FoneSquare Privacy Policy

FoneSquare Privacy Policy

Last updated date: 2026.10.16

1. Introduction

1.1. Welcome to the services provided by AHS DEVICE HONG KONG LIMITED and its affiliates (“we”, “us”, or “AHS”). These services include the FoneSquare APP operated by us (“FoneSquare”) and any new forms that may emerge due to technological development. We fully recognize the importance of personal data to you, and we will implement appropriate security protection measures in accordance with applicable laws and regulations to do our utmost to ensure the security and controllability of your personal data. When you use our services, we will collect and use your relevant information. Through the FoneSquare Privacy Policy (“Privacy Policy”), we intend to explain to you how we currently and in the future collect, use, store, disclose, and/or process the personal data you provide to us and/or we possess relating to you, and to assist you in making an informed decision before providing any personal data to us. If you are located in Hong Kong SAR, the Philippines, Indonesia, Vietnam, Malaysia, Thailand, the United Arab Emirates, or Saudi Arabia, jurisdiction-specific supplemental terms shall apply. Please refer to the “Jurisdiction-Specific Supplemental Terms” section below.

1.2. This Privacy Policy applies to the services we provide but does not apply to services (if any) offered on FoneSquare by other third parties. When you use a specific product/function of the service, there may be a separate agreement, privacy policy, etc., specifically for that product/function. Please read and agree to the relevant agreement or policy before using that specific function.

1.3. FoneSquare is an online platform for second-hand goods trading, primarily adopting a self-operated sales model. This Privacy Policy is integral to your use of FoneSquare and the various business functions included therein (“Services”). We hope that you will carefully read and confirm that you have fully understood the contents of this Privacy Policy before using the Services, so that you may make choices you deem appropriate in accordance with the guidance of this Privacy Policy. We endeavor to present the relevant terms used in this Privacy Policy in a clear and concise manner to facilitate your better understanding.

1.4. By registering an account on FoneSquare and accessing and using the Services, you acknowledge the functions provided by FoneSquare and the personal data processing necessary for the operation of such functions.

1.5. To the extent permitted by applicable law, if there is any conflict between the English version and another language version of this Privacy Policy, the English version shall prevail.

1.6. This Privacy Policy will help you understand the following:

1. Collection of Personal Data

2. Use of Personal Data

3. Cookies and Similar Technologies

4. Sharing and Disclosure of Personal Data

5. Retention of Personal Data

6. Cross-Border Transfer of Personal Data

7. Security Measures for Personal Data

8. Data Subject Rights

9. Protection of Minors’ Personal Data

10. Notices and Amendments

11. Contact Us

12. Hong Kong Supplement

13. Philippines Supplement

14. Indonesia Supplement

15. Vietnam Supplement

16. Malaysia Supplement

17. Thailand Supplement

18. United Arab Emirates Supplement

19. Saudi Arabia Supplement

2. Collection of Personal Data

To provide you with the Services, you shall provide us with the necessary personal data. If you refuse to provide the necessary personal data, you will be unable to use the Services properly. The types of personal data we collect from you, whether directly or indirectly, depend on your specific interactions with us and the Services. Generally, we collect the following personal data:

2.1. Personal Data You Provide to Us

When you register an account, filter and browse products, place orders and purchase products, contact us directly, or otherwise use the Services, we may ask you to provide the following personal data:

（1） Account Data: phone number, email address, password you voluntarily set, verification code, registration time, account status, and other registration and login data.

（2） Identity Verification Data: for individual users: name, country or region of residence, nationality, ID card photo and ID number and/or passport number and passport photo, and document validity period; for business users: company name, company registration ID, photo of the company registration certificate, legal representative information, address of company, document type and document validity period. During this process we may request access to your device’s camera or photo/storage permissions to capture a photo in real time or select an existing photo.

（3） Order and Pickup Data: order number, product details, price information, order time, order status, store, warehouse, and other information set out in the order generated upon purchase; outbound delivery note number, order number, outbound status, creation time, item code, IMEI, SKU name, outbound time, and other information set out in the outbound delivery note generated when products are dispatched for pickup.

（4） Payment Information: payment account, payment method, payment status, payment time, payment amount, currency, transaction serial number, third-party serial number, and other data required for the payment process.

（5） Invoicing Data: data required for the invoicing process includes individual name, business entity name, contact method, order data (including product description, price information, order time).

（6） Message and Communication Data: communication records generated when you contact us via WhatsApp, WeCom or relevant methods permitted by us, as well as account data, order data, payment information, and other data necessary to verify your identity. During this process, we may request access to your device’s camera or photo/storage permissions to capture a photo in real time or select an existing photo or file.

