oro

Please read this Privacy Policy and Our Terms of Use carefully before submitting any Personal Data or other information to Us. This Privacy Policy should be read in conjunction with Our Terms of Use and any other notices or consents provided to You at the point of data collection. By providing Your express consent, You acknowledge and agree that Your Personal Data may be received, collected, transferred, used, disclosed, and/or otherwise processed by Us in accordance with this Privacy Policy.

PRIVACY POLICY

Last Updated: 19 June 2025

This Privacy Policy ("Privacy Policy") sets out the manner and legal basis on which ORO Labs Pte. Ltd., a company incorporated under the Applicable Laws of Singapore (referred to as "ORO Labs", "We", "Us", or "Our"), including its affiliates and associated entities (unless the context otherwise requires), collects, uses, discloses, processes, and protects Personal Data in accordance with the PDPA and all other applicable data protection laws.

This Privacy Policy applies to all Personal Data provided to or collected by ORO Labs in connection with Your access to or use of Our website https://orogold.app, including all subdomains, web pages, applications, and content made available by ORO Labs (the "Platform"), except for any specific components that directly facilitate, or are intended to facilitate, regulated financial services or trading activities (“Trading Components”), which are operated solely by independent Third-Party Service Providers and governed by their respective policies.

ORO Labs operates solely as a technology interface provider and does not engage in any activity regulated under Singapore law, including but not limited to the issuance, custody, brokerage, or trading of digital assets. Accordingly, this Privacy Policy governs only Our collection and processing of personal data as a technology provider and does not extend to any third-party services accessible via the Platform, including services offered through the Trading Components. Users are advised to review the privacy practices of any Third-Party Service Providers they engage with through or outside the Platform.

By accessing or using the Platform, submitting any personal data to Us, or otherwise interacting with ORO Labs, You acknowledge that You have read, understood, and agree to the terms of this Privacy Policy. If You do not agree with this Privacy Policy or any part thereof, You must immediately discontinue use of the Platform and refrain from providing any personal data to Us.

1. GENERAL

1.1 Definitions

(a) "$GOLD" refers to the proprietary token issued by independent Third-Party Service Providers, representing a digital form of gold ownership and backed by physical gold. Its issuance, management, and operation are conducted in accordance with applicable legal and regulatory frameworks by the Third-Party Service Providers.

(b) "AML/CFT" means applicable anti-money laundering and counter-terrorist financing laws, regulations, and guidelines.

(c) "Applicable Law" means any statute, law, regulation, rule, ordinance, code, directive, decree, judgement, order, policy, guideline, or other legal requirement issued by any governmental, regulatory, judicial, or statutory authority, including any amendments, re-enactments, or replacements thereof, that are applicable to the subject matter of this Privacy Policy.

(d) "Cookies" refer to small data files placed on Your device when You access or use the Platform. They allow Us and selected third parties to recognise Your browser or device and gather information about Your preferences or past activity.

(e) "DPO" refers to a data protection officer who is responsible for ensuring that ORO Labs is compliant with the PDPA.

(f) "Intellectual Property" includes all ideas, concepts, creations, discoveries, inventions, improvements, know-how, trade secrets, proprietary techniques, methods, processes, systems, algorithms, works of authorship, research, software programs, databases, electronic codes, and other confidential or proprietary information. It also encompasses trademarks, service marks, designs, models, tools, devices, principles, formulas, teaching techniques, documents, records, user guides, and any other tangible or intangible assets, whether in written, electronic, or any other form, regardless of whether they are copyrightable, patentable, or otherwise legally protectable.

(g) "KYC" refers to the know-your-customer requirements and the process of verifying a User's identity in compliance with Applicable Laws and regulations.

(h) "ORO Labs," "We," "Us," or "Our" refers to ORO Labs Pte. Ltd. as defined in the introductory section of this Privacy Policy.

(i) "PDPA" means the Personal Data Protection Act 2012 of Singapore, including all subsidiary legislation, regulations, guidelines, advisory notes, and amendments thereto, as may be updated, supplemented, or replaced from time to time.

(j) "Personal Data" means any information, whether true or not, that can identify an individual:

i. on its own; or

ii. when combined with other information to which ORO Labs has or is likely to have access.

(k) "Platform" has the meaning assigned to it in the introductory section of this Privacy Policy.

