Privacy Policy

Alpha Living & Beauty Sdn Bhd — GiselleIOT Mobile Application

Effective Date: 26 May 2026 Last Updated: 26 May 2026

1. Introduction

Alpha Living & Beauty Sdn Bhd and its subsidiaries ("we", "us", "our", "Alpha Living") are committed to protecting your privacy. This Privacy Policy ("Policy") describes our practices in connection with the collection, use, storage, transfer and disclosure of Personal Data we process through your individual use of the following services, products, and related mobile applications (collectively, the "Products"):

• GiselleIOT Mobile Application

This Policy is issued in compliance with the Personal Data Protection Act 2010 of Malaysia, as amended by the Personal Data Protection (Amendment) Act 2024 (collectively, the"PDPA"), and applicable data protection laws in other jurisdictions where our Products are offered.

Before you use our Products, please read this Policy carefully. By registering an account, providing your Personal Data, or by continuing to use our Products without expressly objecting to this Policy, you are deemed to consent to the processing of your Personal Data as described herein. If you do not agree, please discontinue use of the Products.

For any questions regarding this Policy, please contact our Data Protection Officer at

admin@alpha-living.com.

Bilingual Notice: In accordance with Section 7 of the PDPA, this Privacy Policy is issued in both English and Bahasa Malaysia. In the event of any inconsistency between the two versions, the English version shall prevail to the extent permitted by applicable law.

2. Definitions

"Personal Data" means information that relates directly or indirectly to a data subject who is identified or identifiable from that information, or from that information and other information in our possession, and includes any Sensitive Personal Data and any expression of opinion about the data subject."Sensitive Personal Data" means personal data consisting of information as to the physical or mental health or condition of a data subject, their political opinions, religious beliefs or other beliefs of a similar nature, the commission or alleged commission of any offence, biometric data, and any other personal data as the Minister may prescribe under the PDPA.

"Smart Devices" refer to computing devices produced or manufactured by hardware manufacturers, with human-machine interfaces and the ability to transmit data via wireless network connections, including smart home appliances, smart wearable devices, smart aircleaning devices, and similar devices.

"App" refers to the GiselleIOT mobile application, which provides end users with remote control of Smart Devices and connectivity to the cloud IoT platform of our service provider.

"Data Protection Officer" or "DPO" means the officer designated by Alpha Living under Section12A of the PDPA, responsible for overseeing the Company's compliance with the PDPA.

3. What Personal Data We Collect

In order to provide our services to you, we may ask you to provide certain Personal Data necessary for those services. If you do not provide such Personal Data, we may not be able to provide you with our products or services.

3.1 Information You Voluntarily Provide

Registered Account Data: When you register an account with us, we collect your name and contact details, such as email address, phone number, username, and login credentials. During your interaction with our Products, we may further collect your nickname, profile picture, country code, language preference, and time zone information.Feedback: When you use the feedback and suggestion features in our Products, we collect your email address, mobile phone number and your feedback content to address your enquiries and resolve device issues in a timely manner.

3.2 Information Based on Additional Functions

In order to provide higher-quality services with optimised user experiences, we may collect and use certain information if you consent to use additional functions in the App. If you do not provide such information, you may continue to use basic services of the App and connected Smart Devices, but certain features may not be available.

(a) Location-Based Functions: When you enable location-based functions through your mobile device permission settings, we collect and process your location information to enable these functions, such as pairing with your Smart Devices and automation scenarios. When youenable the geo-fence feature, your location may be shared with Google Maps services, governed by Google's Data Processing and Security Terms. Opt out: "My &rt; Setting &rt; Privacy Setting &rt; Location Information".

(b) Camera Permission: You may use the camera to scan codes, pair with Smart Devices, ortake videos. We only access the camera when you actively use the relevant feature. Opt out:"My &rt; Setting &rt; Privacy Setting &rt; Camera".

(c) Microphone Permission: We obtain voice information through the microphone only when you voluntarily activate it in the App. Opt out: "My &rt; Setting &rt; Privacy Setting &rt; Microphone".