2.2. Personal Data We Collect by Automated Means

When you use the Services, we collect your personal data by automated means:

（1） Service Log Information: We collect information about your activities and behaviors when using the Services, including device information, language settings, timestamps, IP addresses, web logs, and other information for which we have obtained your authorization, relating to your actions such as browsing, clicking, viewing, adding items to the shopping cart, filtering, placing orders and completing transactions, after-sales activities, and other operational behaviors.

（2） Device Technical Information: IDFA, device identifier, device model, device type, network environment, current region setting of the device.

2.3. Personal Data We Receive from Third Parties

When you use the Services, we collect your personal data from third parties:

（1） Payment Information: If you use the payment function, we may receive information related to your payment transactions from banks and relevant payment service providers, including payment account, payment status, payment amount, transaction serial number, payment time, and other information necessary for order completion, financial accounting, or fraud prevention.

3. Use of Personal Data

3.1. How we collect and use your personal data will depend on your activities and interactions when using the Services. We will use your personal data in accordance with the applicable laws and regulations of the country or region in which you are located and for the following purposes:

Purpose of Use	Personal Data	Legal Basis
Account Registration and Management: To create and set up your account, link the information associated with your various login methods, identify duplicate users, and allow you to change your password to safeguard account security.	(1) Account Data: such as phone number, email address.	(1) Processing such data is necessary for the performance of the contract or to safeguard legitimate interests (if appliable). (2) If you fail to provide such data, we will be unable to create and manage an account for you.
Identity Verification: To prevent fraud, illegal or non-compliant activities, and abnormal transactions; to prevent the Services from being used for unlawful purposes; to match and identify your identity information through automated technology, verify the validity and authenticity of your identity, and identify potential transaction risks for risk control.	(1) Identity Verification Data: such as an individual user’s name, country or region of residence, nationality, ID number or passport number, ID card photo or passport photo, document validity period.	(1) Processing such data is necessary for the performance of the contract or to safeguard legitimate interests (if appliable). (2) If you fail to provide such data, we will be unable to verify and identify your account identity.
Providing Information Browsing and Product Filtering: You may select a nearby store and browse, click on, and view products of interest to you through the product filtering function.	(1) Service Log Information: device information related to operational behaviors, language, time, IP address, web logs, etc. (2) Device Technical Information: device parameters and system information, device network environment information, etc.	(1) Processing such data is necessary for the performance of the contract or to safeguard legitimate interests (if appliable). (2) If you fail to provide such data, we will be unable to improve and provide you with relevant services.
Completing Transaction Activities such as Order Placement, Payment, and Product Delivery: To create orders for you, manage orders, process transactions and payment settlements, handle product payment and delivery, and ensure transaction security.	(1) Order and Pickup Data: such as order number, order status, store, and other order information; and outbound delivery note number, outbound status, and other pickup data. (2) Payment Information: such as payment account, payment method, payment status, payment time, etc. (3) Invoicing Data: such as individual name, business entity name, contact method, order data. (4) Device Technical Information: such as device type, device identifier, etc.	(1) Processing such data is necessary for the performance of the contract or to safeguard legitimate interests (if appliable). (2) If you fail to provide such data, we will be unable to provide you with commodity trading services.
Providing Customer Service and Dispute Resolution: To address your complaints, feedback, questions, service requests, and related disputes.	(1) Communication records generated when you contact us via WhatsApp and WeCom. (2) Account data, order information, payment information, and other data types required for the provision of customer service and dispute resolution.	(1) Processing such data is necessary for the performance of the contract or to safeguard legitimate interests (if appliable). (2) If you fail to provide such data, we will be unable to process your customer service requests.
Conducting Research and Analytical Decision-Making: We may use the collected data for data analysis and research to better safeguard your experience when using the Services and support business decision-making analysis, among other purposes.	(1) Service Log Information: device information related to operational behaviors, language, time, IP address, web logs, etc. (2) Device Technical Information: device parameters and system information, device network environment information, etc.	(1) We process such data with your consent or to safeguard legitimate interests (if appliable). (2) If you fail to provide such data, we will be unable to provide you with a better service experience.
Ensuring Operational Security: To optimize the Services and ensure operational security.	(1) Device Technical Information: device parameters and system information, device network environment information, etc.	(1) Processing such data is necessary for the performance of the contract or to safeguard legitimate interests (if appliable). (2) If you fail to provide such data, we will be unable to effectively maintain operational safety and prevent security incidents.
Complying with legal requirements and regulatory obligations and protecting our legitimate interests.	(1) The personal data we collect through the Services as described in this Privacy Policy, unless otherwise provided by law.	(1) Processing of such data is necessary to comply with legal obligations and protect our legitimate interests. (2) If you fail to provide such data, it may result in us and/or you violating applicable laws and regulations.

