3.    Personal Information Sharing and Disclosures

We may disclose personal information that we collect or you provide in the following ways:

• Sharing with consent: with your consent or at your request, we will share your personal data within the scope of your consent/request with specific third parties or categories of third parties authorized or designated by you.

• Sharing with Vesync’s corporate group: we may share your personal information with our subsidiaries, parents, affiliates only for explicit, and legitimate purposes, and the sharing is limited only to information required by services. For example, we verify the global uniqueness of accounts before allowing them to be registered.

• Sharing with service providers: we also may disclose your information to contractors, service providers, or third parties we use to support our business. They usually perform certain business-related functions for us, such as website hosting, data analysis, payment and credit card processing, infrastructure provision, IT services, customer support service, e-mail delivery services, marketing, analytics, and other similar services. These service providers are contractually restricted from using or disclosing the information, except as necessary to perform services on our behalf or to comply with legal requirements.

• Sharing with business partners: some products and/or services are provided to you directly by our partners. (E.g., products sold by third-party sellers through Vesync store, provided by other companies through Vesync’s applications.) When you use third party products and/or services, we may share your information with them to provide you with the products and/or services you request. These third-party services are offered by independent data controllers and their use of your personal data is subject to their respective privacy policies. You should carefully review their policies to determine how they will treat your information.

• Sharing for complying with the law or legal process: we may be required to respond to a subpoena, court order, search warrant, administrative or judicial process, requests by law enforcement agencies, or other requests that we must respond to under applicable law. We may disclose your personal information in response to any of these requirements.

• Sharing for protection of our legal rights and/or those of others: we may disclose your personal information to preserve the security of our mobile applications, website, or social media accounts; resolve disputes; or assess any possible wrongdoing.

• Sharing during asset transfer: to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our App users is among the assets transferred.

• To enforce our rights arising from any contracts entered into between you and us, including the App End User License Agreement, Terms and Conditions of use, and for billing and collection.

• To fulfill the purpose for which you provide it.

• For any other purpose disclosed by us when you provide the information.

We will ensure that the lawfulness of this sharing and, if applicable, sign stringent non-disclosure agreements (NDAs) and/or data processing clauses with the companies, organizations, and individuals with whom personal data is shared, requiring them to comply with this policy and take appropriate confidentiality and security measures when processing personal information.

We may also share Aggregate Data collected about the application and device usage, as long as the data does not identify any specific individuals, to analyze trends about home networking and utility use, to show third parties how their products could work with our products and to generally improve our products and services.

4.    Retention of Personal Information

We will only retain your personal information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. You may delete your Vesync online account at any time. After you delete your online account, Vesync will delete the personal information stored in it, including any stored payment data or personal information collected by smart devices. This (Section 4) does not apply to Aggregated Data.

5.    How We Secure Personal Information

Vesync implements reasonable and appropriate industry-standard security controls to protect personal information in its possession. Vesync’s administrative, physical, and technical safeguards:

• Provide assurances of the integrity and confidentiality of personal information covered by this policy.

• Protect against reasonably anticipated threats or hazards to the security or integrity of personal information, and unauthorized uses or disclosures of such personal information; and

• Facilitate compliance with legal frameworks of requirements under applicable data protection laws.

To this end, we take the following measures:

• We take reasonable and feasible measures to ensure that the personal information collected is minimal and relevant to what is necessary in relation to the purposes for which they are processed. We retain your personal information for no longer than is necessary for the purposes stated in this policy and privacy notice of specific product or service, unless extending the retention period is required or permitted by law.

• We use a range of technologies such as cryptographic technologies to ensure the confidentiality of information in transmission. We implement trusted protection mechanisms to protect data and data storage servers from attacks.

• We deploy access control mechanisms to ensure that only authorized personnel can access your personal information. In addition, we control the number of authorized personnel and implement hierarchical permission management on them based on service requirements and personnel levels.

• We strictly select business partners and service providers and incorporate personal information protection requirements into commercial contracts, audits, and appraisal activities that are at least as stringent as the ones Vesync itself uses, consistent with this policy.

• We hold security and privacy protection training courses or other equivalent publicity activities to raise employees' personal information protection awareness.

The safety and security of your data also depend on you. Where we have given you (or where you have chosen) a password for access to certain parts of our services, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. We urge you to be careful about giving out data in public areas of the App like message boards. The information you share in public areas may be viewed by any user of the App.

Although we do our best to protect your personal information, unfortunately, no security measures can provide absolute protection. To cope with possible risks, such as personal information leakage, damage, and loss, we have procedures in place to deal with suspected data security breaches. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with Contact Information below.

6.    How We Protect Children's Personal Information

a. Marketing and Sales to Adults

The App and services are not intended for children under the age of 16 or the equivalent age as specified by law in your jurisdiction. We do not knowingly collect personal information from children for purposes of marketing or sales. We also do not collect any personal information from children under the age of 16 without their parent’s or guardian’s consent. If we learn we have collected or received personal information from a child without parental consent, we will take steps to delete that information as soon as possible. If you believe that we have unknowingly collected information about a child in connection with our marketing or sales operations, please contact us using one of the methods in the Contact Information below for us to delete it.

b. Personal Information of Children Collected in Connection with the Use of Smart Devices

While our App and services are available only to registered adult users, we recognize that family and household members of registered users may be children. We also recognize that registered adult users may, from time to time, permit their family and household members, including children, to use their Vesync products. For example, parents or guardians of a child may allow their child to use the smart scale or other fitness products and configure their Vesync accounts to track fitness data about their child. Parents or guardians may also add a child’s name, weight, age, and birthday into their Vesync accounts. Therefore, online accounts maintained by Vesync, as used by registered adult users, may include personal information of children. Note, persons under the age of 18, or any higher minimum age in the jurisdiction where that person resides, are not permitted to create Vesync accounts, and we do not ask a child to supply any information to us directly. Rather, a parent or guardian must provide the child’s personal information and consents to the collection and disclosure of their child’s information through his or her account and in accordance with this Privacy Policy.