(l) "Privacy Policy" refers to this privacy policy.

(m) "Services" refers to limited functionality and services provided directly by ORO Labs through the Platform, including user interface access, technical support, non-transactional features, and any related services made available by ORO Labs, as further described in the Terms of Use.

(n) "Terms of Use" refers to the Terms of Use available at orogold.app/terms-and-conditions.

(o) "Third-Party Service Providers" means independent entities, platforms, or service providers that offer services accessible through or referenced on the Platform, including but not limited to the issuance, trading, custody, redemption, or other facilitation of $GOLD and other digital assets. This includes, without limitation, token issuers, digital asset exchanges, custodians, payment processors, regulatory compliance providers, technology vendors, and marketing affiliates. Third-Party Service Providers operate independently of ORO Labs and are not owned, managed, or controlled by ORO Labs. All the respective services offered by these Third-Party Service Providers are subject to their independent terms and conditions.

(p) "Trading Component" has the meaning assigned to it in the introductory section of this Privacy Policy.

(q) "User," "You," or "Your" refers to any person who accesses the Platform or utilises the Services, whether as a registered or unregistered user.

1.2 Interpretations

(a) Headings and defined terms are for convenience only and do not affect the interpretation of these Terms.

(b) In these Terms, unless repugnant to the context:

i. The meaning of general words is not limited by specific examples introduced by "including," "for example," "such as," or similar expressions.

ii. The singular includes the plural and vice versa.

iii. All terms and conditions of these Terms, including introductory paragraphs, recitals, schedules, and any attached documents, are contractual, binding, and incorporated by reference.

iv. A reference to "person" includes an individual, corporation, partnership, association, limited liability company, joint venture, trust, unincorporated association, governmental entity, or other legal entity.

v. A reference to a particular person includes that person's executors, administrators, successors, permitted assigns, and legal representatives.

vi. A reference to any date or time is determined in accordance with the relevant jurisdiction applicable to these Terms.

vii. A reference to a day means a calendar day in Singapore or the relevant jurisdiction.

viii. A reference to a business day means a day, other than Saturday or Sunday, on which banks are open for general business in Singapore or the relevant jurisdiction.

ix. Any period of time calculated from a specific date or event excludes the starting date unless expressly stated otherwise.

x. If a person is required to take an action on or by a specific date and it occurs after 5:00 PM in the relevant jurisdiction, it will be considered performed on the next day.

xi. If the deadline for an action falls on a non-business day, the action must be performed on the next business day.

xii. The term "You" refers to You as an individual or, where applicable, the legal entity or third party on whose behalf You use the Services.

2. SCOPE

2.1 This Privacy Policy applies to all Personal Data collected, used, and disclosed by ORO Labs in connection with Your use of Our Platform in accordance with the PDPA and other applicable data protection laws in Singapore. It governs how We handle the Personal Data of Users who visit Our website or utilise Our Services.

2.2 This Privacy Policy applies to all Personal Data that ORO Labs collects, uses, discloses, processes, or stores in connection with:

(a) Your access to or use of the Platform and its associated Services;

(b) any interactions You have with ORO Labs, whether through the Platform, email, customer support, or other communication channels; and

(c) any Personal Data shared with or obtained by ORO Labs from Third-Party Service Providers, affiliates, or business partners in relation to the Platform and Services.

2.3 This Privacy Policy does not apply to:

(a) any third-party platforms, services, or websites linked to or referenced on the Platform, including those operated by Third-Party Service Providers. ORO shall take reasonable steps to ensure that all Third-Party Service Providers to whom it discloses any of Your Personal Data implement appropriate safeguards and comply with Applicable Laws for data protection. However, ORO shall not be responsible for any acts or omissions of such Third-Party Service Providers, who operate independently under their own privacy and data protection policies. Such third parties operate independently of ORO Labs and are governed by their own privacy policies and data practices;

(b) data that is anonymised or aggregated in a manner that no longer identifies an individual, from an individual data point or through a collection thereof; and

(c) any Personal Data collected by Third-Party Service Providers that use ORO Labs' Intellectual Property to facilitate their own services, as they are solely responsible for their own data processing activities.

2.4 This Privacy Policy supplements but does not replace any other consents You may have provided to Us regarding Your Personal Data.