3.2. In the context of identity verification, the results of automated analysis are used solely to assist authorized personnel in carrying out manual reviews. We will not make decisions that produce legal effects or similarly significant effects concerning you, such as refusing a transaction or taking other final adverse actions, based solely on such automated analysis. If you have any objection to the risk assessment results we have produced, you may contact us using the contact details provided in this Privacy Policy.

3.3. In the future, we may use your personal data for direct marketing purposes; however, we will not do so unless we have obtained your prior consent. We will inform you of the specific circumstances and ensure that the processing is limited to the personal data that is necessary and proportionate for direct marketing purposes. You may also withdraw your consent or object to our use and provision of your personal data for direct marketing. If you wish to withdraw your consent, please contact us using the contact details provided in this Privacy Policy.

3.4. Where necessary, we may transfer your personal data to our affiliates and third-party service providers for the purposes described in this Privacy Policy.

3.5. If we intend to use your personal data for purposes not specified in this Privacy Policy, or to use information collected for a specific purpose for any other purpose, we will notify you in advance and obtain your consent or ensure that we have the relevant legal basis.

4. Sharing and Disclosure of Personal Data

In the course of providing the Services to you, we may share, disclose, or transfer your personal data to the following recipients in the circumstances described below:

4.1. Others with Your Consent. We may share or publicly display your personal data with your consent or upon your instructions.

4.2. Our Affiliates. Our affiliates may use your personal data for the purposes described in this Privacy Policy. If our affiliates intend to change the purposes for which they process personal data, they will notify you and seek your separate consent again or ensure that they have the relevant legal basis.

4.3. Third-Party Service Providers. These include cloud storage service providers, technical service providers, and payment service providers, which may use your personal data for the purposes set out in this Privacy Policy. We will review and assess the security capabilities of any third-party service provider that receives your personal data and take other appropriate measures to protect the security of your personal data. Please note that we only provide your personal data for the purposes described in this Privacy Policy. Certain processing activities carried out by third-party service providers that go beyond the scope described in this Privacy Policy may be governed by their own privacy policies rather than this Privacy Policy.

4.4. Government Agencies and Judicial Authorities. We may provide your personal data where it is necessary to comply with applicable laws and regulations, legal proceedings, or mandatory administrative or judicial requirements. We will review and verify the legal documents presented by judicial and law enforcement authorities to ensure the legality, legitimacy, and necessity of such data sharing.

5. Retention of Personal Data

5.1. We will retain your personal data for the period necessary to fulfill the purposes described in this Privacy Policy or to comply with applicable legal obligations, unless otherwise required or permitted by applicable laws and regulations.

5.2. The criteria we use to determine the retention period primarily include:

(1) Fulfilling the purposes of providing the Services to you and maintaining records to address potential inquiries or complaints;

(2) Ensuring the security and quality of the Services we provide to you;

(3) Whether you have consented to a longer retention period;

(4) Whether any other special agreement or legal requirement exists regarding the retention period.

5.3. We will delete of anonymize your personal data it in accordance with the requirements of applicable law once the retention period has expired, ta data is no longer necessary for the purposes set out in this Privacy Policy, or you submit a deletion request.

5.4. In the event that we terminate the Services or our operations, we will notify you through such means as announcements, emails or others, and will delete or anonymize your personal data within a reasonable period.

6. Cross-Border Transfer of Personal Data

6.1. Your personal data may be transferred to countries or regions outside your place of residence. We will centrally store and manage your personal data in Singapore. Where the store you select is located outside your country or region, we will also transfer your personal data to our affiliate (located in Dubai). In addition, we may process your personal data in China or allow remote access to your personal data from China, to assist with the implementation of risk control mechanisms and for the purposes of conducting global product operational analysis and data statistics. The categories of recipients of your personal data include:

(1) Our affiliates, for the purposes of performing contractual obligations to complete pickup and delivery, and providing services such as risk control, operational support, and data analysis;

(2) Third-party service providers, for the purposes of performing contractual obligations, such as cloud storage service providers offering storage services.

6.2. Where it is necessary for us to carry out a cross-border transfer of your personal data or to allow remote access from other countries or regions, we will transfer your personal data based on the consent you have provided, by implementing appropriate technical safeguard measures (such as prescribed standard contractual clauses, etc.) and/or to the extent necessary for the provision of the services you have requested (performance of the contract). We will ensure that your personal data receives adequate protection.

7. Security Measures for Personal Data

7.1. We implement security protection measures that comply with industry standards to safeguard your personal data against unauthorized access, use, or modification, and to prevent data damage or loss. These measures include, but are not limited to, the adoption of encryption, de-identification, and anonymization technologies, as well as the establishment and enforcement of data security management systems and related policies to regulate the storage and use of personal data.

