Data Privacy Policy

A. ABOUT THIS POLICY

SightGlass Vision Inc and our subsidiaries (“We/our”) respect your privacy and commit to protecting it through our compliance with the practices described below.

This Data Privacy Policy ( “Policy”) describes our practices for collecting, using, maintaining, protecting, and disclosing the personal data we may collect from you or that you may provide when you visit our website (www.sightglassvision.com) or other digital communications that link or refer to this Policy (our “Website”). This Policy applies to personal data collected through our Website regardless of the country where you are located.

The Website may include links to third-party websites, plug-ins, services, social networks, or applications. Clicking on those links or enabling those connections may allow the third party to collect or process data about you. We do not control these third-party websites and we encourage you to read the privacy policy of every website you visit.

Please read this Policy carefully to understand our practices for processing and storing your personal data. By engaging with our Website, you accept and consent to the practices described in this Policy.

B. WHO IS RESPONSIBLE FOR YOUR DATA?

SightGlass Vision Inc. (head office at: 13555 N. Stemmons Fwy, RM342, Dallas, TX 75234 USA) is the data controller of your personal data.

We can be contacted by email at: contact@sightglassvision.com or by post using the address set out above.

C. DATA WE MAY COLLECT ABOUT YOU

We may collect and use different types of data from and about you including:

• Personal data that we could reasonably use to directly or indirectly identify you, such as your first and last name, email address, and telephone number, or other similar identifier (“personal data“).

• Non-personal data that does not directly or indirectly reveal your identity or directly relate to an identified individual, such as demographic information, statistics, or aggregated information. Statistical or aggregated data does not directly identify a specific person, but we may derive non-personal statistical or aggregated data from personal data. For example, we may aggregate personal data to calculate the percentage of users accessing a specific Website feature.

• Technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, your browser type and version, time zone setting, browser plug-in types and versions, or operating system and platform.

• Non-personal details about your Website interactions, including the full Uniform Resource Locators (URLs), clickstream information to, through, and from ourWebsite (including date and time), products viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), or methods used to browse away from the page.

If we combine or connect non-personal, demographic, or technical data with personal data so that it directly or indirectly identifies an individual, we treat the combined information as personal data.

D. HOW WE COLLECT DATA ABOUT YOU

• Direct interactions. You may give us information about you by filling in the contact form or by corresponding with us by email, or interacting with third party tools available on our Website (such as the ‘Vision Simulator’), or otherwise.

• Automated technologies or interactions.

We collect information about Website usage through cookies (see the section on Cookies below) and server logs, which track the IP addresses of users visiting our Website and the pages they visit. Information collected via the our server logs includes users’ IP addresses and the web pages visited. We also use Matomoanalytics, a web analytics service provided by Innocraft Ltd. to understand how visitors engage with our Website and so We can improve it.

• Cookies. Our Website uses cookies (small files placed on your device) to distinguish you from other Website users. This helps us deliver a better and more personalized service when you browse our Website. Please refer to our Cookie Policy which is available via the Cookie Settings – Manage my Cookie Preferences, for further information about the cookies used on the Website.

E. HOW WE USE YOUR PERSONAL DATA

We use your personal data to communicate with you, or to conduct other business operations, such as using data to improve and personalize your experiences. Examples of how we may use the personal data we collect include to:

• Provide you with the information and support you have requested.

• Meet our obligations and enforce our rights arising from any contracts with you, or comply with legal requirements.

• Fulfil the purposes for which you provided the data or that were described when it was collected.

• Ensure that we present our Website content in the most effective manner for you and for your computer.

• Manage our Website and troubleshoot any problems.

• Improve our Website, products, marketing, or customer relationships and experiences.

Vision Simulator tool

You may use the vision simulator tool on our Website. If you wish to do so you will be prompted to enter a name, age, sex and rx relating to the individual for whom you wish to see a personalised myopia simulation. This data is only requested and used for personalization and myopia simulation purposes. The name you submit will not be stored or used for any other reason and will be deleted from the system once the simulation has been produced. The other information you provide will be stored by our service provider Ocumetra Ltd in an anonymised form and will only be used to monitor or enhance the functionality of the tool.

We may use non-personal or aggregate data for any business purpose.

F. HOW AND WHEN DO WE SHARE PERSONAL DATA WITH THIRD PARTIES?

We may share your personal data with:

• Any member of our corporate group, which means our subsidiaries, our ultimate holding company and its subsidiaries, and our affiliates.

• Business partners, suppliers, service providers (e.g. hosting and maintenance service providers), sub-contractors, and other third parties we use to support our business (such as analytics providers that assist us with Website improvement and optimization). We use the analytics provider Matomo.

• To fulfil the purpose for which you provide it.

• For any other purposes that we disclose in writing when you provide the data.

• With your consent.

We may also share your personal data:

• If we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.

• To a buyer or other successor in the event of merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, where one of the transferred assets is the personal data we hold.

• To comply with any court order, law, or legal process, including responding to any government or regulatory request.

• To enforce or apply our Website terms of use and other agreements.

• To protect the rights, property, or safety of our business, our employees, our customers, or others. This includes exchanging information with other companies and organizations for the purposes of cybersecurity, fraud protection, and credit risk reduction.

We may share non-personal data without restriction.

G. INTERNATIONAL TRANSFERS OF PERSONAL DATA

Our Website is hosted in Ireland. We may process, store, and transfer the personal data we collect, in and to a country outside your own and/or outside of Ireland, with differentprivacy laws.

