Privacy Policy (Device & APP)

This Privacy Policy of Even Realities device and App (the “Policy”) explains how we collect, use, store, disclose, and share (collectively “process”) your personal data when you use our devices (including but not limited to Even Realities digital/smart glasses, smart ring, collectively the “Devices”) and their companion application “Even Realities App”, “Even Hub Developer Portal Program Platform” (collectively the “Products”) to interact with your environment such as routes navigation, real-time translation, Health, and other services provided by Even Realities (collectively the “Services”). We respect your privacy and will take security protection measures to protect your personal data. Please note our Services may involve integrations with websites, applications, and services managed by third parties. By interacting with these third parties, you are providing information directly to the third party and not us and subject to the third party’s privacy policy. Please read their data usage policies or other documentation. Our linking to another site or service doesn’t mean we endorse that third party.

In this Policy “Even Realities”, “we”, “us” or “our” refers to Even Realities GmbH, a company registered in Berlin with its registered address located at Friedrichstraße 79, 10117 Berlin, Germany.

This Policy may be updated from time to time and therefore please check back periodically for the latest version of the Policy as indicated below. If there will be any significant changes made to the use of your personal data in a manner different from that stated at the time of collection, we will notify you by posting a notice on our App or by other means.

Here is a summary of the information contained in this Policy. This summary is to help you navigate the Policy and it is not a substitute for reading everything. You can view the particular sections for more detailed information.

For the purpose of this Policy “personal data” means any information relating to an identified or identifiable individual. To the extent that our processing of your personal data is subject to certain data privacy protection laws (including but not limited to the General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act as amended in 2020 (“CCPA”), collectively hereafter “applicable laws”), we will also notify you about the legal basis on which we process your personal data and your rights under such laws.

We collect the following categories of personal data from you:

• Requested Registration Information: when you create an account to our Services, we will collect email address and password.
• Requested Technical Information: when you register or log in to your account, we will collect some technical information automatically including:
  • Device Information: the device ID, device manufacturer, device model, device platform, device brand, device identification code (IMEI, IDFA, Android ID, MAC, OAID, Advertising ID, Serial Number, IMSI, UAID, ICCID, IDFV, BSSID, SSID), installed app list, operating system name, operating system version, device size.
  • Network Information: IP address, Wi-Fi information, base station information, operator information, and location-related information.
• Optional Profile Information: After you create an account, you can fulfill your profile information including nick name, date of birth, gender, activities, height and weight.
• Purchase and Account Benefit Information: If you complete a purchase within the app, we will collect and process your purchase history and account benefit information.

During the provision of services, we may access the main device permissions as follows:

• Permission to access the local network
• Permission to push notifications
• Permission to obtain location information
• Permission to turn on the Bluetooth
• Permission to view calendar events
• Permission to read clipboard contents
• Permission to run background services
• Permission to retrieve installed application lists

You can choose to disable part of or all permissions in the device settings. Disabling only affects the corresponding function and does not affect the other functions of the Services. The way permissions are displayed and disabled may vary on different devices. Please refer to the instructions or guidelines provided by the device and system developers for information on how to disable permissions.

We will only use your personal data as permitted by applicable laws. Our legal bases for collecting and using the personal information described in this Policy depends on the personal data we collect and the specific context in which we collect the information:

• We need to perform a contract with you;
• You have given us consent to do so;
• Processing your personal data in reliance on our legitimate interests, including for the purposes:
  • providing, maintaining, and marketing our Products and Services;
  • detecting, preventing, and enforcing violations of our [Terms of Service] other applicable specifications, including misuse of Products and Services, fraud, abuse, and other trust and safety protocols; and
  • protecting our legal rights and the rights of others.
• We need to comply with our legal obligations under the applicable laws.

The purposes for which we process personal data subject to applicable laws and the legal basis on which we perform such processing are as follows:

If you use the Products and Services, your data will be processed on servers located in Netherlands. Additionally, we will only transfer your personal data to our partners, service providers, and other third parties when necessary. In such cases, your personal data may be stored on those third parties’ servers.

