InnoGate App – Privacy Notice

HG Innovation Limited (“HGI”, “we” or “us”) takes the security and protection of your personal data very seriously. This app privacy notice (“Privacy Notice“) informs you about the collection, storage, and other processing of your personal data by HGI, as well as your related rights, when you use our InnoGate app (“App”).

We reserve the right to change the content of this Privacy Notice from time to time; we therefore recommend that you review this Privacy Notice at regular intervals. We will notify you in accordance with applicable law of any relevant changes that impact the processing of your personal data collected before the relevant Privacy Notice update. You can access the current version of this Privacy Policy at any time under https://www.inno-gate.com/privacy-policy.html .

Our Privacy Notice is structured as follows:

1. Who is responsible for the processing of my data? How can I contact HGI or its data protection officer

HGI is responsible as controller within the meaning of the General Data Protection Regulation (“GDPR”) for the processing of your personal data in the context of your use of our App.

You can reach HGI at any time under the following contact details:

HG Innovation Limited
Flat/RM 06 23/F
The Metropolis Tower 10, Metropolis Drive Hung Hom, Kowloon
Hong Kong
support@inno-gate.com

You can reach HGI’s representative in the EU at any time under the following contact details:

Green Fun France
34, avenue des Champs-Elysées 75008 Paris
privacy@elfbar.fr

2. What are “Personal Data” and what does “Processing” mean?

2.1 “Personal data” means any information relating to an identified or identifiable natural person (“data subject“); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

2.2 “Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

3. What types of data will be collected about me? Do I have an obligation to provide my data?

In the context of your use of our App, we will collect and process different categories of personal data, depending on your use of our App and the type of interaction with us.

In most cases, there will not be an obligation that you disclose certain information about yourself to us. However, in order to provide you with the functionalities and services via our App, we need certain data from you. Failure to provide this information may prevent you from using certain features or services. Where necessary, we will further inform you at the time your information is collected whether certain data is compulsory and the consequences of the failure to provide such data.

The categories of personal data we collect include:

• product identifiers (e.g., product MAC address);
• product usage data (e.g., battery level, using level, product resistance value, usage duration, number of usages, usage time, usage power, child lock status);
• communication content and data (e.g., content of emails that we exchanged with you or notes on phone calls in the context of customer support requests);
• age verification data, in particular a relevant government issued ID document and selfie provided by you during the age verification process;
• technical information we collect from your smartphone or other device connected with your product (e.g., IP address, location on country level based on your IP address, device ID, system bluetooth permissions, and logfile data);
• Firebase Crashlytics data, including the Crashlytics Installation UUID, Firebase installations ID, crash traces and breakpad minidump formatted data (NDK crashes only); and
• inferences drawn from any of the above information.

We collect the information about you either directly from you or, where applicable, from our service provider used for age verification.

4. For which purposes and on what legal basis will my data be used?

The App allows you to use Bluetooth technology to connect and communicate with your product(s), including to monitor and control the usage of your product.

Below we inform you in more detail which data HGI collects and processes when you use our App and related services, for which purposes such data is used and on which legal basis the processing of your data is based.

