ARSHADES PRIVACY POLICY

ARShades Solutions
Last updated: 26 August 2026

Pursuant to Regulation (EU) 2016/679 (“GDPR”), the UK GDPR, the California Consumer Privacy Act (“CCPA”) and its amendments, including the California Privacy Rights Act (“CPRA”), other U.S. state privacy laws, including the Virginia Consumer Data Protection Act (“VCDPA”), the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”), the Montana Consumer Data Privacy Act (“MCDPA”), the Oregon Consumer Privacy Act (“OCPA”), as well as further applicable U.S. state privacy laws, the Illinois Biometric Information Privacy Act (“BIPA”), the Texas Capture or Use of Biometric Identifier Act (“CUBI”), Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”), the Australian Privacy Act, Brazil’s Lei Geral de Proteção de Dados (“LGPD”), Switzerland’s Federal Act on Data Protection (“FADP”), Japan’s Act on the Protection of Personal Information (“APPI”), China’s Personal Information Protection Law (“PIPL”), South Africa’s Protection of Personal Information Act (“POPIA”), India’s Digital Personal Data Protection Act (“DPDP”), the United Arab Emirates’ DIFC Data Protection Law, the Saudi Personal Data Protection Law (“PDPL”), the New Zealand Privacy Act 2020, the Singapore Personal Data Protection Act (“PDPA”), the Philippines Data Privacy Act (“DPA”), the Malaysia Personal Data Protection Act (“PDPA”) and other applicable international data-protection laws, collectively referred to as the “International Privacy Laws”.

Spaarkly s.r.l. (“Spaarkly”, “we”, “us” or “our”), a company registered in Italy with registered office at Via della Tecnica n. 18, 85100 Potenza (Italy), email: privacy@spaarkly.com, acting as data controller, provides this Privacy Policy (“PP”) concerning the processing of the personal data of users (“you” or “User”) who access or interact with the ARSHADES Technology available globally, including:

• ARShades Virtual Try-On (“ARShades VTO”, “VTO”, “Web VTO”, “VTO App”, “Applications and Services”);
• ARShades VTO Explorer (“VTO Explorer”), as a module or feature that can be integrated into ARShades web, mobile, catalogue, e-commerce, mirror, showroom or in-store experiences;
• AR PD Meter;
• ARShades Mirror (“Mirror”);
• ARShades Gateway (“Gateway”, “Standalone Application”);
• ARShades Campaign Catalogue (“Campaign Catalogue”), as a public web-based product catalogue integrating ARShades experiences.

This Privacy Policy is based on the GDPR as its principal legal framework, supplemented by the specific requirements of the laws of the countries in which we offer our services. Where regulatory differences arise, they are set out in the Regulatory Addenda appended to this document.

We encourage Users to read carefully both the main body of this Policy and the Addendum applicable to their geographical area, in order to fully understand their rights and the local specifics relating to the processing of their data.

Introduction

Spaarkly s.r.l. (“Spaarkly”, “we”, “us” or “our”), a company registered in Italy, is the owner of the ARSHADES Technology, the ARSHADES trademark and other Augmented Reality (AR) solutions for eyewear applications used in this web or mobile application under the name ARShades.

We act as data controller under applicable data-protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the California Consumer Privacy Act (“CCPA”), Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”), the Australian Privacy Act, the UK GDPR and other international laws. This Privacy Policy provides information on how we collect, use and process the personal data of users (“you” or “User”) who access or interact with our ARSHADES technology (“VTO”, “Web VTO”, “Web or Mobile Application”, “App”, “Applications and Services”), available globally.

Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• Personal Data: any information relating to an identifiable natural person, including IP address, email and other data voluntarily provided by the User.
• Session Data: information collected during a user session, such as interaction timestamps, pages viewed and usage statistics. It is retained for up to 14 months before anonymisation.
• Device Data: technical information about the User’s device, including device type, operating system, browser version and preferred language. It is used for service optimisation and security.
• Geolocation Data: subject to the User’s consent, ARShades may collect the approximate location based on IP address or, in standalone applications, the precise GPS location, in order to provide location-based services. Users may disable this feature at any time.
• Data Controller: Spaarkly s.r.l., which determines the purposes and means of the processing of personal data.
• Processing: any operation carried out on personal data, including collection, storage, anonymisation and erasure.
• Cookies and tracking technologies: essential cookies necessary for the functioning of the service and optional analytics tools, where enabled by the User. No marketing cookies are used.
• Data Subject Rights: Users may access, rectify, erase or restrict the processing of their data as provided under the GDPR, the CCPA and similar laws. Requests may be sent to privacy@spaarkly.com.
• International data transfers: where personal data is transferred outside the European Economic Area (EEA), Spaarkly ensures compliance through Standard Contractual Clauses (SCCs) or equivalent safeguards.
• ARShades VTO: a virtual try-on (VTO) solution that allows users to see how eyewear fits their face in real-time augmented reality (AR). It works on web and mobile devices without storing biometric data.
• ARShades VTO Explorer: a photographic virtual try-on and augmented-catalogue module that allows Users to generate realistic, personalised previews of multiple eyewear products from a limited number of images captured during the session. VTO Explorer can be integrated into ARShades web, mobile, catalogue, mirror or other in-store experiences. The captured images are processed locally on the User’s device or on the device used for the experience and are not automatically uploaded to Spaarkly’s servers. Where VTO Explorer is used on a device installed in a point of sale, showroom, event venue or other public place, and the User chooses to obtain, download or share the final photos on their own device, only the final photos selected by the User may be temporarily uploaded to Spaarkly’s servers solely to make them available to the User, and are deleted as described in this Policy.
• AR PD Meter: a pupillary distance (PD) measurement tool that estimates the distance between the User’s pupils by means of AR and facial-landmark detection. Camera images and video streams are not retained, are not used for biometric identification and are not used to create facial templates. To calculate the pupillary distance, AR PD Meter may temporarily transmit derived technical data—such as facial landmarks, face orientation, device technical information and the parameters required for the calculation—to the ARShades backend located in the European Union. Such data is used solely to return the measurement result and is discarded after processing.
• ARShades Mirror: a retail virtual try-on experience delivered through dedicated stations (screen and camera) installed in points of sale, showrooms and event venues, in the ARShades Mirror Showroom, Portrait and Photobooth editions, allowing users to browse virtual eyewear catalogues and try eyewear on in AR without requiring the storage of personal data.
• ARShades Gateway: a standalone AR platform that provides, among other things, a virtual try-on experience. It may optionally use geolocation, subject to consent, to personalise recommendations.
• ARShades Campaign Catalogue: a public web-based product catalogue, accessible through a dedicated URL, which showcases a brand’s eyewear products and allows Users to launch ARShades experiences such as VTO, 3D Viewer and VTO Explorer. The catalogue page does not write cookies, local storage or other identifiers to the User’s device; its use is measured in aggregated form as described in the section “Public catalogue usage-measurement data (Campaign Catalogue)”.

1. PURPOSES OF PROCESSING AND LEGAL BASIS

a) ARShades solutions on devices owned by the User

ARShades offers Augmented Reality (AR) solutions for the virtual try-on of eyewear, usable on personal devices such as computers, smartphones and tablets.

We process the User’s personal data in order to provide a virtual try-on experience, enabling users to try different eyewear shapes and sizes on websites and mobile applications. The ultimate objective is to offer frame recommendations based on the User’s facial features, allowing the User to see how particular models might fit their face.

The legal basis for such processing is:

• Provision of the VTO Services: enabling the User to virtually try on eyewear frames, test shapes and sizes and use tools such as pupillary-distance measurement (legal basis: performance of a contract or of pre-contractual measures requested by the User, pursuant to Article 6(1)(b) GDPR).
• Service improvement, analytics, security and fraud prevention: improving the quality, usability, analytical understanding and security of our Services, generating anonymous statistics on the use and performance of ARShades experiences—including the aggregated measurement of the use of public Campaign Catalogue pages—preventing unlawful use and fraud and ensuring the integrity of networks and systems (legal basis: legitimate interest, Article 6(1)(f) GDPR).
• Compliance with legal obligations: complying with legal obligations or with orders of competent authorities relating to data retention, security and other regulatory requirements (legal basis: legal obligation, Article 6(1)(c) GDPR).
• Consent, where applicable: where consent is required—for example, for camera access or for any optional analytics tools, where available—the processing will be based on consent (Article 6(1)(a) GDPR), which may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

Such consent may be given by the data subject by ticking the relevant box at the end of this Privacy Policy.

Failure to give consent, where required, may prevent access to certain features of the Services.

b) ARShades solutions on devices installed in points of sale, showrooms or public places (ARShades Mirror)

Some ARShades solutions, including ARShades Mirror, are installed on dedicated stations located in points of sale, event venues or other places accessible to the public, in order to enable the virtual try-on of eyewear.

Some versions of ARShades Mirror, including the ARShades Mirror Showroom edition, may include the VTO Explorer module. In such cases, the same principles described for VTO Explorer apply: the images captured for personalisation and augmented-catalogue generation are processed locally on the device used for the experience and are not automatically uploaded to Spaarkly’s servers.

Here too, the ultimate objective is to offer frame recommendations based on the User’s facial features, allowing the User to see how particular models would appear on their face.

The legal basis for the processing is:

• Provision of the VTO Services: enabling the User to virtually try on eyewear frames, test shapes and sizes and use tools such as pupillary-distance measurement (legal basis: performance of a contract or of pre-contractual measures requested by the data subject, pursuant to Article 6(1)(b) GDPR).
• Service improvement, analytics, security and fraud prevention: improving the quality, usability, analytical understanding and security of our Services, generating anonymous statistics on the use and performance of ARShades experiences, preventing unlawful use and fraud and ensuring the integrity of networks and systems (legal basis: legitimate interest, Article 6(1)(f) GDPR).
• Legal obligations: complying with legal obligations or with orders of competent authorities relating to data retention, security and other regulatory requirements (legal basis: legal obligation, Article 6(1)(c) GDPR).
• Consent, where applicable: where consent is required—for example, for camera access, for capturing the images necessary to use the VTO Explorer module, or for the temporary storage of the final photos selected by the User for download or sharing through features such as “Shoot & Share” or equivalent download functions—the processing will be based on consent (Article 6(1)(a) GDPR), which may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

2. HOW ARSHADES VTO WORKS

ARShades technology uses computer vision to detect faces and estimate measurements without creating or storing facial templates.