We adhere to retention policies for the personal data we collect to ensure that it is not retained longer than necessary for the intended purpose. Different retention periods are applied to the various types of personal data collected by us in accordance with the service needs and regulatory requirements.

Upon expiration of the retention period, we will either delete or anonymize your personal data. Measures will be taken to render the information irrecoverable or irreproducible.

When assessing how long your personal data is retained, we consider criteria such as: (i) the nature of the personal data and the activities involved; (ii) when and for how long you use the Products; and (iii) our legitimate interests and our legal obligations.

We have implemented appropriate technical and organizational security measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, and other unlawful or unauthorized forms of processing in accordance with applicable laws. When using an App account, it is important that you select a strong password and do not share it with others. If you have any concerns that your App account or personal data has been put at risk, for example if someone could have found out your password, please contact us by using the contact details provided in Section 11 below.

Please note the Internet is an open system, the transmission of information via the internet is not completely secure. Although we will implement all reasonable measures to protect your personal data, we cannot guarantee the security of your data transmitted to us using the internet – any such transmission is at your own risk and you are responsible for ensuring that any personal data that you send to us are sent securely.

In order to provide you with more comprehensive and high-quality Products and Services, we will authorize our commercial partners to provide certain services to you. In such cases, these partners may process some of your personal data.

We will only process your personal data for lawful, legitimate, necessary, specific, and explicit purposes and we will only process the personal data required to provide the Services. We will require our partners through agreements to retain data only for the necessary period and to implement adequate security measures to protect data security.

We will disclose personal data to the following categories of third parties for the purposes explained in this Policy:

• Even Realities Affiliated Cmpanies: We may share your personal data to our affiliated companies or grant access to your personal data to them to provide Even Realities Products and Services to you, or to fulfill our contractual and legal obligations. For example, some of the systems through which we provide Even Realities Products and Services are operated by our affiliated companies; some of our affiliated companies also provide supporting or maintenance services to our Products and Services.
• Even Realities Partners: Even Realities have partnerships with many retail stores and opticians (the “Even Realities Partners”), we permit the Even Realities Partners to sell our products via their online channels or offline channels.
  • When you order our products through Even Realities Partners, the products are generally delivered by relevant Even Realities Partner. To fulfill the transaction between you and Even Realities Partners, the Even Realities Partners will process your personal data collected for transaction scenario as the data controller. For more information on how the Even Realities Partners will process your personal data, please refer to these Even Realities Partners' own privacy policy. You can usually find their privacy policy on their website homepage. Even Realities is not responsible for personal data processing activities conducted by Even Realities Partners mentioned above.
  • Nevertheless, when you purchase our products through Even Realities Partners' online or offline channels, Even Realities is still the data controller regarding processing some of your personal data, including without limitation the Account Information, Device Information, App information, or Usage Information for the purposes described in the How do we use your data section.
  • When you require Even Realities Partners to provide customer support service, we may share the personal data we collect from you to Even Realities Partners for the purpose of responding to your requests. For such personal data, Even Realities, as the data controller, will ensure that Even Realities Partners will only process them as per Even Realities's instruction.
• Service providers and business partners: Third-party service providers who provide us with technology services (such as cloud storage service, real-time voice translation, ASR voice) and business support (such as navigation service, AI service, weather service, logistics services and optical services) may need to process your data. These third parties may be located in the US or other countries/regions, and will process your personal data on our behalf under relevant contracts.
• Law enforcement agencies, public authorities, or other judicial bodies and organizations: We disclose Information if we are legally required to do so or if we have a good faith belief that such use is reasonably necessary to comply with a legal obligation, process, or request; enforce our Terms of Service and other terms, policies, and standards, including investigation of any potential violation thereof; detect, prevent, or otherwise address security, fraud, or technical issues; or protect the rights, property, or safety of us, our users, a third party, or the public as required or permitted by applicable laws (including exchanging information with other companies and organizations for the purposes of fraud protection).
• Change of corporate ownership: If we are involved in a merger, acquisition, bankruptcy, reorganization, partnership, asset sale, or other transaction, we may disclose your Information as part of that transaction.
• Third-Party Plug-ins: Even Hub is a plugin platform provided by Even Realities that allows third-party developers to create applications or plugins (“Plug-in”) that extend the functionality of Even Realities Products and Services. These Plug-ins are not developed or controlled by Even Realities and are provided by independent third-party developers. When you install or use a Plug-in, it may access certain personal data in order to provide its functionality. Even Realities may share your personal data in accordance with your authorization but we can not control how third-party developers use your data and is not responsible for the data processing practices of third-party Plug-in. We recommend that you carefully review the Plug-in’s privacy policy and related information before installing it.
  • Some Plug-ins may disclose data to third-party servers in order to provide their functionality or services. In such cases, the data will be processed in accordance with the privacy policy of the Plug-in developer.
  • Even Realities does not process or control such data disclosures on behalf of third-party Plug-in developers.

