cybersight-HUD User Policy & Privacy Agreement

Introduction

The cybersight-HUD application is developed and operated by SINGAPORE CYBERSIGHT TECHNOLOGY PTE. LTD. (hereinafter referred to as "the Company," "we," "us," or "our"). This "User Policy & Privacy Agreement" (hereinafter referred to as "this Policy") is intended to explain to you how we collect, use, store, and protect your personal data, and the rights you have regarding this information. The Company complies with relevant data protection laws, including the European Union's General Data Protection Regulation (GDPR), the United States' California Consumer Privacy Act (CCPA) and its California Privacy Rights Act (CPRA), Japan's Act on the Protection of Personal Information (APPI), South Korea's Personal Information Protection Act (PIPA), and Singapore's Personal Data Protection Act (PDPA). By using the cybersight-HUD application services, you agree to the entire content of this Policy. This Policy is an integral part of the application's terms of service.

Definitions

To facilitate the understanding of this Policy, the following terms are defined as follows:

• This Application: Refers to the cybersight-HUD mobile application software and its related services.
• The Company/We: Refers to SINGAPORE CYBERSIGHT TECHNOLOGY PTE. LTD., the developer and operator of this Application.
• You/User: Refers to the individual user of this Application.
• Personal Data (Personal Information): Refers to any information recorded electronically or otherwise that can, alone or in combination with other information, identify a specific natural person or reflect the activities of a specific natural person. This includes data related to you, such as name, contact information, location information, device identifiers, etc.
• Sensitive Personal Data: Refers to personal data that, if leaked or used improperly, could endanger personal or property safety, or could lead to serious consequences such as damage to personal reputation, physical or mental health, or discrimination. Sensitive data in this Application may include your precise geographical location, cycling tracks, heart rate, and other health data. We will collect and use such data only after obtaining your explicit consent and will provide it with special protection.

Personal Data We Collect

We adhere to the principle of minimum necessity, collecting only the personal data required to provide our services. We do not request or collect information irrelevant to the functions provided, and specifically, we do not collect your mobile phone number. The main types of data we collect include:

• Account Information: When you register for an account with this Application, we may collect your nickname, avatar, and login credentials (such as an email address). We will not require your mobile phone number for registration or verification purposes.
• Cycling and Location Information: To provide core functions such as ride recording and navigation, we will collect your real-time location information (such as GPS location) when you use this Application. We may also collect data related to your exercise, such as cycling tracks, speed, mileage, and biological or motion data from your connected sensor devices (e.g., heart rate, power). This information is used for real-time data display in the HUD, route navigation, and safety alerts. This health and location data is considered sensitive personal data, which we will process and strictly protect only after obtaining your consent.
• Device Information: When you use this Application, we automatically collect some device and system information to ensure the normal operation and adaptation of the service. This information may include your device model, operating system version, unique device identifier, application version, network connection type, and IP address. Collecting this information helps us optimize application performance, improve compatibility, and ensure the security of our services.
• Application Usage Log: We may record your usage of this Application, including feature usage, click behavior, access times and frequency, and other log information, as well as application crash reports or error logs (this information does not contain data that can directly identify you). The collection of such information is for technical necessity and service improvement purposes, helping us to diagnose problems and enhance the user experience. You may choose to refuse the collection of certain information based on technical necessity, but the corresponding service functions may not be available as a result.
• Communication and Feedback: If you contact us via email or in-app customer service, we may collect and store the contact information you provide (such as your email address) and the content of your communication to respond to your inquiries, resolve your issues, or improve our services.
• Payment Information: Not applicable. This Application does not offer any shopping or payment services, so we will not request or process your financial payment information, such as credit cards or third-party payment accounts.

Device Permissions Explained

To achieve the above functions, this Application may require you to grant certain device permissions. For example, location permission is required to record your routes and provide navigation, Bluetooth permission is needed to connect to smart glasses or other cycling devices, and storage permission is used to save ride data. If you refuse to grant the relevant permissions, the corresponding functions of the application will be unavailable, and you may not be able to access the services provided by that function. Please decide whether to grant permissions based on your needs, but refusing may affect your use of some features of this Application.