2.5 We may amend this Privacy Policy from time to time. Any updates will be posted on Our Platform, and Your continued use of Our Platform and Services constitutes Your acceptance of the revised Privacy Policy.

3. COLLECTION OF PERSONAL DATA

3.1 Depending on Your interactions with Us, We may collect, use, and process various types of Personal Data, including but not limited to the following:

(a) Identity Data: Full name, nationality, country of residence, date of birth, gender, government-issued identification details (e.g., passport, national registration identity card, foreign identification number), and any other verification information required for compliance purposes, including KYC and AML/CFT obligations;

(b) Contact Data: Mailing address, email address, telephone number, Telegram username or Telegram ID, and other communication details;

(c) Financial and Transaction Data: Bank account details, digital asset wallet addresses, transaction history, and payment records related to the Platform, if any;

(d) Technical Data: Internet protocol address, device information, browser type, login credentials, time zone settings, and other data collected through Cookies or tracking technologies;

(e) Platform Usage Data: Interactions with the Platform, including project participation, transaction activity, and browsing behaviour;

(f) Marketing and Communication Preferences: Preferences regarding marketing communications, newsletters, surveys, and other correspondence from ORO Labs;

(g) Support and Correspondence Data: Information provided during interactions with Our support team, such as messages, documents, and troubleshooting requests; and

(h) Third-Party Data: Information obtained from service providers, business partners, regulatory authorities, or public sources for due diligence, fraud prevention, or compliance purposes.

3.2 We collect Personal Data through the following means:

(a) Directly from You: When You contact Us, create an account, submit KYC and AML/CFT verification documents, request support, or engage with the Platform;

(b) From Third Parties: Information from Third Party Service Providers, business partners, regulatory authorities, and publicly available sources such as government registries and industry databases; and

(c) Automatically: As further detailed in clause 14 (Cookies and Tracking Technologies), We may automatically collect technical and usage-related Personal Data when You access or use the Platform, including through Cookies, log files, and similar tracking technologies. This may include, without limitation:

i. Device and Browser Information: Internet protocol address, operating system, browser type, and time zone settings;

ii. Log Data: Login timestamps, access history, and session duration; and

iii. Interaction Data: Pages visited, links clicked, and navigation patterns.

3.3 Exclusions

(a) ORO Labs does not collect or process sensitive or special category Personal Data, such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health information, or sexual orientation, unless required by Applicable Law or with Your explicit consent.

(b) Any data that is fully anonymised or aggregated to the extent that it cannot be used, individually through a data point or through a collection thereof, to identify an individual is not considered Personal Data under this Privacy Policy.

3.4 Some Personal Data may be required to fulfil contractual or legal obligations. If You choose not to provide certain Personal Data, We may not be able to offer certain features or respond to specific requests.

4. PURPOSES OF PROCESSING PERSONAL DATA

4.1 We process Personal Data in accordance with Applicable Laws and only for purposes that are necessary, lawful, and relevant, including but not limited to:

(a) Service Delivery & Account Management: To provide, operate, and maintain the Platform, including:

i. Facilitating access to Platform features and Services;

ii. Processing transactions and verifying User identities; and

iii. Managing User accounts, preferences, and settings.

(b) Legal and Regulatory Compliance: To comply with Applicable Laws, regulatory obligations, and industry standards, including:

i. Conducting KYC and AML/CFT checks and fraud prevention;

ii. Responding to lawful requests from regulatory or government authorities; and

iii. Enforcing Our Terms of Use, Privacy Policy, and other agreements.

(c) Platform Security & Fraud Prevention: To detect, investigate, and mitigate security threats or suspicious activities, including:

i. Preventing unauthorised access, fraud, or cyber threats;

ii. Monitoring Platform usage for anomalies; and

iii. Ensuring compliance with applicable security standards.

(d) User Experience & Platform Optimisation: To improve Platform functionality and User experience, including:

i. Analysing customer cohorts, usage trends, customer preferences, market trends and customer interactions;

ii. Managing and responding to Your complaints, queries, requests, feedback and suggestions.

iii. Enhancing, improving and developing the Platform and Service performance, features, and security; and

iv. Troubleshooting and resolving technical issues.