Since we maintain servers located in Netherlands, your personal data may be processed on servers located outside of the country where you live. Meanwhile, due to the international nature of our business, your personal data may also be accessed by our affiliates or be transferred to third-party service providers and business partners in connection with the purposes set out in this Policy. For this reason, we transfer personal data to other jurisdictions that may have different laws and data protection compliance requirements to those that apply in the jurisdiction in which you are located.

In the event of an international transfer of personal data, when required by applicable laws, we will provide an adequate level of protection for your personal data using various means including where appropriate implementing the European Commission approved Standard Contractual Clauses and UK International Data Transfer Agreement between our affiliates and third parties (where applicable) or any other lawful approach that permits the lawful transfer of personal data from those countries. For more information regarding international data transfer, please refer to Data Storage and Cross-Border Transfers.

Subject to applicable law and depending on where you reside, you may have some rights regarding your personal data as described further below. You may exercise some of your right in the Apps via “Settings > Account”. If you have any other requests relating to the access of your personal data, please contact us.

Data Access

You may have the right to know what personal data we process about you, including the categories of personal data, the business or commercial purposes for collection, and the categories of third parties to whom we disclose it.

Data Correction

You may have the right to request that we correct inaccurate personal data that we retain about you, subject to certain exceptions.

Data Portability

You may contact us to request the personal data you have provided to us in a structured, commonly used, and machine-readable format and have it transferred to another controller to the extent applicable.

Data Deletion

You have the right to delete your account and erase your personal data. Upon deleting your account, all your personal data will be deleted. Additionally, you may also request deletion of the personal data you provide by contacting us. If some of your personal data cannot be deleted, we will inform you of the reasons for not taking action.

Please note that we reserve the right to retain some of your personal data where there are valid grounds for us to do so under applicable laws. If you would like to request the deletion of your data from our systems, please contact us at support@evenrealities.com or contact us from the Services within the Even Realities App. We will make every reasonable effort to fulfill your request in accordance with applicable data protection laws. Certain data may be retained for a period required by law, our legitimate business purposes, or as necessary to fulfill contractual obligations. We may retain anonymized or aggregated data that does not personally identify you for analytical and reporting purposes. We will notify you once your data deletion request is processed. If there are any challenges or exceptional circumstances that may affect the processing time, we will communicate these issues to you promptly.

Withdrawal of Consent

Where we process your personal data on the basis of your consent, you may withdraw your consent by contacting us. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

Objection to the Processing

Subject to applicable laws, you may object to the processing of your personal data based on our legitimate interests where there are grounds relating to your particular situation by contacting us. Please note that we may have an overriding legitimate interest to keep processing your personal data, but we will let you know where this is the case.

Restriction to the Processing

If you would like to restrict our processing of your personal data, you may contact us. You have the right to restrict the processing of your data where one of the following applies:

• the processing is unlawful and you oppose the erasure of relevant personal data;
• for the purpose of establishment, exercise, or defense of legal claims, you request us to retain your personal data that we were supposed to delete;
• your objection regarding the accuracy of your personal data is pending our verification;
• your request to object to the processing of your personal data is pending our verification.

Other Rights

Depending on your jurisdiction, you may be entitled to additional rights in relation to your personal data. For example, you may also have the right to lodge complaints with an applicable data protection authority if you consider that the processing of your personal data infringes any applicable data protection laws (for example the EU General Data Protection Regulation). For California residents, please find more details of your rights in Section 8 below.

