PRIVACY POLICY

At EYELIGHTS, protecting your personal data is a priority.

When you use our application (hereinafter the "Application"), we collect personal data relating to you.
The purpose of this policy is to inform you how we process this data.

1. Who is the data controller?
The data controller is the company EYELIGHTS, a simplified joint-stock company (SAS), registered with the Toulouse Trade and Companies Register under number 819 514 118, with its registered office at 308 allée du Lac, LABEGE 31670, France (hereinafter "we").

2. What data do we collect?
Personal data is any information that allows an individual to be identified directly or when combined with other data.

We collect data falling into the following categories:

• Identification data (including your last name, first name, email address, phone number, and photo);

• Connection data (for example, logs, account creation date);

• Data relating to your telephone conversations (including the start and end date/time of each call);

• Precise or approximate geolocation data in order to: (i) share your position with other users and (ii) provide the GPS navigation service.

When you use our Application, we may use approximate geolocation data (latitude, longitude, altitude) relating to you in order to: (i) adjust the volume of the EyeRide product based on your acceleration and braking, and (ii) share your position with other users.
This data is used both when you use the Application and when the Application is running in the background.
This data is only used with your explicit consent.

In addition, if you authorize us, we will collect the personal data of your contacts available in your device's phone directory (namely their phone number and email address) so that you can directly find them in our Application and contact them more easily.

Mandatory data is indicated when you provide us with your information. These fields are marked with an asterisk and are necessary for us to provide you with our services.

3. On what legal basis, for what purposes, and for how long do we keep your personal data?

4. Who are the recipients of your data?
The following parties will have access to your personal data:

• (i) Our company's personnel;

• (ii) Our subcontractors: hosting provider, CRM tool, VOIP communication provider;

• (iii) Where applicable: public and private bodies, exclusively to meet our legal obligations.

5. Is your data likely to be transferred outside the European Union?
Your data is kept and stored for the entire duration of processing on the servers of AMAZON WEB SERVICES, located within the European Union.

In connection with the tools we use (see Article 4 on recipients regarding our subcontractors), your data may be transferred outside the European Union. Such transfers are secured through the following mechanisms:

• Either the data is transferred to a country deemed to provide an adequate level of protection by an European Commission decision;

• Or we have signed a specific contract with our subcontractors governing the transfer of your data outside the European Union, based on the Standard Contractual Clauses approved by the European Commission between a data controller and a processor;

• Or we use appropriate safeguards provided for under applicable regulations.

6. What are your rights regarding your data?

You have the following rights regarding your personal data:

• Right to information: this is precisely the purpose of this policy.

• Right of access: you have the right to access all your personal data at any time.

• Right to rectification: you have the right to correct inaccurate, incomplete, or outdated personal data at any time.

• Right to restriction: you have the right to obtain restriction of processing of your personal data in certain cases defined in Article 18 of the GDPR.

• Right to erasure: you have the right to request that your personal data be erased and to prohibit any future collection.

• Right to lodge a complaint with a competent supervisory authority (in France, the CNIL), if you consider that the processing of your personal data violates applicable laws.

• Right to set directives regarding the retention, erasure, and disclosure of your personal data after your death.

• Right to withdraw consent at any time: for purposes based on consent, you may withdraw your consent at any time. This withdrawal will not affect the lawfulness of processing carried out before withdrawal.

• Right to data portability: under certain conditions, you have the right to receive the personal data you provided to us in a standard machine-readable format and to request its transfer to a recipient of your choice.

• Right to object: you have the right to object to the processing of your personal data. Note, however, that we may continue processing despite this objection for legitimate reasons or for the establishment, exercise, or defense of legal claims.

You may exercise these rights by writing to us at the contact details below. We may ask you to provide additional information or documents to verify your identity.

7. Contact point for personal data

Contact email: customercare@eye-lights.com
Contact address: EyeLights, 308 allée du Lac, Lake Park, 31670 Labège, France

8. Modifications
We may modify this policy at any time, in particular to comply with regulatory, jurisprudential, editorial, or technical changes. These modifications will apply from the effective date of the modified version. You are therefore encouraged to regularly consult the latest version of this policy.

Effective date: 11/05/2026