PRIVACY POLICY

Effective Date: 1 March 2026

Data Controller

The responsible legal entity for processing your personal data depends on your location and the nature of your interaction with DOTS&BITS: • For users located within the European Economic Area (EEA): Lexagon Group GmbH, Seestr. 45, 82211 Herrsching, Germany Email: dpo_eu@dotsandbits.com • For users located in Singapore or the Asia-Pacific region: Lexagon Capital Partners Singapore Pte. Ltd., 1 Scotts Road, #24-10, Singapore 228208 Email: dpo_asia@dotsandbits.com In some cases—such as where services span both regions—these entities may act as joint controllers. You may exercise your data rights with either entity.

Legal Basis for Processing

We process your data based on the following legal grounds: • Consent (Art. 6(1)(a) GDPR / Sec. 13 PDPA) • Contractual necessity (Art. 6(1)(b) GDPR) • Legal obligations (Art. 6(1)(c) GDPR) • Legitimate interests (Art. 6(1)(f) GDPR), such as improving services, ensuring security, or internal reporting

Information We Collect

3.1 Personal Data You Provide We may collect personal data that you provide directly, including: Name, Email address, Telephone number, Company name, Payment and billing information, Any other details voluntarily submitted through forms or communication. 3.2 Automatically Collected Data When you use our website, we may collect: IP address, Browser type and version, Device identifiers, Access dates and times, Pages visited and usage patterns, Cookies and similar tracking data (see Cookie Policy).

Purpose of Processing

We use your data to: • Deliver, improve, and maintain our services • Respond to inquiries or service requests • Process payments and manage user accounts • Send essential service updates • Provide marketing communications (only with consent) • Comply with legal or regulatory obligations

Marketing and Communication Preferences

With your explicit consent, we may send marketing updates about DOTS&BITS services or selected partner offerings. You may withdraw consent at any time using the unsubscribe link in emails or by contacting: • dpo_eu@dotsandbits.com (EU) • dpo_asia@dotsandbits.com (Asia)

Use of Cookies

We use cookies and similar technologies to improve your browsing experience and analyze traffic. You can manage preferences via our Cookie Consent Banner. For details, see our Cookie Policy.

Data Sharing

We may share your data with: • Trusted service providers (e.g., hosting, analytics, payment processors) • Affiliated companies within the Lexagon Group • Legal authorities as required by law • Business acquirers in case of restructuring, sale, or merger All third parties are contractually obligated to process data securely and only as instructed.

International Data Transfers

If your data is transferred internationally (e.g., from the EU to Singapore), we ensure appropriate safeguards, such as: • Standard Contractual Clauses (SCCs) • Binding contractual obligations • Local compliance mechanisms

Data Retention

We retain personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable law.

Your Rights

EU/EEA Residents (GDPR) — You have the right to: Access your data, Rectify inaccurate information, Erase your data ("right to be forgotten"), Restrict or object to processing, Request data portability, Withdraw consent at any time, Lodge a complaint with your local Data Protection Authority. Singapore Residents (PDPA) — You have the right to: Access your data, Correct inaccurate data, Withdraw consent, Request data portability (when implemented by the PDPC). To exercise these rights: • EU: dpo_eu@dotsandbits.com • Asia: dpo_asia@dotsandbits.com

Data Security

We take your data seriously. Measures include: • Data encryption (in transit and at rest) • Secure data centers • Access controls and audit logs • Staff training and regular security reviews While no system is completely immune to risks, we take reasonable steps to protect your data.

Third-Party Websites

Our website may contain links to third-party sites. DOTS&BITS is not responsible for the content or data practices of these sites. Please review their privacy policies independently.

Updates to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal obligations. Updates will be posted with a revised effective date. Continued use of our services after updates means you accept the changes.

Contact

For all privacy inquiries or data subject rights requests, please contact: EU Contact: Email: dpo_eu@dotsandbits.com Address: Lexagon Group GmbH, Seestr. 45, 82211 Herrsching, Germany Asia Contact: Email: dpo_asia@dotsandbits.com Address: Lexagon Capital Partners Singapore Pte. Ltd., 1 Scotts Road, #24-10, Singapore 228208