OULUTION LEGAL

OULUTION COOKIE POLICY

Oulution Holdings Limited · Business Registration Number 72443593

Registered office: Room D07, 8/F, Kai Tak Fty Building, No. 99 King Fuk Street, Sanpokong, Kowloon, Hong Kong

Last updated: 1 May 2026 Effective date: 1 May 2026

ON THIS PAGE

1. About this Policy

1.1 This Cookie Policy explains how Oulution Holdings Limited (“Oulution”, “we”, “us”, “our”), a company incorporated in Hong Kong with Business Registration Number 72443593 and registered office at Room D07, 8/F, Kai Tak Fty Building, No. 99 King Fuk Street, Sanpokong, Kowloon, Hong Kong, uses cookies and similar technologies on the Oulution website at oulution.ai and in the Oulution mobile applications (together, the “Services”). It should be read together with the Oulution Privacy Policy.

1.2 This Policy is provided to satisfy transparency obligations under:

(a) the ePrivacy Directive 2002/58/EC (as amended by Directive 2009/136/EC);

(b) the UK Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”);

(c) the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”);

(d) the UK General Data Protection Regulation and the Data Protection Act 2018 (“UK GDPR”);

(e) the Hong Kong Personal Data (Privacy) Ordinance (Cap 486) (“PDPO”);

(f) the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”); and

(g) other applicable data-protection and electronic-communications laws.

1.3 Questions about this Policy can be directed to info@oulution.ai.

2. What cookies and similar technologies are

2.1 A cookie is a small text file placed on your device (computer, tablet, phone) when you visit a website. Cookies allow the website to recognise your device and store certain information about your preferences or actions.

2.2 Similar technologies we may use include:

(a) Software development kits (SDKs) embedded in our mobile applications that perform functions analogous to cookies;

(b) Pixels and web beacons — small graphic images used to track user interactions with web content or email;

(c) Local storage and session storage — browser-based storage mechanisms that persist data on your device;

(d) Device identifiers — persistent identifiers such as advertising IDs (IDFA on iOS, GAID on Android);

(e) Fingerprinting techniques — where used, we treat these as equivalent to cookies for consent purposes.

2.3 Cookies and similar technologies may be:

(a) First-party — set by Oulution directly; or third-party — set by a service provider or partner on our behalf or for their own purposes;

(b) Session — deleted when you close your browser or app; or persistent — remaining on your device until they expire or you delete them.

3. Categories of cookies and similar technologies we use

We use four categories, described below. A live, up-to-date inventory of each specific cookie or SDK in each category — including its name, provider, purpose, duration, and whether first-party or third-party — is available in the Cookie Preferences panel accessible from any page of the Services.

(a) Strictly necessary. Required for the Services to function. Includes authentication, session management, security, load balancing, fraud prevention, and remembering your consent choices. These cannot be disabled without breaking core Service functionality. Legal basis: no consent required under the exemption in Article 5(3) of the ePrivacy Directive and regulation 6(4) of PECR (strictly necessary for the provision of a service explicitly requested by the user).

(b) Functional. Remember your preferences (language, region, display settings, matter drafts in progress) to improve your experience. Legal basis: consent.

(c) Analytics. Help us understand how users interact with the Services so we can improve them. Includes aggregated usage metrics, feature adoption tracking, performance monitoring, and error tracking. Where we use analytics providers, we configure them to minimise data collection (IP truncation, no cross-site tracking) where technically supported. Legal basis: consent.

(d) Advertising and marketing. Used to measure the effectiveness of our marketing campaigns, attribute sign-ups to source channels, and, where applicable, deliver relevant advertising on third-party platforms. Legal basis: consent.

4.1 On your first visit to the Services (and periodically thereafter, or when we materially change our cookie use), we display a cookie consent banner offering:

(a) Accept All — enables all cookie categories;

(b) Reject All — presented with equal visual prominence to Accept All (as required by CJEU judgment Planet49 Case C-673/17, and by guidance from the CNIL, the ICO, the EDPB, and other supervisory authorities); rejects all non-essential cookies;

(c) Manage preferences — granular per-category controls with no pre-ticked boxes. Consent is only recorded on affirmative action.

4.2 You can change your preferences at any time via the Cookie Preferences link available in the footer of every page of the Services, or through your browser or device settings.

4.3 No cookie wall. We do not condition access to the Services or to substantive content on your acceptance of non-essential cookies.

4.4 Consent lifetime. Consent is stored for a maximum of 12 months, after which we will re-request it. You can withdraw consent at any time without any detriment to your use of the Services.

5. Third-party cookies and cross-border transfers

5.1 Some cookies are set by third-party service providers on our behalf. These third parties may transfer data internationally. Where such transfers involve personal data leaving the EEA, the UK, mainland China, or another jurisdiction with data-transfer restrictions, we rely on the transfer mechanisms described in the Oulution Privacy Policy, including EU Standard Contractual Clauses, the UK International Data Transfer Addendum, the PIPL Standard Contract, adequacy decisions, and equivalent instruments.

5.2 The Cookie Preferences panel identifies which third parties are associated with which cookies and where they are established.

6. Do-Not-Track, Global Privacy Control, and equivalent signals

6.1 We honour the Global Privacy Control (GPC) browser signal for California users as an opt-out of “sale” or “sharing” of personal information under the CCPA (as required by CCPA § 1798.135(b) and CPPA regulations).

6.2 Browser-level Do Not Track (DNT) signals are not currently a defined legal standard and we do not treat them as a binding consent instruction, save where mandated by applicable law.

6.3 Where a jurisdiction develops an equivalent standard opt-out signal recognised by law, we will honour it.

7. Mobile applications

7.1 In our mobile applications, we use SDKs and device identifiers rather than browser cookies. Consent for these is obtained in the app on first launch, using the same four-category framework and equal-prominence Accept All / Reject All choices described above.

7.2 On iOS, we use Apple’s App Tracking Transparency (ATT) prompt where our use of the advertising identifier (IDFA) requires it. On Android, we honour the user’s advertising-ID reset and opt-out settings.

8. Retention

Cookie durations are set out for each cookie in the Cookie Preferences panel. Session cookies expire at the end of the session. Persistent cookies expire at intervals ranging from 24 hours to a maximum of 12 months, unless a shorter period is required by law.

9. Contact and complaints

9.1 Questions or concerns about this Policy: info@oulution.ai.

9.2 You have the right to lodge a complaint with the data-protection or communications regulator in your jurisdiction, including:

(a) the Hong Kong Privacy Commissioner for Personal Data (PCPD);

(b) the UK Information Commissioner’s Office (ICO);

(c) the EU/EEA supervisory authority in the Member State of your habitual residence, place of work, or place of the alleged infringement;

(d) the California Privacy Protection Agency (CPPA);

(e) equivalent authorities in other jurisdictions.

10. Changes to this Policy

We may update this Policy from time to time. Material changes will trigger a fresh cookie consent banner. The “Last updated” date at the top of this Policy indicates when it was most recently revised.