(e) Marketing & Communications: To send marketing materials, or promotional offers, with Your consent, and Service related updates including:

i. Service-related updates, notifications, including through email and in-device notifications, and in-Platform notifications;

ii. Newsletters, product updates, or surveys;

iii. Invitations to events or engagement opportunities; and

iv. Customised marketing based on User preferences.

(f) Business Operations & Corporate Transactions: To support business continuity, including internal research, analytics, and reporting.

4.2 If We rely on Your consent for any processing activities, You may withdraw Your consent at any time by contacting Us. However, this will not affect the legality of processing carried out before consent was withdrawn.

4.3 We do not sell or share Your Personal Data with unaffiliated third parties for their direct marketing purposes without Your express consent.

4.4 In accordance with Applicable Law, We process Personal Data under one or more of the following lawful bases:

(a) Your consent, which You may withdraw at any time;

(b) Your deemed consent per Applicable Law;

(d) Our legitimate interests provided that such interests do not override Your fundamental rights and freedoms (as required under the Applicable Laws);

(e) where necessary to protect Your vital interests or those of another person; and

(f) Where processing is required for the establishment, exercise or defence of legal claims.

5. DISCLOSURE OF PERSONAL DATA

5.1 ORO Labs may disclose or share Your Personal Data with Third-Party Service Providers, partners, or other third parties to the extent necessary for the purposes set out in this Privacy Policy and as permitted under Applicable Laws. This includes supporting Our operations, products, Platform functionality, regulatory compliance, and service delivery.

5.2 Such disclosures may include (but are not limited to) Third-Party Service Providers that assist with:

(a) identity verification, KYC, and AML/CFT compliance;

(b) token-related services (including, without limitation, issuance, staking, swaps, redemptions, and sales of $GOLD);

(d) payment processing and transaction facilitation; and

(e) customer support, marketing, communications, and social media integrations.

5.3 These Third-Party Service Providers are granted access to Your Personal Data solely for the purpose of performing their designated services. ORO Labs shall require them to adhere to strict confidentiality obligations and implement appropriate data protection and security measures in compliance with Applicable Laws.

5.4 We may also disclose aggregated or anonymised data that does not directly or indirectly identify any individual. Such data may be shared with third parties for research, analytics, platform optimisation, security improvements, or similar business purposes.

5.5 The Platform may contain embedded tools, software, or links that connect You to external applications or services operated by Third-Party Service Providers. If You choose to interact with such third-party services—whether through a direct integration or by following a link—You acknowledge and agree that:

(a) any Personal Data provided to such third parties or collected by them is subject to their respective privacy policies and practices;

(b) ORO Labs does not control and disclaims all responsibility for the data collection, processing, security, and disclosure practices of any Third-Party Service Provider; and

5.6 To the fullest extent permitted by Applicable Law, ORO Labs shall not be liable for any loss, damage, unauthorised access, or misuse of Personal Data that occurs outside of Our systems or arises from the actions or omissions of any Third-Party Service Provider, except to the extent that such exclusion is prohibited by Applicable Law. We do not warrant the accuracy, security, or lawfulness of their practices and accept no responsibility for consequences resulting from Your direct disclosure of Personal Data to them.

5.7 We may disclose Your Personal Data to governmental agencies, regulatory authorities, courts, or law enforcement bodies where such disclosure is required:

(a) to comply with any Applicable Law or legal obligation;

(b) in response to a subpoena, court order, or legal process;

(d) to protect Our legal interests, rights, property, or safety, or those of others.

5.8 In the event of a merger, acquisition, reorganisation, sale of assets, or similar corporate transaction involving ORO Labs, Your Personal Data may be transferred to or accessed by the acquiring or successor entity as part of the transaction. We will ensure that any such transfer is handled in accordance with Applicable Law and, where feasible, subject to appropriate safeguards.

6. THIRD-PARTY PERSONAL DATA DISCLOSED BY USERS

6.1 If You provide ORO Labs with Personal Data relating to any third party (including but not limited to Your affiliates, employees, agents, or representatives), You represent and warrant that:

(a) You have obtained the third party’s express, informed consent to share their Personal Data with Us for the purposes outlined in this Privacy Policy;

(b) You have provided them with a copy of this Privacy Policy and explained its contents to them, ensuring that they understand and agree to how their Personal Data will be used; and

(c) they have explicitly consented to the collection, use, processing, transfer, and disclosure of their Personal Data as described herein.

