How we handle
your data.

This Privacy Policy ("Privacy Policy") describes how INFUN TECH LIMITED ("Company", "we" or "our") collects, uses, and discloses Personal Data (as defined below), in connection with:

• Visitors of our website available at www.KTRLpatch.com and other digital pages we own and operate that direct to our website, and any content, features or services included therein ("website" and "Visitors", respectively);
• Individuals who have placed an order to purchase our KTRL Smart Patch products ("Consumers" and "Product" respectively) through our website.

Visitors and Consumers shall be further referred to herein as "you" and "your". The website and any services provided therein including order placement shall be further referred to herein as "Services".

This Privacy Policy further explains how we safeguard your Personal Data, how such data may be used or shared with others, and how you may exercise your rights related to your Personal Data, as required under applicable data protection laws.

This Privacy Policy is an integral part of our Terms and Conditions (collectively the "Terms"). Any capitalized terms not defined herein shall have the meaning ascribed to them in the Terms and Conditions.

The types of Personal Data we receive and collect depend on which Services you use and how you use them. Any Personal Data you provide is made at your free will and consent (where required under applicable data protection legislation), and you acknowledge that you are not under any statutory obligation to provide us with Personal Data. However, we must collect or receive some Personal Data to provide the Service, and if you will not provide us with such Personal Data, we will not be able to fulfill certain purposes — for example, provide certain Services — all as described under Section 4 below "Data We Collect & Purpose of Collection and Use" which details the purposes for which each Personal Data set is collected.

This Privacy Policy further includes or incorporates specific information required under applicable data protection laws for residents of certain jurisdictions.

We reserve the right to amend this Privacy Policy from time to time, at our sole discretion. The most recent version of this Privacy Policy will always be posted on the website and the update date will be reflected in the "Last Updated" heading. We will provide notice to you if these changes are material, and, where required by applicable law, we will obtain your consent. Any amendments to the Privacy Policy will become effective immediately, unless we notify otherwise. We recommend you review this Privacy Policy periodically to ensure that you understand our most updated privacy practices.

INFUN TECH LIMITED is the "data controller" (as such term is defined under privacy legislation) of the Personal Data collected by us, as detailed under this Privacy Policy.

For any question, inquiry or concern related to this Privacy Policy or the collection and use of your Personal Data, you may contact our privacy team as follows:

Address: ROOM 701 UNIT 127, 7/F TOWER B, NEW MANDARIN PLAZA, 14 SCIENCE MUSEUM ROAD, TSIM SHA TSUI, HONG KONG

Email: support@KTRLpatch.com

Website: www.KTRLpatch.com

Depending on your interaction with us and our Services, we may collect certain information related to such interaction and use, as follows:

"Non-Personal Data" — meaning information which does not identify a specific natural person and cannot reasonably be used for such identification. Non-Personal Data includes technical information regarding your device or browser, type of operating system, scope, frequency, interactions with the website, and other technical information regarding the device used — all when collected on an aggregate basis, or otherwise not combined with any identifiers. We may further process and anonymize Personal Data in a manner that the data will be Non-Personal Data. Non-Personal Data may be used by us without limitation and for any purpose. Some of this information may be considered "de-identified" under applicable privacy laws and when we rely on data that has been "de-identified", we will take reasonable measures to ensure that the de-identified information cannot be associated with an individual, household, or device and not attempt to re-identify it.

"Personal Data" — meaning information that identifies an individual or may with reasonable effort or by reasonable means identify an individual. This may include online identifiers such as IP address, name, emails, etc., and other information that is associated with you. If we combine Personal Data with Non-Personal Data, we will treat the combined data as Personal Data.

Below we detail the types of Personal Data we collect and how and for which purposes we use your Personal Data.

