Duoke Privacy Policy

Date of Publication: March 27, 2026
Effective Date: March 27, 2026

Welcome to our products and services

We understand the importance of personal information and privacy to you. Therefore, this Privacy Policy (Hereinafter referred to as "this policy") explains the rules regarding the collection, use, sharing, management, and protection of your information when you use this software product and enjoy other internet software products and services provided by our company (Hereinafter referred to as "this Service"). Please note: We hope you will carefully read and thoroughly understand the contents of this Policy before using this Service, and use this Service only after confirming that you fully understand and agree to it.

Depending on your location, the entity responsible for processing your personal information (i.e., the personal information controller/handler, hereinafter referred to as "we," "us," or "Duoke") is as follows:

• Users in China: If you are a registered user of this service and are located within China, the entity responsible for processing your personal information is Shenzhen Lebo Network Technology Co., Ltd.
• Users in Other Overseas Regions: If you are a registered user of this service and are located in regions outside of China, the entity responsible for processing your personal information is VASTAR SINGAPORE TECHNOLOGY PTE. LTD.

By agreeing to register, you acknowledge and agree to all the contents of this policy. This policy is an integral part of our Terms of Service.

This policy applies to all functions and services provided to you by our Duoke platform (including website and app). This privacy policy does not apply to services provided to you by other third parties. Before choosing to use third-party services, you should fully understand the product functions and privacy policies of the third-party services before deciding whether to use the corresponding functions or services.

Important content regarding your personal information rights and interests is highlighted in bold; please pay special attention. We will regularly check and update our policy; please visit this page periodically to ensure you are aware of the latest version of the Privacy Policy.

Definitions

• Enterprise User refers to an organization that obtains management authority by authorizing users to register, log in to, and use Duoke products or services, including but not limited to legal entities, government agencies, partnerships, sole proprietorships, and other unincorporated organizations. Enterprise Users may create sub-accounts, establish their work teams, and invite Authorized Users to join their work teams through the Duoke product or service platform.
• Authorized User refers to a natural person authorized or invited by an Enterprise User to join the organizational structure established by the Enterprise User within this service and to use this service (typically an employee of the Enterprise User). The natural person designated by the Enterprise User to configure this service and exercise backend management authority on behalf of the Enterprise User is referred to as the Administrator (for clarity, referred to as "Administrator User" in this Privacy Policy). Administrator Users may invite other Authorized Users to use this service.
• Individual User refers to a natural person who registers for a Duoke account using a mobile number and verification code, or logs into the Duoke platform using a third-party account authorization, and uses Duoke products or services as an individual.
• End Consumer refers to the personal data subjects involved in Customer service conversation managed by Authorized Users during their use of this service, such as consumers consulting with business users through third-party e-commerce platforms, etc.
• Authorized Users and Individual Users who directly register and use the platform services are collectively referred to as "you."

This Privacy Policy will help you understand the following

• 1. How We Collect and Use Your Personal Information
• 2. How we use cookies and similar technologies
• 3. How We Share, Transfer, and Disclose Your Personal Information
• 4. How We Protect Your Personal Information
• 5. How We Store Your Personal Information
• 6. Your Rights
• 7. How We Handle Minors' Personal Information
• 8. How Your Personal Information is Transferred Globally
• 9. Changes to This Privacy Policy
• 10. Contact Us
• 11. Others
• Appendix I: EU Appendix
• Appendix II: US Appendix

1. How We Collect and Use Your Personal Information

Our company will adhere to the principles of legitimacy, legality, and necessity, and will collect and use your personal information that you voluntarily provide or that is generated as a result of your use of this service for the following purposes, in order to provide you with better services.