7.2. We only permit access to personal data by those employees of AHS and its affiliates, and authorized third-party service providers who have a legitimate need to know such information. We have also implemented strict access control and monitoring mechanisms. Furthermore, we enforce physical access restrictions at our data centers to strengthen physical security protection.

7.3. The internet is not an absolutely secure environment. While we will endeavor to ensure and warrant the security of any information you send to us, we also ask you to take care to protect your personal data. In the event that our physical, technical, or administrative safeguards are breached, resulting in unauthorized access to, public disclosure of, tampering with, or destruction of information, which in turn damages your legitimate rights and interests, we will bear the corresponding legal liability.

7.4. In the unfortunate event of a personal data security incident, we will, in accordance with applicable laws and regulations, promptly notify you through reasonable means such as telephone, email, or public announcement as necessary, and report the handling of the incident to the relevant regulatory authorities.

8. Data Subject Rights

8.1. You are entitled to exercise certain data subject rights with respect to your personal data in accordance with the applicable laws and regulations of your jurisdiction, including the right of access, the right to rectification, and the right to withdraw consent, among others.

8.2. The data subject rights available to you may vary depending on the laws and regulations of the country or region in which you are located. This Privacy Policy does not, and is not intended to, create, expand, or modify any data subject or consumer rights, or our corresponding obligations, as prescribed by the laws and regulations of your jurisdiction, unless otherwise provided by applicable laws and regulations.

8.3. When you contact us to exercise these rights, we may verify your identity in accordance with applicable law and the actual circumstances. Where necessary, we may charge a reasonable fee and will provide a response within a reasonable period from the date of receipt of your request.

8.4. Please note that under certain circumstances (subject to the laws and regulations of your country or region), we may be unable to respond to your request to exercise your rights. For example, we may decline your request where disclosing certain personal data could harm the rights or interests of others, or would violate applicable laws and regulations. In such cases, we will inform you of the reasons for the refusal and, to the extent permitted by law, provide you with as much information as possible.

9. Protection of Minors’ Personal Data

9.1. The Services are primarily directed to adults who have full legal capacity. If, under the laws and regulations of your country or region, you are a minor or lack legal capacity, please do not use the Services.

9.2. If you have any questions regarding the protection of minors’ personal data or believe that we have collected a minor’s personal data without consent, please contact us using the contact details set out in this Privacy Policy. Upon verification, we will endeavor to delete the relevant data as soon as possible.

10. Notices and Amendments

10.1. As our business evolves and to provide you with better services, this Privacy Policy may be updated from time to time. Any updates will be posted on the page where this Privacy Policy appears or communicated to you via email or other means.

10.2. If you have any concerns regarding the revised Privacy Policy, please contact us using the contact details provided in this Privacy Policy.

10.3. If you do not agree with the revised Privacy Policy, you have the right to discontinue using our Services. However, your continued use of the Services shall be deemed as your acknowledgement of and agreement (if needed) to the revised Privacy Policy.

11. Contact Us

11.1. If you have any questions, comments, or suggestions regarding this Privacy Policy or matters relating to your personal data, please contact us via WhatsApp and WeCom or at fonesquare@ahsdevice.com.

11.2. We may not respond to inquiries that are unrelated to this Privacy Policy or your personal data rights. We will respond to your request within a reasonable period as required by applicable law and will process your request in accordance with this Privacy Policy and applicable laws and regulations.

11.3. If you are not satisfied with our response, particularly if you believe that our processing of your personal data has infringed upon your legitimate rights and interests, you also have the right to lodge a complaint with the relevant supervisory authority in accordance with the laws and regulations of your jurisdiction.

Jurisdiction-Specific Supplemental Terms

If you are located in any of the jurisdictions listed below, the jurisdiction-specific supplemental terms set out in the corresponding appendix shall apply to you. Where your jurisdiction is not specifically listed, no additional terms shall apply.

12. Hong Kong Supplement

This Supplement applies solely to citizens or residents located in Hong Kong SAR (“you”). This Supplement serves as an addendum to the main body of this Privacy Policy and is based on the Personal Data (Privacy) Ordinance of Hong Kong. In the event of any conflict between this Supplement and the main body of this Privacy Policy concerning the processing of personal data of users in the Hong Kong, this Supplement shall prevail. The data user is AHS DEVICE HONG KONG LIMITED.

12.1. Use of Personal Data

We collect, use, and disclose your personal data for the purposes set out in Section 3 of the main body of this Privacy Policy. The provision of your personal data is voluntary. However, if you fail to provide such data, we may not be able to provide you with the relevant services, or it may result in us and/or you violating applicable laws and regulations.

In the future, we may use your personal data for direct marketing based on our legitimate interests. We will inform you of the specific details at the relevant time and obtain your consent, ensuring that the scope of processing is limited to the personal data that is necessary and proportionate for the purposes of direct marketing.