Online Identifiers & Usage Data — When you access our website or otherwise interact with its content and features or use our Services, certain information regarding your access and use is collected, including information that is automatically collected and generated through use of our, or our third-party service providers' and marketing partners', cookies and tracking technologies (see Section 6 — "Cookies and Tracking Technologies"). This information includes online identifiers associated or transmitted from your browser and device, such as Internet Protocol address (IP), a "cookie" identifier, user agent, and similar unique online identifiers, tags, etc. ("Online Identifiers"). Online Identifiers, such as IP address, are also used to extract your approximate location (e.g., country and Zip). This also includes information regarding your use and interactions with the Services including session durations and time and date stamp, the content you viewed on our website, your interactions within the Services (click streams, actions made such as checking a consent box or clicking on "place order"), crash data, the URL or advertising campaign from which you have reached our website, language preferences, Products added to the cart, etc. (collectively "Usage Data"). If the Usage Data is associated with an Online Identifier it is processed by us as Personal Data.

Online Identifiers and Usage Data are collected and used for the following purposes:

• Our Services' functionality, operation, security and fraud prevention, debugging and to resolve errors and technical issues;
• To customize the Services based on your approximate location;
• To have internal analytics and statistics, used by us to enhance and improve our Services;
• To promote, advertise and market our website and Services, including targeted advertisements (subject to your cookies' settings and preferences) and to measure effectiveness of our digital advertising campaigns.

Contact Information & Communications — We collect contact information such as name, email address, phone number and country ("Contact Information"), if you contact us with any inquiries, request information regarding our Product, sign up to receive our marketing materials and newsletter, contact our customer support, etc., either through an online form available on our website, by sending us an email or by any other means. We will further collect and store the content of communications with you, including email correspondence and any information you choose to share with us through your correspondence ("Communications Data").

Contact Information and Communications Data are used to:

• Respond to your inquiries or requests, or send you the information and materials you have requested or signed up to receive (you may unsubscribe at any time via the "unsubscribe" link in our messages);
• Maintain records of our communications, improve our support and marketing, and where reasonably required to comply with regulatory requirements or to handle disputes;
• Internal analytics and statistics to enhance our Services;
• Maintain our marketing/mailing lists and "opt-out" lists in compliance with applicable laws.

Customers — Information Provided When You Place Orders — When you place an order, as part of the checkout process, you will be requested to provide us with information such as your full name, email address, telephone number, as well as billing and shipping address. Your payment is processed by our third-party payment processor; we do not store your full payment information — only, where applicable, the last 4 digits of your payment method and expiry date for record-keeping purposes. We will further retain records of the Products' orders you have made from us, any returns or refunds provided, promotions or coupons used, etc. ("Orders Information").

Orders Information is used to:

• Fulfill and deliver your orders, process returns, and handle inquiries;
• Send transactional and operational messages (order confirmations, shipping updates, invoices) and, subject to applicable law, marketing communications you may opt out of at any time;
• Maintain bookkeeping records and comply with regulatory requirements (e.g., tax);
• Internal analytics to improve our Services, customize promotional offers, and personalize your shopping experience.

Reviews Submission Information — If you choose to submit feedback or reviews regarding your experience with the Products or our Services, you may be asked to provide your name (or nickname) and the content of your feedback ("Reviews Submission Information"). It is used to post reviews on our website or other media for marketing purposes and to improve our Product and Services. We recommend you do not disclose additional Personal Data in your review, as such content might be publicly posted.

We may also use certain Personal Data to prevent potentially prohibited or illegal activities, fraud, identity theft, and other misuse of the Services and to enforce our Terms, as well as to protect the security or integrity of our databases.

Depending on the nature of your interaction with us and our website and Services, we may collect Personal Data as follows:

• Automatically — we may use cookies or similar tracking technologies to gather information automatically when you interact with our website and Services (see Section 6 — "Cookies and Similar Tracking Technologies We Use").
• Provided directly by you — we collect information when you choose to provide it, such as when you place an order, contact us, or sign up for newsletters.

