Privacy Policy

1. About ORamaVR & this Policy

We are ORamaVR S.A., a Switzerland based company, which creates virtual reality (VR) software products and services and operates a platform where users can download and obtain services related to or in connection with our VR products. In order to provide you with the best of our services we need information that we obtain through the collection and processing of Personal Data.

We are committed to protecting and respecting the privacy of our user's Personal Data and will process all Personal Data fairly, lawfully, and transparently. We stay in line with Regulation (EU) 2016/679 (GDPR), the Swiss Federal Act on Data Protection (FADP), and all other applicable data protection laws.

We have set forth this Privacy Policy to explain how we, ORamaVR S.A. and our affiliates (collectively "Company", "we", "us", or "our") collect, use, transfer, disclose and protect your information and Personal Data as part of our technology platforms, including our websites (www.oramavr.com / portal.oramavr.com), web pages, forum, social media pages, and software (the "Services").

By accessing and continuing to use our Services and by submitting Personal Data to us, you confirm that you agree to this Privacy Policy. We reserve the right to update this Policy at any time by posting the revised version on our website.

2. Personal Data Controller

ORamaVR S.A. (an incorporation pursuant to the laws of Switzerland, located at Route de la Galaise 34, c/o FONGIT, CH-1228 Plan-les-Ouates, Geneva, Switzerland) is the controller and is responsible for the collection and processing of your Personal Data.

3. Personal Data we collect

"Personal data" means any information relating to an identified or identifiable natural person. It does not cover information which cannot be used to identify you ("Anonymous Data").

(i) Personal Data You Give Us

We collect the Personal Data you knowingly and voluntarily provide when you use our Services, including:

• Your name and email address
• Country
• Username, password, and avatar
• Internal account IDs assigned to your account

If you use single sign-on (Google or Facebook), we may also collect your Google email address / authentication token, or your Facebook user ID and registered email address (if permitted).

We also collect information you provide through forms, surveys, or correspondence, as well as suggestions and feedback you share with us.

(ii) Analytics Data from Our VR Software

When you use our VR software, we collect and analyse data including: completion time per action, skipped actions, scores, session time, session count, error/warning counts, session dates, scenario IDs, hand movements, interactions, avatar movements and speech.

(iii) Data from Your Web Browser

We may automatically collect data sent by your web browser, such as: device details, IP address, login data, browser type and version, time zone, operating system, and date/time of visits. We may also collect browsing patterns and usage statistics via cookies, server logs and similar technologies. Please see our Cookie Policy for more information.

(iv) Data from Third Parties

We may receive data from business partners and service providers that furnish analytical or geographic/demographic information, including social networking services such as Facebook and Twitter.

(v) Advertising Data

We may collect information regarding visits to advertisements we host on behalf of our clients, which may include view counts, view duration, time of day, and IP address.

4. How we use your Personal Data

We may use the Personal Data we collect for the following purposes:

• a. To operate and provide our Services — create accounts, enable features, communicate with you, provide support, and respond to enquiries.
• b. To improve our Services — analyse usage, identify technical issues, research user preferences, develop new features and functionality.
• c. To advertise — use Advertising Data to evaluate and enhance advertising campaigns.
• d. To promote safety and security — verify accounts, combat harmful conduct, detect and prevent fraud, maintain the integrity of our Services.
• e. For research and analysis — use aggregated, de-identified data to better understand and serve our users.
• f. Marketing communications — send information about our products and services subject to your communication preferences. You may unsubscribe at any time.
• g. Contractual obligations — carry out our obligations arising from contracts between you and us.
• h. Legal compliance — comply with court orders, laws, and regulatory requests.
• i. With your consent — for any other purpose for which we provide specific notice at the time of collection.

5. Lawful basis for processing

We will only collect and process your Personal Data where we have a lawful basis to do so:

• For purposes under Sections 4a and 4d — performance of a contract (Art. 6 par. 1a GDPR).
• For purposes under Sections 4b, 4c, 4d, 4e and 4g — legitimate interests, except where overridden by your interests or fundamental rights (Art. 6 par. 1f GDPR).
• Where required by law — legal obligation.
• For any other purpose — your explicit consent, which you may withdraw at any time by contacting us at info@oramavr.com.