For example, We may share your personal data within the our group of companies. This will involve transferring your data outside the EEA.

Some of our external third parties (e.g. service providers) may be based outside the EEA so their processing of your personal data will involve a transfer of data outside the EEA. Whenever we transfer your personal data out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data.

• Where we use certain service providers, we may use specific contracts approved for use in the EEA which give personal data the same protection it has in the EEA.

By submitting your personal data or engaging with our Websites, you consent to this transfer, storing, or processing.

You can request further details about the safeguards that we implement by contacting us at: contact@sightglassvision.com.

H. HOW LONG DO WE STORE PERSONAL DATA?

It is our policy to retain your personal data for the length of time required for the specific purpose or purposes for which it was collected (e.g., for the fulfilment of an agreement with you). However, we may be obliged to store some personal data for a longer time, taking into account factors including:

• legal obligation(s) under applicable law to retain data for a certain period of time (e.g. compliance with tax and accountancy requirements);

• the establishment, exercise or defence of legal claims (e.g., for the purposes of a potential dispute).

In some circumstances you can ask us to delete your personal data: see Section J(Your Rights) below for further information.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

If you would like to find out how long we keep your personal data for a particular purpose, you can contact us at: contact@sightglassvision.com.

I. HOW DO WE PROTECT YOUR PERSONAL DATA?

We have put in place appropriate technical and organisational security measures to protect your personal data against the risk of loss, misuse, or unauthorised alteration or destruction. Such measures may include the use of firewalls, encryption (where appropriate), access rights limits and management processes, careful selection of processors and other technically and commercially reasonable measures to provide appropriate protection for your Personal Data. Where appropriate, we may also make backup copies and use other such means to prevent accidental damage to or destruction of your Personal Data. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

J. YOUR RIGHTS

The following section explains your data protection rights that you can exercise. The rights may only apply in certain circumstances and are subject to certain exemptions. Please see the table below for a summary of your rights. You can exercise these rights using the contact details set out in Section N (How to Contact Us).

• The right of access (commonly known as a “data subject access request”) – you have the right to receive a copy of any personal data that we hold about you, subject to certain exemptions.

• The right to rectification – you can ask us to take measures to correct your personal data if it is inaccurate or incomplete (e.g. if we have the wrong name or address for you).

• The right to erasure – this is also known as the ‘right to be forgotten’ and, in summary, enables you to request the deletion or removal of your personal atain certain circumstances. For example (i) where your personal data is no longer necessary in relation to the purposes for which they were collected or otherwise used; (ii) if you withdraw your consent and there is no other legal ground which we are able to rely on for the continued use of your personal data; (iii) if you object to the use of your personal data (as set out below); (iv) if we have used your personal data unlawfully; or (v) if your personal data needs to be erased to comply with a legal obligation.

• The right to restrict processing – You have the right to suspend our use of your personal data in certain circumstances. For example (i) where you think your personal data is inaccurate and only for such period to enable us to verify the accuracy of your personal data; (ii) the use of your personal data is unlawful and you oppose the erasure of your personal data and request that it is suspended instead; (iii) we no longer need your personal data, but your personal data is required by you for the establishment, exercise or defence of legal claims; or (iv) you have objected to the use of your personal data and we are verifying whether our grounds for the use of your personal data override your objection.

• The right to data portability –You have the right to obtain personal data that you have provided to us in a structured, commonly used and machine-readable format and for it to be transferred to you or another organisation, where it is technically feasible. The right only applies where the use of the personal data you provided was with your consent or for the performance of a contract with you, and when the use of your personal data is carried out by automated (i.e. electronic) means.

• The right to object – You have the right to object to the use of your personal data in certain circumstances.

• The right to withdraw consent – where we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time.

• The right to object to a decision which is based solely on automated processing – You have the right in certain circumstances not to be subject to a decision which is based solely on automated processing without human intervention.

• The right to complain to the relevant data protection authority Before assessing your request, we may request additional information in order to identify you. If you do not provide the requested information and, as a result, we are not in a position to identify you, we may refuse to action your request.

We will generally respond to your request within one month of receiving your request. We can extend this period by an additional two months if this is necessary taking into account the complexity and number of requests that you have submitted.

We will not charge you for such communications or actions we take, unless:

• you request additional copies of your personal data undergoing processing, in which case we may charge for our reasonable administrative costs, or

• you submit manifestly unfounded or excessive requests, in particular because of their repetitive character, in which case we may either charge for our reasonable administrative costs or refuse to act on the request.

K. CHILDREN’S ONLINE PRIVACY

We do not direct our Website to minors and we do not knowingly collect personal data from children. If we learn we have mistakenly or unintentionally collected or received personal data from a child without appropriate consent, we will delete it. If you believe we mistakenly or unintentionally collected any information from or about a child, please contact us at contact@sightglassvision.com.

L. THIRD PARTY LINKS

Our websites may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for how they handle your personal data. When you leave one of our websites, we encourage you to read the privacy notice of every website you visit.

M. PRIVACY POLICY CHANGES

This Policy may change from time to time. Your continued engagement with our Website after any such revisions indicates that you accept and consent to them, so please check the Policy periodically for updates. We will post any changes on this page.

N: HOW TO CONTACT US

If you wish to request further information regarding this Policy or the way we use your personal data or if you wish to exercise any of the above rights set out in Section Jyou can contact us at: contact@sightglassvision.com

Last updated: June 2023