ARShades uses facial-measurement software for the Virtual Try-On and AR PD Meter services. A 3D facial mesh is generated through the camera. For the Virtual Try-On, eyewear placement and rendering take place locally on the device. For AR PD Meter, the derived technical data required to calculate the pupillary distance may be temporarily transmitted to the ARShades backend located in the European Union, solely to return the measurement result.

Where an ARShades experience includes the VTO Explorer module, the system may ask the User to capture a limited number of images during the session. Such images are used as a stable visual reference to generate realistic previews of multiple eyewear products in the catalogue. The system may apply facial-landmark detection, adaptive facial masks, segmentation of facial areas such as skin, hair and ears, as well as local rendering techniques, in order to position the eyewear correctly and produce realistic previews.

Such processing is carried out locally on the User’s device or on the device used for the experience. The images captured for personalisation and catalogue generation are not automatically uploaded to Spaarkly’s servers, are not used for facial recognition and are not used to create a biometric identifier or a persistent facial template.

We do not carry out any unique identification of the User based on the facial mesh; the data is used solely to virtually position the eyewear and to provide recommendations based on facial features.

Unlike biometric technologies that create unique identifiers linked to individuals, our system:

• operates on anonymous mathematical points common to all faces;
• does not use the measurements to identify specific persons, nor are the measurements, on their own, capable of identifying them;
• does not use or store data for facial-recognition purposes;
• processes the Virtual Try-On facial data locally on the User’s device, with no server-side storage;
• for AR PD Meter, temporarily uses derived technical data on the ARShades backend solely to calculate and return the PD result, discarding it after processing.

To use these features, the User must grant the necessary permissions for access to the camera (“Cam”) and to other hardware components—for example, the TrueDepth camera or the Depth API—and must have a compatible version of the operating system installed on their device to support the Augmented Reality experiences.

The User may refuse such permissions, but doing so will make it impossible to use the service.

Such data is collected locally on the User’s device, save as indicated for the AR PD Meter calculation, and is used solely in anonymous or aggregated form for development purposes and to gather statistical information on the use of ARShades.

How we collect and manage consent

The browser or the mobile operating system independently requests access to the camera through a pop-up. Users must grant permission before the ARShades experience can operate.

Users may withdraw consent at any time by disabling camera access in their browser or device settings.

3. CATEGORIES OF PERSONAL DATA PROCESSED

Facial-measurement data

The system calculates the following facial dimensions in real time:

• pupillary distance;
• jaw length;
• forehead width and height;
• nose length and width;
• cheekbone height;
• face width at the cheekbones;
• face width at the mouth;
• chin length;
• overall face length.

Such measurements are processed instantly and locally for the Virtual Try-On. In the case of AR PD Meter, the derived technical data required to calculate the pupillary distance may be temporarily transmitted to the ARShades backend located in the European Union, solely to calculate and return the measurement result. It is not stored as a unique identifier, is not used for facial recognition and is discarded after processing. Any technical or session data retained for security, analytics, abuse prevention or service improvement is retained for a maximum of 14 months and thereafter aggregated or anonymised.

Anonymous statistical data

We may collect, in anonymised and non-traceable form, information such as approximate gender and age range, solely for the purpose of providing eyewear recommendations, verifying minimum-age requirements, generating anonymous statistics and improving the user experience. In any event, we will expressly inform the User of this possibility and will proceed only after obtaining their specific authorisation.

Some ARShades experiences, such as ARShades Mirror, may include a local artificial-intelligence module—using open-source AI technology run directly on the device—for anonymous statistical and analytical purposes relating to the use, performance and improvement of the ARShades services.

Such module may automatically estimate certain general characteristics of the person interacting with the experience, such as estimated gender, estimated age range and the presence or absence of eyewear. The estimation of further general demographic attributes is disabled by default and may be enabled only for specific projects, subject to prior legal assessment; in that case, the notice displayed on the device expressly indicates it.

Such data is processed solely in anonymous and aggregated form for statistical purposes, service analysis, product-performance assessment, usage analytics and improvement of the ARShades services. It is not used to identify the User, is not linked to a name, contact details, facial template, account or persistent identifier, and is not used for facial recognition, individual profiling, automated decision-making producing legal or similarly significant effects, marketing or behavioural tracking.

The AI analysis is carried out locally on the device. Spaarkly may collect only anonymous statistical outputs derived from such analysis, where technically enabled, and not facial images, facial templates, biometric identifiers or data that directly identifies the User. The above remains applicable: any activation of such module is brought to the User’s attention and, where required by applicable law, is subject to the User’s specific authorisation.

Device and session data

We collect standard usage information such as:

• IP address;
• device type;
• operating system;
• preferred language;
• brands and products viewed;
• access dates and times;
• anonymous statistics on interactions with the VTO app, for example whether the User wears eyeglasses.

Such data is collected to improve the Services, ensure security and analyse the use of our solutions.

Public catalogue usage-measurement data (Campaign Catalogue)

When the User visits the public page of an ARShades Campaign Catalogue, Spaarkly measures the use of the page in aggregated form, in order to provide its clients with campaign statistics: number of visits, an estimate of unique visitors within a single day, page scroll depth, interactions with products, openings of the immersive experiences, the channel from which the visit originated and the device type.

Such measurement is carried out without writing cookies, local storage or other identifiers to the User’s device. For the sole purpose of distinguishing visits within a single day, Spaarkly’s systems compute, server-side, a technical code by applying a non-reversible cryptographic hash function to the IP address and to technical browser information, together with a rotating secret element renewed every 24 hours; the IP address is discarded immediately after the computation and is not retained. The resulting code does not allow the User to be recognised across different days and constitutes derived technical data not used to identify the User and not capable, on its own, of identifying the User. It is not used for recognition, individual profiling, marketing or behavioural tracking across different websites or services.

The usage events so collected are deleted after the daily statistical aggregation, as a rule within 48 hours of collection; thereafter, only aggregated statistics, free of any technical code, are retained. The legal basis for such processing is the legitimate interest of Spaarkly and its clients in measuring the effectiveness of campaigns and the use of the service (Article 6(1)(f) GDPR); the User may object as set out in Section 12 (Data Subject Rights).

The launch of an immersive experience from the catalogue (for example, VTO or VTO Explorer) remains subject to the consents, notices and rules described in the other sections of this Policy.

Facial images or biometric data

ARShades does not collect, store or process biometric identifiers or biometric information within the meaning of the GDPR or as defined by state laws such as BIPA, CUBI, CCPA or similar laws. The facial-measurement technology used by ARShades detects facial landmarks in order to overlay, position or render the eyewear and, for AR PD Meter, to calculate the pupillary distance, without generating or storing biometric identifiers. No facial templates, scans or unique identifiers are created, stored or transferred to our servers. Any derived technical data transmitted to the ARShades backend for AR PD Meter is used solely to return the measurement result and is discarded after processing.

Where an ARShades experience includes the VTO Explorer module, the User may be asked to capture a limited number of images during the session. Such images are processed locally on the User’s device or on the device used for the experience in order to generate personalised catalogue previews and are not automatically uploaded to Spaarkly’s servers.

Where VTO Explorer or other ARShades photographic-output features are used on the User’s device, the final photos generated during the experience may be saved or downloaded directly to that device. In such cases, Spaarkly has no need to upload, store or otherwise process such final photos on its servers in order to make them available to the User.

A separate temporary server-side processing may occur only where the experience is provided through a device installed in a point of sale, showroom, event venue or other public place, and the User chooses to obtain, download or share on their own device final photos depicting them wearing the selected eyewear. In that case, only the final photos selected by the User are temporarily uploaded to Spaarkly’s servers for the sole purpose of making them available to the User for download or sharing. Such photos are not used for identification, facial recognition, profiling, marketing, analytics or the training of artificial-intelligence systems.

Should a jurisdiction redefine biometric data in such a way as to potentially include ARShades technology, we confirm that facial analysis and personalisation remain strictly local on the User’s device or on the device used for the experience and are not stored or used for identification purposes. Any temporary upload of final photos is limited to the download or sharing requested by the User from devices installed in points of sale, showrooms, event venues or other public places, and is subject to the retention limits described in this Policy.

Final photos selected by the User

Where the User chooses to obtain, download or share final photos generated through ARShades VTO, VTO Explorer, ARShades Mirror, “Shoot & Share” or equivalent features, the manner of processing depends on the type of device used for the experience.

Where the experience takes place on the User’s personal device, the final photos may be saved or downloaded directly to that device and are not uploaded to Spaarkly’s servers for that purpose.

Where the experience takes place on a device installed in a point of sale, showroom, event venue or other public place, Spaarkly may temporarily process only the final photos selected by the User, solely to make them available to the User for download or sharing on their own device.

Such photos may depict the User wearing one or more selected eyewear products. They are not used for facial recognition, biometric identification, profiling, marketing, analytics or the training of artificial-intelligence systems.

The User may delete such photos immediately after download, where this option is available. If the User does not delete them manually, they are automatically deleted from Spaarkly’s servers by the day following the session.

Geolocation data in standalone applications (ARShades Gateway)

Some standalone ARShades applications—that is, applications not embedded in clients’ websites—may collect geolocation data as follows:

• Precise geolocation: subject to explicit consent, specific standalone ARShades applications may collect precise geolocation coordinates from the device in order to provide location-based services or recommendations.
• Approximate location: in the absence of explicit consent to precise location, we may infer an approximate location based on the IP address.

The collection of geolocation data in standalone applications is:

• optional: location permissions may be refused without affecting the core VTO features;
• consent-based: precise geolocation is collected only subject to explicit consent;
• purpose-limited: used only to provide relevant eyewear recommendations or location-based services;
• subject to the same retention policy: anonymised within 14 months together with the other technical data.

Managing geolocation consent

On first use of our standalone applications, the browser will ask you to allow or block access to location. This is a session-based consent that does not necessarily persist between visits but, depending on the User’s choice and the browser settings, that decision may be:

• remembered locally by the browser for future visits to the same application;
• set so as to ask each time;
• granted temporarily for the current session only.