1.1 Basic Account Services

User Registration and Login: When registering a Duoke account, you need to fill in your mobile phone number, email address, password, verification code, and invitation code (optional). When logging into the Duoke platform, you need to provide your email address, password, and enter the verification code. You can browse product pages anonymously, but you need to register as a user of our company when purchasing this service. If you are an Administrator User authorized by an Enterprise User, you may register sub-accounts for other Authorized Users and manage sub-account permissions. To assist Administrator Users in opening sub-accounts, Administrator Users need to provide us with the user's email and password of the Authorized Users. When Enterprise Users and Administrator Users use this function to authorize us to collect employee personal information, they shall ensure that they have obtained the informed consent of the employees themselves.

1.2 Subscription Purchase and Transaction Management

Purchase Information: To fulfill basic functions, including processing your payment and refund requests and keeping you informed of your order status, we will collect your identification and contact information, such as your name and phone number. Invoice Issuance: When you request an invoice from us, we will collect your registration information, including your name, company name, bank name, bank account number, and mailing address, to verify your payment receipts and invoicing information. You are responsible for ensuring the authenticity, accuracy, and completeness of the invoicing information you submit.

1.3 After-sales service and customer service

Transaction and After-Sales Service: To provide you with transaction and after-sales services, and to implement and optimize service functions and content, our company will collect and use your store's order information (including order amount, recipient's country/region, order number, order and payment time, order status, order details (including buyer's name, buyer's email, shipping address, and remarks) and customer information (including buyer's account, country/region, order amount, order quantity, payment amount, number of paid orders, refund amount, number of refund orders, and last order time), customer service and after-sales service information required to implement product functions, product reviews, and other store operation information. To facilitate contact with you, help you resolve your inquiries, complaints, and suggestions as quickly as possible, or record the handling solutions and results of related issues, our company will collect your communication, communication/call records, and related content (including account information, order information, other information you provide to prove relevant facts, or contact information you leave).

1.4 Operation and Safe Operation

To ensure service security, and to guarantee the secure operation, quality, and efficiency of our software and services, we will collect your IP address, operation logs (username, operation time, operation location, and operation content), and device identification code (a string of characters encoded by the device manufacturer to uniquely identify the device, such as the IMEI number, Android ID, IMSI, or SIM serial number of a mobile phone). To ensure the security and legality of your use of this service and to more accurately comply with network management laws and regulations, we may use your account information, transaction information, order information, etc., to prevent various illegal and irregular events or infringements on the legitimate rights and interests of other parties.

1.5 Marketing

We may use the contact information you provided to invite you to participate in surveys about our products and services, carry out service-related marketing activities, and push the latest market activity information and offers. If you do not wish to receive commercial advertisements from us, you may unsubscribe via the instructions in the text message or email prompts, or through other methods we provide.

1.6 Other notes

If the information you provide contains personal information of other third parties, you ensure that you have obtained legal authorization and can handle any disputes arising from such personal information independently before providing it to our company. To provide you with better service, we will update the functions and services offered on our online platform from time to time. In principle, when new functions or services are related to our currently provided functions or services, the personal information collected and used will be directly or reasonably related to the original processing purpose. In scenarios where the personal information is not directly or reasonably related to the original processing purpose, we will collect and use your personal information again, in accordance with legal requirements, through reasonable means such as page prompts, interactive processes, and agreement confirmations, and obtain your consent.

1.7 Device Permissions

To provide you with a higher-quality, more satisfying, and personalized service, and to continuously strive to enhance your experience, we may request to enable certain permissions in the following scenarios, and collect and use your information accordingly. If you decline to provide such information or enable the corresponding permissions, you may still access the basic services provided by us; however, you may not benefit from the enhanced experience enabled by such additional information.

• Camera and Photo Gallery Information: When you use the service to take photos via the camera or upload photos or images from your gallery to set up reminders for positive reviews, post comments, etc., we will request to enable camera or photo gallery permissions and collect the image information you upload.
• Microphone (Voice) Information: To better use our services, when you enable the microphone to communicate with us or other parties, we may request to enable your microphone permission and collect your voice information to identify your needs.
• Storage Permission Information: To enable you to post information or record crash logs locally, we may request to enable permission to read from or write to your device storage, and will read from or write to your device storage such necessary information as images, files, crash logs, etc.
• Device MAC Address Information: In order to ensure service security, identify device uniqueness and provide more precise services, the Company may collect your device's MAC address information for purposes such as device identification, abnormal login detection and security risk control.
• Software Installation List Information: In order to provide you with a more personalized service experience, the Company may collect information about the software installed on your device for purposes such as analyzing application usage, optimizing service functions and recommending relevant content.