12.2. Data Subject Rights

Under the Personal Data (Privacy) Ordinance, you are entitled to the following rights with respect to your personal data:

(1) Right of Access: You have the right to request access to and obtain a copy of your personal data held by us.

(2) Right to Correction: You have the right to request the correction of any personal data that is inaccurate, or that has been collected or processed unlawfully.

(3) Right to Object to Direct Marketing: You have the right to request that we cease using your personal data for direct marketing (if applicable).

(4) Right to Withdraw Consent: You have the right to withdraw your consent to our processing of your personal data. We will cease the relevant processing activities immediately, without prejudice to the lawfulness of processing based on your consent prior to its withdrawal.

If you wish to access your personal data, you are required to submit a “Data Access Request Form” (Form OPS003, available at https://www.pcpd.org.hk/chinese/publications/files/Dformc.pdf). When you exercise the above rights, we will verify your identity, assess your request, and respond within 40 calendar days, unless a longer period is permitted by law. In exceptional circumstances, we may refuse your request as permitted under applicable law, in which case we will inform you of the reasons for the refusal. If you have any questions about exercising any of these rights, please contact us using the contact details provided in this Supplement.

12.3. Protection of Minors’ Personal Data

For the purposes of this Supplement, a minor as referred to in Section 10 of the main body of this Privacy Policy means any person under 18 years of age. If we become aware that such minor has provided us with their personal data, we may promptly delete the relevant personal data.

12.4. Contact Us

If you have any questions or comments regarding this Privacy Policy, or if you wish to exercise your data subject rights under the Personal Data (Privacy) Ordinance, you may contact us at: +852 5951 8109.

13. Philippines Supplement

This Supplement applies solely to citizens or residents located in Philippines (“you”). This Supplement serves as an addendum to the main body of this Privacy Policy and is based on the Republic Act 10173 Data Privacy Act of 2012, its implementing rules and regulations, regulatory guidelines, and other relevant issuances. In the event of any conflict between this Supplement and the main body of this Privacy Policy concerning the processing of personal data of users in the Philippines, this Supplement shall prevail. The personal data controller is AHS DEVICE HONG KONG LIMITED.

13.1. Use of Personal Data

By using the Services in the Philippines, you consent to the terms of the main body of this Privacy Policy and this Supplement, and you expressly consent to our collection, use, and sharing of your name, nationality, passport number and passport photo for the purpose of identity verification in accordance with the main body of this Privacy Policy. In addition, we collect and process your personal data, including personal information and sensitive personal information, for the purposes and on the legal basis set out in Section 3 of the main body of this Privacy Policy.

13.2. Sharing and Disclosure of Personal Data

We may transfer and share your personal data with relevant recipients in the circumstances described in the main body of this Privacy Policy. We will require the data processors receiving your personal data to enter into a data processing agreement with us and to ensure that appropriate safeguards are implemented to protect the confidentiality of the personal data, prevent its use for unauthorized purposes, and ensure compliance with the requirements for personal information processing under applicable laws.

13.3. Data Subject Rights

Under the Republic Act 10173 Data Privacy Act of 2012, you are entitled to the following rights with respect to your personal data:

(1) Right to Access: Upon request, you have the right to reasonably access the following: the contents of your personal data that were processed; the sources from which your personal data were obtained; the names and addresses of the recipients of your personal data; the manner of processing; the reasons for disclosure of your personal data to recipients; information on automated processes; the date on which your personal data were last accessed and modified; and the name, identity, and address of the personal information controller.

(2) Right to Rectification: You have the right to dispute and request the correction of any inaccuracy or error in your personal data, unless the request is vexatious or unreasonable.

(3) Right to Object or Withdraw Consent: You have the right to object to the processing of your personal data, including processing for direct marketing, automated processing, or profiling. You also have the right to be informed of any changes to the processing of your personal data and to withdraw your consent accordingly.

(4) Right to Suspend, withdraw or order the blocking, removal or destruction: If you discover and have substantial proof that your personal data are incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes, or no longer necessary for the purposes for which they were collected, you have the right to suspend, withdraw, or order the blocking, removal, or destruction of your personal data from our filing system.

(5) Right to Damages: You have the right to be compensated for any damages sustained as a result of any inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data.

(6) Right to Data Portability: Where your personal data are processed by electronic means and in a structured and commonly used format, you have the right to obtain a copy of such data undergoing processing for further use.

(7) Right to Lodge a Complaint: If you believe that your privacy has been violated, or that a personal data breach has occurred, or that you have been affected by a violation of applicable laws or regulations, you may lodge a complaint with the National Privacy Commission.

If the data subject is deceased, incapacitated, or otherwise unable to exercise their rights as a data subject, the legal heirs and assigns of the data subject may invoke the data subject’s rights at any time.