You can change these permission settings at any time through your browser settings.

All technical data collected, including any geolocation data, is automatically anonymised within 14 months, as described in our retention policy.

4. MANNER OF PROCESSING

Personal data is processed by means of IT systems and, where necessary, manually, in accordance with the principles of fairness, lawfulness, transparency and confidentiality. Authorised personnel, who are trained and instructed, access the data for the stated purposes.

We adopt technical and organisational measures designed to prevent unauthorised access and to protect the data.

5. PROCESSING OF DATA IN ARSHADES MIRROR

ARShades Mirror shares the same core features as the other ARShades VTO solutions: facial landmarks are processed in real time, locally on the device, without persistent templates or identity recognition, and no video stream leaves the station. In the ARShades Mirror Showroom edition, an estimate of the distance from the camera, based on average anthropometric values, is derived on the device from the facial landmarks for the sole purpose of sizing the virtual frames; no pupillary distance is measured or returned, and this estimate is neither stored nor transmitted. This section specifically governs the additional aspects relating to in-store deployment and the optional “Shoot & Share” feature, which allows users to save and share selfies wearing the selected eyewear. Personal data is processed as follows:

Manner of processing

• The images captured for virtual try-on, personalisation, catalogue generation, facial fitting, segmentation, product placement and rendering are processed locally on the device without automatic transfer to Spaarkly’s servers.
• In ARShades Mirror editions that include the VTO Explorer module, such as ARShades Mirror Showroom, the images captured during the personalisation phase are used locally to generate augmented-catalogue previews and are not uploaded to Spaarkly’s servers.
• Only where the User actively chooses to obtain, download or share final photos depicting them wearing the selected eyewear from a device installed in a point of sale, showroom, event venue or other public place may such selected final photos be temporarily uploaded to Spaarkly’s servers solely to make them available to the User on their own device.
• The point-of-sale owner has no direct access to the data or images generated by Users, as access to the software is restricted exclusively to ARShades.
• ARShades undertakes not to access User data except where necessary for specific technical-maintenance activities, and always without viewing or processing the captured images.
• Spaarkly does not disclose User data to third parties for the latter’s own purposes. For hosting and service delivery, Spaarkly may rely on qualified cloud-infrastructure providers, with servers located in the European Union, appointed as data processors pursuant to Article 28 GDPR and bound by appropriate data-processing agreements. Processing activities are carried out exclusively by authorised Spaarkly personnel and by such providers, within the limits of the instructions given.

Automatic deletion and security measures

• The final photos temporarily uploaded through ARShades Mirror, VTO Explorer, “Shoot & Share” or equivalent download/sharing features from devices installed in points of sale, showrooms, event venues or other public places may be deleted immediately from our servers by Users after being downloaded to their own device, where this option is available. If Users do not manually delete their photos, our system automatically removes them by the day following the session by means of a scheduled automatic procedure, without manual intervention.
• Temporarily stored data is encrypted at rest and in transit to ensure its security.
• All access to ARShades devices for technical maintenance is recorded in an access log in accordance with Article 5(1)(f) GDPR.
• The software is configured to restrict access to the data exclusively to authorised ARShades personnel.

Role of ARShades and of the point of sale

• ARShades remains the sole data controller for the data generated through ARShades Mirror.
• The point of sale does not process User data, as it has no access to the data generated or to the management of the software.

6. DATA COLLECTION AND RETENTION PERIOD

• Facial-measurement data is collected locally on the User’s device for the Virtual Try-On and retained only for as long as necessary to provide the ARShades VTO services. For AR PD Meter, the derived technical data required to calculate the pupillary distance may be temporarily transmitted to the ARShades backend located in the EU, used solely to return the measurement result and discarded after processing.
• Session and device data is stored on Spaarkly’s servers, located within the EU. IP addresses are deleted and fully dissociated from all other data within 14 months. Only aggregated and anonymised data is retained for statistical analysis.
• Public catalogue usage-measurement data (Campaign Catalogue) is deleted after the daily statistical aggregation, as a rule within 48 hours of collection; thereafter, only aggregated and anonymous statistics are retained.
• The retention period for personal data may be extended in exceptional cases, for example to comply with legal obligations or for fraud-prevention purposes.

7. COOKIE POLICY

ARShades uses only strictly necessary cookies, which are essential for the functioning of our services. Such cookies:

• enable core website functionality, such as session management and security;
• do not track users across different websites;
• are not used for analytics, marketing or third-party tracking.

As such cookies are essential, they do not require the User’s consent under the GDPR and the ePrivacy Directive. Users may manage their browser settings to block or delete cookies, but doing so may affect the functionality of the service.

The public Campaign Catalogue pages do not set cookies or local storage: the measurement of their use is carried out exclusively server-side, as described in the section “Public catalogue usage-measurement data (Campaign Catalogue)”. The cookies described in this section relate to the ARShades experiences (for example, VTO) launched by the User.

Strictly necessary cookies used

Storage technologies used

For technical reasons connected with cross-domain restrictions in some browsers, ARShades may store consent using cookies or local-storage mechanisms. Both methods serve the same functional purpose: to remember acceptance of the privacy policy in order to avoid repeated requests during subsequent VTO experiences.

Where cookies cannot be set due to browser restrictions, local storage is used as a fallback mechanism. Such local-storage data is subject to the same retention periods, security measures and user controls as cookies. You can delete both cookies and local-storage data through your browser settings.

The information stored using either method is limited to essential consent flags and is not used for tracking or profiling.

8. NATURE OF THE PROVISION OF DATA AND CONSEQUENCES OF FAILURE TO PROVIDE IT

The provision of data for the purposes described above is voluntary and free of charge. With the exception of geolocation data in certain standalone ARShades products, if the User chooses not to provide the data or permissions required for a specific feature, we may be unable to provide that feature.

For example, refusal of camera access will prevent use of the VTO experience. Refusal to capture the images required by the VTO Explorer module may prevent the generation of augmented-catalogue previews.

Where the experience takes place on the User’s personal device, the choice not to save or download the final photos does not prevent the User from using the local virtual try-on or catalogue-exploration experience, where available. Where the experience takes place on a device installed in a point of sale, showroom, event venue or other public place, the choice not to request the download or sharing of the final photos means that no temporary upload of such photos to Spaarkly’s servers will be carried out for that purpose.

9. INTERNATIONAL DATA TRANSFERS

All data is stored on servers located within the European Union (EU).

We do not transfer your personal data outside the European Economic Area (EEA).

Should it become necessary in the future to transfer data outside the EEA, we will ensure that appropriate safeguards are put in place in accordance with the GDPR and other applicable laws, such as the Standard Contractual Clauses (SCCs) approved by the European Commission.

10. SECURITY MEASURES

We adopt appropriate technical and organisational measures to protect data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Such measures include:

• encryption;
• firewalls;
• secure servers;
• access-management systems to prevent unauthorised access to systems and data.

We constantly monitor and update our security protocols to ensure compliance with the latest data-protection standards.

Protocol in the event of a security breach

In the event of a security incident affecting session data, device data, IP addresses or geolocation data, ARShades will:

• assess the level of risk pursuant to Article 33 GDPR. We will assess any potential breach in accordance with Article 33 GDPR and will notify the competent supervisory authority within 72 hours where required by applicable law;
• owing to the absence of personal contact data, be unable to notify individual users directly. Where required, we will instead issue a public notice through our official website or other channels;
• mitigate and resolve the incident as quickly as possible, implementing, where necessary, additional safeguards.

11. CHILDREN’S PRIVACY

ARShades is designed for users of all ages. However, only users who have reached the minimum legal age required in their country may independently give consent to the processing of their personal data.

If a user is below that age, the consent of a parent or guardian is required for the processing of the data, and the parent or guardian must accept this Privacy Policy on the user’s behalf.

We are committed to protecting the privacy of minors and encourage parents and guardians to actively monitor minors’ online activity and digital experiences.

We do not intentionally collect or process the personal data of any User—and therefore of any minor—in the absence of a valid legal basis and, in the case of minors below the applicable legal age, of verified parental consent.

Given the way ARShades is designed, we do not create accounts, do not request names or contact details and do not generate persistent identifiers: facial processing takes place locally on the device, and any technical and session data that may be retained (for example, the IP address) is dissociated from all other data within the periods set out in Section 6 (Data Collection and Retention Period). Accordingly, we hold no data attributable to an identified or identifiable minor.

Should a parent or guardian believe that their child has used the service without their consent, they may contact us at privacy@spaarkly.com to request the erasure of the data, indicating the IP address used and, where available, the approximate date and time of the session. Where such details enable us to identify the relevant data, we will immediately take steps to erase it; failing that, we recall that technical data remains in any event subject to the retention limits and automatic deletion described in Section 6 (Data Collection and Retention Period).

12. DATA SUBJECT RIGHTS

Under the GDPR and equivalent laws, Users enjoy the following rights:

Right of access

• To request confirmation as to whether or not their personal data is being processed.
• To obtain access to the relevant information, such as the purposes, the categories of data processed, the recipients or categories of recipients, the retention period, etc.

Right to rectification

• To request the correction of inaccurate or incomplete data.

Right to erasure (“right to be forgotten”)

• To request the erasure of personal data where:
  • the data is no longer necessary in relation to the purposes for which it was collected;
  • consent is withdrawn, where the processing is based on consent;
  • the data has been processed unlawfully.

Right to restriction of processing

• To request the restriction of processing where:
  • the accuracy of the data is contested;
  • the processing is unlawful but you oppose erasure;
  • the data is required for the establishment, exercise or defence of legal claims, even if the controller no longer needs it;
  • you have objected to the processing, pending verification of the legitimate grounds.

Right to data portability

• To receive your personal data in a structured, commonly used and machine-readable format.
• To request its direct transmission to another controller, where technically feasible.

Right to object

• To object to processing based on legitimate interest.

Right to withdraw consent

• To withdraw consent at any time where the processing is based on consent.

Consent-management interface

To facilitate the exercise of the right to withdraw consent, ARShades provides a dedicated cookie/consent-management icon within the Virtual Try-On interface. By clicking on that icon, the User can:

• view the current status of their consent;
• access our full Privacy Policy;
• withdraw previously given consent.