6.2 You are solely responsible for ensuring that any third-party Personal Data provided to ORO Labs is complete, accurate, current, and not misleading. Failure to do so may result in delays, errors, or inability to provide Services, and may also constitute a breach of Applicable Law.

6.3 You agree to fully indemnify and hold harmless ORO Labs, its affiliates, officers, employees, and agents from and against any and all claims, liabilities, losses, damages, or expenses (including reasonable legal fees) arising from or in connection with:

(a) Your failure to obtain the necessary consent from the relevant third party; or

(b) any breach of this clause 6 or any violation of Applicable Law relating to the Personal Data of third parties provided by You.

7. CROSS-BORDER TRANSFER OF PERSONAL DATA

7.1 In the course of providing the Platform and related Services, ORO Labs may transfer, store, or otherwise process Your Personal Data in jurisdictions outside of Your country of residence, including but not limited to Singapore and other countries where Our Third-Party Service Providers, affiliates, or data centres are located. Where such cross-border transfers occur, We will take reasonable steps to ensure that Your Personal Data continues to be protected to a standard comparable to that under Applicable Law, including the PDPA.

7.2 Your Personal Data is currently stored and processed using infrastructure provided by Neon, a third-party database provider operating on Amazon Web Services (AWS) infrastructure located in the United States. By accessing or using the Platform, You acknowledge and consent to this cross-border storage and to any necessary transfers of Your Personal Data that support Platform operations, maintenance, and disaster recovery.

7.3 We implement appropriate safeguards to protect Personal Data transferred internationally. These safeguards may include:

(a) contractual clauses that require recipients to protect the data to standards equivalent to those under Applicable Law;

(b) technical and organisational measures; and

7.4 By using the Platform, You acknowledge and consent to the transfer of Your Personal Data to jurisdictions that may have different and potentially less protective data protection standards than those in Your home country. If You do not wish for Your Personal Data to be transferred in this manner, please refrain from using the Platform.

8. RETENTION OF PERSONAL DATA

8.1 ORO Labs will retain Your Personal Data for as long as is reasonably necessary to fulfil the purposes for which it was collected, as described in this Privacy Policy, or as otherwise required under Applicable Law. This may include retaining Personal Data for purposes such as tax, accounting, AML/CFT and KYC compliance, regulatory reporting, or complying with lawful requests from competent authorities.

8.2 Where relevant, Personal Data may also be retained for an extended period if it is reasonably necessary for the establishment, exercise, or defence of legal claims or in connection with any actual or potential investigation, litigation, or dispute involving ORO Labs.

8.3 Once Personal Data is no longer required for the purposes for which it was collected, and where there is no legal or business need to retain it, ORO Labs will take reasonable steps to:

(a) erase or securely destroy the data;

(b) anonymise the data irreversibly; or

(c) restrict access to the data and use it solely for legitimate purposes (e.g., audit, fraud prevention, or legal compliance) in accordance with Applicable Law.

9. DATA SECURITY AND PROTECTION MEASURES

9.1 ORO Labs is committed to safeguarding Your Personal Data and implements reasonable administrative, organisational, physical, and technical measures to protect it against unauthorised access, loss, misuse, disclosure, alteration, or destruction in accordance with the PDPA and other Applicable Laws. These measures are designed to be appropriate to the nature of the Personal Data and the risks associated with its processing.

9.2 Access to Personal Data is restricted to personnel who require access to perform their roles and are contractually bound to maintain the confidentiality, integrity, and security of such data. These individuals are required to process Your Personal Data strictly in accordance with this Privacy Policy and applicable data protection laws.

9.3 While ORO Labs takes reasonable steps to protect the security of Your Personal Data within Our systems, ORO Labs does not control and is not responsible for the data-protection practices of Neon, AWS, or any other third-party service providers engaged to store or process data on Our behalf.

9.4 While We take reasonable steps to protect the security and integrity of all Personal Data within Our control, You acknowledge and agree that no method of transmission over the internet, or method of electronic storage, is completely secure or risk-free. Accordingly, ORO Labs does not warrant or guarantee that Your Personal Data will be completely secure from unauthorised access, interception, loss, or misuse by third parties.