When you exercise any of the above rights, we will verify your identity, assess your request, and respond within 30 working days, unless a longer period is permitted by law. In exceptional circumstances, we may refuse your request as permitted under applicable law, in which case we will inform you of the reasons for the refusal. If you have any questions about exercising any of these rights, please contact us using the contact details provided in this Supplement.

13.4. Protection of Minors’ Personal Data

13.5. Contact Us

We have appointed a Data Protection Officer. If you have any questions or comments regarding this Privacy Policy, or wish to exercise your data subject rights under the Republic Act 10173 Data Privacy Act of 2012, you may contact us at: +852 59518109.

14. Indonesia Supplement

This Supplement applies solely to citizens or residents located in Indonesia (“you”). This Supplement serves as an addendum to the main body of this Privacy Policy and is based on the Law Number 27 of 2022 concerning Personal Data Protection. In the event of any conflict between this Supplement and the main body of this Privacy Policy concerning the processing of personal data of users in the Indonesian, this Supplement shall prevail. The personal data controller is AHS DEVICE HONG KONG LIMITED.

14.1. Use of Personal Data

We collect and process your personal data for the purposes and on the legal basis set out in Section 3 of the main body of this Privacy Policy.

The provision of your personal data is voluntary. However, if you fail to provide such data, we may not be able to provide you with the relevant services, or it may result in us and/or you violating applicable laws and regulations.

14.2. Retention of Personal Data

We will retain and process your personal data for as long as necessary to provide the Services, until you cease to be our user, including when you no longer browse or use FoneSquare. After you cease using the Services, we may still retain your personal data for a period of 5 years (or longer, if required) as necessary to comply with legal obligations or for the establishment, exercise, or defense of legal claims. Upon expiry of such retention period, we will delete or anonymize your personal data.

14.3. Data Subject Rights

Under the Law Number 27 of 2022 concerning Personal Data Protection, you are entitled to the following rights with respect to your personal data:

(1) Right to Be Informed: You have the right to be informed of the legal basis for processing, the purposes of data use, and the accountability of the entity requesting the personal data, among other information.

(2) Right to Rectification: You have the right to request the completion, updating, or correction of your personal data.

(3) Right of Access: You have the right to request access to and obtain a copy of your personal data in accordance with the law, and to request that we provide you with records of the processing of your personal data.

(4) Right to Removal, Destruction, or Cessation of Processing: You have the right to request the cessation of processing, removal, or destruction of your personal data in accordance with the law.

(5) Right to Withdraw Consent: You have the right to withdraw the consent you have previously provided to us for the processing of your personal data. If you withdraw your consent, you may not be able to use certain features of the Services in certain circumstances.

(6) Right to Object to Automated Decision-Making: You have the right to object to decisions based solely on automated processing, including profiling, which produce legal effects or significantly affect the data subject.

(7) Right to Suspend or Restrict Processing: You have the right to request the suspension or restriction of the processing of your personal data in accordance with the purposes of such processing.

(8) Right to Damages: You have the right to file a lawsuit and claim compensation for unlawful or non-compliant processing of your personal data in accordance with the law.

(9) Right to Data Portability: You have the right to request your personal data in a structured, commonly used format or electronic system, and to require us to securely transmit such data to another data controller.

When you exercise any of the above rights, we will verify your identity, assess your request, and respond within 72 hours, unless a longer period is permitted by law. In exceptional circumstances, we may refuse your request as permitted under applicable law, in which case we will inform you of the reasons for the refusal. If you have any questions about exercising any of these rights, please contact us using the contact details provided in this Supplement.

14.4. Protection of Minors’ Personal Data

For the purposes of this Supplement, a minor as referred to in Section 10 of the main body of this Privacy Policy means any person under 21 years of age who is unmarried and under guardianship. If we become aware that such minor has provided us with their personal data, we may promptly delete the relevant personal data.

14.5. Contact Us

If you have any questions or comments regarding this Privacy Policy, or wish to exercise your data subject rights under the Law Number 27 of 2022 concerning Personal Data Protection, you may contact us at: +852 59518109.

15. Vietnam Supplement

This Supplement applies solely to citizens or residents located in Vietnam (“you”). This Supplement serves as an addendum to the main body of this Privacy Policy and is based on the Law on Personal Data Protection, Law No. 91/2025/QH15 of Vietnam. In the event of any conflict between this Supplement and the main body of this Privacy Policy concerning the processing of personal data of users in the Vietnam, this Supplement shall prevail. The personal data controller is AHS DEVICE HONG KONG LIMITED.

15.1. Data Subject Rights

Under the Law on Personal Data Protection, Law No. 91/2025/QH15 of Vietnam, you are entitled to the following rights with respect to your personal data:

(1) Right to Be Informed: You have the right to be informed of the processing activities relating to your personal data.