Purpose	Type of data	Lawful basis
To provide you with the requested functionalities and services via the App and enable you to monitor and control the usage of your product; This includes: Technical delivery of our App’s content to your device; Enabling users to adjust device settings, including to synchronize time and date settings of your products with your connected device’s clock; Enabling users to view the status and performance of their product (such as product resistance value, battery level, using usage level and other device information); Tracking and analyzing product usage to help users monitor and manage their using habits, including frequency, duration and consumption patterns; Receiving product status notifications, including battery level, system alerts, etc. (where the user has provided permissions for device status notifications); and Providing over-the-air (OTA) firmware updates for your product(s) via the App, to provide you with the latest software and security features.	(a) Product identifiers (b) Product usage data (c) Technical information collected from your connected device	Necessary for performance of the contractual relationship with you, or taking necessary steps prior to entering into the contract (Art. 6(1) lit. b) GDPR).
To perform age verification services	Age verification data	Necessary for our legitimate interests (Art. 6(1) lit. f) GDPR) in ensuring and documenting compliance with applicable legal obligations and our terms of service and performing age verification to ensure appropriate protection of minors.
To provide you with legally compliant information (e.g., our terms or privacy notice) and features of our App	Technical information collected from your connected device (location on country level based on your IP address)	Necessary for our legitimate interests (Art. 6(1) lit. f) GDPR) in ensuring and documenting compliance with applicable legal obligations in your jurisdiction.
To administer our relationship with you, which will include notifying you about changes to our terms or privacy notice.	Technical information collected from your connected device	Necessary for our legitimate interests (Art. 6(1) lit. f) GDPR) in ensuring effective communication with you in connection with the business relationship between HGI and you, e.g., when we inform you about changes to our terms and conditions or when you contact us with questions.
To maintain and ensure security of the App and products (including troubleshooting, software updates, system maintenance and support, and cybersecurity protection) This includes that our App may receive information about you from the Firebase Crashlytics service for the purpose of crash collection and helping debug crashes; see further details at: https://firebase.google.com/support/privacy.	(a) Product identifiers (b) Product usage data (c) Technical information collected from your connected device (d) Firebase Crashlytics data	Necessary for our legitimate interests in ensuring effective, functioning and secure provision of our App and products, including ensuring error-free technical operation and adequate product and information security (Art. 6(1) lit. f) GDPR)
To improve and optimize our App and develop related products and services, including data analytics to understand user preferences	(a) Product identifiers (b) Product usage data (c) Technical information collected from your connected device	Necessary for our legitimate interests in market analysis, quality assurance, and product and service improvement (Art. 6(1) lit. f) GDPR)
To comply with applicable legal requirements, including data retention obligations, to demonstrate compliance with applicable laws and regulations, and to respond to requests by courts and authorities.	All data as described in section 3	(a) Necessary to comply with our legal obligations of HGI (Art. 6(1) lit. c) GDPR) (b) Necessary for our legitimate interests in ensuring and documenting compliance with applicable legal requirements (Art. 6(1) lit. f) GDPR)
To establish, exercise and defend legal claims.	All data as described in section 3	Necessary for our legitimate interests in establishing, exercising and defending legal claims (Art. 6(1) lit. f) GDPR).

To the extent the processing of your personal data for the above purposes is based on your consent, you can withdraw your consent at any time. The withdrawal of your consent does not affect the lawfulness of the processing based on the consent before its withdrawal.

5. Who will my data be disclosed to?

HGI ensures a high level of security when disclosing your data. We may share your personal data with the following recipients:

• Service providers (as processors): We may disclose your personal data to our service providers, including our HGI group companies or affiliated companies, which process your personal data on our behalf and under our instructions. These companies are contractually obliged as processors in accordance with applicable data protection law and may only use your personal data to the extent necessary to provide the services requested by us. For instance, we may share your personal data with our service providers that perform IT services (including hosting services or other operational technical support) or other business operations for us which are carried out in accordance with our instructions. An up-to-date list of all service providers is available upon request from HGI under the contact details listed in section 1.
• Age verification service provider: Where necessary in order to perform age verification services, our age verification service provider (GB Group Plc, UK) will collect age verification data directly from you via the App and process the data for age verification purposes. This service provider acts as independent controller in relation to the age verification check, and as our processor in relation to storing certain data for compliance purposes in an audit trail. Our service provider is contractually obliged to process your data in accordance with applicable data protection law. For further information on the processing of your personal data by GB Group Plc as controller, please see GB Group Plc’s privacy policy (https://www.gbgplc.com/legal-and-regulatory/products-services-privacy-policy/).
• Law enforcement agencies, courts, authorities and other public bodies: We may further share your personal data with these parties where this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party, for example if we are obliged to cooperate with government authorities in the context of legal investigations. Where permitted by law or regulation and reasonably practicable, we will attempt to notify you of such requirements.
• Asset purchasers: We may share your personal data with any third party that purchases, or to which we transfer, all or substantially all of our assets and business. Should such a sale or transfer occur, we will use reasonable efforts to try to ensure that the entity to which we transfer your personal data uses it in a manner that is consistent with this Privacy Notice. You will be notified via email and/or a prominent notice on the websites of any change in ownership or uses of your personal data.

6. Will my data be processed also in countries outside the EU/EEA?

Your personal data will be stored by our external service providers on servers in the European Union.

The personal data may be accessed from and/or transferred to our group company or affiliated company as necessary for the purposes described in section 5 above.

In addition, to the extent we engage our external age verification service provider, we may need to transfer your personal data to the United Kingdom (UK) and Turkey.