Where consent is withdrawn, we immediately delete the consent data from both cookies and local storage, terminate the current VTO session and require fresh consent for any subsequent use of our services. This mechanism ensures that the User retains full control over their data at all times.

Exercising rights

As ARShades does not require user registration and does not collect direct personal identifiers such as names or email addresses, it may be necessary to provide additional information to verify identity, such as IP address, device information or session details, in order to verify and handle data-related requests. This is necessary to associate the request with the technical data retained.

If a user cannot provide their IP address or other identifying session details, we may be unable to fulfil certain requests, such as data erasure, as ARShades does not maintain personally identifiable profiles.

Requests must be sent by email to the data controller at: privacy@spaarkly.com

If you believe that your data has been processed unlawfully, you have the right to lodge a complaint with:

• the Italian Garante per la Protezione dei Dati Personali: www.garanteprivacy.it;
• another competent supervisory authority in your country of residence.

13. CHANGES TO THIS PRIVACY POLICY

We may periodically update this Privacy Policy to reflect:

• changes to our Services;
• updates to the technology;
• new legal requirements;
• internal changes to policies.

When updates are made, we will change the “Last updated” date at the beginning of this document.

We encourage Users to review this Privacy Policy periodically to stay informed about how we protect their data.

14. CONTACT INFORMATION

The data controller is: Spaarkly s.r.l. Address: Via della Tecnica n. 18, 85100 Potenza, Italy Email: privacy@spaarkly.com

For further information or requests concerning your personal data, please contact us at the email address indicated.

---

REGULATORY ADDENDA

Introduction to the Regulatory Addenda

This Privacy Policy establishes the general framework for the protection of personal data, based primarily on the GDPR. However, in some jurisdictions additional or different requirements may apply.

The following Regulatory Addenda supplement or modify the main body of the Policy. Each Addendum specifies, for the relevant geographical area or country:

• additional or different rights compared with those described in the main Policy;
• the manner of exercising such rights, including local contacts, procedures and response times;
• any additional consent requirements;
• specific data-retention requirements;
• local data-breach notification obligations;
• data-transfer rules, including standard contractual clauses and local requirements.

The general provisions of this Privacy Policy apply to the extent that they do not conflict with the terms of the Addenda. In the event of a conflict, the provisions of the applicable Addendum prevail.

We encourage Users to read carefully the Addendum applicable to their country or region of residence.

Index of regional and national Addenda

1. European Union / European Economic Area / United Kingdom
2. Switzerland
3. United States
4. Canada
5. Australia and New Zealand
6. Asia-Pacific Region
7. Brazil and Latin America
8. Japan
9. China
10. South Africa
11. India
12. Middle East
13. Other Countries

A. UNITED KINGDOM (UK GDPR) / EUROPEAN UNION AND EUROPEAN ECONOMIC AREA (EU/EEA)

Users resident in the United Kingdom and in the EU/EEA benefit from the rights provided under the UK GDPR and the EU GDPR, as described in the main body of this Privacy Policy. For transfers of data outside the United Kingdom or the EU/EEA, Spaarkly ensures compliance with applicable laws, including the use of the Standard Contractual Clauses (SCCs) approved by the European Commission for EU/EEA transfers and the ICO-approved SCCs for transfers from the United Kingdom.

Additional or differentiated rights

There are no substantial differences between the rights provided under the UK GDPR and those provided under the EU GDPR. Users in both jurisdictions retain the same fundamental rights of access, rectification, erasure, restriction, objection and data portability described in the main Policy.

Exercising rights

Users in the United Kingdom and the EU/EEA may exercise their rights by contacting privacy@spaarkly.com. They may also apply to the competent supervisory authority:

• EU/EEA users: the data-protection authority of their respective Member State.
• UK users: the Information Commissioner’s Office (ICO) (https://ico.org.uk/).

Data-breach notification obligations

In the event of a personal-data breach, Spaarkly will notify the competent supervisory authority within 72 hours of becoming aware of it, in accordance with Article 33 GDPR and the ICO reporting requirements in the United Kingdom.

International data transfers

For transfers outside the EU/EEA and the United Kingdom, Spaarkly ensures that appropriate safeguards are put in place, including:

• Standard Contractual Clauses (SCCs) of the European Commission for transfers from the EU/EEA;
• ICO-approved SCCs for transfers from the United Kingdom;
• additional safeguards where necessary, in line with the guidance of the European Data Protection Board (EDPB) and the ICO.

Spaarkly does not transfer personal data to jurisdictions lacking an adequate level of protection, unless SCCs or other legally recognised mechanisms are in place.

B. SWITZERLAND (FADP – FEDERAL ACT ON DATA PROTECTION)

Users resident in Switzerland benefit from data-protection rights that are substantially equivalent to those provided under the GDPR, as Swiss law is closely aligned with European standards.

Additional or differentiated rights under the FADP

Swiss users have the right to:

• access their personal data processed by Spaarkly;
• request the correction or deletion of inaccurate or unnecessary data;
• object to the processing of data for direct-marketing purposes.

Exercising rights

Swiss users may submit requests by email to privacy@spaarkly.com. For any complaints, they may also contact the Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch.

Data-retention requirements

We apply the general data-retention principles described in this Privacy Policy. Personal data is retained only for as long as necessary to achieve the intended purpose and is anonymised within 14 months. Where Swiss law provides for specific retention periods, Spaarkly complies with them.

Data-breach notification obligations

In the event of a data breach entailing a high risk to individuals’ rights, Spaarkly will inform:

• the Federal Data Protection and Information Commissioner (FDPIC);
• the data subjects, where required by Swiss law.

International data transfers

The personal data of Swiss users is not transferred outside Switzerland, unless:

• the destination country is deemed by the Swiss authorities to have an adequate level of protection;
• Standard Contractual Clauses (SCCs) approved by the European Commission are implemented for transfers to the EU/EEA;
• other safeguards compliant with the Swiss FADP are adopted to protect the transferred data.

C. UNITED STATES — U.S. ADDENDUM

The United States does not have a general federal data-protection law applicable to all States. Spaarkly therefore complies with the privacy laws applicable at state level. This Addendum applies to residents of the United States and supplements the ARShades Privacy Policy. It governs compliance with federal and state privacy laws, including, by way of example:

• California: California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA);
• Virginia: Virginia Consumer Data Protection Act (VCDPA);
• Colorado: Colorado Privacy Act (CPA);
• Connecticut: Connecticut Data Privacy Act (CTDPA);
• Utah: Utah Consumer Privacy Act (UCPA);
• Montana: Montana Consumer Data Privacy Act (MCDPA);
• Oregon: Oregon Consumer Privacy Act (OCPA);
• Illinois: Biometric Information Privacy Act (BIPA);
• Texas: Capture or Use of Biometric Identifier Act (CUBI) and Texas Data Privacy and Security Act (TDPSA);
• Washington: biometric privacy law (RCW 19.375);
• other applicable state privacy laws.

The provisions of this Addendum apply in addition to those of the main Policy. In the event of a conflict, this Addendum prevails for U.S. residents.

State-specific rights and laws

1. California (CCPA/CPRA)

California residents have the right to:

• know which categories of personal data we collect;
• understand the purposes of the processing;
• request the deletion of their personal data, subject to the exceptions permitted by law;
• opt out of the sale or sharing of their data, where applicable;
• not be discriminated against for exercising their privacy rights.

2. Virginia, Colorado, Connecticut, Utah, Montana and Oregon

Residents of these States enjoy rights similar to those provided under the CCPA, including:

• rights of access, rectification and deletion;
• opt-out rights with respect to targeted advertising or the sale of personal data, where applicable. Although ARShades does not carry out such activities, residents of Montana and Oregon may nonetheless request confirmation by contacting Spaarkly.

3. Illinois (BIPA), Texas (CUBI), Washington (RCW 19.375)

• Spaarkly does not collect biometric data as defined by these laws.
• ARShades processes only mathematical facial-landmark points for virtual try-on purposes and, through AR PD Meter, for pupillary-distance calculation, which:
  • cannot be used to uniquely identify a person;
  • for the Virtual Try-On, are processed locally on the User’s device and never stored;
  • for AR PD Meter, may be transmitted temporarily, as derived technical data not used to identify the User and not capable, on their own, of identifying the User, to the ARShades backend located in the European Union, used solely to return the measurement result and discarded after processing, without ever being stored;
  • do not create a persistent identifier linked to an individual.

4. Other U.S. States

• Some States do not yet have general privacy laws.
• In such cases, Spaarkly follows the general principles described in this Privacy Policy and complies with any applicable state law.

How to exercise rights

U.S. residents may contact us at privacy@spaarkly.com, specifying their State of residence.

We may request additional identity-verification information, for example device data or IP address, in order to handle the request.

Notice and consent specific to States with biometric legislation

Although our technology does not collect or store biometric information as defined by law, we provide this additional notice and request explicit consent to the use of our virtual try-on and measurement technology.

Before the experience begins, the User gives express consent—by ticking the relevant box accepting this Policy—to the use of the facial-detection technology as described in this Privacy Policy.

You may withdraw such consent at any time by ceasing to use the virtual try-on feature or by disabling camera access in your device settings.

Data-retention requirements

As stated in the main Policy:

• any facial-measurement data is processed in real time and is never retained beyond the immediate session;
• the derived technical data temporarily transmitted to the ARShades backend for AR PD Meter is used solely to return the measurement result and discarded after processing;
• session and device data is anonymised and dissociated within 14 months.

Data-breach notification obligations

As Spaarkly does not collect users’ contact information, it is not possible to notify individuals directly in the event of a data breach. In accordance with state data-breach laws, Spaarkly will notify the competent state authorities where required.

Where required by law, Spaarkly will publish a public notice on its website or through other appropriate channels.

Data-transfer rules

The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union (EU), where it receives the protections afforded by the GDPR.

This means that some data generated by use of the Services in the United States is processed in the EU. U.S. law does not restrict such transfers; the transferred data does not directly identify the User, is protected by appropriate technical and organisational measures and is discarded or anonymised in accordance with the terms of this Policy.

Should it become necessary in the future to transfer personal data from the EU/EEA to the United States, this would take place solely with the safeguards provided under the GDPR, such as the Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework (DPF).