Cookies and Similar Technologies

We may use Cookies or similar technologies (such as device local storage, pixel tags, etc.) in this Application or on related websites to enhance your user experience. If you do not refuse to accept Cookies, we will set or read Cookies on your device to identify you and save your preferences, thereby providing you with more personalized services. For example, Cookies can help us maintain your login status and remember your language choices.

You have the right to accept or refuse Cookies. Most browsers or devices allow you to modify your settings to refuse Cookies. However, if you choose to refuse Cookies, you may not be able to log in or use services or features that rely on Cookies, and some functions of this Application may be limited as a result. Information collected through Cookies set by this Application will be processed and protected in accordance with this Policy. If we use other similar technologies in the application, we will handle them according to the same principles.

How We Use Personal Data

We use the collected personal data for the following purposes:

• To Provide Core Functions and Services: We use your personal data to provide the main functions of this Application. For example, we use your location information to provide navigation routes and ride records, and your sensor data (such as heart rate) to provide real-time workout feedback and safety alerts. These processing activities are usually necessary to fulfill our service contract with you, enabling you to use the functions and services you request.
• To Maintain, Optimize, and Improve Products: We analyze the collected device information and application usage data to maintain the normal operation of this Application, fix bugs, improve security, and enhance our products and services. For example, we use crash logs to diagnose and resolve application errors and improve interface design based on aggregated usage preferences. This processing is based on our legitimate interest in providing a secure and high-quality service.
• To Communicate with You and Provide Support: We may use your contact information (such as your registered email) to send you important service-related notifications, such as software updates, security alerts, feature changes, or other non-marketing messages. Additionally, when you proactively contact customer support, we will use your information to communicate with you, handle your requests, and provide necessary assistance.
• To Comply with Legal Requirements: When necessary, we may use your information in accordance with legal and regulatory requirements. For example, we may need to retain and provide certain data to fulfill legal obligations, respond to requests from competent authorities, or resolve legal disputes.
• To Ensure Security and Prevent Fraud: To protect your account and our services, we use your information for identity verification, security protection, fraud prevention, and abuse monitoring. For example, we may use device and log information to detect abnormal login attempts or prohibited usage and take necessary measures to protect your account and our systems.
• For Other Purposes with Your Consent: If we intend to use your personal data for other purposes not specified in this Policy, we will seek your prior consent. For example, when using your data for new functions or services, we will inform you of the intended purpose and proceed only after obtaining your explicit consent.

We will not use your personal data to send you marketing and promotional information. In other words, you will not receive any commercial marketing push messages or advertising recommendations through this Application.

Legal Basis for Processing

We process your personal data only on a lawful basis to ensure compliance with legal requirements and respect for your privacy. In most cases, we process your data on one of the following legal bases: (1) **Contractual Necessity:** To fulfill our service agreement with you, such as providing the ride recording function you requested; (2) **Consent:** For certain features you choose to enable or sensitive data you provide (such as health data), we will obtain your explicit consent; (3) **Legitimate Interests:** When necessary for our legitimate business interests, such as improving products, ensuring security, and preventing fraud, provided it does not unreasonably affect your rights; (4) **Legal Obligation:** When we need to comply with legal and regulatory requirements. We will not use public interest or the exercise of official authority as a basis for processing your personal data. If we process your information on other legal bases in the future, we will ensure compliance with relevant laws.

Information Sharing and Disclosure

We place great importance on protecting your personal data and will not provide, sell, rent, share, or trade your personal information to any unrelated third party without your consent. In particular, we will not sell your personal data to third parties for their marketing purposes, nor will we provide your personal data to any third party for free.

We may share or disclose your personal data in the following circumstances:

