Privacy Policy of STARWAY FUTURE (HONG KONG) INTELLIGENT TECH LIMITED

Effective Date: February 1, 2026

Introduction

Welcome to use the Starway application. This Privacy Policy (hereinafter referred to as "this Policy") is formulated by STARWAY FUTURE (HONG KONG) INTELLIGENT TECH LIMITED (hereinafter referred to as "we", "us" or "our") in accordance with the GDPR (General Data Protection Regulation). It is designed to transparently explain how we collect, use, disclose and protect your personal information (including personal sensitive information) when you use our Starway mobile application (hereinafter referred to as "this Software") and the STARWAY-branded electric two-wheelers, smart wearable devices and other products (hereinafter referred to as "Devices") that are connected, managed and controlled through this Software, as well as your rights related to your personal information. Using this Software means that you agree to this Policy. We may modify this Policy in the future. If we do so, we will publish the revised policy on this Software.

What Information Do We Collect?

Personal data or personal information refers to any information about an individual from which the identity of that individual can be identified. We only use your information in a legal, transparent and fair manner, so as to provide you with safe, intelligent and personalized products and services.

2.1 Information You Provide Directly

• Account Information: The email address, username, password and profile picture you provide during registration.
• Device Binding Information: The serial number, device name, model and firmware version of the devices (such as electric assist bicycles, electric scooters, electric trolley cars, exoskeletons) you add.
• Personal Profile Information (Optional): The nickname, weight and height you fill in (used to optimize the calculation of sports data).
• Content Information: The sports and travel routes you create, the anti-theft geofences you set, the vehicle photos you take, and the riding records you share.

2.2 Information We Collect Automatically

• Device and Connection Data: To ensure core functions, we collect the pairing status between this Software and your devices, connection signal strength, battery level, motor operation status, error codes, and basic device diagnostic logs.
• Usage and Performance Data: We collect anonymized data about how you interact with the Software, such as the pages you visit, the buttons you click, the frequency of function usage, and device crash reports, to help us improve the user experience. These data will not identify your personal identity, but they can help us understand how people use our Software and enable us to enhance your experience on our Software.

2.3 Information We Collect Only With Your Explicit Separate Consent

• Location Data (Precise GPS, Sensitive Data): When you enable functions such as vehicle anti-theft, real-time tracking, riding records or navigation, we will continuously collect the precise location data of your device or mobile phone. This is necessary to realize anti-theft and core control functions. You can turn off the location permission of this Software in your mobile phone system settings, but this will cause the related functions to fail.
• Health and Biometric Data (Sensitive Data): When you want to use advanced functions such as "AI Intelligent Assist", we will, after obtaining your explicit and separate consent, read your heart rate, blood oxygen saturation and other data from Apple Health Kit or Google Fit. You can manage the permission of health data access in "Settings" at any time, and the switch controls whether to allow this Software to read health data for AI functions. We solemnly promise that such sensitive data will only be used for real-time calculation locally on your device, and will not be uploaded to our server for storage.

2.4 Information We Obtain From Third Parties

• If you use a third-party service such as Apple ID or Google Account to log in, we will receive the basic information necessary for the platform to verify your identity (such as unique identifier, email).
• If you authorize to connect Apple Health or Google Fit, we will receive the specific health data you choose to share.

How We Use Your Information

We only process your personal data when we have a legal basis, including:

• Performance of Contract (Providing Core Services): Use your account, device and location data to realize the functions you request, such as device binding, unlocking, control, status monitoring, anti-theft tracking and firmware upgrade.
• Compliance with Legal Obligations: Assist law enforcement agencies or respond to legal procedures when necessary.
• Legitimate Interests: After balancing your rights and freedoms, use anonymized usage data for product analysis, security protection (such as anti-fraud, anti-theft) and performance improvement.
• Your Explicit Consent: For processing location data to enable vehicle anti-theft, real-time tracking, riding records or navigation functions, we will base on your freely given, clear consent that can be switched on and off at any time.
• Function Optimization: Understand your usage of the Software and devices and your interests to improve our services.

