlyFunds)
6717 Vista Del Lago Ave
Land O' Lakes, FL 34637, United States
Phone: +1 (813) 857-3335

Support: support@onlyfunds.net
Billing: billing@onlyfunds.net
Legal: legal@onlyfunds.net
Privacy / GDPR: privacy@onlyfunds.net