PRIVACY NOTICE FOR EU RESIDENTS（GDPR)

A. Controller and Data Protection Officer

WooPlus is the controller and processor ofyour personal data for purposes of European data protection law.WooPlus has appointed a data protection officer (“DPO”) whois responsible for overseeing questions in relation to this Privacy Notice. Ifyou have any questions about this Privacy Notice, including any requests toexercise your legal rights, please contact the DPO using the details set out below:

Data Protection Officer, Email address: user@wooplus.com

B. Legal bases for processing

We are required to inform you of the legal bases of our processing of your personal data, which are described in the table below. If you have questions about the legal basis of how we process your personal data, you may contact us using the information provided in the section above.

C. Does WooPlus use my personal data for any other purpose?

We may use material that you post on the open access areas of WooPlus in advertising and promotional materials on our partner sites and partner products. We believe these uses are in line with our legitimate interests in enabling us to improve our site and better tailor your online experience to meet your needs.

D. Automated decisions, credit reference agencies and fraud prevention agencies

We sometimes make automated decisions based on your personal data (whether provided by you or collected by us from third parties such as credit reference and fraud prevention agencies). For example, to prevent abuse of the app/site, WooPlus uses automated decisions to block accounts as part of its anti-spam procedures. In order to do this, our systems check accounts and messages for content that indicates breaches of our Terms and Conditions of Use. If an account or message meets certain criteria that demonstrate that the Terms and Conditions of Use are likely to have been breached, the relevant account will automatically be blocked. All users of accounts that have been blocked will be notified that their account has been blocked and affected users can contactsupport@wooplus.comto contest the decision. We will only do this where it is required in connection with a contract, authorized by law, or based on your explicit consent. You can contact us for more information on automated decision making. Please also see the “Your individual legal rights” section below.

E. How long will you keep my personal data?

We keep your personal information only as long as we need it for legitimate business purposes (as set out above) and as permitted by applicable law.

In practice, we delete or anonymise your information upon deletion of your account (following the safety retention window), unless:

1. We must keep it to comply with applicable law (for instance, some “traffic data” is kept for one year to comply with statutory data retention obligations);

2. We must keep it to evidence our compliance with applicable law (for instance, records of consents to our Terms, Privacy Policy and other similar consents are kept for five years);

3. There is an outstanding issue, claim or dispute requiring us to keep the relevant information until it is resolved;

4. The information must be kept for our legitimate business interests, such as fraud prevention and enhancing users' safety and security. For example, information may need to be kept to prevent a user who was banned for unsafe behaviour or security incidents from opening a new account.

In general terms, we will retain your personal data for the duration of your involvement/engagement with us and for as long as reasonably necessary afterwards;

Warning: Even after you remove information from your profile or delete your Account, copies of that information may still be viewable and/or accessed to the extent such information has been previously shared with others, or copied or stored by other Users or to the extent such information has been shared with search engines. We cannot control this, nor do we accept any liability for this. If you have given third party applications or websites access to your personal information they may retain such information to the extent permitted under their terms of service or privacy policies.

And keep in mind that even though our systems are designed to carry out data deletion processes according to the above guidelines, we cannot promise that all data will be deleted within a specific timeframe due to technical constraints.

F. Your individual legal rights

Under certain circumstances, individuals in Europe have rights under data protection laws inrelation to their personal data. If you are located in Europe, you may ask usto take the following actions regarding personal data that we hold:

• Access

You are entitled to ask us if we are processing your personal data and, if so, for a copy of the personal data we hold about you, as well as obtain certain other information about our processing activities.

• Correction

If any personal data we hold about you is incomplete or inaccurate, you can require us to correct it, though we may need to verify the accuracy of the new data you provide to us.

• Erasure

This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law.

• Object

Where our reason for processing your personal data is our legitimate interests, you may object to processing as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes.

• Restriction

You may ask us to suspend our use of your personal data in the following scenarios: if you want us to establish the data's accuracy; where our use of your personal data is unlawful but you do not want us to erase it; where you need us to hold your data for a longer period than we usually would, because you need it to establish, exercise or defend legal claims; or you have objected

to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

• Transfer

Where it is possible, we will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to personal data provided by you which you initially provided consent for us to use or where we used the information to perform a contract with you.

• Withdraw consent

Where our reason for processing is based on your consent, you may withdraw that consent at any time. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

• Automated decision making

You have the right not to be subject to automated decision making (e.g., profiling) that significantly affects you. The exercise of this right is not available to you in the following cases: 1. The automated decision is required to enter into, or perform, a contract with you. 2. We have your explicit consent to make such a decision. 3. The automated decision is authorized by local law of an EU member state.

However, in the first two cases set out above, you still have the right to obtain human intervention in respect of the decision, to express your point of view and to contest the decision.

If you're already a WooPlus user, you may access, update, alter, or delete your basic user profile information by editing your user profile. You can control the information we collect about you by limiting what information is in your profile, by keeping your information current, or by contacting WooPlus Support at Help & Feedback on WooPlus App. You can submit requests to exercise these rights by emailing the WooPlus DPO at user@wooplus.com. We may need to request specific information from you to help us confirm your identity and ensure you are entitled to exercise a right in respect of your personal data. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

There may be legal or other reasons why we cannot, or are not obliged to, fulfil a request to exercise your rights. We will use available lawful exemptions to your individual rights to the extent appropriate. If we decline your request, we will tell you why, subject to legal restrictions.

You will not have to pay a fee to exercise any of your rights relating to your personal data. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances. We will respond to all legitimate requests promptly and, in any event, within any timeframes prescribed by applicable law. In general, we must respond to queries within one month from the receipt of the request, so it is important that requests are identified and sent to support@wooplus.com as soon as possible. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. Any transmission of your personal data will be handled in a secure manner. You also have the right to make a complaint at any time to a supervisory authority (for more information go to https://edpb.europa.eu/about-edpb/board/members_en).