Waiver of class actions and jury trial

FOR USERS LOCATED IN THE UNITED STATES: TO THE MAXIMUM EXTENT PERMITTED BY LAW, YOU AND SPAARKLY AGREE TO WAIVE THE RIGHT TO A JURY TRIAL OR TO PARTICIPATE AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS ACTION, REPRESENTATIVE PROCEEDING OR PRIVATE ATTORNEY GENERAL ACTION.

Unless otherwise agreed between you and Spaarkly, any dispute-resolution proceeding will be conducted solely on an individual basis. If, for any reason, a dispute proceeds before a court rather than in arbitration, you and Spaarkly each waive any right to a jury trial.

This waiver may not be enforceable in all States. Where it is not enforceable under state law, disputes will be resolved in accordance with the requirements of the applicable State.

D. CANADA (PIPEDA — PERSONAL INFORMATION PROTECTION AND ELECTRONIC DOCUMENTS ACT)

Users in Canada are protected by the Personal Information Protection and Electronic Documents Act (PIPEDA) and by provincial privacy laws, including Quebec’s Law 25 (formerly Bill 64), British Columbia’s Personal Information Protection Act (PIPA) and Alberta’s Personal Information Protection Act (PIPA).

Compliance with PIPEDA and provincial privacy laws

Spaarkly operates in Canada and adheres to the PIPEDA principles. Its current data-processing model is as follows:

• the facial data used for the Virtual Try-On is processed locally on the device and is not stored; for AR PD Meter, derived technical data, not used to identify the User and not capable, on their own, of identifying the User, may be transmitted temporarily to the ARShades backend located in the European Union, used solely to return the measurement result and discarded after processing;
• no biometric or uniquely identifying data is collected, nor names, contact details or user profiles;
• the session and device data (including the IP address) is stored on servers located in the European Union and anonymised within 14 months; any final photos requested by the User from in-store devices are deleted by the day following the session. This may involve a transfer of such data to the EU, with the safeguards described in the “International transfers” section of this Addendum.

As Spaarkly does not process data capable of directly identifying Users (such as names, contact details or persistent identifiers), certain PIPEDA obligations, such as obtaining consent for secondary uses of data or maintaining detailed records of processing activities, do not strictly apply.

Users’ rights under PIPEDA

Users in Canada enjoy rights analogous to those provided under the GDPR, including:

• right of access: to request a copy of their personal data and information on its use;
• right to rectification: to request the correction of inaccurate or incomplete data;
• right to withdraw consent: to withdraw previously given consent at any time;
• right to challenge compliance: to challenge an organisation’s compliance with the PIPEDA principles;
• right to recourse: to lodge a complaint with the competent data-protection authority.

Exercising rights

Canadian users may exercise their rights by contacting privacy@spaarkly.com.

To verify identity, additional information such as the IP address or device identifiers may be requested before requests are handled.

If users are not satisfied with our response, they may apply to:

• the Office of the Privacy Commissioner of Canada (OPC) (https://www.priv.gc.ca/en/);
• the provincial privacy commissioners in British Columbia, Alberta or Quebec, where applicable.

Data retention and security measures

PIPEDA requires that personal data be retained only for as long as necessary for the intended purpose.

• Spaarkly ensures that session and device data is anonymised within 14 months, in accordance with best practices.
• Robust technical and organisational measures are adopted to prevent unauthorised access, data leaks or misuse.

Data-breach notification obligations

• In the event of a data breach that presents a real risk of significant harm, Spaarkly will notify:
  • the Office of the Privacy Commissioner of Canada (OPC);
  • the provincial privacy commissioners, where required by provincial law;
  • where legally required, a public notice will be published on Spaarkly’s website or through other appropriate channels.
• As Spaarkly does not collect users’ contact information, individual notifications cannot be sent.

International transfers and compliance assurance

The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union. This may involve a transfer of data outside Canada to the EU, a jurisdiction that ensures a high level of protection of personal data. Such data does not directly identify the User and is protected by contractual safeguards and appropriate technical and organisational measures, in accordance with PIPEDA’s Accountability principle.

Should a Canadian authority require additional safeguards, Spaarkly will immediately adopt all necessary compliance measures, including:

• ensuring compliance with PIPEDA’s Accountability principle in relation to international transfers;
• implementing Standard Contractual Clauses (SCCs) or other legally recognised transfer mechanisms, where necessary;
• providing clear and accessible information on potential cross-border transfers and the risks involved.

As Spaarkly remains committed to full compliance with PIPEDA and provincial privacy laws, it will monitor regulatory developments and adapt its processing practices should the authorities require further safeguards.

E. AUSTRALIA AND NEW ZEALAND

Users in Australia and New Zealand are protected by the respective general privacy laws:

• Australia: Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), and the Privacy Amendment (Notifiable Data Breaches) Act 2017;
• New Zealand: Privacy Act 2020, including the Information Privacy Principles (IPPs), regulated by the Office of the Privacy Commissioner (OPC).

Compliance with Australian and New Zealand privacy laws

Spaarkly operates in Australia and New Zealand and adheres to the principles set out in the privacy laws of those jurisdictions. Its current data-processing model is as follows:

• the facial data used for the Virtual Try-On is processed locally on the device and is not stored; for AR PD Meter, derived technical data, not used to identify the User and not capable, on their own, of identifying the User, may be transmitted temporarily to the ARShades backend located in the European Union, used solely to return the measurement result and discarded after processing;
• no biometric or uniquely identifying data is collected, nor names, contact details or user profiles;
• the session and device data (including the IP address) is stored on servers located in the European Union and anonymised within 14 months; any final photos requested by the User from in-store devices are deleted by the day following the session. This may involve a transfer of such data to the EU, with the safeguards described in the “International transfers” section of this Addendum.

As Spaarkly does not process data capable of directly identifying Users (such as names, contact details or persistent identifiers), certain obligations under the Australian Privacy Act and the New Zealand Privacy Act, such as the preparation of a comprehensive privacy management plan or the maintenance of detailed records of processing activities, do not strictly apply.

Users’ rights under Australian and New Zealand privacy laws

Users in Australia and New Zealand have privacy rights that include:

• right of access: to request access to their personal data held by an organisation;
• right to correction: to request the correction of inaccurate, out-of-date, incomplete or misleading data;
• right to object: to object to certain types of processing, in particular direct marketing in Australia and processing likely to cause significant harm, distress or prejudice in New Zealand;
• right to complain: to lodge a complaint with the competent privacy authority where they believe their rights have been infringed;
• right to remedies: to obtain remedies for privacy breaches, including correction, apology or compensation, where applicable.

Exercising rights

Users in Australia and New Zealand may exercise their rights by contacting privacy@spaarkly.com.

Identity verification may be requested, for example through the IP address or device identifiers, before requests are handled.

If users are not satisfied with Spaarkly’s response, they may apply to:

• the Office of the Australian Information Commissioner (OAIC) (https://www.oaic.gov.au/);
• the Office of the Privacy Commissioner (OPC) of New Zealand (https://www.privacy.org.nz/).

Data retention and security measures

Both the Australian Privacy Act and the New Zealand Privacy Act require that personal data not be retained longer than necessary for the intended purpose.

• Spaarkly ensures that session and device data is anonymised within 14 months, in accordance with best practices.
• Robust technical and organisational measures are adopted to prevent unauthorised access, data leaks or misuse, in accordance with APP 11 in Australia and IPP 5 in New Zealand.

Data-breach notification obligations

• In the event of a data breach likely to result in serious harm to data subjects, Spaarkly will notify:
  • the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches (NDB) scheme, completing the incident assessment within 30 days and notifying as soon as reasonably practicable;
  • the Office of the Privacy Commissioner (OPC) of New Zealand as soon as possible, in accordance with the mandatory notification requirements of the Privacy Act 2020.
• As Spaarkly does not collect users’ contact information, individual notifications cannot be sent directly. Where legally required, Spaarkly will publish a public notice on its website or through other appropriate channels.

International transfers and compliance assurance

The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union. This may involve a transfer of data outside Australia or New Zealand to the EU, a jurisdiction that ensures a high level of protection of personal data. Such data does not directly identify the User and is protected by contractual safeguards and appropriate technical and organisational measures, in line with APP 8 in Australia and IPP 12 in New Zealand.

Should an authority require additional safeguards, Spaarkly will immediately adopt all necessary compliance measures, including:

• ensuring compliance with APP 8 and with Section 16C of the Australian Privacy Act on cross-border disclosures;
• implementing the appropriate safeguards required by IPP 12 of the New Zealand Privacy Act 2020 for overseas transfers;
• providing users with clear information on potential cross-border transfers and maintaining accountability in relation to data protection.

As Spaarkly remains committed to full compliance with Australian and New Zealand privacy laws, it will monitor regulatory developments and adapt its processing practices should the authorities require further safeguards.

F. ASIA-PACIFIC REGION

Users in the Asia-Pacific region are protected by various national general data-protection laws, including:

• Singapore: Personal Data Protection Act (PDPA) of 2012, as amended in 2020, enforced by the Personal Data Protection Commission (PDPC);
• Malaysia: Personal Data Protection Act (PDPA) of 2010, enforced by the Personal Data Protection Department (JPDP);
• Philippines: Data Privacy Act (DPA) of 2012, enforced by the National Privacy Commission (NPC);
• Indonesia: Personal Data Protection Law (PDP Law) of 2022, modelled on the GDPR;
• Thailand: Personal Data Protection Act (PDPA) of 2019, enforced by the Personal Data Protection Committee (PDPC);
• South Korea: Personal Information Protection Act (PIPA), enforced by the Personal Information Protection Commission (PIPC);
• other jurisdictions with emerging data-protection frameworks.

Compliance with Asia-Pacific data-protection laws

Spaarkly operates in the Asia-Pacific region and adheres to the principles established by the privacy laws of those jurisdictions. Its current data-processing model is as follows:

• the facial data used for the Virtual Try-On is processed locally on the device and is not stored; for AR PD Meter, derived technical data, not used to identify the User and not capable, on their own, of identifying the User, may be transmitted temporarily to the ARShades backend located in the European Union, used solely to return the measurement result and discarded after processing;
• no biometric or uniquely identifying data is collected, nor names, contact details or user profiles;
• the session and device data (including the IP address) is stored on servers located in the European Union and anonymised within 14 months; any final photos requested by the User from in-store devices are deleted by the day following the session. This may involve a transfer of such data to the EU, with the safeguards described in the “International transfers” section of this Addendum.

