Norwii Privacy Policy

Norwii Privacy Policy

Last Updated: December 2, 2025

Effective Date: December 2, 2025

Introduction

Norwii (hereinafter referred to as "we," "us," or "our") is committed to protecting your privacy and the security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our 3C digital hardware products ("Devices"), our websites, mobile applications, and related software services (collectively, "Services").

Please read this Privacy Policy carefully. By creating an account, using our Devices, or accessing our Services, you acknowledge that you have read, understood, and agreed to be bound by the terms of this Policy.

Table of Contents

1.Information We Collect

2.How We Use Your Information

3.Cookies and Tracking Technologies

4.How We Share and Disclose Your Information

5.International Data Transfers

6.Security and Retention of Data

7.Your Rights and Choices

8.Children's Privacy

9.Updates to This Policy

10.Contact Us

1.Information We Collect

To provide you with seamless hardware and software experience, we collect information in the following ways:

1.1 Information You Provide to Us

• Account Information: When you register a Norwii ID, we collect youremail address, phone number, username, and password.

• Transaction Information: When you purchase products from our officialstore, we collect your shipping address, recipient name, contact number,and order details. Note: We do not store your complete credit cardinformation; payments are processed by third-party secure paymentgateways.

• Customer Support: When you contact us for repairs or support, we maycollect your proof of purchase, device serial number (SN/IMEI), anddescriptions of the issue.

1.2 Information We Collect Automatically

• Device Information: When you activate and connect your Device to thenetwork, we collect hardware identifiers (e.g., IMEI, MEID, Serial Number,MAC address), operating system version, and IP address. This is necessaryfor warranty validation and firmware updates.

• Usage Data: We may collect anonymous data about how you use oursoftware, such as app crash logs, feature usage frequency, and clickstreamdata to improve system stability.

• IoT & Location Data: If you use our smart home apps to connectDevices, we may request Location permissions (GPS/Wi-Fi) to scan for andpair with nearby devices via Bluetooth/Wi-Fi, as required by the operatingsystem (e.g., Android).

1.3 Biometric Information and Local Authentication

We may use facial recognition or fingerprint authentication features available on your mobile device (such as Face ID®, Touch ID®, or Android Biometrics) to facilitate easier login to our App or to authenticate specific actions within the App.

If your Device supports fingerprint or facial recognition:

• Local Storage Only: Your original fingerprint or facial mapping datais encrypted and stored strictly in the Secure Enclave (TEE) on the Deviceitself.

• Local Processing Only: When you use these features, the biometric data(e.g., facial map or fingerprint reference) is processed strictly on yourdevice (stored in the device’s Secure Enclave or TrustedExecution Environment).

• No Data Transmission: We do not collect, access, store, or transmityour original biometric information to our servers or any third-partycloud. Our App only receives a "verification successful" or"verification failed" confirmation token from your device'soperating system.

• Management: You can manage or disable these features at any time viayour mobile device’s system settings.

2.How We Use Your Information

We process your personal data for the following legitimate purposes:

• Service Provision: To process your orders, deliver products, andactivate your devices.

• Cloud Services: To provide data backup and synchronization services(e.g., contacts, photos, notes) if you opt-in to such features.

• Product Improvement: To analyze software performance and develop newhardware features.

• Communication: To send you important notices, such as softwareupdates, security alerts, and changes to our terms.

• Security: To verify identity and prevent fraud or unauthorized use ofour products.

To provide the full functionality of our Services and to ensure proper connectivity with your Norwii hardware, our mobile application may request access to certain system permissions on your mobile device. We request these permissions on an "as-needed" basis, and you will be prompted to grant access when you use the specific feature.

Below is a list of permissions we may request and the specific purposes for which they are used:

• Managing Permissions: You can revoke these permissions at any time bygoing to your mobile device’s Settings > Norwii Presenter and toggling the permissions off. Please note that denying certainpermissions (such as Bluetooth or Location) may prevent the App fromconnecting to or controlling your hardware.

3.Cookies and Tracking Technologies

We use Cookies and similar technologies (such as web beacons and local storage) to enhance your browsing experience, remember your preferences, and analyze website traffic. You can manage your cookie preferences through your browser settings. However, disabling cookies may affect certain functionalities of our website.

4.How We Share and Disclose Your Information

We do not sell your personal information. We only share data in the following circumstances:

• Service Providers: We share necessary data with third-party vendorswho perform services on our behalf, such as logistics companies (forshipping), payment processors, and cloud infrastructure providers.

