1. INTRODUCTION

REFSIX Limited, trading as Scorza ("SCORZA,", "Scorza", "us," "we," or "our"), takes your privacy seriously and wants you to understand how we use, collect, and share Personal Data and the measures we take to protect your Personal Data. "Personal Data" means any information that identifies you or can be reasonably linked to you, or information which is otherwise considered to be "personal information" or "personal data" under applicable laws.

This Privacy Policy applies to Personal Data we collect about SCORZA users and other consumers who interact with SCORZA or use our services, including by visiting our websites or our social media pages or by using our mobile apps, the SCORZA Performance Vest, or any features, content, or applications offered by SCORZA in connection therewith (collectively, the "Services"). This Privacy Policy does not cover the practices of companies or people that we do not own, control or manage. We are not responsible for the policies and practices of any third parties, and we do not control, operate, or endorse any information, products, or services that may be offered by third parties or accessible on or through the Services.

We have provided supplemental notices below for individuals located in the European Economic Area, the United Kingdom, and Switzerland.

2. HOW WE COLLECT PERSONAL DATA

We collect Personal Data about you from:

• Yourself, when you provide such information directly to us, such as when completing your profile or responding to a questionnaire;

• SCORZA Performance Vest that you wear;

• Automatic data collection, such as Cookies, local storage objects, web beacons, and other similar technologies in connection with your use of the Services;

• Customers and partners, such as teams, coaches, or other organizations that engage with our Services;

• Marketing and advertising partners, such as companies that have entered in joint marketing relationships with us or assist us with marketing or promotional services, which may provide us with data related to how you interact with our Services, advertisements, or communications;

• Social media, other third-party platforms, and linked accounts, devices, or features, if you interact with our pages on social media sites, post content to their sites using the Services, sign into the Services through a third-party site or service, or otherwise link accounts, devices, or features to your SCORZA account; and

• Data providers, such as information services and data licensors, when we supplement your data.

3. PERSONAL DATA WE COLLECT

We may collect the following types of Personal Data:

• Contact details, such as your first and last name, email and mailing address, and phone number;

• Profile data, such as username and password that you may establish to create a SCORZA account, as well as any photographs or information you choose to include in your SCORZA profile;

• Communications that we exchange with you, including when you contact us via email, web app, or mobile app with questions, feedback, or reviews;

• Wellness Data, including but not limited to physiological metrics such as resting heart rate, heart rate variability, respiratory rate; acceleration; metadata on workouts and sleep; the type of physical activity you engage in and the duration of your activity; data reflecting strain and recovery; your physiological profile, including birthday, gender identity, weight, height, fitness/athlete level (e.g., professional or recreational); and details you choose to submit about your habits and diet. We may use certain of this information to customize your experience with us as part of our Services;

• Payment and transactional data needed to complete your orders on the website or through the Services (including name, email address, payment card information, bank account number, billing information) and your transaction history, although SCORZA does not have access to payment card numbers. Our payment processors will collect the financial information necessary to process your payments in accordance with the payment processor's respective services agreement and privacy policy;

• Marketing data, such as your preferences for receiving our marketing communications, and details about your engagement with them (e.g., the marketing emails that you open and the links within them that you click);

• Device data, such as your computer or mobile device operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP Address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier, radio/network information (e.g., Wi-Fi, LTE, 3G), and general location information such as city, state, or geographic area;

• Geolocation data, such as GPS (precise geolocation), IP Address, and movement on certain exercise types if you give permission for SCORZA to do so; and

• Online activity data, such as pages or screens you view, how long you spent on a page or screen, the website you visited before visiting our website, navigation paths between pages or screens, information about your activity on a page or screen, access times, and duration of access.

4. COOKIES AND SIMILAR TECHNOLOGIES

SCORZA uses cookies and similar technologies such as pixel tags, web beacons, clear GIFs, and JavaScript (collectively, "Cookies") to enable our servers to recognize your web browser and tell us how and when you visit and use our Services, as well as to analyze trends, learn about our user base, and operate and improve our Services. Cookies are small pieces of data included on the Services (such as on a website or in an email) or placed on your computer, tablet, phone, or similar device when you use that device to visit our Services.

Cookie Usage and Type

SCORZA uses the following Cookies:

• Essential Cookies: Essential Cookies are required for providing you with features or Services that you have requested. For example, certain Cookies enable you to log into secure areas of our Services. Disabling these Cookies may make certain features and Services unavailable.

• Functionality Cookies: Functional Cookies are used to record your choices and settings regarding our Services, maintain your preferences over time, and recognize you when you return to our Services. These Cookies help us to personalize our content for you, greet you by name, and remember your preferences.

• Performance/Analytical Cookies: Performance/Analytical Cookies allow us to understand how users use our Services by collecting information on how often a user engages with a particular feature of the Services. We use these aggregated statistics internally to improve the Services.