• Service Providers: We may share your personal data with third-party service providers who perform certain functions on our behalf (such as server hosting, data analysis, etc.). These service providers may only process your data according to our instructions and for the purposes described in this Policy. We will sign strict confidentiality and data protection agreements with them, requiring that they not use your data for other purposes and prohibiting access to your data after the service is completed.
• Legal Compliance and Protection: Where required or permitted by law, we may disclose your personal information based on your personal wishes or legal provisions. For example, when judicial or regulatory authorities make a lawful data request, or when we are convinced it is necessary to comply with applicable laws and regulations, fulfill mandatory legal procedures, enforce this Policy, or protect the rights, safety, and property of us and our users, we will disclose necessary information in accordance with legal provisions.
• Handling of Violations: If you violate applicable laws and regulations or the service terms of this Application, we may disclose your personal information to the extent necessary to competent authorities or affected third parties to handle the breach or prevent further harm. Similarly, to protect the personal and property safety of the Company, you, or other users, we may share necessary information in emergency situations.
• Business Transfers: As our business develops, we may undergo mergers, acquisitions, asset transfers, or bankruptcy liquidation. In such transactions involving the transfer of user information, your personal data may be transferred as one of the assets to the receiving party. We will ensure, to the extent required by law, that the new holder continues to be bound by this Policy or will obtain your separate consent.
• With Your Consent: Except for the situations described above, if we need to provide your personal data to other third parties, we will inform you appropriately and obtain your consent. For example, if sharing your information is required for participating in a joint promotion, we will ask for your authorization.

We will not provide your personal data to any third party for their independent marketing or commercial purposes. Likewise, we do not permit our partners to collect, use, or disclose your personal data without authorization.

Data Storage and International Transfer

We will store your personal data on secure servers for the necessary period. To provide stable services globally, we use a distributed server architecture, and data may be stored and backed up on servers in different countries or regions. Our primary data center is located in the United States, so your personal data may be transferred to the United States for storage and processing, or accessed from your country/region. Additionally, depending on your location and service needs, your data may also be processed on servers in other countries/regions. For example, if you use our services in the European Economic Area (EEA), your data may be transferred outside the EEA for processing.

For cross-border transfers of personal data, we will take necessary protective measures in accordance with applicable laws. For example, for data of EU users, we will implement appropriate protection mechanisms as required by GDPR (such as signing Standard Contractual Clauses, SCCs) to ensure that the data receives an equivalent level of protection abroad. For cross-border transfers regulated by Singapore's PDPA, we will ensure that the receiving party can provide a level of protection no less than that required by the PDPA, or obtain your explicit consent before transferring personal data out of Singapore. Similarly, for legal requirements in Japan, South Korea, the United States, etc., we will ensure compliance with local obligations regarding data export, including obtaining your consent or taking additional security measures when necessary. We commit that regardless of where your personal data is stored, we will take reasonable measures to ensure its security and that such cross-border transfers comply with relevant legal requirements.

Data Retention

We will retain your personal data for the minimum period necessary to achieve the purposes described in this Policy, unless a longer retention period is required or permitted by law. Generally, as long as you continue to use this Application and have not deleted your account, we will retain your personal data to provide you with services (for example, long-term storage of your historical ride data for you to access at any time). Your ride data (including track routes, etc.) will be retained for the duration of your account's existence, unless you actively delete this data or your account. We do this to facilitate your review of historical exercise records and data trends at any time.

When you delete your account or actively request the deletion of your personal data, we will delete or anonymize your personal data as required by law. Specifically, after you submit an account deletion request and pass the necessary security verification, we will securely destroy or de-identify all personal data under your account (including your profile and ride track data), making it impossible to identify and restore. Please note that after deleting your account, all ride records associated with your account will be permanently deleted and cannot be recovered. Please back up any data you wish to save before proceeding.

In exceptional cases, if certain data needs to be retained for a certain period after you delete your account to fulfill legal obligations (such as financial reporting, dispute resolution), we will retain the necessary data only to fulfill such obligations as required by law and will delete it immediately after the respective retention period expires. However, unless otherwise required by law, we will not continue to retain personal data when it is no longer needed for the purposes stated at the time of collection. We will also periodically review the personal data we hold and securely delete or anonymize any data that is no longer necessary to retain.

Data Security

Protecting your personal data is our top priority. We have implemented a variety of industry-standard security measures to protect your personal data from unauthorized access, disclosure, use, modification, or loss. These measures include, but are not limited to, using transport layer encryption (SSL/TLS) to protect data transmission, encrypting sensitive information (such as passwords) for storage, deploying firewalls and intrusion detection systems, protecting against network attacks, and strictly limiting employee and third-party access to data. We also regularly review our information collection, storage, and processing procedures to prevent unauthorized access and use.

