WisDM Privacy Policy

RAKwireless Technology Limited

Room 1002, 10/F, Easey Commercial Building, 253-261 Hennessy Road, Wan Chai, Hong Kong, People's Republic of China

Email: [email protected]

Data Protection Officer

Please contact us [email protected] to receive answers to any data protection-related questions. Please note that we may record any communication to preserve the evidence of your request and our response.

In order to use the Platform you should have a registered RAK ID account (the “RAK ID Account”, and associated data is “RAK ID Account Data”), which is also operated by us. More information regarding the Account is available in RAK ID Privacy Notice (the “RAK ID Notice”), which is available on the RAK ID website (the “RAK ID Website”).

By logging in or registering on the Platform using your RAK ID Account, you grant WisDM permission to access and retrieve specific personal information data from your RAK ID Account (referred to as the "WisDM Profile Data"). The WisDM Profile Data is necessary for creating one or more organizations within WisDM that are associated with your RAK ID. This data will be displayed within WisDM under the section titled "Your RAK ID information".

If you do not have a RAK ID Account, you may register it within the Platform. In this case, the entered data will be stored both within the Platform and the RAK ID Account.

Please note that you can manage your RAK ID Account and WisDM Profile Data within the interface available within the RAK ID Website.

The data processing of the WisDM Profile Data is also subject to the RAK ID Notice. We suggest you read the RAK ID Notice before registering and using the RAK ID Account.

We may collect and process the following personal information:

1. WisDM Profile Data: when you login to the Platform with your RAK ID Account or register a RAK ID Account within the Platform. Your email address is also processed if you are invited to use the Platform;
2. Purchase Data: when you purchase a subscription within the Platform;
3. Contact Data: when you contact our support team or us via contact details provided herein or within the Platform;
4. Automatically Collected Data: when you use the Platform.

A. WisDM Profile Data:

As described above, to use the Platform you should grant WisDM permission to access and retrieve the WisDM Profile Data from your RAK ID Account. Accordingly, we receive the WisDM Profile Data (i.e., personal data which is related to your RAK ID Account). Such data may include the following:

*Note for users registered before the Last Updated date above: the new purpose for processing email addresses was introduced on the Last Updated date above. For this purpose we conducted the necessary purpose compatibility test to ensure that your privacy is not jeopardised. If you wish to request the test or general explanations, please contact us.

The mandatory data is transferred to us in any case, because this data is always contained within your WisDM Profile. We receive the optional data only if you provided such information within the RAK ID Account. Please note that you can modify or delete respective data within the RAK ID Website. The Platform does not have the functionality to alter or erase your RAK ID Account Data or WisDM Profile Data.

B. Purchase Data

Within the Platform you may be able to purchase, maintain, and manage your subscription. In order to process payments and complete the transactions within the Platform, we use the Stripe solution (“Stripe”). Stripe is a third-party solution that collects and processes your Purchase Data on our behalf. To process the payment the following Purchase Data is collected:

1. credit/debit card number, CVC code, and expiration date;
2. purchase amount;
3. date of purchase;
4. cardholder’s name;
5. email address;
6. country;
7. phone number;
8. business name (if you provide us with your personal name, not a name of a legal entity);
9. billing/shipping address (address line, city, state (if applicable), postal code, country);
10. tax information, including ID type and ID number.

The aforementioned information is necessary for the payment processing and is collected (and processed) in order to perform a contract with you or the organisation you represent (purchase or renewal of the subscription) and comply with legal obligations imposed on us. Such information is processed by Stripe on our behalf and will not be processed by us. Stripe is a United States and Irish company, which will process your personal data in accordance with its privacy documentation available on its website, including the Privacy Policy available at https://stripe.com/privacy.

After the payment is processed, we will retain and process the following information related to your payment:

1. purchase date;
2. type of purchase (purchase, renewal, upgrade, or downgrade of the subscription plan);
3. type of the chosen plan;
4. total amount of the transaction;
5. four last payment card digits;
6. subscription period;
7. invoice generated by Stripe and information available therein.

Such information is necessary for the performance of the contract with you or the organisation you represent (purchase or renewal of the subscription) so we can verify that you purchased the respective subscription.

C. Contact Data

You may contact us via the contact details indicated in this Policy or by making a support request within the Platform. When you contact us or submit a request, you may provide us with certain additional personal information. Such information may include your other email address or any other personal information that you choose to provide to us. When you submit a request within the Platform, we will also automatically receive the details related to your device, namely: operational system, type of device (desktop/mobile), browser version, etc.

This data is necessary to address your issue, answer your request, contact you back, or address you properly, where and as applicable depending on the type of personal information. The legal basis for processing such data — our legitimate interest to assist you with using the Platform.

D. Automatically Collected Data

In order to detect and fix bugs and crashes within the Platform, we use the Amazon Web Services (AWS) CloudWatch solution that records logs of your activities conducted within the Platform. The logs are combined with your email address and unique internal identifier (unique number assigned by us to each user at registration) to detect the user which had a technical problem within the Platform. More information about the Amazon Web Services (AWS) CloudWatch solution is available at APM Tool - Amazon CloudWatch - AWS.