• Legal Compliance: We may disclose your information if required by law,legal process, litigation, or requests from public and governmentauthorities.

• Business Transfers: In the event of a merger, acquisition, or sale ofassets, your data may be transferred to the acquiring entity.

• With Your Consent: We may share your information with other thirdparties when we have obtained your explicit consent.

5.International Data Transfers

Norwii operates globally. Therefore, your personal data may be transferred to, and processed in, countries other than the country in which you reside.

• If you are located in the European Economic Area (EEA), we ensure thatcross-border transfers comply with GDPR requirements (e.g., using StandardContractual Clauses).

• For users in China, data is stored on servers within mainland China,unless cross-border transfer is necessary and legally compliant.

6.Security and Retention of Data

6.1 Security Measures

We implement industry-standard technical and organizational measures (e.g., TLS encryption for data in transit, AES-256 encryption for data at rest) to protect your data against unauthorized access, alteration, or loss.

6.2 Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Policy, or as required by law (e.g., tax or accounting laws). When data is no longer needed, we will securely delete or anonymize it.

7.Your Rights and Choices

Depending on your jurisdiction (such as GDPR for EU users or CCPA for California residents), you may have the following rights:

• Access: Request a copy of the personal data we hold about you.

• Correction: Request that we correct inaccurate or incomplete data.

• Deletion: Request the deletion of your account and personal data("Right to be Forgotten").

• Restriction: Request us to restrict the processing of your data.

• Portability: Request to receive your data in a structured, commonlyused format.

• Withdraw Consent: You may withdraw your consent at any time via devicesettings or by contacting us.

To exercise these rights, please contact us at support@norwii.com.

8.Children's Privacy

Our products and services are not directed to children under the age of 14 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from children without parental consent. If we become aware that a child has provided us with personal data, we will take steps to delete such information.

9.Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the new Policy on this page and updating the "Last Updated" date.

10.Contact Us

If you have any questions or concerns regarding this Privacy Policy or our data practices, please contact our Data Protection Officer (DPO) at:

• Company Name: Norwii

• Address: 2F, Building 3, No.277, Jinfeng Road, Pudong New Area,Shanghai 201201, P. R. China

• Email: support@norwii.com

11. Supplemental Terms – Jurisdiction-Specific

12. UNITED STATES

These following disclosures supplement the information contained in the main body of our Privacy Notice by providing additional information about our Personal Data processing practices relating to individual residents of certain states in the United States, including the states of California, Nevada, Colorado, Connecticut, Montana, Oregon, Texas, Utah, or Virginia in the United States. For a detailed description of how we collect, use, disclose, and otherwise process Personal Data, please read the main body of our Privacy Notice.

Collection and Use of Personal Data

Personal Data

As described in more detail above, we collect, and have collected in the preceding 12 months, the following categories of Personal Data:

• Identifiers, such as first and last name, preferred name, phonenumber, email address, user ID, and online identifiers.

• Customer records, such as contact information, address bookinformation, and account information.

• Protected classification characteristics, such as age, gender, andhealth status.

• Commercial information, such as records of purchases and prices,shipping address and contact information, and details of returns, andconsumer histories and tendencies.

• Biometric information, such as facial or other biometric recognitiontechnology results processed and maintained solely on the user’s device (see below for more detail).

• Internet / network information, such as the device type, manufacturer,and model, operating system, IP address, browser type, Internet serviceprovider, and unique identifiers associated with you, your device, or yournetwork.

• Audio, electronic, visual, thermal, olfactory, or similar information,including voice prompts / recordings and service avatars, images andvideo.

• Professional / employment information, such as employer and job title.

• Sensitive personal data, such as account credentials, biometricinformation and health data (as further described below).

• Other Personal Data, such as your communication preferences,entertainment preferences, home configuration (for our home-relatedservices), participation in our loyalty and incentive programs, and anyother Personal Data you choose to share in custom messages sent throughthe forms, email addresses, or other contact information we make availableto customers.

• Inferences, including consumer preferences, predispositions, andcharacteristics.

As described above, we collect this Personal Data directly from you, automatically when you interact with our Sites, Applications, products, or other services, from third parties, and from public third-party platforms such as social media websites.

We collect Personal Data from and about you for a variety of purposes. For example, we use Personal Data to communicate with you; to facilitate, process, and fulfill orders you place with us or the services you request; to conduct surveys, sweepstakes, contests and other promotions; to analyze and improve the use of our Sites and Applications; to deliver marketing communications and personalized and non-personalized advertising; and to facilitate our customer services.