9.5 In the event of a Personal Data breach that is likely to result in a risk to Your rights or freedoms, ORO Labs will:

(a) notify the relevant data protection authority in accordance with Applicable Law, including within three (3) calendar days of becoming aware of the breach (or such other period as required under Applicable Law); and

(b) notify affected individuals within a reasonable time where required by Applicable Law.

9.6 To the fullest extent permitted by Applicable Law, ORO Labs disclaims any liability for unauthorised access, disclosure, loss, or corruption of Personal Data that occurs outside of Our reasonable control, including but not limited to incidents arising from cyber-attacks, system vulnerabilities, failure of Third-Party Service Providers, or other force majeure events.

10. YOUR RIGHTS

10.1 In accordance with the Applicable Laws and regulations, You may be entitled to:

(a) access and enquire about the processing of Your Personal Data and be provided with a copy of Your Personal Data in a structured, commonly used and machine readable format;

(b) request the correction of inaccurate or incomplete Personal Data that We hold and/or deletion of Your Personal Data;

(c) withdraw Your consent to the processing of Your Personal Data within Our possession or control (if the legal basis for such processing is based on Your consent);

(d) request receipt or transmission to another organisation in a machine-readable form, of the Personal Data that You have provided to Us where technically feasible;

(e) restrict to processing of the Personal Data where You;

i. contests the accuracy of the Personal Data;

ii. have reasons to believe the processing is unlawful, but You do not wish the data to be erased and request restriction instead; and

iii. require it for the establishment, exercise, or defence of legal claims, and We no longer need the Personal Data. The restriction will apply until We have taken steps to verify the accuracy of the Personal Data.

(f) object on grounds relating to Your particular situation to the processing of Your Personal Data where processing is based on Our legitimate interests. We will cease processing Your personal data unless We provide compelling legitimate grounds for the processing which override Your interests, rights and freedoms or for the establishment, exercise, or defence of legal claims; and

(g) request the erasure of Your Personal Data, subject to Applicable Law, when it is no longer necessary in relation to the purposes for which they were collected, used, disclosed and in cases where the processing was based on consent which has been withdrawn and there is no other legal basis for processing.

10.2 You may opt out of receiving marketing communications from Us at any time by using the “unsubscribe” option provided in Our emails. However, even if You opt out, We may still send You service-related messages necessary for the use of Our Platform or Services.

10.3 To ensure the security of Your Personal Data, We may require You to provide specific information to verify Your identity before processing any privacy-related requests.

10.4 Due to Our limited role in processing Personal Data (as described in the Terms of Use), the extent to which We may assist You in exercising these rights may be subject to certain technical or legal limitations. We will respond to all legitimate requests within one (1) month. If Your request is complex or if multiple requests have been made, We may require additional time and will notify You accordingly.

11. PERSONS UNDER EIGHTEEN

11.1 Our Platform and Services are not intended for individuals under the age of eighteen (18). We do not knowingly collect Personal Data from individuals under eighteen (18) years old. If We become aware that We have inadvertently collected such information, We will take appropriate steps to delete it. If You believe that We may have mistakenly or unintentionally collected Personal Data from an individual under eighteen (18), please contact Us immediately.

12. CONTACTING ORO LABS

12.1 If You have any questions regarding this Privacy Policy, concerns about Our data practices, or wish to exercise any rights outlined in this Privacy Policy, You may contact our Data Protection Officer at:

(a) Email: support@orogold.app

12.2 To assist Us in processing Your request efficiently, You should provide sufficient details about Your inquiry, including any supporting evidence or relevant information. We will treat all requests and complaints confidentially. Our team will serve as the first point of contact for all privacy-related matters and will ensure compliance with Our data protection obligations.

12.3 We are committed to addressing any concerns or complaints related to the collection, use, disclosure, or processing of Personal Data. We have established a process for receiving, investigating, and responding to such complaints in a timely and appropriate manner.

12.4 If You wish to raise a concern or lodge a complaint regarding Our data protection practices or compliance with this Privacy Policy or Applicable Law, please contact Our Data Protection Officer using the details provided in Clause 12.1. We will acknowledge receipt of Your complaint and aim to provide a substantive response within a reasonable period, typically within thirty (30) calendar days.

12.5 If additional information is required, We will reach out to You. Upon reaching a determination, We will notify You in writing, which may include electronic communication via email.