(d) Storage Permission (Android): To ensure stable operation, after you grant storagepermission, we access pictures, files, and crash logs from your mobile device's storage. Optout: "My &rt; Setting &rt; Privacy Setting &rt; Storage".

(e) Notification Permission: We send notifications about the use of Smart Devices or services,especially security alerts. Opt out: "My &rt; Setting &rt; Privacy Setting &rt; Notifications".

(f) Floating Window / Alert Window Permission: You may bind a camera in the App and requestthe App to display the camera's real-time image in a separate window. Opt out: "My &rt; MessageCenter &rt; Setting &rt; Device Alert".

(g) Bluetooth Permission: You may enable Bluetooth functions to control, pair with, discoverand configure Smart Devices. We only use Bluetooth in the following scenarios: displayingdevice status; performing device control; discovering Smart Devices; and Smart Device network distribution. Opt out: "My &rt; Settings &rt; Privacy Setting &rt; Bluetooth".

3.3 Information We Collect Automatically Mobile Device Information: To provide and maintain the normal operation of our Services, improve and optimise our Services, and protect your account security, we automatically collect mobile device information such as device model, IP address, wireless connection information, operating system type and version, application version, push notification identifier, log files, and mobile network information.Usage Data: We automatically collect usage data relating to visits, clicks, downloads, messages sent and received, and other usage during your interaction with our websites and Services.Log Information: System and exception logs may be uploaded, including your IP address, language preference, operating system version, and date/time of access, to facilitate problemidentification and resolution.Where information that alone cannot identify a specific individual, when combined with other information, may be used to do so, we will treat such information as Personal Data and apply appropriate safeguards.

3.4 Smart Device Related Information Basic Device Information: When you connect your Smart Devices, we collect device name,device ID, online status, activation time, firmware version, and upgrade information. Device Connection Information: Depending on the Smart Device, this may include Wi-Fi information and device MAC address. Information Reported by Smart Devices: Depending on the Smart Device, we may collect information such as cooking temperatures, timer settings, selected modes, power status, and error or safety codes.

4. Purposes and Legal Basis for Processing Personal Data Under Section 6 of the PDPA, we process Personal Data only with your consent or where another lawful basis applies. The purposes for which we process your Personal Data are as follows:

• Providing Our Services: We process your account data, mobile device information,usage data, location information, and Smart Device related information to provide the Services you have requested. Legal basis: performance of our contract with you (UserAgreement).

• Improving Our Services: We process your mobile device information, usage data,location information, and Smart Device related information to ensure the functions andsafety of the Services, develop and improve the Services, analyse operational efficiency, and prevent fraudulent or inappropriate usage. Legal basis: performance of our contract with you; our legitimate interests in maintaining and improving the Products.

• Marketing Communication and Personalisation: We may process your account data,usage data, and device information to personalise product design and provide tailoredservices, including recommendations and surveys. Legal basis: your consent. Opt out:"My &rt; Settings &rt; Privacy Settings &rt; Personalisation".

• Legal Compliance: We may process and disclose your Personal Data to comply withlegal obligations, enforce our agreements, protect rights and safety, and addresssecurity, fraud or technical issues.If there is any change in the purposes for processing your Personal Data, we will notify you byemail and/or a prominent notice in the App prior to such change taking effect.

5. Who We Share Personal Data WithAlpha Living shares Personal Data only as described in this Policy. We may share your Personal Data with the following recipients:

• Third-party service providers performing business-related functions on our behalf, including the cloud IoT platform provider, hosting providers, analytics providers, payment processors, IT services providers, customer support, and email delivery services.

• Customers and business partners who provide you, directly or indirectly, with SmartDevices or with networks and systems through which you access our Services.

• Subsidiaries or affiliates within the Alpha Living corporate group, for regular businessactivities and in compliance with applicable law, this Policy and other appropriateconfidentiality and security measures.