Notification Permission: (a) You may view the status of the above permissions in your device settings or within the application's privacy settings, and decide whether to enable or disable them; (b) By enabling any permission, you authorize the application to collect and use the relevant personal information to provide the corresponding service; (c) Once you disable any permission, you revoke such authorization, and the application will no longer collect or use the relevant personal information based on that permission, nor will it be able to provide the service associated with that permission.

Permission Management: (a) The application will strictly follow the user's choices and collect and use relevant information only within the scope of your authorization; (b) The application will not access, collect, use, or share your personal information without your consent.

1.9 User Services Provided When We Act as a Personal Information Processor

We will assist Authorized Users in processing the following personal information based on the instructions of the Enterprise User and the agreement between us and the Enterprise User:

1.9.1 If you are an Authorized User, during your use of this service, in addition to information collected through the system and proactively submitted by you, to enable you to use this service more conveniently, the Enterprise User and Administrator User will provide us with personal information necessary to realize the functions and services of this service. This includes the authorized user's name, role, session permissions, account status, and creation time. The Enterprise User and Administrator User will update this information from time to time based on actual circumstances. According to the representations and warranties of the Enterprise User, before the Enterprise User or Administrator User provides us with your aforementioned personal information, they have obtained your explicit authorization and fully informed you of the purpose, scope, and manner of collecting and using your personal information. If you cannot confirm the above, we recommend that you immediately stop accessing or using this service and confirm the matter with the Enterprise User or Administrator User. You may also contact us through the methods provided in this Privacy Policy, and we will cooperate with you to handle the relevant matters within our capacity.

1.9.2 When Authorized Users use this service, We will collect customer service conversation records between authorized users and end-users. In addition, we will also obtain buyer order information (including order number, order time, product information, actual payment amount, payment method, remarks, logistics provider, logistics method, tracking number, logistics status, reason for exception, latest logistics description, logistics update time, and coupon information) from the third-party platforms where end-users place orders, in order to support your use of the customer chat function. When Authorized Users collect the personal information of End Consumers, they shall ensure that they have obtained the End Consumer's informed consent (including separate consent where required) or other legal basis compliant with applicable laws.

2. How we use cookies and similar technologies

You understand and agree that, to provide you with a more convenient access experience, when you visit our company or use our services, we may use relevant technologies to send one or more cookies or anonymous identifiers to your device to collect and store information about your access to and use of our services. We promise that we will not use cookies for any purpose other than those described in this policy. Our use of cookies and similar technologies is primarily to achieve the following functions or services:

• To ensure the secure and efficient operation of our products and services: We may use cookies or anonymous identifiers for authentication and security to verify your safe login or to identify any instances of theft, fraud, or other illegal activities. These technologies also help us improve service efficiency and increase login and response times.
• To help you have a more convenient access experience: Using this type of technology can help you save yourself the steps and processes of repeatedly filling in personal information and entering search terms.
• Clearing Cookies: Most browsers provide users with the ability to clear browser cache data. You can clear this data in your browser settings. If you clear cookies, you may be unable to use services or functions provided by our company that rely on cookies, due to these modifications.

3. How We Share, Transfer, and Disclose Your Personal Information

3.1. Public disclosure

We take your personal information very seriously. Without your consent, we will not disclose it to any unrelated third party, nor will we make it public, except in the following circumstances:

• With your explicit consent or based on your active choice;
• Where you are required to provide your personal information due to legal, regulatory, mandatory administrative enforcement, or judicial requirements, we may publicly disclose your personal information in accordance with the required type and method of disclosure;
• Other circumstances where disclosure is permitted by law or agreement between the parties.

