Supplemental Privacy Policy for U.S. Consumers

This Supplemental Privacy Policy for U.S. Consumers (“Supplemental Policy”) describes KaiZhan Limited’s (Co Reg No 12610906) (“KaiZhan”, “we,” “us,” and “our”) practices regarding the collection, use, and disclosure of Personal Data and provides instructions for submitting data subject requests. This Supplemental Policy applies only to information collected about California, Colorado, Virginia, Utah, and Connecticut consumers.

It provides information required under the California Consumer Privacy Act of 2018 and California Privacy Rights Act of 2020 (collectively, the “CPRA”), the Colorado Privacy Act of 2021 (the “CPA”), the Virginia Consumer Data Protection Act of 2021 (the “VCDPA”), the Utah Consumer Privacy Act of 2022 (the “UCPA”), and the Connecticut Data Privacy Act of 2022 (“CDPA”).

We also provide a brief paragraph regarding information collected about Nevada consumers under the heading “Privacy Notice for Nevada Residents” at the end of this Supplemental Policy. The other portions of this Supplemental Policy do not apply to Nevada consumers.

Like our Privacy Policy, this Supplemental Policy explains how we collect personal data, principally through our VIA Academy mobile application (the “App”) and website (including www.viaacademy.com and its subdomains, collectively, the “Site”) (together, the “Services”).

Some portions of this Supplemental Policy apply only to consumers of particular states. In those instances, we have indicated that such language applies only to those consumers.

A. Definitions

• “Personal Data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Data includes “personal data” as that term is defined in the CPA, VCDPA, UCPA, and CDPA and “personal information” as that term is defined in the CPRA. Personal Data also includes “Sensitive Personal Data,” as defined below, except where otherwise noted.
• “Sensitive Personal Data” means Personal Data that reveals a consumer’s social security, driver’s license, state identification card, or passport number; account log-in, financial account number, debit card number, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; precise geolocation; racial or ethnic origin, religious beliefs, or union membership; contents of email or text messages; and genetic data. Sensitive Personal Data also includes processing of biometric information for the purpose of uniquely identifying a consumer and Personal Data collected and analyzed concerning a consumer’s health, sex life, or sexual orientation. Sensitive Personal Data includes “sensitive data” as that term is defined in the CPA, VCDPA, UCPA, and CDPA, and “sensitive personal information” as that term is defined in the CPRA.
• “Third Party” has the meanings afforded to it in the CPRA, CPA, VCDPA, UCPA, and CDPA.
• “Vendor” means a service provider, contractor, or processor as those terms are defined in the CPRA, CPA, VCDPA, UCPA, and CDPA.

To the extent other terms used in this Supplemental Policy are defined terms under the CPRA, CPA, VCDPA, UCPA, or CDPA they shall have the meanings afforded to them in those statutes, whether or not capitalized herein. As there are some variations between such definitions in each of the five statutes, the definitions applicable to you are those provided in the statute for the state in which you are a consumer. For example, if you are a Virginia consumer, terms used in this Supplemental Policy that are defined terms in the VCDPA shall have the meanings afforded to them in the VCDPA as this Supplemental Policy applies to you.

B. Collection & Processing of Personal Data

We, and our Vendors, may have collected and processed the following categories of Personal Data about you in the preceding 12 months:

1. Identifiers, such as name, alias, online identifiers, account name, physical characteristics or description;
2. Contact and financial information, including email address, payment information and purchase history;
3. Characteristics of protected classifications under state or federal law, such as age, gender, race, physical or mental health conditions, and marital status;
4. Commercial information, such as transaction information and purchase history;
5. Internet or other electronic network activity information, such as browsing history and interactions with our websites or advertisements;
6. Audio, electronic, visual and similar information;
7. Inferences drawn from any of the Personal Data listed above to create a profile or summary about, for example, an individual’s preferences and characteristics; and
8. Sensitive Personal Data, including:
   (a) Personal Data that reveals:
   (i) Racial or ethnic origin.

Retention of Personal Data. We retain your Personal Data for the period reasonably necessary to provide goods and services to you and for the period reasonably necessary to support our business operational purposes listed in Section E.

C. Categories of Personal Data We Disclose to Vendors & Third Parties

We may disclose the following categories of Personal Data to Vendors and Third Parties:

1. Identifiers, such as name, alias, online identifiers, account name, physical characteristics or description;
2. Contact and financial information, including email address, payment information and purchase history;
3. Characteristics of protected classifications under state or federal law, such as age, gender, race, physical or mental health conditions, and marital status;
4. Commercial information, such as transaction information and purchase history;
5. Internet or other electronic network activity information, such as browsing history and interactions with our websites or advertisements;
6. Audio, electronic, visual and similar information;
7. Inferences drawn from any of the Personal Data listed above to create a profile or summary about, for example, an individual’s preferences and characteristics; and
8. Sensitive Personal Data, including:
   (a) Personal Data that reveals:
   (i) Racial or ethnic origin.

