Data Protection Policy

3.1 For Fit has identified specific Purposes of Processing

Generally, the Company collects, uses, stores or otherwise Processes Personal Data in the following ways:

• • I only process Personal Data for specific Purpose(s) of Processing.

• • when Data Subject submits any form or document, enters into a formal agreement or provides other documentation or information in respect of its interactions and commercial relationship with For Fit;

• • when Data Subject interacts with For Fit personnel, including customer service officers, relationship personnel and other representatives, for example, via telephone calls, letters, fax, face-to-face meetings and email;

• • when Data Subject’s images are captured by For Fit via CCTV cameras while Data Subject is within the Company’s premises;

• • when Data Subject uses For Fit services provided through online and other technology platforms;

• • when Data Subject requests that For Fit contact him, be included in an email or other mailing list; or when Data Subject responds to For Fit’s request for additional Personal Data;

• • when Data Subject uses the Company’s electronic services, or interact with For Fit via our websites;

• • when For Fit carries out checks, due diligence or other screening activities (including background checks) in accordance with legal or regulatory obligations or the Company’s risk management procedures that may be required by law or that may have been put in place by For Fit;

• • when For Fit acts on preventing or investigating any fraud, unlawful activity or omission or misconduct relating to Data Subject’s relationship with For Fit or any other matter arising from Data Subject’s relationship with For Fit, For Fit will collect your e-mail address to send you “transactional emails” with the product if you decide to buy it. If you agree to subscribe to the service newsletter, we will, from time to time, send free commercial marketing, content and promotional materials to your email address;

• • when For Fit is complying with or as required by any request or direction of any public authority; or responding to requests for information from regulatory agencies, ministries, statutory boards or other similar authorities,

• • when For Fit performs financial reporting, regulatory reporting, management reporting, risk management reporting (including monitoring risk exposure) audit reporting,

• • when For Fit seeks information about Data Subject and receive Data Subject’s Personal Data in connection with its relationship with For Fit, from business partners, public agencies, current - employer and the relevant authorities; and/or

• • when Data Subject submits its Personal Data or the Personal Data of a third party (e.g. information on spouse, children, parents, and/or employees etc.) to For Fit for any other reason.

All the above activities are labelled as Purposes of Processing and are listed in the For Fit Records of Processing.

3.2 For Fit’s Purpose of Processing have a lawful and valid basis

For Fit’s Purposes of Processing are grounded on one of the following basis:

The basis for each For Fit’s Purpose of Processing is mentioned in For Fit Records of Processing.

3.3 The Processing is limited to only what is necessary for achieving the For Fit’s Purpose of Processing

4.1 For Fit informs the Data Subjects of the Processing activity

As a rule, documents that are given to Data Subject (either forms or contracts) contain all the required information for For Fit to observe the Company’s obligations to duly inform the Data Subjects of the Processing Activity.

Notwithstanding the letter of the documents given to Data Subjects, upon request, For Fit personnel will explain thoroughly to what business activity is the Processing related to, what type of Personal Data is requested from the Data Subject, and that Company has set-up appropriate organizational and technical measures to ensure that Personal Data is kept safe and confidential.

In case the Data Subjects are not required to fill in independently forms as Data Subjects are only required to submit certain documentation or to give their Personal Data verbally, For Fit personnel will have the obligation to inform the Data Subject of all the coordinates of the Processing activity. The checklist of the aspects that need to be brought to the attention of the Data Subject are the following:

In case of profiling and/or automated decision making, For Fit will ensure the observance of the Data Subject’s rights:

• • – Data Subject shall be informed, upon the commencement of data processing, of the fact of profiling/automated decision-making, the range of his/her Personal Data involved in profiling, the logic involved in the method applied and the possible consequences of automated decision-making on the Data Subject.

• • Where a decision can be delivered in a process either entirely as a result of an automated sub-process or also with human intervention, the Data Subject must then be informed of the cases where the Company can make decision entirely by automated means (as a result of a sub-process).