When children's personal information is collected based on the consent of the parent or guardian, we will only use or disclose the information in accordance with Vesync Privacy Policy for Children. Parents or guardians who need to access, modify, or delete the personal information of their children or people under guardianship can do so directly in their Vesync account. Alternatively, contact us via the channels provided in the Contact Information below.

7.    Exercising Your Rights

If you would like to access the personal account information, and you are a Vesync user, you can log into the App and make the corrections to the personal information in your account profile. By logging into your account and using your account settings, you can also delete your account, which will delete all your personal information and data. Please note, by deleting your account, you will no longer be able to use the App, services, and Vesync products’ smart functionalities. If you need assistance, please contact us by one of the means described in the Contact Information below, and someone on our support team will assist you to correct or update your personal information.

Please keep in mind that in unusual circumstances we may have a legal right or obligation to preserve personal information as it currently exists. For example, if you ask us to delete your transaction data while Vesync is legally obligated to keep a record of that transaction to comply with the law, we may also decline to grant a request where doing so would undermine our legitimate use of data for anti-fraud and security purposes, such as when you request deletion of an account that is being investigated for security concerns. Other reasons your privacy request may be denied are if it jeopardizes the privacy of others, is frivolous or vexatious, or would be extremely impractical. If we do not grant your request upon your personal information, we will communicate with you concerning the reason.

If you wish to adjust your personalized content settings, please use the settings menu in the App. If you wish to opt out of or stop receiving any marketing communications from us, please contact us at one of the mechanisms listed in Contact Information below, or for email communications just use the unsubscribe button at the bottom of the email. Nonetheless, even if you opt out of marketing communications, we will still contact you regarding support, administration, and security of our services and products. You can always choose not to provide information, though not providing such information may mean that you may be unable to make a purchase or to take advantage of certain features of our services.

8.    Notice to California Residents

For California residents, please refer to our Privacy Policy for California Residents.

9.    Notice to Colorado/ Connecticut/ Virginia/ Utah/ Nevada Residents

Colorado, Connecticut, Virginia, and Utah each provide their state residents with rights to:

• Confirm whether we process their personal information.

• Access and delete certain personal information.

• Data portability.

Colorado, Connecticut, and Virginia also provide their state residents with rights to:

• Appeal our denial of requests.

Nevada residents who wish to exercise their sale opt-out rights may submit a request to privacy@vesync.com. However, please know we do not currently sell data triggering that statute's opt-out requirements

10.     Links to Other Parties’ Websites, Products, and Services

The App and services may contain links to third-party websites, products, and services of interest. All links to third-party websites, products, and services are provided for users' convenience only. You need to determine your interaction with such links on your own. We cannot be responsible for the protection and privacy of any information which you provide while visiting or using such third-party websites, products, and/or services and they are not governed by this policy. You should exercise caution and look at the privacy statement applicable in question.

In addition, when you download the App, certain third parties may use automatic data collection technologies to collect information about you or your device. These third parties may include: 1) your mobile device manufacturer, like Apple, Samsung and Google; and 2) your mobile service provider. These third parties may use tracking technologies to collect information about you or your online activities over time and across different websites, apps, and other online services websites. We do not control these third-party tracking technologies or how they may be used. If you have any questions, you should contact the responsible provider directly.

11.     Do Not Track Disclosures

With regard to Do Not Track (DNT), we currently don’t respond to DNT signals in browsers because no DNT standard has been adopted.

12.  Entire Privacy Policy

We may provide you with separate privacy notices for specific products and services, and such privacy notices is incorporated into herein by reference. If there is any inconsistency between privacy notices and this Privacy Policy, the privacy notice shall prevail.

13.  Changes to Our Privacy Policy

Our business changes constantly, and our privacy policy and the terms of use will also change accordingly. We may email periodic reminders of our policy and terms, but you should check our applications of legal & policy frequently to see the most recent changes. Unless stated otherwise, our current privacy policy applies to all data that we have about you and your account(s).

We stand behind the promises we make and will never materially change our policies and practices to make them materially less protective of user information collected in the past without the consent of affected users. However, we may amend this policy from time to time. We will make amendments to the policy by displaying an amended copy on our application of legal & policy, and, if necessary, by sending a notice to you by email. Your continued use of our applications after the revision will constitute your approval of the revised version.

The date the privacy policy was last revised is identified at the top of the page. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically checking our application and this privacy policy for any changes.

14.  Contact Information

Please direct all requests for assistance, questions, or complaints about our privacy practices to our privacy team by email, postal mail, or phone at the following contact data:

Attention:  Privacy Team

Email:  privacy@vesync.com

Postal Address:  1202 North Miller Street, Suite A, Anaheim, CA 92806 US

If you have any concerns or complaints about Vesync’s privacy policies or practices, please provide information relevant to your complaint. Our privacy team will evaluate your concern or complaint based on the information you provide and send you a response. We may need to ask you for additional information to evaluate your concern or complaint. We will promptly investigate and respond to your communications about a complaint. You may have other rights under the law and the right to contact the privacy regulator in your local jurisdiction about your concern or complaint.