3.2 Sharing

Except in the following circumstances, we will not share your personal information with any individual, company, or organization outside of us:

• In accordance with this policy or with your prior explicit consent or authorization.
• When necessary as required by applicable laws, regulations, legal processes, or mandatory administrative or judicial requirements.
• To the extent permitted by laws and regulations, to protect the interests, property, or safety of us, our affiliates or partners, you or other users of our company, or the public interest from harm.
• To achieve the core functions of our products and services or to provide you with the services you require;
• When necessary, to share information with third-party service providers, such as payment service providers, marketing and advertising service providers, fraud prevention and information security service providers, etc..
• To handle your disputes or controversies with others as needed.
• As stipulated in relevant agreements or other legal documents signed with you.
• Used for academic research purposes.
• You have violated this policy, and the company has provided it to third parties for the purpose of protecting its rights.
• Used for the public interest as stipulated by laws and regulations.
• To ensure the implementation of product-related functions and the safe and stable operation of applications, we may access services provided by third parties to achieve related purposes. Please see the "List of Third-Party Information Sharing and SDKs" and the "Personal Information Collection List" for details.

3.3 Transfer

We will not transfer your personal information to any company, organization, or individual, except in the following circumstances: (1) Transfer with explicit consent: We will transfer your personal information to other parties after obtaining your explicit consent; (2) In the event of a merger, division, dissolution, acquisition, or bankruptcy, if a transfer of personal information occurs, we will inform you of the name and contact information of the recipient of your personal information and require the new company or organization holding your personal information to continue to be bound by this Privacy Policy. Otherwise, we will require the company, organization, or individual to obtain your authorization and consent again.

3.4 Exceptions to obtaining prior authorization and consent when sharing, transferring, or publicly disclosing personal information

In the following circumstances, sharing, transferring, or publicly disclosing your personal information does not require your prior authorization or consent:

• (1) It is necessary to perform statutory duties or obligations.
• (2) It is directly related to national security or defense security.
• (3) It is necessary for the conclusion and performance of contracts in which you are a party.
• (4) It is directly related to public safety, public health, or major public interests. For example, necessary for responding to public health emergencies or for protecting the life, health, and property of natural persons in emergency situations.
• (5) It is directly related to criminal investigation, prosecution, trial, and execution of judgments.
• (6) It is necessary for protecting your or other individuals' life, property, or other major legitimate rights and interests, but where obtaining your authorization or consent is difficult.
• (7) In accordance with laws and regulations, within a reasonable scope, your voluntarily disclosed or other legally disclosed personal information may be processed, such as through legitimate news reports, government information disclosure channels, etc.

4. How We Protect Your Personal Information

• Our company has implemented industry-standard security measures to protect your personal information and prevent unauthorized access, disclosure, use, modification, damage, or loss. We will take all reasonable and feasible measures to protect your personal information.
• However, you fully understand and agree that due to technological limitations and the potential for malicious attacks, it is impossible to guarantee 100% information security in the internet industry, even with the strongest security measures.
• In the unfortunate event of a personal information security incident, we will, in accordance with legal requirements, inform you of: the basic circumstances and potential impact of the security incident, the measures already taken or to be taken, suggestions for your self-protection and risk reduction, and remedial measures for you. We will inform you of the relevant circumstances of the incident via email, letter, telephone, or push notification. When it is difficult to notify each individual data subject, we will issue a public announcement in a reasonable and effective manner. Simultaneously, we will also report the handling of the personal information security incident to regulatory authorities as required.

5. How We Store Your Personal Information

Your personal information will be stored on Tencent Cloud's Hong Kong servers. We will only retain your personal information for the period necessary to achieve the purposes described in this policy, unless a longer retention period is required by your needs or as permitted or required by laws and regulations. In determining this retention period, we will consider various criteria, including the type of service you request or provide, the nature of our relationship with you, the impact on the services we provide to you if we delete certain of your information, and the retention period required by law. Upon your withdrawal of consent, deletion of information, or cancellation of your account, we will delete or anonymize your personal information in accordance with legal and regulatory requirements.