(2) Right to Consent or Not Consent, to Request Withdrawal of Consent, and to Restrict Processing: Where we process your personal data based on your consent, you have the right to withdraw your consent and request restriction of the processing; provided that the withdrawal of consent shall not affect the lawfulness of the collection, use, and disclosure of your personal data carried out on the basis of your prior consent.

(3) Right to Removal and to Object to Processing: You have the right to request the deletion, destruction, or anonymization of your personal data, and to object to the processing of your personal data, including processing for direct marketing or automated decision-making.

(4) Right to Provision of Data: You have the right to request that we provide your personal data to you or to other agencies, organizations, or individuals, unless otherwise provided by law.

(5) Right to Complaint, Denunciation, Lawsuit, Damages, and Request for Protection: You have the right, in accordance with the law, to lodge complaints, make denunciations, initiate lawsuits, and claim damages in respect of violations of the law, and to request competent authorities and relevant authorities, organizations and individuals involved in personal data processing to protect your personal data in accordance with the law.

When you exercise any of the above rights, we will verify your identity, assess your request, and respond to and carry out within the time limits prescribed by law. For example, requests for access and correction will be responded to within 2 working days and executed within 10 days. In exceptional circumstances, we may refuse your request as permitted under applicable law, in which case we will inform you of the reasons for the refusal. If you have any questions about exercising any of these rights, please contact us using the contact details provided in this Supplement.

15.2. Data Subject Obligations

As a data subject, you have the following obligations:

(1) To protect your own personal data;

(2) To respect and protect the personal data of others;

(3) To provide complete and accurate personal data when required by law, under contract, or when consenting to the processing of your personal data;

(4) To comply with the law on personal data protection and to participate in the prevention of and fight against violations of personal data.

15.3. Protection of Minors’ Personal Data

For the purposes of this Supplement, a minor as referred to in Section 10 of the main body of this Privacy Policy means any person under the age of 16 or under guardianship. If we become aware that such minor has provided us with their personal data, we may promptly delete the relevant personal data.

15.4. Contact Us

We have appointed a Data Protection Officer. If you have any questions or comments regarding this Privacy Policy, or wish to exercise your data subject rights under the Law on Personal Data Protection, Law No. 91/2025/QH15 of Vietnam, you may contact us at: +852 59518109.

16. Malaysia Supplement

This Supplement applies solely to citizens or residents located in Malaysia (“you”). For the avoidance of doubt, the main body of this Privacy Policy shall also serve as the personal data protection notice required under the Personal Data Protection Act 2010. The personal data controller is AHS DEVICE HONG KONG LIMITED.

16.1. Consequences of Failure to Provide Personal Data

16.2. Access and Correction

If you wish to access or correct your personal data, or to learn about our policies, procedures, and types of personal data we process, please contact us at: +852 59518109.

17. Thailand Supplement

This Supplement applies solely to citizens or residents located in Thailand (“you”). This Supplement serves as an addendum to the main body of this Privacy Policy and is based on the Personal Data Protection Act B.E. 2562 (2019) of Thailand. In the event of any conflict between this Supplement and the main body of this Privacy Policy concerning the processing of personal data of users in the Thailand, this Supplement shall prevail. The personal data controller is AHS DEVICE HONG KONG LIMITED.

17.1. Use of Personal Data

We collect and process your personal data for the purposes and on the legal basis set out in Section 3 of the main body of this Privacy Policy. The provision of your personal data is voluntary.

However, if you fail to provide such data, we may not be able to provide you with the relevant services, or it may result in us and/or you violating applicable laws and regulations.

17.2. Data Subject Rights

Under the Personal Data Protection Act B.E. 2562 (2019) of Thailand, you are entitled to the following rights with respect to your personal data:

(1) Right of Access: You have the right to access and obtain a copy of your personal data, or to request disclosure of the acquisition of your personal data obtained without your consent.

(2) Right to Data Portability: You have the right to request that your personal data be provided in a commonly used format readable or usable by automated tools or devices, and to use or disclose such data by automated means, as well as to transmit your personal data in such format to another data controller, unless otherwise provided by law.

(3) Right to Rectification: You have the right to request that we correct, modify, supplement, or update your personal data.

(4) Right to Withdraw Consent: Where we rely on your consent to process your personal data, you have the right to withdraw your consent at any time, unless restricted by law or a contract that benefits you; provided that the withdrawal of consent shall not affect the lawfulness of the collection, use, and disclosure of your personal data carried out on the basis of your prior consent.

(5) Right to Object: You have the right to object to the collection, use, or disclosure of your personal data, including processing for direct marketing purposes, following which we shall cease collecting, using, or disclosing the relevant personal data.

(6) Right to Removal: You have the right to request that we delete, destroy, or anonymize your personal data, unless otherwise provided by law.