• An affiliate or other third party in connection with any reorganisation, merger, sale, jointventure, assignment or transfer of all or part of our business, assets or shares. Youwill be notified by email and/or a prominent notice in the App.

• Any person where we believe in good faith that access, use, preservation or disclosureis reasonably necessary to comply with applicable law or governmental request;enforce our User Agreement and other policies; protect our operations and systems;protect rights, property or safety of Alpha Living, our users, third parties or the public;or perform risk management and fraud-prevention checks.Except as set out above, we will not disclose your Personal Data to other third parties withoutyour consent.

6. International Transfer of Personal DataAlpha Living complies with applicable data localisation requirements in the jurisdictions wherewe operate. To facilitate our operations, we may transfer, store and process your PersonalData in jurisdictions other than where you reside, including the People's Republic of China(where our cloud IoT platform provider Tuya Smart operates servers), Singapore, and otherjurisdictions in Southeast Asia.In accordance with Section 129 of the PDPA, cross-border transfers of Personal Data fromMalaysia are made only to places gazetted by the Minister or where one or more of thefollowing safeguards applies: • you have consented to the transfer;

• the transfer is necessary for the performance of a contract between you and AlphaLiving;

• the recipient is bound by contractual obligations providing an adequate level ofprotection (such as EU Standard Contractual Clauses or comparable model clauses);or

• Alpha Living has taken all reasonable precautions and exercised all due diligence toensure that the Personal Data will not be processed in any manner that wouldcontravene the PDPA. For further detail on the safeguards in place, please contact our DPO at dpo@alphaliving.com.

7. Your Rights Relating to Your Personal DataUnder the PDPA, you have the rights set out below. You may exercise these rights by either:

• Emailing our Data Protection Officer at dpo@alpha-living.com; or

• Submitting a request through the in-App feedback channel: "Me &rt; Personal Center &rt;Account and Security". We will respond to verified requests within 30 days. There is no fee for exercising these rights,but we may charge a reasonable fee where requests are manifestly unfounded or excessive.For security purposes, we may ask you to verify your identity before taking further action.You have the following rights:

• Right of Access — Request access to the Personal Data we hold about you ( "My &rt;Setting &rt; Privacy Settings &rt; Personal Data Export").

• Right to Correction — Request correction of inaccurate or incomplete Personal Data.

• Right to Erasure (Deletion) — Request deletion of your Personal Data ("My &rt; Setting&rt; Account and Security &rt; Delete Account"). When you confirm account deletion, yourPersonal Data will be deleted in accordance with our retention schedule.

• Right to Restrict Processing — Request restriction of our processing of some or all ofyour Personal Data.

• Right to Data Portability — Request transfer of your Personal Data, in a structured,commonly used and machine-readable format, to you or to a third party, whereprocessing is automated and based on your consent or a contract with you (introducedby the 2024 amendments to the PDPA).

• Right to Object — Object to processing of Personal Data based on our legitimateinterests or for direct marketing purposes.

• Right to Withdraw Consent — Withdraw your consent at any time, as described inSection 8 below.If you are not satisfied with our response, you have the right to lodge a complaint with thePersonal Data Protection Commissioner of Malaysia (Pesuruhjaya Perlindungan Data Peribadi, JPDP) at www.pdp.gov.my.

8. Withdrawal of ConsentYou may withdraw your consent for the processing of your Personal Data through the followingapproaches:

• For permissions granted through your device system settings, withdraw consent bychanging device permissions (location, camera, photo album, microphone, Bluetooth,notifications, and other related functions);

• Opt out of the Personalisation feature through "Me &rt; Settings &rt; Privacy Settings &rt;Personalisation";

• Unbind a Smart Device through the App; after unbinding, information related to thatSmart Device will no longer be collected;

• If you previously consented to associate your App account with a third-party service(such as a health platform), unbind it via that third-party platform;

• Delete your account through "Me &rt; Settings &rt; Account and Security &rt; Delete Account".Withdrawing your consent may prevent us from continuing to provide you with certain productsor services. Withdrawal does not affect the lawfulness of processing carried out based onconsent before its withdrawal.