As Spaarkly does not process data capable of directly identifying Users (such as names, contact details or persistent identifiers), certain obligations under Asia-Pacific privacy laws, such as data-protection impact assessments, registration with authorities or detailed records of processing activities, do not strictly apply in most cases.

Users’ rights under Asia-Pacific privacy laws

Users in Asia-Pacific countries with general data-protection laws generally enjoy rights similar to those provided under the GDPR, including:

• right of access: to request information on the collection, use and disclosure of personal data;
• right to correction: to request the correction of inaccurate or incomplete personal data;
• right to withdraw consent: to withdraw previously given consent;
• right to data portability: to request the transfer of data to another organisation, in jurisdictions such as Singapore and the Philippines;
• right to erasure: to request the deletion of personal data under specific conditions, depending on the jurisdiction;
• right to object: to object to processing for direct marketing or other purposes, depending on the jurisdiction.

Exercising rights

Users in Asia-Pacific countries may exercise their rights by contacting privacy@spaarkly.com.

Identity verification may be requested, for example through the IP address or device identifiers, before requests are handled.

If users are not satisfied with Spaarkly’s response, they may apply to their competent national data-protection authority:

• the Personal Data Protection Commission (PDPC) of Singapore (https://www.pdpc.gov.sg/);
• the Personal Data Protection Department (JPDP) of Malaysia (https://www.pdp.gov.my/);
• the National Privacy Commission (NPC) of the Philippines (https://privacy.gov.ph/);
• the Personal Data Protection Committee (PDPC) of Thailand;
• the Personal Information Protection Commission (PIPC) of South Korea;
• other competent national authorities, where applicable.

Data retention and security measures

Data-protection laws in the Asia-Pacific region generally require that personal data be retained only for as long as necessary for the intended purpose and thereafter securely deleted.

• Spaarkly ensures that session and device data is anonymised within 14 months, in accordance with best practices.
• Robust technical and organisational measures are adopted to prevent unauthorised access, data leaks or misuse, including encryption, access controls and periodic security assessments.

Data-breach notification obligations

• In the event of a data breach likely to cause harm to individuals, Spaarkly will notify:
  • the competent data-protection authority, in accordance with local requirements:
    • Singapore: within 3 days for notifiable breaches;
    • Philippines: within 72 hours;
    • Thailand: without undue delay, within 72 hours;
    • South Korea: without delay;
    • other jurisdictions in accordance with their respective timeframes.
• As Spaarkly does not collect users’ contact information, individual notifications cannot be sent directly. Where legally required, Spaarkly will publish a public notice on its website or through other appropriate channels.

International transfers and compliance assurance

The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union. This may involve a transfer of data outside the User’s country to the EU, a jurisdiction that ensures a high level of protection of personal data. Such data does not directly identify the User and is protected by contractual safeguards and appropriate technical and organisational measures, so as to ensure a level of protection comparable to that required by the applicable local laws.

Should an authority require additional safeguards, Spaarkly will immediately adopt all necessary compliance measures, including:

• ensuring compliance with specific transfer provisions, such as:
  • the transfer-limitation obligation of Singapore’s PDPA and its related requirements for overseas transfers;
  • the Philippines DPA’s rules on cross-border data sharing;
  • Malaysia’s PDPA prohibition on transfers to certain countries;
  • South Korea’s PIPA requirements for overseas transfers;
• implementing legally recognised transfer mechanisms, such as consent, contractual safeguards, binding corporate rules or certification mechanisms;
• providing users with clear information on potential cross-border transfers and maintaining accountability in relation to data protection.

As Spaarkly remains committed to full compliance with Asia-Pacific privacy laws, it will monitor regulatory developments in each jurisdiction and adapt its processing practices should the authorities require further safeguards.

G. BRAZIL AND LATIN AMERICA

Users in Brazil and Latin America are protected by various national general data-protection laws, including:

• Brazil: Lei Geral de Proteção de Dados (LGPD) of 2018, enforced by the Autoridade Nacional de Proteção de Dados (ANPD);
• Mexico: Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) of 2010, enforced by the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI);
• Argentina: Personal Data Protection Act (PDPA), Law No. 25.326, enforced by the Agencia de Acceso a la Información Pública (AAIP);
• Colombia: Law 1581 of 2012 on the general data-protection regime, enforced by the Superintendencia de Industria y Comercio (SIC);
• Chile: Law No. 19.628 on the Protection of Private Life, with ongoing regulatory reforms;
• Uruguay: Law No. 18.331 on Personal Data Protection and Habeas Data Action, enforced by the Unidad Reguladora y de Control de Datos Personales (URCDP);
• other jurisdictions with emerging data-protection frameworks.

Compliance with Latin American data-protection laws

Spaarkly operates in Latin America and adheres to the principles established by the privacy laws of those jurisdictions. Its current data-processing model is as follows:

• the facial data used for the Virtual Try-On is processed locally on the device and is not stored; for AR PD Meter, derived technical data, not used to identify the User and not capable, on their own, of identifying the User, may be transmitted temporarily to the ARShades backend located in the European Union, used solely to return the measurement result and discarded after processing;
• no biometric or uniquely identifying data is collected, nor names, contact details or user profiles;
• the session and device data (including the IP address) is stored on servers located in the European Union and anonymised within 14 months; any final photos requested by the User from in-store devices are deleted by the day following the session. This may involve a transfer of such data to the EU, with the safeguards described in the “International transfers” section of this Addendum.

As Spaarkly does not process data capable of directly identifying Users (such as names, contact details or persistent identifiers), certain obligations under Latin American data-protection laws, such as detailed records of processing activities, the appointment of a data protection officer or impact assessments, do not strictly apply in most cases.

Users’ rights under Latin American privacy laws

Users in Brazil and Latin America with general data-protection laws generally enjoy rights similar to those provided under the GDPR, including:

• right of confirmation and access (ARCO rights): to confirm the existence of processing and access personal data;
• right to rectification (ARCO rights): to correct inaccurate, incomplete or out-of-date data;
• right to cancellation (ARCO rights): to request the deletion of unnecessary or excessive data;
• right to object (ARCO rights): to object to unlawful or non-consensual processing;
• right to information: to receive clear information on processing activities;
• right to data portability: to request the transfer of data to another service provider, in particular under the Brazilian LGPD;
• right to withdraw consent: to withdraw previously given consent at any time;
• right to review of automated decisions: to request the review of decisions taken solely by automated processing under the LGPD.

Exercising rights

Users in Brazil and Latin America may exercise their rights by contacting privacy@spaarkly.com.

Identity verification may be requested, for example through the IP address or device identifiers, before requests are handled.

If users are not satisfied with Spaarkly’s response, they may apply to their competent national authority:

• the National Data Protection Authority of Brazil (ANPD) (https://www.gov.br/anpd/);
• the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) of Mexico (https://home.inai.org.mx/);
• the Agencia de Acceso a la Información Pública (AAIP) of Argentina (https://www.argentina.gob.ar/aaip);
• the Superintendencia de Industria y Comercio (SIC) of Colombia (https://www.sic.gov.co/);
• other competent national authorities, where applicable.

Data retention and security measures

Data-protection laws in Latin America generally require that personal data be retained only for as long as necessary for the intended purpose and thereafter securely deleted.

• Spaarkly ensures that session and device data is anonymised within 14 months, in accordance with best practices.
• Robust technical and organisational measures are adopted to prevent unauthorised access, data leaks or misuse, as required by Latin American laws, such as Article 46 of the Brazilian LGPD and Article 19 of the Mexican LFPDPPP.

Data-breach notification obligations

• In the event of a data breach that may cause risk or harm to data subjects, Spaarkly will notify:
  • the competent data-protection authority, in accordance with local requirements:
    • Brazil: notification to the ANPD within 3 business days of becoming aware of the incident, pursuant to Resolução CD/ANPD No. 15/2024;
    • Mexico: prompt notification to data subjects following confirmation of the breach;
    • other jurisdictions in accordance with their respective requirements.
• As Spaarkly does not collect users’ contact information, individual notifications cannot be sent directly. Where legally required, Spaarkly will publish a public notice on its website or through other appropriate channels.

International transfers and compliance assurance

The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union. This may involve a transfer of data outside the User’s country to the EU, a jurisdiction that ensures a high level of protection of personal data. Such data does not directly identify the User and is protected by contractual safeguards and appropriate technical and organisational measures, so as to ensure a level of protection comparable to that required by the applicable local laws.

Should an authority require additional safeguards, Spaarkly will immediately adopt all necessary compliance measures, including:

• ensuring compliance with specific transfer provisions, such as:
  • the requirements of the Brazilian LGPD for international transfers (Articles 33-36);
  • the principles of the Mexican LFPDPPP for cross-border data sharing;
  • the Argentine adequate-level requirement under the PDPA;
  • the requirements of the Colombian SIC for cross-border transfers;
• implementing legally recognised transfer mechanisms, such as:
  • standard contractual clauses;
  • binding corporate rules;
  • certification mechanisms;
  • specific consent to the transfer;
  • adequacy decisions;
• providing users with clear information on potential cross-border transfers and maintaining accountability in relation to data protection.

As Spaarkly remains committed to full compliance with Latin American privacy laws, it will monitor regulatory developments in each jurisdiction and adapt its processing practices should the authorities require further safeguards.

H. JAPAN (APPI — ACT ON THE PROTECTION OF PERSONAL INFORMATION)

Users in Japan are protected by the Act on the Protection of Personal Information (APPI), as substantially amended in 2020 and effective from April 2022, which establishes a comprehensive data-protection framework enforced by the Personal Information Protection Commission (PPC).