Although we have taken strict security measures, please understand that no method of transmission over the Internet or electronic storage is 100% secure. There is no "absolute security" in an information network environment. Therefore, we cannot promise that your personal data will be absolutely secure under all circumstances. However, we will do our best to ensure the security of your personal data. If a security breach of our systems occurs or your information is suspected of being compromised, we will immediately activate our emergency plan, take necessary measures to prevent the security incident from escalating, and notify affected users and regulatory authorities in a timely manner as required by law. Our notification methods may include in-app pop-ups, push notifications, emails, etc., and we will also provide preventive measures recommendations when necessary.

At the same time, we also recommend that you take active measures to protect your personal information, including but not limited to properly securing your account password and avoiding leaking sensitive information such as verification codes to others. Please be sure to use complex passwords and change them regularly. If you discover any security risks to your account or personal data (such as a password leak or abnormal login), please notify us immediately through the contact methods provided in this Policy so that we can assist you in taking timely measures to prevent further losses.

User Rights

According to applicable data protection laws, you have the following rights regarding your personal data:

• Right of Access: You have the right to request confirmation as to whether we are processing your personal data, and you have the right to obtain a copy of the personal data we hold about you. This includes obtaining the specific content of your personal data, as well as understanding the purposes for which we process your data, the types of personal data we hold, the sources of the data, and the categories of parties with whom the data is shared.
• Right to Rectification: If you find that our personal data about you is inaccurate or incomplete, you have the right to request that we correct or supplement it. We will correct the relevant data as required by law after verifying your identity and the accuracy of the new information provided, and will notify any relevant third parties (if required by law).
• Right to Erasure: In certain circumstances, you may request that we delete the personal data you have provided (the "right to be forgotten"). For example, you can request deletion when the information is no longer necessary for the purposes for which it was collected, or when you withdraw your consent for its processing and we have no other legal basis to continue processing it. It should be emphasized that when you delete your account for this Application, we will automatically delete all personal data associated with your account (unless retained for limited circumstances in compliance with legal requirements).
• Right to Withdraw Consent: You have the right to withdraw your consent at any time for any processing of your personal data that you have granted us. For example, you can withdraw your consent for previous data processing by turning off certain optional features in the application settings. We will cease the corresponding data processing activities within a reasonable time. However, please understand that withdrawing consent may result in certain functions that rely on that data no longer being available to you (e.g., withdrawing location permission will disable navigation and track recording functions). The lawfulness of processing based on your consent before its withdrawal is not affected.
• Right to Object: To the extent provided by applicable law, you have the right, based on your particular situation, to object at any time to our processing of certain of your personal data. For example, if we process your personal data based on legitimate interests, you have the right to object. Once you object, we will stop processing the corresponding data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims. Additionally, you always have the right to object to our processing of your personal data for direct marketing purposes, and upon objection, we will cease the relevant processing for marketing within a reasonable period (although, as previously stated, we do not currently use your data for any marketing purposes).
• Right to Restrict Processing: In certain circumstances, you have the right to request that we temporarily restrict the processing of your personal data. For example, when you contest the accuracy of the personal data, you can request that we restrict processing during the verification period; or when you believe our processing is unlawful but do not want the data deleted. During the restriction period, we will only process the restricted data with your consent or for limited purposes such as legal claims.
• Right to Data Portability: For personal data that you have provided to us, you have the right to receive it in a structured, commonly used, and machine-readable format, and, where technically feasible, to request that we transmit this data to another service provider (data controller) designated by you. This right typically applies to data that we process automatically based on your consent or for the performance of a contract. We will assist you in securely transmitting the data directly to you or a third party of your choice.

California Consumer Rights

If you are a California resident, under the CCPA/CPRA, you have the following rights in addition to those listed above:

• Right to Opt-Out of Sale or Sharing of Information: You have the right to direct us not to "sell" or "share" your personal information with third parties (terms as defined in the CCPA/CPRA). As we have committed, we do not sell your personal information. If you wish to formally exercise your right to opt-out of sale/sharing, you can submit a request through our contact methods, and we will comply after verifying your identity.
• Right to Non-Discrimination: We will not refuse to provide services to you, or provide you with different treatment than other users, because you exercise any of your privacy rights. In short, we will not reduce the quality of service, deny service, or charge unreasonable fees as a penalty for exercising your rights. This non-discrimination principle will be strictly followed.