9. Data Breach NotificationIn accordance with Section 12B of the PDPA (as amended in 2024), in the event of a personaldata breach Alpha Living will:

• notify the Personal Data Protection Commissioner of Malaysia (JPDP) without unduedelay and, where feasible, no later than 72 hours after becoming aware of the breach; and

• where the breach is likely to result in significant harm to you, notify you directly withoutundue delay, by email and/or a prominent notice in the App.Such notification will include, to the extent available: the nature of the breach, the categoriesand approximate number of affected data subjects and records, the likely consequences, themeasures taken or proposed, and the DPO contact for further information.10. Security MeasuresWe use commercially reasonable physical, administrative, and technical safeguards topreserve the integrity and security of your Personal Data, including:

• Device access: proprietary algorithms ensure data isolation, access authentication,and authorisation;

• Data communication: TLS encryption protocols and commercial-grade encryptionbased on dynamic keys;

• Data processing: data filtering, validation and complete data audit logs;

• Data storage: encrypted storage of all confidential user information.Alpha Living undertakes periodic penetration testing and vulnerability assessment of the IoTplatform. If you have reason to believe that your interaction with us is no longer secure (for example, ifthe security of your account may have been compromised), please notify us immediately byemailing admin@alpha-living.com.

11. Data RetentionWe retain your Personal Data only for the minimum period necessary for the purposes set outin this Policy, unless a longer retention period is required or permitted by applicable law. Afterthe retention period ends, we will securely destroy or anonymise your Personal Data.The standard retention schedule is as follows:

• Active accounts: Personal Data is retained for the duration of your account;

• Closed or deleted accounts: Personal Data is retained for ninety (90) days after closureor deletion, then permanently deleted or anonymised, except where a longer period isrequired by law (for example, tax records under the Income Tax Act 1967 or antimoney-laundering obligations);

• Backup copies: are overwritten on rolling cycles not exceeding 180 days.Where, for technical reasons, we are unable to delete Personal Data, we will ensureappropriate measures are in place to prevent any further use of such Personal Data.

12. Children's Privacy

Protecting the privacy of young children is especially important to us. The Services are notdirected to individuals under the age of thirteen (13), or such other age provided by applicablelaw in the relevant jurisdiction. In Malaysia, where consent is required from a person underthe age of eighteen (18), such consent must be given by the parent, guardian or person whohas parental responsibility for that person.We do not knowingly collect Personal Data from any child without verifiable consent from thatchild's parent or legal guardian. If we become aware that we have collected Personal Datafrom a child without such consent, we will take steps to remove that information promptly. Ifyou are a parent or legal guardian and believe your child has provided Personal Data to us,please contact our DPO at dpo@alpha-living.com.

13. Data Protection Officer

In accordance with Section 12A of the PDPA, Alpha Living has appointed a Data ProtectionOfficer. You may contact the DPO at:

• Name: Data Protection Officer, Alpha Living & Beauty Sdn Bhd

• Email: admin@alpha-living.com

• Address: Beside 33, No 3, Jalan CJ 1/1, Kawasan Perindustrian Cheras Jaya, 43200 Seri Kembangan, Selangor, Malaysia

14. Changes to this Privacy PolicyWe may update this Privacy Policy from time to time to reflect changes in our informationpractices, legal requirements or business operations. If we make any material changes, wewill notify you by email (sent to the address specified in your account) or by a prominent noticein the App prior to the change taking effect. We encourage you to periodically review thisPolicy for the latest information on our privacy practices.

15. Contact UsIf you have any questions about our practices or this Privacy Policy, please contact us at:

• Alpha Living & Beauty Sdn Bhd• Beside 33, No 3, Jalan CJ 1/1, Kawasan Perindustrian Cheras Jaya, 43200 SeriKembangan, Selangor, Malaysia

• Data Protection Officer: admin@alpha-living.com