We use information that we collect about you or that you provide to us, including any personal data, generally based on the following purposes:

We may disclose personal information that we collect or you provide in the following ways:

• Sharing with consent: with your consent or at your request, we will share your personal data within the scope of your consent/request with specific third parties or categories of third parties authorized or designated by you. For example, when you decide to sync your information with other apps such as Apple Health, Google Health, etc.

• Sharing with Vesync’s corporate group: we may share your personal information with our subsidiaries, parents, affiliates only for explicit, and legitimate purposes, and the sharing is limited only to information required by services. For example, we verify the global uniqueness of accounts before allowing them to be registered.

• Sharing with service providers: we also may disclose your information to contractors, service providers, or third parties we use to support our business. They usually perform certain business-related functions for us, such as website hosting, data analysis, payment and credit card processing, infrastructure provision, IT services, customer support service, e-mail delivery services, marketing, analytics, and other similar services. These service providers are contractually restricted from using or disclosing the information, except as necessary to perform services on our behalf or to comply with legal requirements.

• Sharing with business partners: some products and/or services are provided to you directly by our partners. (E.g., products sold by third-party sellers through Vesync store, provided by other companies through Vesync’s applications.) When you use third party products and/or services, we may share your information with them to provide you with the products and/or services you request. These third-party services are offered by independent data controllers and their use of your personal data is subject to their respective privacy policies. You should carefully review their policies to determine how they will treat your information.

• Sharing for complying with the law or legal process: we may be required to respond to a subpoena, court order, search warrant, administrative or judicial process, requests by law enforcement agencies, or other requests that we must respond to under applicable law. We may disclose your personal information in response to any of these requirements.

• Sharing for protection of our legal rights and/or those of others: we may disclose your personal information to preserve the security of our mobile applications, website, or social media accounts; resolve disputes; or assess any possible wrongdoing.

• Sharing during asset transfer: to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our App users is among the assets transferred.

• To enforce our rights arising from any contracts entered into between you and us, including the Terms of Use, and for billing and collection.

• To fulfill the purpose for which you provide it.

• For any other purpose disclosed by us when you provide the information.

We will ensure that the lawfulness of this sharing and, if applicable, sign stringent non-disclosure agreements (NDAs) and/or data processing clauses with the companies, organizations, and individuals with whom personal data is shared, requiring them to comply with this policy and take appropriate confidentiality and security measures when processing personal information.

We may also share Aggregate Data collected about the application and device usage, as long as the data does not identify any specific individuals, to analyze trends about home networking and utility use, to show third parties how their products could work with our products and to generally improve our products and services.

In the preceding twelve (12) months, the Company has shared personal information with the categories of third parties indicated in the chart below.

Disclosure of "Sale" of Personal Data defined in Applicable States in the U.S.

While we don't sell your information for money, it's important to note that the use of cookies or sharing information with advertisers for cross-context behavioral advertising may be considered a "sale" of information in certain states. In this specific context, we are considered to be "selling" information by making personal information available to third parties through third-party website cookies. You have the option to decline these cookies through our cookie banner.

We will only retain your personal information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. You may delete your Vesync online account at any time. After you delete your online account, Vesync will delete the personal information stored in it, including any personal information collected by smart devices, unless under which we are obligated to keep them.

This (Section 5) does not apply to deidentified or Aggregated Data.

Vesync implements reasonable and appropriate industry-standard security controls to protect personal information in its possession. Vesync’s administrative, physical, and technical safeguards:

• Provide assurances of the integrity and confidentiality of personal information covered by this policy.

• Protect against reasonably anticipated threats or hazards to the security or integrity of personal information, and unauthorized uses or disclosures of such personal information; and

• Facilitate compliance with legal frameworks of requirements under applicable data protection laws.

To this end, we take the following measures:

• We take reasonable and feasible measures to ensure that the personal information collected is minimal and relevant to what is necessary in relation to the purposes for which they are processed. We retain your personal information for no longer than is necessary for the purposes stated in this policy and privacy notice of specific product or service, unless extending the retention period is required or permitted by law.

• We use a range of technologies such as cryptographic technologies to ensure the confidentiality of information in transmission. We implement trusted protection mechanisms to protect data and data storage servers from attacks.