6. Your Rights

6.1 Access to Your Personal Information

You have the right to access your personal information, except as provided by laws and regulations. If you wish to exercise your data access rights, you can access them directly through the product interface. For personal information that cannot be directly accessed within the product, you can contact us using the contact information set forth in this Privacy Policy, and we will respond to your access request within the legally prescribed time limit.

6.2 Correct your personal information

If you find any errors in the personal information we process about you, you have the right to request that we correct them. You can correct your personal information yourself through the product interface. If you are unable to correct this personal information through the product interface, you can contact us using the contact information listed in Chapter 10 of this Privacy Policy. We will respond to your correction request within 5-7 business days.

6.3 Delete your personal information

You may request the deletion of your personal information by sending an email in the following circumstances:

• If our processing of personal information violates laws and regulations;
• If we collect or use your personal information without your consent;
• If our processing of personal information violates our agreement with you;
• If you no longer use our products or services, or if you cancel your account;
• If we no longer provide you with products or services.

If we decide to respond to your deletion request, we will also notify the entities that have obtained your personal information from us, requiring them to delete it promptly, unless otherwise stipulated by laws and regulations, or these entities have obtained your independent authorization.

6.4 Changing the scope of your authorization or withdrawing your consent

You can view the status of each authorized permission on our client application. Enabling any permission signifies that you have authorized our company to collect and use that information for the corresponding purpose. Deactivating any permission means you have revoked that authorization; our company will no longer collect or use that personal information, nor will it be able to achieve the purpose authorized. You can withdraw all authorizations for our company to continue collecting your personal information by canceling your account. However, your decision to revoke permissions will not affect the collection, processing, and use of information previously based on your authorization. Please understand that each business function requires some basic personal information to complete. When you withdraw your consent or authorization, our company will no longer be able to provide you with the services corresponding to the withdrawn consent or authorization, nor will it process your personal information. However, your decision to withdraw consent or authorization will not affect the collection, processing, and use of information previously based on your authorization.

6.5 Cancel account

You can view the account cancellation process and procedures by entering "Cancel" in the "Contact Us" section of our client app. Once you successfully apply to cancel your account, we will complete the review within 7 business days. After approval, we will delete or anonymize your personal information in accordance with this policy, unless otherwise stipulated by laws and regulations.

6.6 Get a copy of your personal information

You have the right to obtain a copy of your personal information. If you require a copy of the personal information we have collected from you, you may contact us using the contact information listed in Chapter 10 of this Privacy Policy. We will respond and take the necessary actions within 5-7 business days after verifying your identity. We will submit a copy of your personal information to you via email. Subject to applicable laws and technical feasibility, we will provide you with a copy of your personal information upon your request.

6.7 Right of transfer

You can contact us through the methods set out in the "Contact Us" section of this policy to exercise your legally entitled right to transfer your personal information. Subject to compliance with relevant national laws and regulations, if you request the transfer of your personal information to your designated personal information processor, we will provide the necessary transfer methods in accordance with the relevant regulations.

6.8 Other personal information related requests

Under applicable data protection laws, you may have other rights related to your personal information. If you wish to exercise these rights or have any requests regarding your personal information, you can contact us through the methods set forth in this policy. We will complete the review within 7 business days of your application. Upon approval, we will respond to your requests regarding your personal information in accordance with this policy, unless otherwise stipulated by laws and regulations. We will be unable to respond to your requests in the following circumstances:

• Requests related to the fulfillment of legal obligations by the personal information controller.
• Requests directly related to national security and defense security.
• Requests directly related to public safety, public health, and major public interests.
• Requests directly related to criminal investigation, prosecution, trial, and execution of judgments.
• Requests where the personal information controller has sufficient evidence to show that the personal information subject acted maliciously or abused their rights.
• Requests made to protect the vital legitimate rights and interests of the personal information subject or other individuals, but where obtaining consent is difficult.
• Requests where responding to the personal information subject's request would seriously harm the legitimate rights and interests of the personal information subject or other individuals or organizations.
• Requests involving trade secrets.