• Marketing Cookies: Marketing Cookies collect data about your online activity and identify your interests so that we can provide marketing that we believe is relevant to you.

Online Tracking Opt-outs

There are a number of ways you can opt out of certain interest-based advertising and other online tracking activities:

• Blocking Cookies in your browser: Most browsers let you remove or reject Cookies, including Cookies used for interest-based advertising. To do this, follow the instructions in your browser settings. For more information about Cookies, visit www.allaboutcookies.org.

• Blocking advertising ID use in your mobile device settings: Your mobile devices may offer settings that enable you to make choices about the collection, use, or transfer of your advertising ID.

• Using privacy plug-ins or browsers: You can block our websites from setting Cookies used for interest-based ads by using a browser with privacy features or installing browser plugins and configuring them to block third party Cookies/trackers.

5. HOW WE USE PERSONAL DATA

We process and use Personal Data for the following purposes:

Service delivery, including to:

• Provide, operate, improve, develop, understand, and personalize the Services and our business, including testing, research, analysis, and product development;

• Satisfy the reason you provided the information to us, including for delivery of the Services and responding to and fulfilling requests;

• Communicate with you about the Services, including Service announcements, updates, or offers;

• Send transactional emails related to incomplete purchases or checkout processes;

• Provide support and assistance for the Services;

• Create and manage your account or other user profiles;

• Customize website content and communications based on your preferences; and

• Process orders, memberships, or other transactions.

Research and development

We may create and use Aggregated Data, De-Identified Data, or other anonymous data from Personal Data we collect, including Wellness Data, for our business purposes, including to analyze the effectiveness of the Services, to improve and add features to the Services, and to analyze the general behavior and characteristics of users of the Services. We also use anonymous Wellness Data for research purposes to help us and our research partners answer important questions about human performance and create an even-better experience for our users by identifying cutting-edge insights and providing new content and product features.

Direct marketing and advertising

We may use data from the Personal Data we collect, including Wellness Data and certain data collected when you browse our website, to send you direct offers or other marketing messages or to advertise the Services or other SCORZA product offerings.

Compliance and protection, including to:

• Protect against or deter fraudulent, illegal, or harmful actions and maintain the safety, security, and integrity of our Services;

• Comply with or enforce our legal or contractual obligations, resolve disputes, and enforce our Terms of Use and Terms of Sale;

• Audit our internal processes for compliance with legal and contractual requirements and internal policies;

• Protect our, your, or others' rights, privacy, safety, or property (including by making and defending legal claims); and

• Respond to law enforcement requests and as required or permitted by applicable law, court order, or governmental regulations.

6. HOW WE SHARE PERSONAL DATA

We may share your Personal Data with:

• Service providers, such as payment processors, vendors who advertise our Services or other SCORZA products, security and fraud prevention consultants, hosting and other technology and communications providers, analytics providers, and staff augmentation and contract personnel, that provide services to us or on our behalf;

• Professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services they render to us;

• Authorities and others, including law enforcement, government authorities, and private parties we believe in good faith to be necessary or appropriate to comply with the law or legal process;

• Business transferees, such as acquirers and other relevant participants in business transactions (or diligence or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale, or other disposition of all or any portion of the business or assets of, or equity interests in, SCORZA or our affiliates;

• Teams, coaches, and organizations that you choose to share your data with or that manage your use of the Services;

• Distributors and retailers of our Services or other SCORZA products; and

• Affiliates of SCORZA.

7. HOW YOU MAY SHARE PERSONAL DATA THROUGH THE SERVICES

Depending on how you use the Services, you may share Personal Data with:

• Other users of the Services or the general public, when you choose to share information and content with other users of the Services through social features;

• Third-party social media platforms, when you choose to connect your account on those services with your SCORZA account or post content to social media;

• Teams and coaches, if your use of the Services is managed by or shared with a team, coach, or other organization, your account information and Personal Data may be shared with that entity subject to your consent;

• Corporate wellness programs, if you use the Services in connection with an employer or organizational wellness program, we may share your information with that organization subject to your consent.

8. YOUR CHOICES

Access, update, or delete

When you log in to your account, you may access, and, in some cases, edit or delete certain information you've provided to us, such as first and last name, username and password, email and mailing address, and other information in your profile. When you update information, however, we may maintain a copy of the unrevised information in our records. You may request access to or a full deletion of your account and corresponding data by contacting contact@scorza.com.

Push notifications and device permissions

You can change your settings related to push notifications and device permissions through the settings on your mobile device.

Geolocation data

You may allow or disallow SCORZA to collect geolocation data by enabling or disabling location services on your mobile device. If you decline to grant SCORZA access to this data, we will not be able to provide certain Services, capabilities, or features to you.

Wellness Data

You can disable collection of additional Wellness Data by un-pairing your SCORZA Performance Vest from your mobile device. If you unpair your SCORZA Performance Vest from your mobile device, we will not be able to provide certain Services, capabilities, or features to you.