If you would like to contact us to exercise one or more of these rights, to ask a question about these rights or any other provision of this Policy, or about our processing of your personal data, or to file a complaint about how we process your personal data, you may use the contact details provided in Section 11 below. When submitting a right request, please specify the scope and basis of your request and provide us with the necessary information to verify your identity. We may contact you to confirm your identity in order to handle your request. We will respond to your request or complaint in due course under applicable data protection laws.

Our Services are not directed towards and we do not knowingly collect, sell, or share any information about children. If you become aware that a child has provided any personal data to us while using our Services, please email us at the contact details provided in Section 11 below and we will investigate the matter and if appropriate delete the personal data.

If you are a California resident, the California Privacy Rights Act or other California privacy laws described below require us to provide you with the following additional information:

Your California Rights and Choices

As a California resident, you may be able to exercise the following rights:

• the right to know any or all of the following information relating to your personal data we have collected and disclosed in the last 12 months upon verification of your identity:
  • The specific pieces of personal data we have collected about you
  • The categories of personal data we have collected about you
  • The categories of sources of the personal data
  • The categories of personal data that we have disclosed to third parties for a business purpose and the categories of recipients to whom this information was disclosed
  • The categories of personal data we have sold and the categories of third parties to whom the information was sold
  • The business or commercial purposes for collecting or selling personal data.
• the right to correct any inaccurate personal data we have about you.
• the right to request deletion of personal data we have collected from you subject to certain exceptions.
• the right to opt-out of the sale and/or the sharing of your personal data and sensitive personal data to third parties now or in the future.

You also have the right to be free of discrimination for exercising these rights. However, please note that the exercise of these rights may limit our ability to process personal data. For example, if you submit a deletion request, we may no longer be able to provide you with our Services.

Limit the Use of Sensitive Personal Data

You also have the right to request limitation of use and disclosure of your sensitive personal data subject to certain exceptions. If you would like to limit the use of your sensitive personal data, please contact us by using the contact details provided in Section 11 below.

The location, biometric information, and verification code are sensitive personal data as defined by the CPRA. Currently, we use and disclose such data to third-party service providers for the purpose necessary to provide Services to you, supporting your account management, calculating the parameters for your Even Realities smart glasses, enabling the functions of Even Realities smart glasses including navigation, real-time translation. We do not “sell” or “share” (as defined under the CPRA) your sensitive personal data.

Do Not Sell or Share My Personal Data

Based on the definition of “sell” and “share” under the CPRA, we do not believe that we engage in such activity and have not engaged in such activity in the past 12 months from the effective date of this Policy.

To submit your California Consumer Rights Requests

You may submit a request to exercise your California Consumer Rights by contacting us using the contact details provided in Section 11 below. We will need to verify your identity before processing your request, which may require us to request additional personal data from you or require you to log into your account if you have one. In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity or locate your information in our systems, or as permitted by law. Subject to certain restrictions, you can have an agent exercise your rights for you. If you have an agent exercising your rights, we must be provided with your written authorization allowing that person to make such a request on your behalf. We reserve the right to deny the agent’s request if we are not reasonably able to confirm proper authorization and/or verify your identity as the requestor.

Appeal

You may appeal our refusal to take action on a request by contacting us using the contact details provided in Section 11 below. If your appeal is denied and you are a California resident, you may contact the California Attorney General about the results of the appeal by submitting a complaint by clicking here: https://oag.ca.gov/contact/consumer-complaint-against-business-or-company.

California’s “Shine the Light” Law

California’s “Shine the Light” law (Civil Code Section §1798.83) provides certain rights to California residents who have an established business relationship with us with regard to the disclosure of certain types of personal data to third parties for their direct marketing purposes. We do not disclose personal data to third parties for their direct marketing purposes.

We do not provide medical care or advise and are thus not a Covered Entity under HIPAA (US Health Insurance Portability and Accountability Act) (“HIPAA”).

However, in respect of the health data of our US-based customers, we strive to comply with all of the requirements as per HIPAA.

10.Notice to Singapore Residents