We use "cookies" (or similar tracking technologies such as tags, pixels, etc.) when you access, interact with, or use our website and Services. The use of cookies is a standard industry-wide practice. A "cookie" is a small piece of information that a website assigns and stores on your device or browser while you are viewing the website. Cookies can be used for various purposes, including allowing you to navigate between pages efficiently, enabling automatic activation of certain features (e.g., shopping cart), for statistical purposes, as well as for advertising purposes.

The information generally collected and stored by cookies includes Online Identifiers (such as cookie ID, IP address) and Usage Data (such as actions made, click stream, time and date stamp, content viewed, directing URLs), preferences and technical information related to your device or browser.

Cookies can be either placed by us, or by third parties such as analytics providers, marketing partners, social media, etc. The duration of cookies can be either "session" — deleted when you close your browser — or "persistent" — for longer periods according to their purpose and settings. You may delete or block cookies through your browser or device settings.

You may change your cookies settings and preferences at any time (including accept cookies, reject cookies, and opt-out) by using the cookie setting tool available on our website. Most browsers allow you to erase cookies, block their acceptance, or receive a warning before a cookie is stored. Please refer to your browser's settings or support page for more details.

Once you choose to opt out or disable cookies, some features of our website and Services may not operate properly and your online experience may be limited. Even if you do opt out, you may still receive some content and advertising — but it will not be targeted.

Where we use third-party advertising cookies, the third party may independently collect Personal Data through such tracking technologies and may combine it with other information they have collected relating to your online activities across the Internet, for the purpose of enhanced targeting and ad delivery, as well as aggregated analytics. These third parties collect and use this information under their own privacy policies and are responsible for their practices.

We share your Personal Data with third parties, including our affiliated companies, partners or service providers that help us operate and manage our website, business operations, marketing operations and Services. The categories of third-party recipients, the type of Personal Data shared, and the purposes are as follows:

Our Service Providers and Agents — we share Personal Data with agents and service providers that perform services on our behalf. These may include counsel and advisors, technology and hosting providers (such as analytics tools, security tools, communications tools, payment processors, shipping and delivery services). These providers are prohibited from using Personal Data we share with them for any purposes other than providing the requested services. The type of Personal Data shared can be any data processed by us, as needed for the specific service.

Marketing Partners — we may share Personal Data with marketing partners we engage with or use their tools and services to market and promote our website and Services, for example for targeted online advertising. These partners may include social media platforms or other marketing service operators. The Personal Data shared may include Online Identifiers and Usage Data.

Our Company Group & Corporate Transactions — we share Personal Data internally within our company group to fulfill the purposes for which Personal Data is collected, or in the event of a corporate transaction (e.g., sale of a substantial part of business, merger, consolidation). Our affiliated or acquiring company will assume the rights and obligations described under this Privacy Policy.

Enforcement of our Rights, Security and Fraud Prevention & Law Enforcement — we may disclose certain Personal Data to law enforcement, governmental agencies, or authorized third parties as needed to comply with applicable laws or in response to a verified order. We may further disclose Personal Data to enforce our policies and agreements and defend our rights, including investigation of potential violations or alleged illegal activity, solely to the extent required.

For the avoidance of doubt, we may transfer, disclose or otherwise use Non-Personal Data or information that is linked to anonymous random identifiers or aggregated in a non-identifiable way, at our discretion and without limitation.

Under certain privacy laws, the term "sale" refers to disclosing or making available Personal Data to a third party in exchange for monetary or other valuable consideration, including for targeted advertising purposes. We do not "sell" Personal Data as most people would commonly understand that term — meaning we do not disclose your Personal Data in direct exchange for money or some other form of payment.

However, due to the broad definition of "sale" under applicable privacy laws, our practice of sharing the categories of Personal Data described above when we use cookies or other third-party advertising services may be considered "selling" Personal Data. The categories of Personal Data shared for this purpose include: Identifiers (Online Identifiers such as IP and Cookie ID); Internet and electronic network activity information (Usage Data); and Geolocation data (such as country level extracted from IP).

You have the right to opt out of such "sale" at any time, by changing your preferences using the cookies setting tool available on our website.