7. How We Handle Minors' Personal Information

Our products and services are intended for adults only. Children under the age of 18 may not use our products or services without the consent of their parents or guardians. Where we collect children's personal information with parental consent, we will only use or disclose this information as permitted by law, with the explicit consent of the parent or guardian, or as necessary to protect the child. If we discover that we have collected a child's personal information without verifiable parental consent, we will endeavor to delete the data as soon as possible. If at any time a guardian has reason to believe that we have collected personal information from a minor, please contact us using the contact information provided in this Privacy Policy.

8. How Your Personal Information is Transferred Globally

When you access or use our services, your personal data will be stored in Hong Kong. If you are a user in China, we may transfer your personal information outside of China to provide you with services. The overseas recipient is our overseas affiliate, VASTAR SINGAPORE TECHNOLOGY PTE. LTD. (Address: 60 PAYA LEBAR ROAD, #11-53 PAYA LEBAR SQUARE, SINGAPORE 409051, Contact: [email protected]). The scope of personal information we may provide to the overseas recipient includes the personal information you provide or generate using our products and services as listed in Chapter 1 of this policy (excluding subscription purchase and transaction management information, which will be stored locally). Such international transfers will be subject to strict data protection and privacy security measures to ensure the same level of privacy protection as we provide to you locally. You can contact us or the overseas recipient to exercise your rights regarding your personal information.

9. Changes to This Privacy Policy

You understand and agree that the Company reserves the right to modify, supplement, or update this policy from time to time, and will publish such modifications or updates on this service. If you choose to continue using our services, you must re-agree to the revised content of this policy. Please pay attention to and understand the revisions to this policy in a timely manner. If you do not agree to the revised version, you should immediately stop using the services provided by the Company.

10. Contact Us

If you need to exercise the above rights, or have any questions, comments, suggestions, or complaints about this policy, or if you have other concerns that cannot be answered here, please contact us through the following methods: Email: [email protected]

11. Others

• Notice of Cessation of Operations: If our company terminates its services or operations, we will notify you at least thirty days in advance and will delete or anonymize your personal information in accordance with this policy after the termination of services or operations.
• If any provision or any part of any provision of this policy is deemed to be invalid, illegal, or unenforceable under applicable law, this will not affect the validity of any other provision or any part of such provision.
• This policy serves as a valid supplement to the Agreement of Service. In the event of any inconsistency between the two agreements regarding similar provisions, this policy shall prevail. Any matters not covered herein shall be handled in accordance with the Agreement of Service.
• This policy is available in multiple languages, including Chinese, English, and others. In the event of any discrepancy between this policy and other versions, the Chinese version shall prevail.

Appendix I: EU Appendix

The additional disclosures in this section apply only if you are located in the European Economic Area (EEA). This document supplements our Duoke Privacy Policy and describes how we process your personal data (as used in this Appendix, synonymous with "personal information") when you use our products and/or services. In the event of any inconsistency between the Duoke Privacy Policy and this Appendix, this Appendix shall prevail. When processing your personal data, we comply with the EU General Data Protection Regulation (GDPR) and local data protection laws (as applicable).

1. EEA Representative

Our representative in the EEA is iuro Rechtsanwälte GmbH t/a Prighte, with a contact address at Schellinggasse 3, 1010 Vienna, Austria.

2. For What Purposes Do We Process Personal Data?

Please refer to Section 1 of the Duoke Privacy Policy.