12.6 If You are unsatisfied with Our response, You may also have the right to escalate the matter to the Personal Data Protection Commission of Singapore or the relevant supervisory authority in Your jurisdiction.

13. STAFF AWARENESS AND INTERNAL COMMUNICATION

13.1 We ensured that Our employees and relevant personnel are made aware of and provided with access to the Our data protection policies and practices. All staff handling Personal Data receive periodic training and updates regarding their obligations under Applicable Law and this Privacy Policy.

13.2 Internal procedures, including policies on access control, data minimisation, retention, and complaint handling, are documented and communicated to all relevant staff to support consistent and compliant Personal Data handling practices.

14. CHANGES TO THIS PRIVACY POLICY

14.1 By using the Platform, You acknowledge and agree that We may update this Privacy Policy at Our sole discretion from time to time. We may notify You of significant changes by:

(a) sending a notice to the primary email address provided to Us;

(b) placing a prominent notice on Our Platform; and/or

14.2 Changes will take effect upon publication. Your continued use of Our Platform and Services after the effective date constitutes:

(a) acknowledgment of the updated Privacy Policy; and

(b) agreement to be bound by its terms.

15. COOKIES AND TRACKING TECHNOLOGIES

15.1 ORO Labs may use Cookies and similar tracking technologies (such as web beacons, pixels, and local storage) on the Platform to improve functionality, analyse usage patterns, enhance security, and deliver personalised content.

15.2 We use the following types of Cookies:

(a) Strictly Necessary Cookies: Essential for the operation of the Platform, including secure login, fraud prevention, and system administration. These cannot be disabled in Our systems.

(b) Performance and Analytics Cookies: Assists Us in understanding how You interact with the Platform, identify errors, and improve overall functionality.

(d) Targeting or Advertising Cookies: Used by Us or authorised third parties to deliver relevant advertisements based on Your browsing activity across the Platform or other sites.

15.3 Where required under Applicable Law, We obtain Your explicit consent before placing non-essential Cookies on Your device. Upon Your first visit to the Platform, You will be presented with a Cookie banner that allows You to:

(a) accept all Cookies;

(b) reject all non-essential Cookies; or

15.4 You may also manage Your Cookie preferences at any time by adjusting Your browser settings or using the Cookie management tools provided on Our Platform. Please note that disabling certain Cookies may affect the availability or functionality of some features of the Platform.

15.5 We may permit selected Third-Party Service Providers to use Cookies or similar technologies on the Platform for analytics, advertising, and User support. If You choose to interact with these third parties, their use of Your data will be governed by their own privacy and cookie policies. You are responsible for reviewing those policies before engaging with them, and ORO Labs disclaims any responsibility for third-party data practices.

15.6 The information collected through Cookies and similar technologies may constitute Personal Data and will be processed in accordance with this Privacy Policy and Applicable Law, provided Your selection, save Strictly Necessary Cookies, You expressly consent the use of Cookies as made available in this Privacy Policy.

16. JURISDICTION-SPECIFIC PROVISIONS – RESIDENTS OF THE EEA AND THE UNITED KINGDOM

16.1 Through the Platform, we make certain interface-only Services available to users throughout the world. ORO Labs Pte. Ltd. is incorporated in Singapore and is therefore primarily regulated by the Personal Data Protection Act 2012. In addition, because we may process Personal Data of individuals located inside the European Economic Area (“EEA”) or the United Kingdom, we comply, only to the extent legally required, with Regulation (EU) 2016/679 and the UK General Data Protection Regulation (together, “GDPR”).

16.2 The purpose of the following information is to provide you with a concise explanation, in accordance with Articles 13 and 14 GDPR, of how we intend to process your Personal Data when the GDPR applies. If the GDPR is not directly applicable to you, this clause does not extend any additional rights or obligations. Should you require further clarification, or wish to exercise any right, please contact our DPO.

16.3 We recognise the below rights which you enjoy under the applicable data protection law with respect to your personal data:

(a) Right to be informed: You have the right to be informed about the collection and use of your Personal Data. This information is set out in the terms of our Privacy Policy.

(b) Right of access: You may request information from us at any time as to whether we have stored your Personal Data and which Personal Data we have stored. We are required to provide this information to you free of charge.

(c) Right to rectification: If your Personal Data stored by us is inaccurate or incomplete, you have the right to demand at any time that we correct the information.