To the extent HGI transfers your personal data to countries outside the European Union (EU) and the contracting states of the European Economic Area (EEA) (“Third Countries“) that may not ensure a level of data protection as considered adequate by the European Commission under an adequacy decision (Art. 45 GDPR), such as China, HGI has put into place appropriate safeguards (e.g., by concluding EU Standard Contractual Clauses and, where required, implementing supplementary measures) to ensure that your personal data will be protected adequately and as required under European data protection laws (see Art. 46 GDPR). For more information on the countries where your personal data are processed, and the appropriate safeguards in place, including on how to obtain a copy of the measures implemented by us, please contact us at the contact details set out in section 1.

Any transfers to GB Group Plc. (located in the UK) are based on the adequacy decision by the EU Commission for the UK of 28 June 2021 (Art. 45(1), (3) GDPR). GB Group Plc. may, as required, further disclose your data to product support and helpdesk personnel at service providers located in Australia, Türkiye and Costa Rica. In these cases, GB Group Plc. is contractually obliged to put into place appropriate safeguards (e.g., by concluding EU Standard Contractual Clauses and, where required, implementing supplementary measures).

7. How will my personal data be protected?

We implement comprehensive technical and organisational measures to ensure a level of security appropriate to the risk to the personal data we process. These measures are aimed at fully ensuring the ongoing integrity and confidentiality of personal data. We evaluate and improve these measures on a regular basis to ensure the security of the processing permanently.

8. How long will my personal data be stored?

Except as expressly indicated otherwise in this Privacy Notice, your personal data will be stored by us only for as long as necessary for the respective purpose for which we collect and process your personal data.

The below data categories will be stored as follows:

• Technical information, device identifiers and usage data will be processed for as long as necessary for providing you with the requested functionalities and services of the App, including providing legally compliant information (e.g., updates to our terms or privacy notice) and features. Certain data may be further retained for one year to improve our product.
• Age verification data: Any data relating to your age verification stored by GB Group Plc. on our behalf will be deleted 31 days after completion of the age verification process.
• Technical information, device identifiers and usage data, and Firebase Crashlytics data will be processed for as long as necessary for maintaining and ensuring security of the App and products.
• Technical information, device identifiers and usage data processed for improving and optimizing our App and developing related products and services will be retained for one year, and will then be permanently deleted or anonymized prior any further usage.

Your personal data will be deleted thereafter, except where any further storage is necessary to comply with our legal obligations, in particular any applicable data retention obligations, or for the establishment, exercise or defence of our legal claims (such the need to retain records in order to resolve disputes, and investigate or defend against potential claims).

For more information about the specific retention periods applicable to your personal data, please contact us using the contact details set out in section 1.

9. Which rights do I have?

To the extent you are affected by the data processing carried out by HGI you have the right in accordance with applicable legal provisions:

• to obtain information on the personal data processed concerning you and to obtain a copy of such data (right of access);
• to obtain the rectification of any inaccurate personal data and, taking into account the purposes of the processing, to have incomplete personal data completed (right to rectification);
• if there are legitimate reasons, to request the deletion of the personal data (right to erasure);
• to request the restriction of the processing of your personal data, if the legal requirements are met (right to restriction of processing);
• if the legal requirements are met, to receive the personal data provided by you in a structured, commonly used and machine-readable format and to transfer this personal data to another controller or, if technically feasible, to have it transferred by HGI (right to data portability); and
• not to be subject to a decision based solely on automated processing which produces legal effects concerning you or significantly affects you in a similar way, if the legal requirements are not met. An automated decision-making process is not carried out by HGI.

You also have the right to object, in accordance with the statutory provisions, to the processing of personal data, which is necessary for the purpose of HGI’s and our group companies’/third parties’ legitimate interests, on grounds relating to your particular situation (right to object). If your personal data is processed by HGI for direct marketing purposes, you have the right to object to this processing at any time, without any special reason.

If the data processing is based on your consent, you can withdraw the consent at any time. The withdrawal of your consent does not affect the lawfulness of the processing of your personal data until withdrawal.

In order to exercise your rights (including the withdrawal of your consent), as well as in the event of questions regarding the processing of your personal data, please contact HGI at any time using the contact details set out in section 1 above.

Without prejudice to any other remedies, you also have the right to lodge a complaint with a supervisory authority at any time.