Marketing communications

You can opt-out of marketing-related emails and other communications by following the opt-out or unsubscribe instructions contained in the marketing-related message. You cannot opt-out of receiving certain non-marketing emails regarding the Services.

9. OTHER SITES AND SERVICES

The Services may contain links to websites and other online services operated by third parties. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control mobile applications, websites, or online services offered or operated by third parties, and we are not responsible for their actions.

10. DATA SECURITY AND RETENTION OF PERSONAL DATA

We employ a number of physical, technical, organizational, and administrative security measures designed to protect the Personal Data we collect. While we endeavor to protect the privacy of your account and other Personal Data we hold in our records, no security measures are failsafe, and we cannot guarantee the security of your Personal Data.

We retain Personal Data for as long as reasonably necessary for the purposes described in this Privacy Policy, while we have a business need to do so, or as required by law (e.g., for tax, legal, accounting, or other purposes), whichever is longer.

11. PERSONAL DATA OF CHILDREN

Our Services are intended for users who are 18 years of age or older. If you are under the age of 18, please do not attempt to register for the Services or send any Personal Data about yourself to us. If we learn that we have collected Personal Data from a person under the age of 18, we will delete that information as quickly as possible. If you believe that a person under the age of 18 may have provided us Personal Data, please contact us at contact@scorza.com.

12. CHANGES TO THIS PRIVACY POLICY

We are constantly trying to improve our Services, so we may need to change this Privacy Policy from time to time. Changes will be posted on the SCORZA website and available on other SCORZA Services. We will alert you to material changes by placing a notice on the SCORZA website, by sending you an email, and/or by some other means. If you use the Services after any changes to the Privacy Policy have been posted, that means you agree to all of the changes.

13. CONTACT US

If you have any questions or concerns regarding our privacy policies, please send us a detailed message to contact@scorza.com or at the mailing address below.

REFSIX Limited (trading as SCORZA) Attn: Legal Department 51 Half Moon Lane Worthing, West Sussex BN13 2EP United Kingdom

14. PRIVACY NOTICE FOR EUROPEAN RESIDENTS

If you are a resident of the European Economic Area, the United Kingdom, or Switzerland, you may have additional rights under the General Data Protection Regulation (the "GDPR") and other European data protection and e-privacy laws.

Controller and European Representatives

REFSIX Limited (trading as SCORZA) will be the controller of your Personal Data processed in connection with the Services. Our contact information is as follows:

REFSIX Limited (trading as SCORZA) 51 Half Moon Lane Worthing, West Sussex BN13 2EP United Kingdom contact@scorza.com

Legal Bases for Processing

We will only process your Personal Data if we have a lawful basis for doing so. The legal bases we typically rely on are:

• Service delivery: Processing is necessary to perform our contract with you or to take steps that you request prior to engaging our Services.

• Research and development: These activities constitute our legitimate interests.

• Marketing and advertising: Processing is based on your consent where required by applicable law, or on our legitimate interests in promoting our business.

• Compliance and protection: Processing is necessary to comply with legal obligations or to protect vital interests.

• Consent: For sensitive Wellness Data, we will ask for your explicit consent to process this data.

Data Subject Rights

You have certain rights with respect to your Personal Data, including:

• Access: You can request information about the Personal Data we hold about you and request a copy of such Personal Data.

• Rectification: You can request that we correct or supplement incomplete, inaccurate, or outdated Personal Data.

• Erasure: You can request that we erase your Personal Data from our systems.

• Withdrawal of consent: You can withdraw your consent to processing at any time.

• Portability: You can ask for a copy of your Personal Data in a machine-readable format.

• Objection: You can object to the further use or disclosure of your Personal Data for certain purposes.

• Restriction of processing: You can ask us to restrict further processing of your Personal Data.

• Right to file a complaint: You have the right to lodge a complaint with the supervisory authority.

For more information about these rights, or to submit a request, please email support@scorza.com.

Processing of Personal Data Outside the UK/EU

To provide the Services, we may process your Personal Data outside the UK/EU. Where we do so, we will ensure appropriate safeguards are in place to protect your Personal Data in accordance with applicable data protection laws.

15. DEFINITIONS

Aggregated Data: Data that has undergone a process whereby raw data is gathered and expressed in a summary form for statistical analysis, rendering it anonymous and no longer Personal Data.

Cookies: Small files stored on a user's device designed to hold data specific to a particular user and website.

De-Identified Data: Data where all personally identifiable information has been removed, rendering the data anonymous and no longer Personal Data.

SCORZA Performance Vest: Your SCORZA Performance Vest is a performance garment with a pocket designed to securely hold your smartwatch. When used in conjunction with the SCORZA smartwatch app, it enables the collection of certain types of Personal Data through your own smartwatch device.