Under applicable data protection and privacy laws, individuals have certain rights regarding the Personal Data we process. The rights you may exercise depend on the purpose of collection, your relationship with us, your jurisdiction, and the privacy laws that apply.

The principal rights that may apply include:

• Right to Be Informed — to be provided with information regarding our Personal Data collection and privacy practices, as detailed under this Privacy Policy.
• Right to Access/Inspect Your Personal Data — to ask us to confirm whether we collect and use your Personal Data, to know which Personal Data we hold, and to obtain a copy.
• Right to Correct/Rectify Your Personal Data — to ask us to correct or update Personal Data we hold that is incorrect or to delete inaccurate data, subject to verification.
• Right to Erase Your Personal Data ("Right to Be Forgotten") — to request the erasure of certain Personal Data we hold, subject to our rights and obligations under applicable law (e.g., record keeping, completing transactions, legal compliance, fraud prevention).
• Right to Restrict Processing — to ask us to restrict or limit the processing of your Personal Data, where certain conditions are met.
• Right to Object — to object to our use of your Personal Data if you believe your fundamental rights and freedoms outweigh our legitimate interest.
• Right to Withdraw Consent — when we collect and process your Personal Data based on your consent, you may withdraw such consent at any time.
• Right to Opt-Out / Opt-out of Sale — to opt out of marketing communications and to opt out of the "sale" of Personal Data (i.e., targeted advertising) as described above.
• Data Portability — to ask us to provide a copy of your Personal Data in a portable, readily usable format that allows transmission to another entity.
• Right to Appeal — if we decline a request, we will inform you within the timeframe required by law and provide information on how to appeal where applicable.

Not all of these rights apply in every jurisdiction.

You may submit a request to exercise your rights by contacting our privacy team at support@KTRLpatch.com. When you submit a request, we will take steps to verify your identity by matching the information provided with the information we have in our records. If we are unable to verify your identity after a good-faith attempt, we may deny the request.

Authorized agents may initiate a request on behalf of another individual, provided they supply proof of authorization. Certain rights can be executed independently without a formal request — for example, opting out of marketing emails by clicking "unsubscribe", or changing your cookie preferences using the cookie setting tool.

We retain Personal Data we collect as long as it remains necessary for the purposes set forth in this Privacy Policy, in accordance with applicable laws, or until an individual expresses a preference to opt out.

In certain circumstances, we will retain your Personal Data for longer periods, mainly:

• Where we are required to retain Personal Data to comply with legal, regulatory, tax, or accounting requirements;
• Where retention is necessary to obtain an accurate record of your dealings with us in the event of any complaints or challenges;
• If we reasonably believe there is a prospect of litigation relating to your Personal Data.

Except as required by applicable law, we may at our sole discretion delete or amend information from our systems, without notice to you, once we deem it is no longer necessary for the purposes above.

Securing your Personal Data is of high priority. We design our systems with your security and privacy in mind. We have implemented physical, technical, and administrative security measures that comply with applicable laws and industry standards, such as encryption, access restrictions and permissions.

We cannot be held responsible for unauthorized or unintended access beyond our control, and we make no warranty, express, implied, or otherwise, that we will always be able to prevent such access.

Please contact us at support@KTRLpatch.com if you feel that your privacy was not handled properly, or if you become aware of a third party's attempt to gain unauthorized access to your Personal Data. We will make reasonable efforts to notify you and the appropriate authorities (if required by applicable law) if we discover a security incident related to your Personal Data.

Due to our global business operations, we may store or process your Personal Data in several territories. Any information you provide us may be transferred to and processed in countries other than the country from which you accessed our website or your country of residence. We will take appropriate measures to ensure that your Personal Data receives an adequate level of data protection upon its transfer, consistent with applicable data protection laws.

Our Services and Products are not intended for any individual under the age of 18, and we do not knowingly collect or maintain information about anyone under the age of 18. Please contact us at support@KTRLpatch.com if you have reason to believe that a child has shared any information with us.