Compliance with the Japanese APPI

Spaarkly operates in Japan and adheres to the principles established by the APPI. Its current data-processing model is as follows:

• the facial data used for the Virtual Try-On is processed locally on the device and is not stored; for AR PD Meter, derived technical data, not used to identify the User and not capable, on their own, of identifying the User, may be transmitted temporarily to the ARShades backend located in the European Union, used solely to return the measurement result and discarded after processing;
• no biometric or uniquely identifying data is collected, nor names, contact details or user profiles;
• the session and device data (including the IP address) is stored on servers located in the European Union and anonymised within 14 months; any final photos requested by the User from in-store devices are deleted by the day following the session. This may involve a transfer of such data to the EU, with the safeguards described in the “International transfers” section of this Addendum.

As Spaarkly does not process data capable of directly identifying Users (such as names, contact details or persistent identifiers), certain APPI obligations, such as maintaining detailed records of processing activities, obtaining consent for disclosure to third parties or filing notifications with the PPC, do not strictly apply.

Spaarkly expressly confirms that it does not collect, process or transfer any information that would constitute “Sensitive Personal Information” (Yōhairyo Kojin Jōhō) within the meaning of Article 2(3) of the APPI, such as race, creed, social status, medical history or criminal record.

Users’ rights under the Japanese APPI

Users in Japan enjoy specific rights under the APPI, including:

• right of disclosure (Kaiji): to request the disclosure of personal data held by a business operator;
• right to correction (Seigō): to request the correction, addition or deletion of inaccurate personal data;
• right to cessation of use/deletion (Riyō Teishi / Sakujo): to request the cessation of use or the deletion of personal data processed in breach of the law or beyond the specified purpose;
• right to cessation of disclosure to third parties (Daisansha Teikyō no Teishi): to request the operator to cease the disclosure of personal data to third parties;
• right to an explanation (Setsumei): to receive an explanation of the processing activities relating to personal data;
• right to complain (Kujō): to lodge a complaint with the operator or the PPC.

Exercising rights

Users in Japan may exercise their rights by contacting privacy@spaarkly.com.

Identity verification may be requested, for example through the IP address or device identifiers, before requests are handled. Spaarkly will respond to requests within the period provided under the APPI, generally within two weeks of receipt.

If users are not satisfied with Spaarkly’s response, they may apply to:

• the Personal Information Protection Commission (PPC) of Japan (https://www.ppc.go.jp/en/).

Data retention and security measures

The APPI requires business operators to establish security-control measures (Article 23) and to ensure the accuracy of data (Article 22). It further provides that data must be deleted when no longer necessary in relation to the specified purpose.

• Spaarkly ensures that session and device data is anonymised within 14 months, in accordance with best practices.
• Spaarkly implements comprehensive security measures as required by Article 23 of the APPI, including:
• access controls and authentication mechanisms;
• encryption of data in transit and at rest;
• periodic security assessments and updates;
• staff training on data protection.

Data-breach notification obligations

• In the event of a loss of personal data or other security incident (Jōhō Rōei Jiko), Spaarkly will:
  • make a prompt report to the PPC pursuant to Article 26 of the APPI, where the breach reaches the notification threshold;
  • include in the notification the details of the incident, the types of data involved, the cause and the corrective measures;
  • where legally required, publish a public notice on Spaarkly’s website or through other appropriate channels, as direct individual notifications are not possible in the absence of collected contact data.

International transfers and compliance assurance

The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union. This may involve a transfer of data outside Japan to the EU. The EU is designated by the Personal Information Protection Commission (PPC) as a jurisdiction with equivalent standards of personal-data protection, by virtue of the 2019 EU-Japan mutual adequacy recognition: transfers to the EU are therefore permitted under Article 28 of the APPI.

Should the PPC require additional safeguards, Spaarkly will immediately adopt all necessary compliance measures, including:

• ensuring compliance with Article 28 of the APPI on international transfers, which requires:
  • the individual’s prior consent for transfers to third parties in foreign countries; or
  • assurance that the third party is located in a country with equivalent standards of data protection; or
  • assurance that the third party maintains equivalent standards through contractual arrangements or other means;
• implementing appropriate transfer mechanisms, such as:
  • standard contractual clauses;
  • binding corporate rules;
  • recognised certifications;
• providing users with clear information on potential cross-border transfers in accordance with the APPI requirements.

As Spaarkly remains committed to full compliance with the APPI and its amendments, it will monitor regulatory developments and adapt its processing practices should the PPC or other Japanese authorities require further safeguards.

I. CHINA (PIPL — PERSONAL INFORMATION PROTECTION LAW)

Users in China are protected by the Personal Information Protection Law (PIPL), which establishes principles similar to the GDPR, including strict rules on data processing, consent requirements and restrictions on cross-border transfers.

Compliance with the PIPL

Spaarkly operates in China and adheres to the PIPL principles. Its current processing model is as follows:

• the facial data used for the Virtual Try-On is processed locally on the device and is not stored; for AR PD Meter, derived technical data, not used to identify the User and not capable, on their own, of identifying the User, may be transmitted temporarily to the ARShades backend located in the European Union, used solely to return the measurement result and discarded after processing;
• no collection of biometric or sensitive data: Spaarkly does not collect biometric identifiers, real names, contact details or other data that uniquely identifies the user;
• the session and device data (including the IP address) is stored on servers located in the European Union and anonymised within 14 months.

Spaarkly constantly monitors the applicability of the PIPL requirements to its activities, including those relating to data localisation and security review, and adopts the required measures depending on the nature, volume and purposes of the data processed.

Users’ rights under the PIPL

Users in China enjoy rights aligned with the GDPR, including:

• right of access: to request a copy of their personal data;
• right to rectification: to request the correction of inaccurate or incomplete data;
• right to erasure: to request the deletion of personal data under specific conditions;
• right to restrict or object to processing: to object to certain processing activities;
• right to withdraw consent: to withdraw previously given consent at any time.

In addition, the PIPL recognises rights that go beyond the GDPR, including:

• right to “know and decide”: users have explicit control over how their data is used;
• right to an explanation of automated decisions: users may request an explanation of how automated systems, such as AI-based recommendations, affect them.

Users in China may exercise their rights by contacting privacy@spaarkly.com. If not satisfied with Spaarkly’s response, they may apply to the Cyberspace Administration of China (CAC).

Data retention and security measures

The PIPL requires companies to retain data only for the shortest period necessary to achieve the intended purpose.

• Spaarkly ensures that session and device data is anonymised within 14 months, in accordance with best practices.
• Robust technical and organisational measures are adopted to prevent unauthorised access, data leaks or misuse.

Data-breach notification obligations

In the event of a data breach that may cause significant harm, Spaarkly will notify:

• the competent Chinese regulatory authorities, where required by the PIPL;
• where legally required, a public notice will be published on Spaarkly’s website or through other appropriate channels.

As Spaarkly does not collect users’ contact information, individual notifications cannot be sent.

International transfers and compliance assurance

The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union. For users in China, this may constitute a cross-border provision of personal information under the PIPL. Such data is limited to the minimum necessary, does not allow the User to be directly identified and is discarded or anonymised in accordance with the terms of this Policy.

To the extent that the PIPL requires specific measures for such flows, or should a Chinese authority require additional safeguards, Spaarkly will immediately adopt all necessary compliance measures to ensure continued compliance with the PIPL, including:

• carrying out a security assessment under the CAC rules, where required;
• implementing CAC-approved Standard Contractual Clauses (SCCs) or other approved mechanisms;
• obtaining the user’s explicit consent for any cross-border transfers, where deemed necessary.

As Spaarkly remains committed to full compliance with the PIPL, it will proactively monitor regulatory interpretations and adapt its processing practices should an authority require further safeguards.

J. SOUTH AFRICA (POPIA – PROTECTION OF PERSONAL INFORMATION ACT)

Users in South Africa are protected by the Protection of Personal Information Act (POPIA), which governs the collection, use and security of personal data. POPIA is closely aligned with the GDPR but includes specific local requirements.

Compliance with POPIA

Spaarkly operates in South Africa and complies with the POPIA principles. Its current processing model is as follows:

• the facial data used for the Virtual Try-On is processed locally on the device and is not stored; for AR PD Meter, derived technical data, not used to identify the User and not capable, on their own, of identifying the User, may be transmitted temporarily to the ARShades backend located in the European Union, used solely to return the measurement result and discarded after processing;
• no biometric or uniquely identifying data is collected, nor names, contact details or user profiles;
• the session and device data (including the IP address) is stored on servers located in the European Union and anonymised within 14 months; any final photos requested by the User from in-store devices are deleted by the day following the session. This may involve a transfer of such data to the EU, with the safeguards described in the “International transfers” section of this Addendum.

As Spaarkly does not process personal data in a manner that directly identifies users, it does not fall within certain POPIA obligations, such as obtaining consent for direct marketing or maintaining records of processing activities.

Users’ rights under POPIA

Users in South Africa enjoy rights similar to those provided under the GDPR, including:

• right of access: to request a copy of their personal data;
• right to rectification: to request the correction of inaccurate or incomplete data;
• right to erasure: to request the deletion of personal data in specific cases;
• right to restrict or object to processing: to object to certain processing activities;
• right to withdraw consent: to withdraw previously given consent at any time.

Users may exercise their rights by contacting privacy@spaarkly.com. If not satisfied with Spaarkly’s response, they may apply to the Information Regulator of South Africa (https://inforegulator.org.za/).

Data retention and security measures

POPIA requires that personal data be retained only for as long as necessary for the intended purpose.

• Spaarkly ensures that session and device data is anonymised within 14 months.
• Robust technical and organisational measures are adopted to prevent unauthorised access, data leaks or misuse.

Data-breach notification obligations

In the event of a data breach that may cause significant harm, Spaarkly will notify:

• the Information Regulator of South Africa, where required by POPIA;
• where legally required, a public notice will be published on Spaarkly’s website or through other appropriate channels.

As Spaarkly does not collect users’ contact information, individual notifications cannot be sent.

International transfers and compliance assurance

The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union. This may involve a transfer of data outside South Africa to the EU, in accordance with Section 72 of POPIA, which permits transfers to recipients subject to rules that ensure a substantially similar level of protection: the GDPR satisfies that standard. Such data does not directly identify the User and is protected by contractual safeguards and appropriate technical and organisational measures.

