Roundforest Ltd. (“Roundforest”, “we”, “our” or the “Company”) respects the privacy of its partners, websites visitors, users, and vendors, and is committed to protecting the personal information you may share with us (these and any others with respect to whom we collect personal data, shall collectively be referred to as “user”, “you” or “Data Subjects”).

This policy and notice (the “Privacy Policy”) explains the types of information we collect from you, that we receive about you or that you may provide in the course of your interest in our Services (as defined below), transactions with us or otherwise when you visit our websites. We are transparent about our practices regarding the information we collect, use, maintain and process and describe our practices in this policy and notice. Please read the following carefully to understand our practices regarding your personal data and how we will treat it.

IMPORTANT: BY USING ROUNDFOREST’S SERVICES, INCLUDING WITHOUT LIMITATION ITS CHATBOT, RECOMMENDATIONS PLATFORMS OR ANY OF ITS APPLICATIONS OR WEBSITES (THE “SERVICES”) YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTAND THE TERMS AND CONDITIONS OF THIS PRIVACY POLICY AND THAT ALL PERSONAL DATA (AS DEFINED UNDER REGULATION (EU) 2016/679 (GENERAL DATA PROTECTION REGULATION) (“PERSONAL DATA”) THAT YOU SUBMIT OR THAT IS PROCESSED OR COLLECTED THROUGH THE SERVICES MAY BE PROCESSED BY THE COMPANY IN THE MANNER AND FOR THE PURPOSES DESCRIBED IN THE FOLLOWING PRIVACY POLICY. IF YOU DO NOT AGREE TO THE TERMS AND CONDITIONS SET FORTH HEREIN PLEASE DO NOT USE THE SERVICES.

For the purposes of EU General Data Protection Regulation (the “GDPR”), the California Consumer Privacy Act, as amended (“CCPA”) and other applicable data protection and privacy laws, Roundforest is a data controller (or a business, under CCPA) in relation to the Personal Data of its users, partners, employees and website visitors.

SUMMARY

Information You Provide. When you use the Services, including when you sign up for an account, we may receive your Personal Data such as your name, photo, address, e-mail address, phone number, fields of interest, your social network or a third-party’s user ID through which you registered to or accessed the Services.

Information We Collect. We may collect your Personal Data (including de-identified aggregated data) through your use of the Services, from third parties (including without limitation, from social media plug-in in the Services or from Third Party Platforms (defined below) you interact with or access the Services from), and through communications you send us. We automatically collect and record Personal Data through your use of the Services such as your IP address, advertiser identifiers, cookie information, device ID and technical information regarding the method and nature of your use of the Services.

How We Use Your Information. We use your Personal Data for purposes such as providing you with, improving and operating the Services, understanding usage trends and user preferences, assisting users with online purchasing decisions, personalizing the Services, sharing it with our business partners, offering interest-based ads, and in order to protect the Services from threatening activities.

Recommendations Platform. We may access, review and retain the content of communications between recommenders and users on our recommendations platforms, for further information see ‘User Communications’ section below.

Chatbot Feature. We may collect Personal Data through your use of Company’s chatbot feature, as further detailed in Section 1.7 below.

Video Conferences. We may collect Personal Data through your use of video conferences as part of our customer support, as further detailed in Section 1.8 below.

Surveys and Contests. We may collect Personal Data through your participation in surveys or contests, as further detailed in Section 1.9 below.

Cookies, Web Beacons and Third Party Processors. We use cookies to collect the information described in this privacy policy, to manage and maintain the Services and to track your use of the Services. We may also use web beacons, third party tracking technologies and third party providers.

Links. The Services may contain links to other services, sites and applications that are subject to their own privacy and data protection policies.

Children. We do not intend to collect Personal Data from anyone we know to be under 16 years old. If you believe that we might have collected such information, please contact us.

Information Sharing. We grant access to your Personal Data to our affiliates, representatives, agents, third party service providers and business affiliates on whose website or platform you use the Services. In addition, we may share your Personal Data if required for the provision and maintenance and improvement of the Services; to satisfy applicable law; to prevent fraud or harm; to enforce agreements; or in the event of a merger, acquisition or other structural change or form of sale of part or all of our assets. Information Security. We follow generally accepted industry standards to protect against unauthorized access, alteration, disclosure or destruction of your Personal Data however we cannot guarantee its absolute security.