Sensitive Personal Data

The following Personal Data elements we collect or are otherwise processed in connection with our Sites, Applications, products or services may be classified as “sensitive” under certain privacy laws (“Sensitive Personal Data”):

• Account credentials.

• Payment card information (collected and processed solely by ourthird-party payment providers; Norwii does not have access to this data).

• Biometric information (collected and processed solely on the user’s device; Norwii does not have access to this data).

• Health metrics, including sleep patterns, movements, heart rate,height, weight, and body mass index.

• Precise geolocation data.

We only use or disclose Sensitive Personal Data where reasonably necessary and proportionate, and where permitted by law, for the purposes of performing services you have requested, verifying and improving the services we provide, detecting security incidents, fraud and other illegal actions, ensuring the physical safety of natural persons, performing services on behalf of the business, or short-term transient use. We only collect and process Sensitive Personal Data without the purpose of inferring characteristics about the relevant individual, and we do not sell Sensitive Personal Data or process or otherwise share Sensitive Personal Data for the purpose of targeted advertising (as further described below).

However, depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to limit, or withdraw your consent for, our processing of Sensitive Personal Data (as described in the Your Additional U.S. Privacy Choices section below).

Deidentified Information

We may at times receive, or process Personal Data to create, deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual or household. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.

Keep Your Information Safe and Secure

All Norwii products are built with strong security features that continuously protect your information. The insights we gain from maintaining our services help us detect and automatically block security threats from ever reaching you. And if we do detect something risky that we think you should know about, we’ll notify you and help guide you through steps to stay better protected.

We work hard to protect you and Norwii from unauthorized access, alteration, disclosure, or destruction of information we hold, including:

- We use encryption to keep your data private while in transit

- We offer a range of security features, like Safe Browsing, Security Checkup, and 2 Step Verification to help you protect your account

- We review our information collection, storage, and processing practices, including physical security measures, to prevent unauthorized access to our systems

- We restrict access to personal information to Norwii employees, contractors, and agents who need that information in order to process it. Anyone with this access is subject to strict contractual confidentiality obligations.

Personal Data Disclosures, Sales, and Targeted Advertising

We may disclose the categories of Personal Data above to the following categories of third parties: the entities that make up the Norwii group, Processors, ad networks and advertising partners, business and marketing partners, third-party providers with services integrating with our services, individuals you choose to share Personal Data with, and certain third parties where you have provided consent or where otherwise required or permitted by law. Please be aware that we will not transfer your Sensitive Personal Data to any third parties, including advertising platforms, data brokers, or information resellers, for purposes other than providing or improving the use case or features of our Sites, Applications, products, or services, without your consent.

Our disclosure or making available of identifiers, customer records, commercial information, internet / network information, and inferences to ad networks and advertising partners may qualify as the sale of Personal Data or the sharing or processing of Personal Data for the purpose of displaying advertisements that are selected based on Personal Data obtained or inferred over time from an individual’s activities across businesses or distinctly-branded websites, applications, or other services (otherwise known as “targeted advertising” or “cross-context behavioral advertising”) under certain privacy laws.

Depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to limit or opt-out of the sale of Personal Data or the processing of Personal Data for purposes of targeted advertising (as described in the Your Additional U.S. Privacy Choices section below).

Please note we do not sell the Personal Data of individuals we know to be less than 16 years of age or share such information for targeted advertising purposes. In addition, we do not sell Sensitive Personal Data, and we do not process or otherwise share Sensitive Personal Data for the purpose of targeted advertising.

Automated Decision-Making and Profiling

We do not conduct automated processing of Personal Data for the purposes of evaluating, analyzing, or predicting an individual’s personal aspects in furtherance of decisions that produce legal or similarly significant effects. As a result, we do not provide a right to exercise control over such forms of automated decision-making and profiling.

Your Additional U.S. Privacy Choices

Depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following rights:

• Right to Know. The right to confirm whether we are processing PersonalData about you and, under California and Oregon law only, to obtaincertain personalized details about the Personal Data we have collectedabout you, including;

• The categories of Personal Data collected;

• The categories of sources of the Personal Data;

• The purposes for which the Personal Data were collected;

• The categories of Personal Data disclosed to third parties (if any),and the categories of recipients to whom this Personal Data were disclosed(or, for Oregon residents only, a list of the specific third parties towhom personal data have been disclosed);

• The categories of Personal Data shared for targeted advertisingpurposes (if any), and the categories of recipients to whom the PersonalData were disclosed for these purposes; and

• The categories of Personal Data sold (if any) and the categories ofthird parties to whom the Personal Data were sold.