3. What Are the Legal Bases for Our Data Processing?

The legal basis for collecting and using the personal data described in this policy will depend on the type of personal data we collect and the specific context in which we collect it, including but not limited to the following circumstances:

• Necessary for the performance of a contract concluded between you and us (GDPR Article 6(1)(b));
• Where you have provided explicit consent for us to process your personal data (GDPR Article 6(1)(a));
• In certain jurisdictions, where processing is necessary for our legitimate interests, including but not limited to (GDPR Article 6(1)(f)): Providing, maintaining, and promoting our services; Detecting, preventing, and addressing violations of our terms of use or service agreements, including service abuse, fraud, misconduct, and other trust and safety-related risks; Protecting our legitimate rights and interests and those of others; Striving to provide you with a positive user experience; Complying with laws or regulations outside the EEA; Maintaining the security and integrity of our products and/or services and related platforms and systems; Improving our products and/or services and developing new services; Managing our relationship with users;
• Where processing is necessary for compliance with a legal obligation to which we are subject under applicable law (GDPR Article 6(1) (c)).

Subject to applicable law, the specific purposes and corresponding legal bases for processing personal data are as follows:

• Providing Account Services — Necessary for the performance of a contract with you
• Subscription Purchase & Transaction Management — Necessary for the performance of a contract with you
• Providing After-Sales & Customer Service — Necessary for the performance of a contract with you
• Sending Marketing Information — Based on your consent
• Operations and Security Operations — Based on our or a third party's legitimate interests

4. Which Categories of Recipients Receive Personal Data from Us?

Please refer to Section 3 of the Duoke Privacy Policy.

5. Where is Your Personal Data Processed, and on What Basis Do We Transfer Personal Data Cross-Border?

Your personal data will be processed in HK. We may disclose personal data to third parties located in Singapore. We take steps to ensure that our processors provide an adequate level of data protection by ensuring appropriate safeguards are in place and data transfer arrangements are properly implemented. If you have any questions or need more information, you may contact us.

6. How Long Do We Process Personal Data?

We retain your personal data only for as long as necessary for the purposes for which it was processed or as required by law. The retention period depends on the purpose for which we collected and used it, as well as the need to retain personal data to comply with applicable laws (including meeting any legal, regulatory, tax, accounting, or reporting requirements). If we retain personal data solely to comply with legal requirements, we will take steps to prevent its processing. Once personal data is no longer necessary for the purposes for which we collected it, we will delete it.

7. What Data Protection Rights Do You Have?

In the EU, you have the following rights, subject to the conditions of the GDPR and/or local data protection laws:

• 1. Right to Object: To the extent permitted by applicable law, where we process your personal information based on legitimate interests, you have the right to object based on grounds relating to your particular situation by contacting us. Please note that in certain circumstances, we may still have compelling legitimate grounds to continue processing your personal information that override your rights; we will inform you if this is the case.
• 2. Right to Access: You have the right to obtain confirmation as to whether or not we process personal information concerning you, and to access such personal information, including but not limited to: the categories of personal information we collect, the business or commercial purpose for collection, the categories of third parties with whom we share personal information, and other relevant information required by applicable law. To the extent required by applicable law, you have the right to access and obtain a copy of your personal information.
• 3. Right to Rectification: To request the correction of inaccurate personal data concerning you.
• 4. Right to Erasure (Right to be Forgotten): To request the deletion of your personal data, provided that such data is not necessary for purposes required by law or for security and integrity purposes.
• 5. Right to Restriction of Processing: To request the restriction of processing of your personal data. In this case, it will be marked and only processed by us for specific purposes.
• 6. Right to Data Portability: To receive the personal data you provided to us in a structured, commonly used, and machine-readable format, and you have the right to transmit that data to another entity without hindrance from us.
• 7. Right to Withdraw Consent: To withdraw your consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.
• 8. Right to Lodge a Complaint with a Supervisory Authority: You have the right to lodge a complaint with a supervisory authority. You may view EEA supervisory authorities and their contact details at: https://edpb.europa.eu/about-edpb/about-edpb/members_en.