We will access and use such information if we detect a vulnerability, bug, or crash of the Platform in order to determine the reason for such malfunction and fix it appropriately. Otherwise, we would not be reasonably able to detect the reason for such malfunction. The legal basis for processing such information is our legitimate interest to ensure the security, continuity, and availability of the Platform and its functionality.

Storage Period

The following table describes the storage period for each personal data item separately:

In particular cases we may also process your personal data longer than described above if it is required under the applicable law. We may also delete your personal data if it is required under the applicable law.

We do not sell or rent out your personal data. However, we may share your personal data if it is reasonably necessary for the performance of our undertakings with you and our legitimate interest to maintain and develop the Platform. In particular, your personal information is shared with the following categories of recipients:

1. RAK ID Account, if you register your RAK ID Account within the Platform;
2. our affiliates if necessary due to our corporate structure;
3. our subcontractors and team members, e.g., support team, technical team, etc.;
4. third-party solutions integrated within the Platform, e.g.:
   • a. Stripe that processes Purchase Data on our behalf;
   • b. Amazon Simple Email Service to send you system-related email notifications;
   • c. Brevo to send you marketing email notifications (Brevo Privacy Statement);
   • d. Zendesk to send you email for customer support request (Zendesk Privacy Policy); and
   • e. Amazon Web Services that provide us with the data storage facilities that are physically located in Germany;
5. government institutions that may request access to your personal data.

Please note that we and the aforementioned recipients are located in jurisdictions which may not ensure the same level of data protection as the country of your residence. We will endeavour to protect your personal data while it is processed, stored, or transferred. If and to the extent we are subject to the European Union General Data Protection Regulation, when we transfer personal data to a country that does not ensure the same level of data protection as the country of your residence, we will use additional safeguards, namely, Standard Contractual Clauses.

According to the applicable data protection legislation you may have the following data protection rights:

a. right to access:

You are able to request access to your personal data that we store about you. Among other you may ask us regarding:

• the purposes for collecting personal information about you;
• categories of personal information concerned;
• who receives your personal information or categories of such recipients;
• how long we are going to store the information about you and if not possible criteria to determine the storage period;
• the right to lodge a complaint with a supervisory authority;
• when your personal information was obtained not from you directly, the source where it came from;
• the existence of either profiling activities or automated decision making based on your personal information. Where such activities are performed, we should also inform you about importance, and expected consequences of them;
• copy of your personal information processed. For such requests further we may charge you with a reasonable fee. We generally provide users with the electronic copy of their personal information unless they request otherwise.

Please note that you may access the RAK Account Data within the RAK ID Website and download it by using respective functionality available within the RAK ID Website. You may access the WisDM Profile Data within the Platform.

b. right to rectification:

You have the right to correct inaccurate (for example, old or incorrect) personal information related to you. Please note that you may personally correct certain RAK ID Account Data (and accordingly the WisDM Profile Data) within the web-interface of the RAK ID Website.

c. right to erasure or the right to be forgotten:

You have, under certain circumstances, the right to request erasure of your personal information. Please note, that this right only applies to the data available at the time of request and is not applicable for future data.

Request to erasure of personal information is possible when:

• personal information is no longer needed for the purposes it was primarily collected or processed;
• when you have already withdrawn your consent for processing your personal data, and we do not have other legal ground to process it;
• when your personal data is processed under legitimate interest and you object to such legal ground. Moreover, there is no overriding legitimate interest to proceed processing of your personal data;
• your personal information was unlawfully processed;
• when your personal data has to be erased due to legal obligation.

Please note that you may delete your RAK ID Account (including the RAK ID Account Data) at any time using the respective functionality available within the RAK ID Website and WisDM Profile Data (including the WisDM Profile Data) at any time using the respective functionality available within the RAK ID Website or the Platform.

d. right to restrict processing:

You may request us to stop processing your personal information when:

• you have reasonable doubts that your information is accurate, and we are verifying the accuracy of such information;
• your personal information was unlawfully processed;
• the purpose of your personal information collection no longer exists, but you wish to store it longer to defend a legal claim.

Moreover, you may request us to stop processing your personal data while we are working on a rectification request or request to object processing of your personal information.

e. right to data portability:

You have the right to obtain from us and further reuse your personal data for your own purposes within other services. You will also be able to transfer your personal information from one IT environment to another in a safe and secure way, when certain conditions apply, such as:

• processing is based on your consent or needed for the contract performance;
• the processing is made only electronically, without any paper -based files included.

Please note that you may independently download the RAK ID Account Data by using respective functionality within the RAK ID Website.

f. right to object:

You have the right to object processing of your personal information at any time. This allows you to stop or prevent us from processing your personal information. This right is absolute, but applies when one of the following conditions are met, including:

• your personal information is used for direct marketing purposes;
• the processing is based on our legitimate interest;
• we are performing tasks carried out for the public interest or by governmental authority;
• your personal information was processed for either research or statistical purposes.

Please note that you may unsubscribe from receiving marketing notifications at any time by clicking the relevant unsubscribe button at the bottom of marketing notifications or by contacting us at the contact information provided above.

g. right not to be subject to automated decision making and profiling:

Currently, neither we nor the Platform use your personal data for profiling or decisions made solely by automated means.

h. right to lodge a complaint with a supervisory authority:

You have a right to lodge a complaint with a data protection authority in a country you either reside, permanently live, work or in a country where data protection infringement takes place.