• Right to Access & Portability. The right to obtain access to thePersonal Data we have collected about you and, where required by law, theright to obtain a copy of the Personal Data in a portable and, to theextent technically feasible, readily usable format that allows you totransmit the data to another entity without hindrance.

• Right to Correction. The right to correct inaccuracies in yourPersonal Data, taking into account the nature of the Personal Data and thepurposes of the processing of the Personal Data.

• Right to Control Over Sensitive Personal Data. The right to exercisecontrol over our collection and processing of certain Sensitive PersonalData.

• Right to Opt-Out of Targeted Advertising. The right to direct us notto use or share Personal Data for certain targeted advertising purposes.

• Right to Opt-Out of Sales. The right to direct us not to sell PersonalData to third parties.

• Right to Deletion. The right to have us delete Personal Data wemaintain about you (subject to certain exceptions).

Depending on your state of residency, you may also have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise the above rights. However, the exercise of the rights described above may result in a different price, rate or quality level of product or service where that difference is reasonably related to the impact the right has on our relationship or is otherwise permitted by law.

Submitting Privacy Rights Requests

Please submit a request specifying the right you wish to exercise by sending us an email at the following address: support@norwii.com.

To exercise your right to opt-out as it relates to the use of cookies and similar technologies that involve the sale of Personal Data or the use of Personal Data for targeted advertising purposes, please click the “Cookie Settings” link in the footer of the website and adjust your preferences accordingly. If you are visiting our Sites with the Global Privacy Control enabled, any cookies that constitute sales or are used for targeted advertising should already be turned off automatically in our cookie preference manager. Please note this opt-out tool is website, device and browser specific, so you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting. In addition, you can also opt-out of cookie-based sales by businesses that participate in the Digital Advertising Alliance’s CCPA Opt-Out Tool by visiting https://www.privacyrights.info/. Lastly, you may follow the other steps set forth above to further exercise control over cookies and similar technologies.

Before processing your request to exercise certain rights (including the Right to Know, Access & Portability, Correction, and Deletion), we will need to verify your identity and confirm you are a resident of a state that offers the requested right(s). In order to verify your identity, we will generally either require the successful authentication of your account, or the matching of sufficient information you provide us to the information we maintain about you in our systems. As a result, we require requests submitted through our online form and email address to include the requester’s name and email address, their relationship with Norwii, the brands relevant to the request, and the data subject’s email address, state/ country/ zip and any comments relating to the request.

In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity or locate your information in our systems, or where you are not a resident of one of the eligible states.

Submitting Authorized Agent Requests

In certain circumstances, you are permitted to use an authorized agent to submit requests on your behalf through the designated methods set forth above where we can verify the authorized agent’s authority to act on your behalf. In order to verify the authorized agent’s authority, we generally require evidence of either (i) a valid power of attorney or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement of authorization for the request. Depending on the evidence provided and your state of residency, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request.

Appealing Privacy Rights Decisions

Depending on your state of residency, you may be able to appeal a decision we have made in connection with your privacy rights request. All appeal requests should be submitted by replying to the communication resolving your original request.

Financial Incentives and Loyalty Programs

We offer various financial incentives to our customers, including:

• Discounts, coupons, and special offers via email when signing up forour email lists or creating an account;

• Rewards when referring a friend who purchases our products orservices; and

• Loyalty programs, where customers earn / redeem rewards based upontheir past transactions with us.

To obtain access to certain of these programs and other offerings, we may ask to collect your Personal Data, including name, contact information, professional information, account information, and transaction information. We consider the value of these programs and other offerings to be reasonably related to the value of the Personal Data to our business, based on our reasonable but sole determination. We estimate the value of the Personal Data by considering the expense incurred by the business related to the collection, storage, and retention of the Personal Data in the context of the financial incentive program and the expenses related to the provision of the financial incentive.

The terms applicable to each program and other offering are provided at the time an eligible customer is offered an opportunity to participate. Interested customers can opt-in to these programs and offerings by following the instructions presented at the time the offer is made. Participating customers may withdraw from our programs and other offerings at any time by unsubscribing from our emails (for email-based incentives), closing their accounts (for loyalty and reward program incentives), following the instructions provided in connection with each offering, or by emailing us at support@norwii.com.