LOVENSE EU DATA ACT STATEMENT

1. Introduction

This EU Data Act Statement ("Statement") is provided in accordance with Regulation (EU) 2023/2854 (the "EU Data Act"). It describes the data that the connected products identified above (the "Connected Products") and the Lovense Apps generate, and how you can access, share and delete it.

This Statement covers only data within the scope of the EU Data Act. For information about our processing of personal data, please refer to our Privacy Policy: https://www.lovense.com/privacy-policy.

Lovense products and services are intended solely for adults. Persons under 18 years of age are not permitted to use them.

2. Data Holder Information

3. Connected Products and Related Services

Under the EU Data Act, a "connected product" is an item that obtains, generates or collects data concerning its use or environment and is able to communicate that data, and whose primary function is not the storing, processing or transmission of data on behalf of anyone other than the user. Our Connected Products are Bluetooth-enabled Lovense products, including vibrators, masturbators and sex machines. The related service is the Lovense Apps, through which the products are controlled.

The Connected Products operate in two modes:

• Standalone mode - used independently, with no connection to the Lovense Apps. No data is generated for storage or transmitted to Lovense servers.
• Connected mode - used with the Lovense Apps. Limited operational data is processed as described in Section 4.

No data is generated or transmitted when the product is powered off or in standby mode.

The Connected Product communicates with the Lovense Apps over Bluetooth Low Energy (BLE) using a proprietary secure protocol. The Lovense Apps communicate with Lovense servers over HTTPS-encrypted format.

4. Data Generated by the Connected Products and the Lovense Apps

The Lovense Connected Product has no persistent storage. Depending on the function, data may be processed only temporarily, stored on the user's mobile device, or transmitted to and stored on Lovense servers. Not all data below is generated by every product or in every use scenario, and what is generated may vary with the product model, firmware version, features used and connection status.

Where a row states "Not stored", the data exists only transiently for the duration of the operation. Log data is retained under the Lovense log retention policy.

5. Purposes of Data Use

We use this data only to:

• operate and control the product according to the user's instructions;
• provide customer support and diagnostics;
• maintain, secure and improve the products; and
• comply with applicable legal obligations.

We do not use readily available data other than on the basis of a contract with the user, and we do not use non-personal data to derive insights about the user's economic situation, assets or production methods (Article 4(13)).

6. Storage, Retention and Security

Data is stored on the user's own device or on secure servers operated by Lovense, as set out in Section 4. It is retained only as long as necessary for the applicable purpose or as required by law, and is then securely deleted or anonymised.

We protect data through:

• SSL/TLS encryption in transit and AES-256 encryption at rest;
• BLE security standards and a proprietary secure protocol for Bluetooth communications;
• least-privilege access control; and
• regular security reviews, vulnerability assessments and penetration testing, etc.

7. Your Rights and How to Exercise Them

Under the EU Data Act you may:

• Access - You may request access to the data generated through your use of the Connected Products and the Lovense Apps. To submit a request, please contact [email protected].
• Port - You may request that such data be made available to a third party of your choice.
• Delete - You may clear locally stored data from your device yourself, or request deletion of data stored on our servers by contacting [email protected].
• Complaint - You have the right to lodge a complaint alleging an infringement of Chapter II of the EU Data Act with the competent authority designated pursuant to Article 37 of the EU Data Act.

We provide data without undue delay and free of charge, in a structured, commonly used and machine-readable format and, where relevant and technically feasible, continuously and in real time, consistent with the interoperability requirements of Article 33. Requests are subject to identity verification and to applicable legal, security and retention requirements. Exercising these rights does not affect the availability or quality of Lovense products or services.

8. Data Sharing and Requests for Data

We do not share data generated by the Connected Products or the Lovense Apps with any third party, except:

• Third parties (B2B) - only where the user has actively and expressly requested or instructed us to make specific data available under Article 5. Where personal data is involved, any sharing will also be subject to the applicable data protection requirements, including any required consent or other lawful basis. The arrangement will specify purpose limitation, confidentiality, security measures and a prohibition on misuse (Articles 5 and 6).
• Public sector bodies (B2G) - where a Union or Member State body demonstrates an exceptional need under Chapter V (Articles 14 to 22), such as a public emergency. Requests must be in writing, specific, proportionate and data-minimised.
• Where required by law, by a regulatory authority or by court order.

Requests may be submitted to [email protected] and are subject to authentication and verification.

9. Developer Resources

The following API and SDK resources are available:

• API - https://developer.lovense.com/docs/standard-solutions.html#standard-api ;
• SDK - https://developer.lovense.com/docs/standard-solutions/standard-js-sdk.html

10. Data Use Restrictions and Prohibited Purposes

Unless expressly authorised by Lovense in writing or required by law, data made available under this Statement must not be used to:

• develop a connected product competing with a Lovense product, or be shared with a third party for that purpose;
• reverse engineer the product, its firmware or algorithms, or the Lovense Apps;
• derive insights about Lovense's economic situation, assets or production methods;
• profile natural persons or conduct targeted advertising, unless strictly necessary for the service the user requested; or
• coerce, deceive or manipulate the user.

Any breach may result in the suspension or revocation of access and in legal consequences.

11. Contact and Data Request Channel

Email: [email protected]

Website: https://www.lovense.com/contact

12. Statement Updates

We may update this Statement to reflect applicable legal requirements, product changes and business needs. The effective date shown above indicates the current version. Material updates will be announced through the Lovense Apps or our official website.