Data Sharing and Disclosure

We will never sell your personal data. We only share data under the following limited circumstances:

• Service Providers: We cooperate with trusted third parties (such as cloud hosting service provider AWS, data analysis tools, customer support platforms) to provide, support and improve this Software and services. They are supervised by data processor agreements signed with these companies, and must comply with the contractual and technical requirements of protecting personal data and prohibiting them from using personal data for purposes other than providing services to us or as required by law. This means that they cannot do anything with your personal information unless we instruct them to do so. They will not share your personal information with any organization other than us or other sub-processors that must comply with our data processor agreement. They will keep your personal information securely and retain it within the period we instruct.
• Laws and Security: We may share personal data when necessary to: (1) Comply with laws, regulations, law enforcement requirements, or respond to, investigate or participate in valid legal procedures and litigation (including procedures from law enforcement agencies or government agencies); (2) Protect the rights, property and safety of our company and users; (3) Enforce or investigate behaviors that may violate the End User License Agreement or policies; (4) Detect, prevent or investigate potential fraud, abuse or security issues (including threats to the public); (5) Resolve disputes and execute agreements.
• Business Restructuring: In the event of merger, acquisition, asset sale or other change of control, your data may be transferred. We will ensure that the transferee continues to comply with this Policy.

International Data Transfers

The operation scope of this Software covers the whole world, which means that personal data can be transmitted, stored and processed outside the country or region where it was originally collected, as long as we or our service providers have users or devices there. Therefore, by using this Software and services or providing personal data for any of the above purposes, you acknowledge that your personal data may be transmitted or stored in Hong Kong, Europe, the United States, and other countries or regions outside the EEA and the United Kingdom. The data protection regulations of these countries or regions may be different from those of your country or region or have a relatively lower protection level. No matter where it is, we will process your personal data in accordance with this Policy, and take appropriate contractual or other measures to protect personal data in accordance with applicable laws. If the personal data of EEA or UK users is transmitted to a recipient in a country outside the EEA or the United Kingdom that is not recognized as having an adequate level of data protection, we will use safeguard mechanisms such as the Standard Contractual Clauses (SCCs) approved by the European Commission to ensure that data transmission complies with the requirements of the GDPR.

Data Security

We adopt industry-standard technical and organizational measures (such as encryption, access control, security audit) to protect your data from unauthorized access, disclosure or destruction. We impose strict contractual confidentiality obligations on our employees and contractors who can access your data.

Data Retention

We only retain your personal data for the period necessary to achieve the purposes stated in this Policy, or for the period necessary to comply with legal obligations. When the data is no longer needed, we will securely delete or anonymize it. You can actively delete riding records or unbind devices within this Software. The criteria we use to determine our retention periods are as follows:

• The period during which we maintain contact with you and provide this Software and services to you (for example, the time when you have an account of this Software or continue to use this Software);
• Whether the account owner modifies the information or the user deletes the information through their account;
• Whether we have a legal obligation to retain the data (for example, some laws require us to retain your transaction records for a certain period before deletion); or
• From our legal standpoint, whether retaining the data is beneficial to us (for example, related to the execution of our agreements, dispute resolution, applicable statute of limitations, litigation or regulatory investigations).

Your Rights and Choices

Your data is important and protected by law. In accordance with the GDPR, you have the following rights:

• Right of Access and Portability: Obtain a copy of your personal data.
• Right to Rectification: Update inaccurate information. You also have the right to request us to complete the information that you consider incomplete.
• Right to Erasure: Request the deletion of your data (subject to legal retention obligations).
• Right to Restriction and Objection: Restrict or object to specific processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw your consent to health data processing at any time, which will not affect the processing before the withdrawal. To exercise your legal rights, please contact us via [email@starwayfuture-tech.com]. We will respond within the legal time limit (usually 30 days). To ensure security, we may need to verify your identity. To the extent permitted by law, we may refuse to process requests that are improperly repetitive or illogical, involve unreasonable technical work, or endanger the privacy of others.

Children's Privacy

Our services are not directed at children under the age of 13 (or a higher age specified in jurisdictions such as the EEA/UK). If we find that we have collected children's data, we will delete it immediately.

Changes to This Policy

We may update this Policy to reflect business or legal changes. In case of major changes, we will publish a notice within this Software and update the effective date at the top.

Contact Us

If you have any questions, requests or complaints about this Policy or your data, please contact:

Data Protection Officer
STARWAY FUTURE (HONG KONG) INTELLIGENT TECH LIMITED
FLAT/RM A 12/F ZJ 300 300 LOCKHART RD WAN CHAI HONG KONG
E-mail: [email@starwayfuture-tech.com]
EU users can also file a complaint with the local data protection authority.