Should a South African authority require additional safeguards, Spaarkly will immediately adopt all necessary compliance measures, including:

• ensuring that any data transfer complies with Section 72 of POPIA, which requires adequate protection;
• implementing Standard Contractual Clauses (SCCs) or other legally recognised transfer mechanisms, where necessary;
• obtaining the user’s explicit consent for any cross-border transfers, should this become a legal requirement.

As Spaarkly remains committed to full compliance with POPIA, it will monitor regulatory developments and adapt its processing practices should the authorities require further safeguards.

K. INDIA (DPDP – DIGITAL PERSONAL DATA PROTECTION ACT)

Users in India are protected by the Digital Personal Data Protection Act (DPDP), which governs the processing of personal data and imposes compliance obligations similar to the GDPR.

Compliance with the DPDP

Spaarkly operates in India and adheres to the DPDP principles. Its current data-processing model is as follows:

• the facial data used for the Virtual Try-On is processed locally on the device and is not stored; for AR PD Meter, derived technical data, not used to identify the User and not capable, on their own, of identifying the User, may be transmitted temporarily to the ARShades backend located in the European Union, used solely to return the measurement result and discarded after processing;
• no biometric or uniquely identifying data is collected, nor names, contact details or user profiles;
• the session and device data (including the IP address) is stored on servers located in the European Union and anonymised within 14 months; any final photos requested by the User from in-store devices are deleted by the day following the session. This may involve a transfer of such data to the EU, with the safeguards described in the “International transfers” section of this Addendum.

As Spaarkly does not process data capable of directly identifying Users (such as names, contact details or persistent identifiers), certain DPDP obligations, such as those imposed on “Significant Data Fiduciaries” (appointment of a data protection officer in India, independent audits and periodic impact assessments), have limited application.

Users’ rights under the DPDP

Users in India enjoy rights similar to those provided under the GDPR, including:

• right of access: to request a summary of the personal data processed;
• right to rectification: to request the correction of inaccurate or incomplete data;
• right to erasure: to request the deletion of personal data under specific conditions;
• right to restrict or object to processing: to object to certain processing activities;
• right to nominate a representative: to designate another person to exercise their rights in the event of death or incapacity.

Users may exercise their rights by contacting privacy@spaarkly.com. If not satisfied with Spaarkly’s response, they may apply to the Data Protection Board of India.

Data retention and security measures

The DPDP Act requires that personal data be retained only for as long as necessary for the intended purpose.

• Spaarkly ensures that session and device data is anonymised within 14 months, in line with best practices.
• Robust technical and organisational measures are adopted to prevent unauthorised access, data leaks or misuse.

Data-breach notification obligations

• In the event of a personal-data breach, Spaarkly will notify:
  • the Data Protection Board of India and, as required by the DPDP, the affected data subjects;
  • as it does not hold Users’ contact data, communication to data subjects will be carried out by means of a public notice on Spaarkly’s website and, where possible, through an in-service notice, as the most effective means available.

International transfers and compliance assurance

The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union. This may involve a transfer of data outside India to the EU. The DPDP permits the transfer of personal data to countries not restricted by the Central Government; the European Union is not currently subject to any such restriction. Such data does not directly identify the User and is protected by contractual safeguards and appropriate technical and organisational measures.

Should an Indian authority require additional safeguards, Spaarkly will immediately adopt all necessary compliance measures, including:

• ensuring compliance with the DPDP requirements on data localisation and transfer;
• implementing legally recognised transfer mechanisms, such as government-approved contractual clauses;
• obtaining the user’s explicit consent for any cross-border transfers, should this become a legal requirement.

As Spaarkly remains committed to full compliance with the DPDP, it will monitor regulatory developments and adapt its processing practices should the authorities require further safeguards.

L. MIDDLE EAST (UNITED ARAB EMIRATES – Dubai – Saudi Arabia – Other Countries)

Users in the Middle East are protected by various national data-protection laws, including:

• United Arab Emirates (UAE): Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data;
• Dubai International Financial Centre (DIFC): DIFC Data Protection Law No. 5 of 2020;
• Saudi Arabia: Personal Data Protection Law (PDPL);
• other applicable national privacy laws.

Compliance with Middle East privacy laws

Spaarkly operates in the Middle East and complies with the applicable data-protection laws. Its current data-processing model is as follows:

• the facial data used for the Virtual Try-On is processed locally on the device and is not stored; for AR PD Meter, derived technical data, not used to identify the User and not capable, on their own, of identifying the User, may be transmitted temporarily to the ARShades backend located in the European Union, used solely to return the measurement result and discarded after processing;
• no biometric or uniquely identifying data is collected, nor names, contact details or user profiles;
• the session and device data (including the IP address) is stored on servers located in the European Union and anonymised within 14 months; any final photos requested by the User from in-store devices are deleted by the day following the session. This may involve a transfer of such data to the EU, with the safeguards described in the “International transfers” section of this Addendum.

As Spaarkly does not process data capable of directly identifying Users (such as names, contact details or persistent identifiers), certain obligations under Middle East privacy laws, such as consent for direct marketing or the maintenance of local processing records, do not apply.

Users’ rights under Middle East privacy laws

Users in Middle East jurisdictions enjoy rights similar to those provided under the GDPR, including:

• right of access: to request a copy of their personal data;
• right to rectification: to request the correction of inaccurate or incomplete data;
• right to erasure: to request the deletion of personal data under specific conditions;
• right to object: to object to certain types of processing;
• right to withdraw consent: to withdraw previously given consent at any time.

Users may exercise their rights by contacting privacy@spaarkly.com.

If not satisfied with Spaarkly’s response, they may apply to:

• the UAE Data Office;
• the DIFC Commissioner of Data Protection (https://www.difc.ae/business/regulations/data-protection/);
• the Saudi Data & Artificial Intelligence Authority (SDAIA), the competent authority under the Saudi Personal Data Protection Law (PDPL).

Data retention and security measures

Middle East data-protection laws require that personal data be retained only for as long as necessary for the intended purpose.

• Spaarkly ensures that session and device data is anonymised within 14 months, in line with best practices.
• Robust technical and organisational measures are adopted to prevent unauthorised access, data leaks or misuse.

Data-breach notification obligations

• In the event of a data breach that may cause significant harm, Spaarkly will notify:
  • the competent Middle East data-protection authority, where required by local law;
  • where legally required, a public notice will be published on Spaarkly’s website or through other appropriate channels.
• As Spaarkly does not collect users’ contact information, individual notifications cannot be sent.

International transfers and compliance assurance

The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union. This may involve a transfer of data outside the User’s country to the EU, a jurisdiction that ensures a high level of protection of personal data and is recognised as adequate by several laws in the region (for example, under the DIFC Data Protection Law). Such data does not directly identify the User and is protected by contractual safeguards and appropriate technical and organisational measures.

Should a Middle East authority require additional safeguards, Spaarkly will immediately adopt all necessary compliance measures, including:

• ensuring compliance with local data-protection laws on international transfers;
• implementing legally recognised transfer mechanisms, such as Standard Contractual Clauses (SCCs) or government-approved frameworks;
• obtaining the user’s explicit consent for any cross-border transfers, should this become a legal requirement.

As Spaarkly remains committed to full compliance with Middle East privacy laws, it will monitor regulatory developments and adapt its processing practices should the authorities require further safeguards.

M. OTHER COUNTRIES

Users in countries not expressly covered by the preceding sections are protected by their respective national data-protection laws, where applicable. Although privacy laws vary, Spaarkly adheres to internationally recognised data-protection principles, derived from the GDPR.

Compliance with international privacy standards

Spaarkly operates globally and complies with internationally recognised data-protection principles. Its current data-processing model is as follows:

• the facial data used for the Virtual Try-On is processed locally on the device and is not stored; for AR PD Meter, derived technical data, not used to identify the User and not capable, on their own, of identifying the User, may be transmitted temporarily to the ARShades backend located in the European Union, used solely to return the measurement result and discarded after processing;
• no biometric or uniquely identifying data is collected, nor names, contact details or user profiles;
• the session and device data (including the IP address) is stored on servers located in the European Union and anonymised within 14 months; any final photos requested by the User from in-store devices are deleted by the day following the session. This may involve a transfer of such data to the EU, with the safeguards described in the “International transfers” section of this Addendum.

As Spaarkly does not process data capable of directly identifying Users (such as names, contact details or persistent identifiers), certain national obligations, such as data localisation, registration with local authorities or additional consent requirements, do not apply.

Users’ rights in other countries

Users in countries not specifically listed in this Privacy Policy may still enjoy rights under national privacy laws. In line with international standards, users generally have the right to:

• access their personal data and request a copy of it;
• request corrections to inaccurate or incomplete data;
• request the deletion of personal data under specific conditions;
• object to certain processing activities;
• withdraw consent, where applicable.

Users may exercise their rights by contacting privacy@spaarkly.com. If they are not satisfied with Spaarkly’s response, they may lodge a complaint with the competent national data-protection authority, where applicable.

Data Retention and Security Measures

Privacy laws in most jurisdictions provide that personal data must be retained only for as long as necessary.

• Spaarkly ensures that session and device data is anonymised within 14 months, in line with best practices.
• Rigorous technical and organisational measures are adopted to prevent unauthorised access, data leaks or misuse.

Data-Breach Notification Obligations

In the event of a data breach that may cause significant harm, Spaarkly will notify:

• The competent data-protection authority, where required by local law.
• Where legally required, it will publish a public notice on its website or through other appropriate channels.

As Spaarkly does not collect users’ contact information, individual notifications cannot be sent.

International Data Transfers and Compliance Assurance

The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union. This may involve a transfer of data outside the User’s country to the EU, a jurisdiction that ensures a high level of protection of personal data. Such data does not directly identify the User and is protected by contractual safeguards and appropriate technical and organisational measures.

Should a regulatory authority require additional safeguards, the company will immediately adopt all necessary compliance measures, including:

• Ensuring compliance with local data-protection laws relating to international transfers.
• Implementing legally recognised transfer mechanisms, such as Standard Contractual Clauses (SCCs) or government-approved frameworks.
• Obtaining users’ explicit consent for any cross-border transfers, should this become a legal requirement.

Spaarkly remains committed to ensuring full compliance with international privacy standards and will constantly monitor regulatory developments, adapting its data-processing practices accordingly should the authorities require further protective measures.