How to Exercise Your Rights: You can contact us at any time via the email address provided in the "Contact Us" section of this Policy to submit your requests for the above rights. To protect your account security, we may verify your identity before processing your request. For example, we may ask you to provide information related to your account to verify your identity. We will respond to your request within the time limit required by law (usually within 30 days of receiving the request, extendable if necessary according to law) and take appropriate action. For reasonable requests, we will provide the service free of charge. However, for repetitive, frequent, or excessive requests, we reserve the right to refuse or charge a reasonable fee as permitted by law.

Additionally, please understand that according to legal regulations, the exercise of some rights may have specific limitations, and we may not be able to respond to your request in the following situations: for example, if we are unable to delete your data due to the need to fulfill legal obligations, or if your request conflicts with public interest, judicial proceedings, etc. In such cases, we will explain to you the reasons why the request cannot be met.

It is worth mentioning that we do not currently engage in any automated decision-making based on user personal data (e.g., decisions that use algorithms to rate users and have a significant impact on their rights). If we plan to implement automated decision-making that will have a significant impact on you in the future, we will inform you of the situation separately before the relevant feature is launched and ensure compliance with legal requirements (including obtaining your consent and providing a channel for manual review when necessary).

Children's Privacy

This Application and its related services are primarily intended for adults or individuals with full civil capacity and are generally not designed for children. We do not knowingly collect personal data from minors (especially children under 13, or minors under 16 in the EU). If you are under the applicable age, please do not register or use this Application, and do not provide us with any personal data about yourself. If local laws set different applicable age standards for the protection of minors, we will follow the relevant regulations.

For minor users who may use this Application with the consent of a parent or guardian, we will only collect and process their personal data after obtaining verifiable consent from a parent or other guardian, and will only use and disclose such information to the extent permitted by law. Guardians should assume the primary responsibility for protecting the privacy of minors.

If we discover that we have inadvertently collected personal data from a child under 13 (or under the age specified in the relevant region) without prior parental or guardian consent, we will take steps to delete the relevant data as soon as possible. If you believe we may hold information from a minor, please notify us through the contact methods provided in this Policy, and we will investigate and handle the matter promptly.

Updates to This Policy

As our services expand or relevant laws and regulations change, we may amend this Policy from time to time. We reserve the right to update this Policy at any time. For example, we may modify this Policy to reflect changes in our information practices or new legal requirements. After this Policy is updated, we will inform you through this Application, official website announcements, or other appropriate means. For material changes (such as changes in processing purposes, types of personal data processed, or your rights), we will notify you in a prominent way before the changes take effect and, where necessary, seek your consent again.

We encourage you to review this Policy periodically for the latest information. Once the updated policy takes effect, if you continue to use this Application's services, you agree to be bound by the revised policy. Before the new policy takes effect, if you do not agree with the revisions, you have the right to stop using this Application and contact us to delete your personal data.

The latest version of this Policy will be available on our website and in the application, and will clearly state the effective date for your reference. If you have any questions or concerns about the modifications to this Policy, you can contact us at any time through the methods provided in the "Contact Us" section, and our staff will be happy to answer your questions.

Contact Us

If you have any questions, comments, or requests regarding the content of this Policy, or wish to exercise your privacy rights, please contact us at:

Company Name: SINGAPORE CYBERSIGHT TECHNOLOGY PTE. LTD.

Address: 190 WOODLANDS INDUSTRIAL PARK E5 #08-13 WOODLANDS BIZHUB (Postal Code: 757516, Singapore)

Privacy Inquiries Email: support@cybersight.sg

We will respond to and resolve your questions as soon as possible after receiving them. Generally, you can communicate with us in English or Chinese. To ensure the security of your information and a timely response to your request, please provide sufficient information to verify your identity and explain your needs when contacting us.

Special Note: The Company has not yet appointed a formal data protection representative in the European Union, nor an independent personal information protection manager in South Korea. If you are located in these regions and have any concerns about your personal data, you can still contact us directly via the email address above, and our global privacy team will handle your inquiry or request directly. Despite not having local representatives, we are still committed to complying with the privacy laws of the EU, South Korea, and other relevant regions and protecting your rights.