To submit a request to exercise your privacy rights, you may contact us by sending an email to [email protected]. When submitting a rights request, please specify the scope and basis of your request and provide us with the necessary information to verify your identity. To process your request, we may contact you to confirm your identity and may ask for more information to clarify the scope of the request and expedite our response. Typically, we will respond to your request within one month of receipt and complete processing within the timeframe stipulated by applicable law.

8. Do You Need to Provide Us with Your Personal Data?

You have no legal obligation to provide us with personal data. However, if we do not receive certain personal data from you, we will be unable to provide our products and/or services.

Appendix II: US Appendix

The additional disclosures in this section apply if you are located in the state of California, USA. If you are located in another US state, we will refer to this Appendix and process your personal data in accordance with applicable laws. This document supplements our Duoke Privacy Policy and describes how we process your personal data when you use our products and/or services. In the event of any inconsistency between the Duoke Privacy Policy and this Appendix, this Appendix shall prevail. When processing your personal data, we comply with the California Privacy Rights Act ("CPRA") and local data protection laws (as applicable).

1. Collection and Use of Your Personal Data.

We have collected and used your personal data in the past 12 months as described in Section 1 of the Duoke Privacy Policy.

2. Disclosure of Personal Data.

We have disclosed personal data to third parties for business purposes in the past 12 months as described in Section 2 of the Duoke Privacy Policy.

3. Your Rights.

As a US resident, you may exercise the following rights:

• Right to Know: After verifying your identity, you have the right to know the following information about our collection and disclosure in the past 12 months: the categories of personal data we have collected about you; the categories of sources from which the personal data is collected; the categories of personal data disclosed to third parties for a business purpose, and the categories of recipients; the categories of personal data sold and the categories of third parties involved; the business or commercial purpose for collecting or selling personal data.
• Right to Correct: You have the right to correct inaccurate personal data we hold about you.
• Right to Delete: You may request the deletion of personal data we have collected, subject to certain exceptions.
• Right to Opt-Out: You have the right to opt out of the sale and/or sharing of your personal data and sensitive personal data to third parties, now or in the future.

You also have the right not to be discriminated against for exercising these rights. However, please note that exercising these rights may limit our ability to process personal data. For example, if you submit a deletion request, we may be unable to continue providing our products and services or interact with you in the same manner.

4. Limiting Use of Sensitive Personal Data.

You also have the right to request limitation of the use and disclosure of sensitive personal data, subject to certain exceptions. If you wish to restrict the use of your sensitive personal data, please contact us using the methods described in Chapter 7 of this Privacy Policy.. Currently, we use and disclose this data to third-party cloud service providers to provide you with account creation, login, and related services.

5. Opt-Out of Sale or Sharing of Your Personal Data.

Based on the definitions of "sale" and "share" under the CPRA, we do not believe we engage in such activities and have not done so in the 12 months preceding the effective date of this Privacy Policy.

6. Submitting Consumer Rights Requests.

You may submit a request to exercise your consumer rights by contacting us through the methods set forth in the "Contact Us" section of this Privacy Policy. We need to verify your identity before processing your request, which may require requesting additional personal data from you or asking you to log in to your account. In some cases, we may deny or limit your request, particularly if we cannot verify your identity or locate your information in our systems, or as permitted by law. You may designate an authorized agent to exercise your rights, provided we receive written authorization from you granting the agent permission to make the request. We reserve the right to deny an agent's request if we cannot reasonably confirm the authorization or verify your identity.

7. Appeal.

If we decline to act on your request, you may contact us to file an appeal using the contact information provided in the "Contact Us" section below. If your appeal is denied and you are a California resident, you may file a complaint with the California Attorney General by clicking the following link: https://oag.ca.gov/contact/consumer-complaint-against-business-or-company.

8. Contact Us.

If you have any questions about this Appendix or wish to exercise your privacy rights, you may contact VASTAR SINGAPORE TECHNOLOGY PTE. LTD.by calling +1 350 600 8221 or sending an email to [email protected].