• We deploy access control mechanisms to ensure that only authorized personnel can access your personal information. In addition, we control the number of authorized personnel and implement hierarchical permission management on them based on service requirements and personnel levels.

• We strictly select business partners and service providers and incorporate personal information protection requirements into commercial contracts, audits, and appraisal activities that are at least as stringent as the ones Vesync itself uses, consistent with this policy.

• We hold security and privacy protection training courses or other equivalent publicity activities to raise employees' personal information protection awareness.

The safety and security of your data also depend on you. Where we have given you (or where you have chosen) a password for access to certain parts of our services, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. We urge you to be careful about giving out data in public areas of the App like Forum. The information you share in public areas may be viewed by any user of the App.

Although we do our best to protect your personal information, unfortunately, no security measures can provide absolute protection. To cope with possible risks, such as personal information leakage, damage, and loss, we have procedures in place to deal with suspected data security breaches. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with Contact Information below.

The Websites, App, and services may contain links to third-party websites, products, and services of interest. All links to third-party websites, products, and services are provided for users' convenience only. You need to determine your interaction with such links on your own. We cannot be responsible for the protection and privacy of any information which you provide while visiting or using such third-party websites, products, and/or services and they are not governed by this policy. You should exercise caution and look at the privacy statement applicable in question.

In addition, when you download the App, certain third parties may use automatic data collection technologies to collect information about you or your device. These third parties may include: 1) your mobile device manufacturer, like Apple, Samsung and Google; and 2) your mobile service provider. These third parties may use tracking technologies to collect information about you or your online activities over time and across different websites, apps, and other online services websites. We do not control these third-party tracking technologies or how they may be used. If you have any questions, you should contact the responsible provider directly.

We share your personal data within the Vesync. Where personal data originated in the EEA, this will involve transferring your data outside the EEA. Whenever we transfer personal data to countries outside of the EEA, we will ensure that the data is transferred in accordance with this Privacy Policy and as permitted by the applicable laws on data protection. Our commitment includes ensuring that an equivalent level of protection is afforded to it by ensuring appropriate safeguards are implemented in the form of specific contracts approved by the European Commission. Please contact us if you want further information on the transfer of personal data out of the EEA.

With regard to Do Not Track (DNT), we currently don’t respond to DNT signals in browsers because no DNT standard has been adopted.

We may provide you with separate privacy notices for specific products and services, and such privacy notices are incorporated into herein by reference. If there is any inconsistency between privacy notices and this Privacy Policy, the privacy notice shall prevail.

Our business changes constantly, and our privacy policy and the terms of use will also change accordingly. We may email periodic reminders of our policy and terms, but you should check our applications of legal & policy frequently to see the most recent changes. Unless stated otherwise, our current privacy policy applies to all data that we have about you and your account(s).

We stand behind the promises we make and will never materially change our policies and practices to make them materially less protective of user information collected in the past without the consent of affected users. However, we may amend this policy from time to time. We will make amendments to the policy by displaying an amended copy on our Websites and App, and, if necessary, by sending a notice to you by email. Your continued use of our applications after the revision will constitute your approval of the revised version.

The date the privacy policy was last revised is identified at the top of the page. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically checking our application and this privacy policy for any changes.

Please direct all requests for assistance, questions, or complaints about our privacy practices to our privacy team by email or postal mail at the following contact data:

Attention:  Privacy Team

Email:  support@vesync.com

Postal Address:  1202 North Miller Street, Suite A, Anaheim, CA 92806 US

If you are EEA and UK users, please contact us via the following address:

Legal representative in EEA: ETEKCITY GmbH

Postal Address: Vossbarg 1,25524 Itzehoe, Germany

Legal representative in the UK: Vesync (UK) Co., Ltd

Postal Address: Unit G2 Havebside Industrial Estate, Fishtoft Road, Boston, PE21 0AH, United Kingdom

If you have any concerns or complaints about Vesync’s privacy policies or practices, please provide information relevant to your complaint. Our privacy team will evaluate your concern or complaint based on the information you provide and send you a response. We may need to ask you for additional information to evaluate your concern or complaint. We will promptly investigate and respond to your communications about a complaint. You may have other rights under the law and the right to contact the privacy regulator in your local jurisdiction about your concern or complaint.