(d) Right to erasure: You have the right to demand that we erase your Personal Data if and to the extent that the data is no longer needed for the purposes for which it was collected or if the data is processed on the basis of your consent and you have revoked that consent. In such cases, we must cease processing your Personal Data and remove that data from our IT systems and databases. You do not have a right to erasure if:

i. the data may not be deleted due to a statutory obligation or must be processed due to a statutory obligation; or

ii. the processing of data is necessary for the establishment, exercise or defence of legal claims.

(e) Right to restriction of processing: You have the right to demand that we restrict the processing of your Personal Data.

(f) Right to data portability: You have the right to receive the Personal Data that you have provided to us in a structured, commonly used and machine-readable format. You also have the right to request that we transmit this data to another controller, where technically feasible. This right applies only if the processing is based on your consent or a contract and is carried out by automated means.

(g) Right in relation to automated decision-making and profiling: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This right does not apply if the decision is needed for a contract with us, is required by law, or is based on your consent.

(h) Right to object to processing: If your data is processed by us on the basis of Article 6(1)(f) GDPR, you may object at any time to processing by us. You may assert any of the rights described above by addressing your specific request to our DPO.

(i) Right to lodge a complaint with a supervisory authority: Pursuant to Article 77 GDPR, you have the right to lodge a complaint with a data-protection supervisory authority if you believe that the processing of your Personal Data infringes data-protection law.

17. JURISDICTION-SPECIFIC PROVISIONS – RESIDENTS IN AMERICAN STATES WITH PRIVACY-RELATED CONSUMER PROTECTION LAWS

This Supplemental Privacy Policy applies to you only if you are a natural person and you are a resident of any state in the United States with a privacy-related consumer-protection law. This Supplemental Privacy Policy is incorporated into and forms part of the ORO Labs Privacy Policy.

Please note that the rules implementing some of these laws have not yet been finalised. We are continuously working to better comply with these laws, and we will update our processes, disclosures and this notice as these implementing rules are finalised.

This Supplemental Privacy Policy provides supplemental notices that are unique to the US states referenced above.

17.1 Categories of Personal Information We Collect, and How We Use and Share that Information.

The Personal Information we may collect, use and share over the next 12 months is set out above in this Privacy Policy.

17.2 Manage Cookie.

Global Privacy Control (“GPC”) is a setting you can enable in your web browser to communicate your privacy preference for not having certain information about your webpage visits collected across websites. For all the details, including how to turn on GPC, visit https://globalprivacycontrol.org/.

17.3 Sharing of Personal Information.

We have allowed third-party ad providers to collect Personal Information from visitors to certain Platform pages (for example, our websites) for the purposes of advertising and analytics. This practice may constitute the “sharing” of Personal Information. To the extent that our practices constitute the sharing of your Personal Information, you have the right to opt out of such sharing with the third parties identified in this Privacy Policy by contacting us using the details in Section 12 (Contacting ORO Labs). You can also opt out by enabling Global Privacy Control (mentioned above).

17.4 We Do Not Sell Your Personal Information.

You have the right to know whether your Personal Information is being sold. ORO Labs does not sell your Personal Information. Your Personal Information is “sold” when it is provided to a third party for monetary or other valuable consideration for a purpose that is not a “business purpose” under the CCPA or other U.S. state data-privacy laws. A “sale” does not include when we disclose your Personal Information at your direction or when otherwise permitted by law.

17.5 Right to Opt-out of Sharing

(a) We do not sell your Personal Information, so we do not offer an opt-out for sales. We may “share” Personal Information with third parties for personalised advertising as described above. You may indicate your choice to opt out of the sharing of your Personal Information with third parties for personalised advertising on third-party sites by contacting us as described in Section 12 (Contacting ORO Labs) or by enabling Global Privacy Control.

(b) Even if you turn off “sharing”, you may still see personalised ads based on information other companies and ad networks have collected about you if you have not opted out with them.

17.6 Non-Discrimination.

U.S. state privacy laws prohibit businesses from discriminating against you for exercising your rights under the law. Discrimination may include denying services, providing a different level or quality of service, or charging different prices. ORO Labs does not discriminate.

Contact Information

For any inquiries regarding this Privacy Policy, please contact ORO Labs at support@orogold.app