PRIVACY POLICY

10. UNITED STATES – STATE-SPECIFIC DISCLOSURES

10.1 California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have certain rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected
• Right to Delete: Request deletion of your personal information, subject to certain exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: Opt out of the sale or sharing of personal information (note: we do not sell personal information)
• Right to Limit Use: Limit the use and disclosure of sensitive personal information
• Non-Discrimination: We will not discriminate against you for exercising your privacy rights

Service Provider Status: When processing data on behalf of our Clients, we act as a "service provider" under the CCPA. California residents should direct their privacy requests to the business (our Client) that collected their information.

10.2 Texas Privacy Rights (TDPSA)

If you are a Texas resident, you have rights under the Texas Data Privacy and Security Act (TDPSA):

• Right to Access: Confirm whether we are processing your personal data and access such data
• Right to Correction: Correct inaccuracies in your personal data
• Right to Deletion: Delete personal data provided by or obtained about you
• Right to Portability: Obtain a copy of your personal data in a portable format
• Right to Opt-Out: Opt out of targeted advertising, sale of personal data, and profiling

10.3 Other U.S. State Privacy Laws

We comply with applicable state privacy laws including those in Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other states with comprehensive privacy legislation. Residents of these states may have similar rights to access, correct, delete, and opt-out of certain processing activities. Please contact us to exercise any applicable rights.

10.4 HIPAA Compliance

When our Services involve the processing of Protected Health Information (PHI) as defined under the Health Insurance Portability and Accountability Act (HIPAA), we enter into Business Associate Agreements (BAAs) with our Clients and implement appropriate administrative, physical, and technical safeguards as required by HIPAA. We do not use or disclose PHI except as permitted by our BAAs and HIPAA.

10.5 TCPA and SMS Compliance

We comply with the Telephone Consumer Protection Act (TCPA) and CTIA guidelines for SMS messaging. We obtain express written consent before sending marketing text messages, honor opt-out requests promptly, and maintain records of consent as required by law.

11. AUSTRALIA – PRIVACY ACT 1988

If you are located in Australia, this section applies in addition to the general provisions of this Privacy Policy. We comply with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth).

11.1 Collection and Use

We collect personal information that is reasonably necessary for, or directly related to, one or more of our functions or activities. We will only use or disclose personal information for the primary purpose for which it was collected, unless an exception applies under the APPs.

11.2 Your Rights

Under Australian privacy law, you have the right to:

• Request access to personal information we hold about you
• Request correction of inaccurate, out-of-date, incomplete, irrelevant, or misleading information
• Complain about a breach of the APPs

11.3 Overseas Disclosure

We may disclose personal information to overseas recipients, including service providers and AI technology providers located in the United States, Singapore, and other countries. Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles the information in accordance with the APPs.

11.4 Complaints

If you believe we have breached the APPs, you may lodge a complaint with us. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

12. SINGAPORE – PDPA COMPLIANCE

As a Singapore-incorporated company, we comply with the Personal Data Protection Act 2012 (PDPA) and its amendments.

12.1 Data Protection Obligations

We are committed to meeting our obligations under the PDPA, including the Consent, Purpose Limitation, Notification, Access and Correction, Accuracy, Protection, Retention Limitation, Transfer Limitation, and Openness obligations.

12.2 Your Rights Under PDPA

Under the PDPA, you have the right to:

• Request access to your personal data in our possession
• Request correction of any errors or omissions in your personal data
• Withdraw consent for the collection, use, or disclosure of your personal data
• Request information about how your personal data has been used or disclosed in the past year

12.3 Data Protection Officer

For inquiries or complaints regarding our handling of personal data in Singapore, please contact our Data Protection Officer at privacy@romea.ai.

13. UNITED KINGDOM – UK GDPR

If you are located in the United Kingdom, this section applies in addition to the general provisions of this Privacy Policy. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

13.1 Legal Basis for Processing

We process personal data on the following legal bases:

• Contract: Processing necessary for the performance of a contract
• Legitimate Interests: Processing necessary for our legitimate business interests, where not overridden by your rights
• Legal Obligation: Processing necessary to comply with legal obligations
• Consent: Where you have given consent for specific processing purposes

13.2 Your Rights Under UK GDPR

You have the following rights:

• Right of access to your personal data
• Right to rectification of inaccurate personal data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Rights related to automated decision-making and profiling

13.3 International Transfers

We may transfer personal data outside the UK. Where we do so, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement, UK Addendum to the EU Standard Contractual Clauses, or transfers to countries with adequacy regulations.

13.4 Complaints

If you have concerns about our data handling practices, you may lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk.

14. EUROPEAN UNION – GDPR

If you are located in the European Economic Area (EEA), this section applies in addition to the general provisions of this Privacy Policy. We comply with the General Data Protection Regulation (EU) 2016/679 (GDPR).

14.1 Data Controller and Processor

ROMEA.AI PTE. LTD. acts as a data processor when processing personal data on behalf of our Clients. For our own business operations (e.g., Client contact information, website visitors), we act as data controller.

14.2 Legal Basis for Processing

We process personal data based on one or more of the following legal bases under Article 6 of the GDPR:

• Performance of a contract with you or to take steps at your request before entering a contract
• Compliance with a legal obligation to which we are subject
• Our legitimate interests, where not overridden by your fundamental rights and freedoms
• Your consent, where specifically obtained

14.3 Your Rights Under GDPR

Under the GDPR, you have the following rights:

• Right of Access (Art. 15): Obtain confirmation of processing and access to your personal data
• Right to Rectification (Art. 16): Correct inaccurate or incomplete personal data
• Right to Erasure (Art. 17): Request deletion of your personal data in certain circumstances
• Right to Restriction (Art. 18): Request restriction of processing in certain circumstances
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used format
• Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing
• Rights re: Automated Decisions (Art. 22): Not be subject to solely automated decision-making with legal or significant effects

14.4 International Transfers

When we transfer personal data outside the EEA, we implement appropriate safeguards in accordance with Chapter V of the GDPR, including the European Commission's Standard Contractual Clauses (SCCs), adequacy decisions, or other lawful mechanisms.

14.5 Data Protection Authority

You have the right to lodge a complaint with your local supervisory authority. A list of EU data protection authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.