Disclosure for California Consumers: We have not sold or shared Personal Data about California consumers in the past twelve months. Relatedly, we do not have actual knowledge that we sell or share Personal Data of California consumers under 16 years of age. For purposes of the CPRA, a “sale” is the disclosure of personal information (as that term is defined by the CPRA) to a Third Party for monetary or other valuable consideration, and a “share” is the disclosure of personal information (as that term is defined by the CPRA) to a Third Party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration.

Disclosure for Colorado, Virginia, Utah, and Connecticut Consumers: We do not sell or share Personal Data to Third Parties or process Personal Data for purposes of targeted advertising, as the terms “sell,” “share,” “process,” and “targeted advertising” are defined in the CPA, VCDPA, UCPA, and CDPA.

D. Sources from Which We Collect Personal Data

We collect Personal Data directly from our users who are California, Colorado, Virginia, Utah, and Connecticut consumers and, for children under 13 years old, their parents. We may also collect Personal Data from our service providers and from third parties who partner with us in relation to the Services, as described in more detail in our Privacy Policy.

E. Purposes for Processing Personal Data

We, and our Vendors, collect and process the Personal Data (excluding Sensitive Personal Data) described in this Supplemental Policy to:

• To register users who choose to create a Registered Account with us, including verifying the user’s age.
• For users under 13, for responding to the child’s request for parental consent, obtaining verified parental consent, communicating with the child’s parent about the child’s registration and permissions, and identifying the child’s permissions as a child user.
• To create a user Profile for registered users.
• To provide, operate, and maintain the Services for registered users, including personalising the App and Site’s features and presentation.
• To enable registered users to access interactive and personalised features, including viewing and uploading content, “reacting”, “following” and “sharing”
• To enable registered users to purchase goods/services via the Services, to process such purchase and verify paying users, to fulfil such purchases, and to enable users who have purchased paid features to access the paid features and to provide the paid features to them (including to display purchase information to the user in the correct currency based on the user’s location).
• To monitor inappropriate conduct and to enable registered users to report inappropriate conduct.
• To communicate with our customers, either directly or through one of our partners, including for customer service, to provide our customers with updates and other information relating to the Services.
• To provide marketing and promotional material to customers who subscribe to the mailing list (available to user aged over 13 years old only).
• To carry out data analytics to understand and analyse how users use our Services, to improve and expand our Services, and to develop new products, services, features, and functionality.
• To find and prevent fraud or other unlawful activity.
• For the parent of a child under 13, to send email updates about the child’s activity on the Services.
• To comply with applicable law, including complying with legal and regulatory requirements and exercising and defending legal claims.
• To organise, operate and monitor the Coach Feedback Monthly Draw, including to enable users to enter the draw, to notify winners and to provide the prizes.

We, and our Vendors, collect and process the Sensitive Personal Data described in this Supplemental Policy only for performing the services or providing the goods reasonably expected by an average consumer who requests those goods or services.

F. Categories of Entities to Whom We Disclose Personal Data

• Vendors. We may disclose your Personal Data to our Vendors for the purposes described in Section E of this Supplemental Policy. Our Vendors provide us with services for our App and Site, such as web hosting, data analysis, customer service, infrastructure provision, technology services, email delivery services, credit card processing, legal services, and other similar services. We grant our Vendors access to Personal Data only to the extent needed for them to perform their functions, and require them to protect the confidentiality and security of such information.
• Third Parties. We may disclose your Personal Data to the following categories of Third Parties:
• • At Your Direction. We may disclose your Personal Data to any Third Party with your consent or at your direction, including when you accept cookies or interact with the Third Parties we use for payment processing purposes, as described in our Privacy Policy.
  • Business Transfers or Assignments. We may disclose your Personal Data to other entities as reasonably necessary to facilitate a merger, sale, joint venture or collaboration, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).
  • Legal and Regulatory. We may disclose your Personal Data to government authorities, including regulatory agencies and courts, as reasonably necessary for our business operational purposes, to assert and defend legal claims, and otherwise as permitted or required by law.

G. Data Subject Rights

• Exercising Data Subject Rights. California, Colorado, Virginia, Utah, and Connecticut consumers have certain rights with respect to the collection and use of their Personal Data. Those rights vary by state. As required by the CPRA, we provide detailed information below regarding the data subject rights available to California consumers. Colorado, Virginia, Utah, and Connecticut consumers have similar rights and can find more detail by referencing the CPA, VCDPA, UCPA, or CDPA, as applicable.
  