(7) Right to Restrict Processing: You have the right to restrict our use of your personal data, unless otherwise provided by law.

(8) Right to Lodge a Complaint: You have the right to lodge a complaint regarding our violation or non-compliance with applicable laws and regulations.

When you exercise any of the above rights, we will verify your identity, assess your request, and respond within 30 days, unless a longer period is permitted by law. In exceptional circumstances, we may refuse your request as permitted under applicable law, in which case we will inform you of the reasons for the refusal. If you have any questions about exercising any of these rights, please contact us using the contact details provided in this Supplement.

17.3. Protection of Minors’ Personal Data

For the purposes of this Supplement, a minor as referred to in Section 10 of the main body of this Privacy Policy means a person under the age of 20 who has not been validly married. If we become aware that such minor has provided us with their personal data, we may promptly delete the relevant personal data.

17.4. Contact Us

If you have any questions or comments regarding this Privacy Policy, or wish to exercise your data subject rights under the Personal Data Protection Act B.E. 2562 (2019) of Thailand, you may contact us at:

AHS DEVICE HONG KONG LIMITED

Address: FLAT/RM 3221 32/F NO 1 HUNG TO ROAD KWUN TONG KL

E-mail: fonesquare@ahsdevice.com

Telephone number: +852 59518109

18. United Arab Emirates Supplement

This Supplement applies solely to citizens or residents (“you”) located in the United Arab Emirates (“UAE”). This Supplement serves as an addendum to the main body of this Privacy Policy and is based on the Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data. In the event of any conflict between this Supplement and the main body of this Privacy Policy concerning the processing of personal data of users in the UAE, this Supplement shall prevail. The personal data controller is AHS DEVICE HONG KONG LIMITED.

18.1. Data Subject Rights

Under the Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data, you are entitled to the following rights with respect to your personal data:

(1) Right to Be Informed: You have the right to request that we provide you with information regarding the processing of your personal data, including the types of data, purposes of processing, automated decision-making, data sharing, retention controls and standards, procedures for data subject rights requests, safeguards for cross-border processing, and the personal data breach incident handling mechanism.

(2) Right to Data Portability: Where we process your personal data by automated means based on your consent or for the performance of a contract, you have the right to request that such personal data be transmitted to another data controller in a structured and machine-readable format.

(3) Right to Rectification: You have the right to request the correction of inaccurate personal data concerning you.

(4) Right to Removal: You have the right to request the erasure of your personal data under the circumstances provided by law, unless otherwise stipulated by law.

(5) Right to Restriction of Processing: You have the right to request the restriction of processing of your personal data under the circumstances provided by law, unless otherwise stipulated by law.

(6) Right to Object: You have the right to object to, and to request the cessation of, the processing of your personal data under the circumstances provided by law, including processing for direct marketing and for statistical surveys that are not necessary for the public interest.

(7) Right to Object to Automated Decision-Making: You have the right to object to automated decision-making, particularly decisions that have legal consequences for you or otherwise significantly affect you, unless otherwise stipulated by law.

(8) Right to Lodge a Complaint: You have the right to lodge a complaint with the UAE Data Office regarding any processing that you believe violates applicable laws and regulations.

18.2. Protection of Minors’ Personal Data

18.3. Contact Us

If you have any questions or comments regarding this Privacy Policy, or wish to exercise your data subject rights under the Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data, you may contact us at: +852 59518109.

19. Saudi Arabia Supplement

This Supplement applies solely to citizens or residents located in Saudi Arabia (“you”). This Supplement serves as an addendum to the main body of this Privacy Policy and is based on the Personal Data Protection Law of Saudi Arabia. In the event of any conflict between this Supplement and the main body of this Privacy Policy concerning the processing of personal data of users in the Saudi Arabia, this Supplement shall prevail. The personal data controller is AHS DEVICE HONG KONG LIMITED.

19.1. Use of Personal Data

We collect and process your personal data for the purposes and on the legal basis set out in Section 3 of the main body of this Privacy Policy.

19.2. Data Subject Rights

Under the Personal Data Protection Law of Saudi Arabia, you are entitled to the following rights with respect to your personal data:

(1) Right to be informed;

(2) Right of access;

(3) Right to rectification or removal of personal data;

(4) Right to rectification of personal data;

(5) Right to restriction of processing;

(6) Right to data portability;

(7) Right to object to processing of personal data;

(8) Right to lodge a complaint: If you believe we have infringed upon your privacy rights, you have the right to lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA).

(9) Any other rights provided under applicable law (if any).

19.3. Protection of Minors’ Personal Data

19.4. Contact Us

If you have any questions or comments regarding this Privacy Policy, or wish to exercise your data subject rights under the Personal Data Protection Law of Saudi Arabia, you may contact us at: +852 59518109.