• • When informing about the logic the automated decision-making is based on, it is not necessary to disclose in detail the algorithm, formula or business rationale applied (this information need not to be so in-depth as to compromise the Company’s business secrets). It is suggested to present the operation of automated decision-making by using examples.

• • -The Data Subject subjected to an automated decision-making is entitled to request human intervention from the For Fit, to make his/her position known and submit an objection against that decision. This right to challenge does not entitle the Data Subject to force the conclusion of the contract, but to dispute the decision based on automated data processing leading to the rejection of concluding the contract.

• • The Data Subject must be granted the opportunity in any case to avail of his/her right to make an objection.

• • -If the legal basis for Processing is a legitimate interest of For Fit, the Data Subject is entitled to the right to object. It follows from the right to object that the Company must examine whether this objection is justified (i.e. whether the Data Subject’s interests override the Company’s interests) and decide on the objection.

4.2 For Fit personnel recognizes and knows how to deal with a request from Data Subjects

EU Data Protection Laws impose that any Data Subject request is responded as soon as possible but no later than 30 days from receipt.

For Fit employees will treat with the utmost importance all enquiries from Data Subjects about the Processing activity.

In all cases, For Fit employees will inform Data Subjects that they may submit a formal request and/or a complaint to the designated address, representing the contact details of the DPO appointed by the Company.

5.1 Data Protection Officer appointed by For Fit

The Company appoints a Data Protection Officer that fulfils the required skills profile as defined in the EU Data Protection Laws:

• • Data Protection Officer function is established as a position directly subordinated and in direct reporting line to Top Management;

• • Data Protection Officer function is not subject to conflicting interests;

• • For Fit involves Data Protection Officer properly and in a timely manner in all issues which relate to the protection of Personal Data;

Company shall:

• • publish the contact details of the Data Protection Officer to Data Subjects and also internally on Company’s intranet, internal telephone directory, and organizational charts to ensure that his or her existence and function is known within the organization;

• • communicate the contact details to the competent supervisory authority;

• • make sure that Data Protection Officer is invited to participate regularly in meetings of senior management;

• • always give a due weight to Data Protection Officer´s opinion. In case of disagreement it is important to document the reasons for not following the Data protection Officer’s advice;

• • promptly and without undue delay consult the Data Protection Officer once a data breach or other incident has occurred;

• • support Data Protection Officer by ‘providing resources necessary to carry out his/her tasks and access to Personal Data and processing operations, and to maintain his or her expert knowledge’.

• • provide the Data Protection Officer with regular training. Data Protection Officer will be given the opportunity to stay up to date with regard to developments within data protection. The aim should be to constantly increase the level of expertise of Data Protection Officer, he/she should be encouraged to participate in training courses on data protection and other forms of professional development, such as participation in privacy fora, workshops, etc.;

• • ensure that the Data Protection Officer ‘does not receive any instructions regarding the exercise of his or her tasks’.

Data Protection Officer shall be bound by secrecy or confidentiality concerning the performance of his or her tasks.

5.2 Internal roles dedicated to Data Protection Compliance at business departments’ level

Data protection compliance is a continuous independent responsibility for each and every employee of the Company and failure to observe this policy may lead to professional liability.

5.3 Internal Regulations

As a general statement, this Data Protection Policy supplements all existing policies. In case of any discrepancies within this Data Protection Policy and EU Data Protection Laws, the latter shall prevail.

We take the privacy of our customers seriously. If you would like to delete your account, you can do so by visiting our website, https://usa.diabeat.com/customers/profile. To initiate the account deletion process, you will be prompted to enter the email associated with your account. Once you have entered your email, you will receive a confirmation email containing a link to complete the account deletion process. Please note that once your account is deleted, all personal information and data associated with the account will be permanently removed from our system and will not be recoverable. If you have any questions or concerns about our account deletion process, please contact us. By initiating the account deletion process, you confirm that you understand and agree to the terms of our privacy policy, including the permanent deletion of your personal information and data associated with your account.