  You may exercise the data subject rights applicable to you under the CPRA, CPA, VCDPA, UCPA, or CDPA by contacting us by email at hello@viaacademy.com with the subject line “Privacy Policy”, by using the in-app Contact Us function, by phone or WhatsApp at +44 7311345970, or by clicking here. Consumers in some states may also authorize an agent to make data subject requests on their behalf.
• Verification of Data Subject Requests. We may ask you to provide information that will enable us to verify your identity in order to comply with your data subject request. In particular, when a California consumer authorizes an agent to make a request on their behalf, we may require the agent to provide proof of signed permission from the consumer to submit the request, or we may require the consumer to verify their own identity to us or confirm with us that they provided the agent with permission to submit the request. In some instances, we may decline to honor your request if an exception applies under applicable law. We will respond to your request consistent with applicable law.
• Non-Discrimination. We will not discriminate against you for exercising your data subject rights. For example, we will not deny goods or services to you, or charge you different prices or rates, or provide a different level of quality for products or services as a result of you exercising your data subject rights.
• Appeals for Virginia, Colorado, and Connecticut Consumers. Virginia, Colorado, and Connecticut consumers have the right to appeal our decisions on their data subject requests. This section does not apply to California or Utah consumers. To appeal our decision on your data subject requests, you may contact us at KaiZhan Limited, 506 Kingsbury Road, London, United Kingdom, NW9 9HE. Please enclose a copy of or otherwise specifically reference our decision on your data subject request, so that we may adequately address your appeal. We will respond to your appeal in accordance with applicable law.

• Data Subject Rights Disclosure for California Consumers: California consumers have the following rights regarding our collection and use of their Personal Data, subject to certain exceptions.
• • Right to Receive Information on Privacy Practices: You have the right to receive the following information at or before the point of collection:
  • • The categories of Personal Data to be collected;
    • The purposes for which the categories of Personal Data are collected or used;
    • Whether or not that Personal Data is sold or shared;
    • If the business collects Sensitive Personal Data, the categories of Sensitive Personal Data to be collected, the purposes for which it is collected or used, and whether that information is sold or shared; and
    • The length of time the business intends to retain each category of Personal Data, or if that is not possible, the criteria used to determine that period.
  • We have provided such information in this Supplemental Policy, and you may request further information about our privacy practices by contacting us as at the contact information provided above.
  • Right to Deletion: You may request that we delete any Personal Data about you we that we collected from you.
  • Right to Correction: You may request that we correct any inaccurate Personal Data we maintain about you.
  • Right to Know: You may request that we provide you with the following information about how we have handled your Personal Data in the 12 months preceding your request:
  • • The categories of Personal Data we collected about you;
    • The categories of sources from which we collected such Personal Data;
    • The business or commercial purpose for collecting Personal Data about you;
    • The categories of Personal Data about you that we shared or disclosed and the categories of Third Parties with whom we shared or disclosed such Personal Data; and
    • The specific pieces of Personal Data we have collected about you.
• • Right to Receive Information About Onward Disclosures: You may request that we disclose to you:
  • • The categories of Personal Data that we have collected about you;
    • The categories of Personal Data that we have sold or shared about you and the categories of Third Parties to whom the Personal Data was sold or shared; and
    • The categories of Personal Data we have disclosed about you for a business purpose and the categories of persons to whom it was disclosed for a business purpose.
  • Right to Non-Discrimination: You have the right not to be discriminated against for exercising your data subject rights. We will not discriminate against you for exercising your data subject rights.

H. Data Subject Rights

• California Residents Under Age 18. If you are a resident of California under the age of 18 and a registered user of our website, you may ask us to remove content or data that you have posted to the website by emailing us at hello@viaacademy.com with the subject line “Privacy Policy”by using the in-app Contact Us function, by phone or WhatsApp at +44 7311345970, or by clicking here. Please note that your request may not ensure complete or comprehensive removal of the content or data, as, for example, some of your content or data may have been reposted by another user.
• Disclosure About Direct Marketing for California Residents. California Civil Code § 1798.83 permits California residents to annually request certain information regarding our disclosure of Personal Data to other entities for their direct marketing purposes in the preceding calendar year. We do not distribute your Personal Data to other entities for their own direct marketing purposes.
• Privacy Notice for Nevada Residents. We do not sell Covered Information as defined under Nevada law, and we generally do not disclose or share personal information as defined under Nevada law for commercial purposes. Under Nevada law, you have the right to direct us to not sell or license your personal information to third parties. To exercise this right, if applicable, you or your authorized representative may email us at hello@viaacademy.com with the subject line “Privacy Policy”, or use the in-app Contact Us function, or contact us by phone or WhatsApp at +44 7311345970, or click here.
• Changes to our Supplemental Policy. We reserve the right to amend this Supplemental Policy at our discretion and at any time. When we make material changes to this Supplemental Policy, we will notify you by posting an updated Supplemental Policy on our website and listing the effective date of such updates.
• Contacting Us. If you have any questions, comments, requests, or concerns related to this Supplemental Policy, our privacy practices, or how to access this policy in another format, please contact us by mail at KaiZhan Limited, 506 Kingsbury Road, London, United Kingdom, NW9 9HE or by email at hello@viaacademy.com with the subject line “Privacy Policy”, by using the in-app Contact Us function, by phone or WhatsApp at +44 7311345970, or by clicking here, for assistance.