6. Where your data is stored

Our Company maintains servers in the United States of America where your Personal Data may be stored and processed. We take all reasonable steps to ensure that Personal Data is stored securely and apply the same protections described in this Privacy Policy, regardless of storage location.

7. Who we may disclose your data to

Except as described in this Policy, we will not disclose Personal Data to third parties without your consent. We may disclose data in the following circumstances:

• a. Service providers — external providers who help us administer and provide our Services (e.g. data storage, analytics, hosting). They process data only on our behalf and under strict confidentiality obligations.
• b. Other users — when you use our VR Software, profile information (username, avatar), achievements, and scores may be visible to other users.
• c. Third parties — aggregated, non-personal, or de-identified data may be shared for reporting, business or marketing purposes.
• d. Legal and protection purposes — where reasonably necessary to respond to legal process, protect rights and safety, or investigate illegal activity.
• e. Business transactions — in connection with a merger, acquisition, asset sale, or similar transaction, your Personal Data may be transferred to the acquiring party and will remain subject to this Privacy Policy.

8. International data transfers

Where we transfer your Personal Data from Switzerland or the EU to other countries including the USA, we ensure a similar degree of protection is maintained by implementing at least one of the following safeguards:

• Transferring to a country deemed adequate by the European Commission.
• Using specific contracts approved by the European Commission (Standard Contractual Clauses).

9. How we keep your data safe

We have put in place appropriate legal, organisational, technical and administrative security measures to protect your Personal Data from accidental loss, unauthorised access, improper alteration or disclosure. Access is limited to employees, agents, and contractors with a legitimate business need.

However, no security system is impenetrable. We cannot guarantee the absolute security of your Personal Data over the Internet. It is your responsibility to keep your password confidential. If you believe your password has been compromised, please advise us immediately at info@oramavr.com.

10. How long we keep your data

We retain your Personal Data for as long as necessary to provide the Services and fulfil the purposes set out in this Policy, unless a longer retention period is required by law. When we no longer need your data, we will either delete it or anonymise it so it can no longer be associated with you.

11. Your privacy rights

As a data subject you have the following rights. To exercise any of these rights, please contact us at info@oramavr.com. We aim to respond within 30 days.

• Right of access — request a copy of the Personal Data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your data where there is no longer a lawful basis for processing.
• Right to restriction — request that processing be restricted to storage only while accuracy or lawfulness is assessed.
• Right to object — object to processing based on legitimate interests, including direct marketing.
• Right to data portability — obtain a digital copy of your data or request a transfer to another company (applies to automated data collected with consent or for contract performance).
• Right to withdraw consent — withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint — complain to your local data protection supervisory authority if you believe we have not complied with data protection laws.

12. Minors

13. Links to third-party websites

Our website may include links to partner, advertiser, or social media websites. These sites have their own privacy policies and we do not accept responsibility for them. Please review the applicable privacy policy before submitting Personal Data to any third-party website.

14. Changes to this Policy

We may update this Privacy Policy from time to time. If changes are significant, we will provide notice by email or through our Services. The "Last Updated" date at the top of this page will always reflect the most recent revision. Your continued use of our Services after any revision constitutes acceptance of the updated Policy.

15. General Data Protection Regulation (GDPR)

The GDPR came into effect on May 25th, 2018 and aligns data privacy laws across all EU countries. If you are a citizen of the EU or EEA using our Services, we will maintain your Personal Data in accordance with the principles of the GDPR as outlined in this Policy.

16. How to contact us

If you have any questions regarding this Privacy Policy, please contact us:

• Email: info@oramavr.com
• Data Protection Officer / Advisor: dpo@oramavr.com
• Postal address: ORamaVR S.A., Route de la Galaise 34, c/o FONGIT, CH-1228 Plan-les-Ouates, Geneva, Switzerland

You may also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) or the data protection authority in your country.

Effective Date: June 16th, 2022