Retention Periods. We retain your Personal Data as needed for the purposes for which it was collected and for lawful, ethical and document retention purposes.

Data Integrity. We process Personal Data only for the purposes for which it was collected and take reasonable stapes to ensure that the Personal Data we process is accurate, complete and current. However, we depend on you to rectify your Personal Data when necessary. We may delete or avoid from recording and storing any information at our discretion.

Data Subjects’ Rights. At any time, you may contact us and request to exercise your rights in accordance with applicable law. For more details see ‘Data Subjects’ Rights’ section below.

Enforcement. We will cooperate with the appropriate regulatory authorities to resolve any formal written complaints regarding processing of Personal Data that cannot be resolved between us and the complaining individual.

International Transfers of Personal Data. Your Personal Data may be stored and processed in a country outside the country of your residence or from which you access the Services. Transfers of your Personal Data outside the EEA will comply with applicable laws.

Your U.S. State Privacy Rights. If you are a California, Colorado, or Nevada resident you may contact us and request information regarding your Personal Data disclosed to third parties for their direct marketing purposes.

Policy

You are not legally required to provide us with Personal Data, however, some features of the Services require you to do so pursuant to this Privacy Policy. In these cases, if you choose to withhold any Personal Data requested by us, it may not be possible for you to access or utilize certain Services. We recognize that privacy is important. This policy applies to all of the software, services, information, tools, features and functionality available on the Services offered by the Company or its subsidiaries or affiliated companies and covers how Personal Data that the Company collects and receives, including in respect of any use of the Services, is treated. If you have any questions about this policy, please feel free to contact us using the contact details provided below.

1. Information We Collect, Why and How We Use It.

Summary: We collect Personal Data about our website and Services users. We use Personal Data to provide and improve our Services, and to meet our contractual, ethical and legal obligations.

We collect Personal Data when you send it to us, or when a vendor, distributor or other business partner, sends it to us; we collect Personal Data through our website and Services, and through our interactions with you.

In order to provide and improve our Services, we may collect Personal Data, including the following types of information:

Processing which is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract (GDPR Article 6(1)(b)) OR Processing which is necessary for compliance with a legal obligation to which Company is subject (GDPR Article 6(1)(c)):

1.1. Information You Provide. For some features of the Services, including when you sign up for an account, we ask you for personal information, including: name, photo, email address, physical address, phone number, fields of interest, your social network or third party service provider user ID through which you accessed or registered to the Services (e. g. Facebook ID, hereinafter, “Third Party Platforms“) and if you sign-up as a recommender to our recommendations platform also your bank account details.

Processing which is necessary for the purposes of the legitimate interests pursued by Company or by a third party (GDPR Article 6(1)(f)) of providing efficient and effective Services to our customers, including:

1.2. Third Parties. We sometimes supplement the information that you provide with information that is received from third parties. If you access the Services through any Third Party Platforms, or interact with any Third Party Platforms or other social media plug-in in the Services (such as a Facebook “Like” button) we may receive information from your respective social media or Third Party Platforms account, including your account information, photo and any information defined as public pursuant to the policies of such Third Party Platforms and/your settings in the respective Third Party Platform.

1.3. User Communications.

1.3.1. When you send email or other communication to the Company or provide your email as part of your Personal Data, we may retain those communications in order to process your inquiries, respond to your requests and improve our Services. We may send you push notifications to send you news and updates in respect of the Services. We may also send you newsletters and promotional communications, you may opt-out of this service at any time by submitting a request at the following email address: privacy@roundforest.com.

1.3.2. When recommenders and users chat in our recommendations platform we may access, retain and review such communications for the purpose of improving the platform, quality control, enforcement of our policies, for referring you to products and services and also for learning user preferences and improving our services.

1.3.3. When you provide us with any information as part of your feedback in response to surveys and contents we may conduct from time to time.

1.4. Aggregated Personal Data. In an ongoing effort to better understand and serve the users of the Services, Company often conducts research on its customer demographics, interests and behavior based on the Personal Data and other information provided to us. This research may be compiled and analyzed on an aggregate basis, and Company may share this aggregate data with its affiliates, agents and business partners. This aggregate information does not identify you personally. Company may also disclose aggregated user statistics in order to describe our services to current and prospective business partners, and to other third parties for other lawful purposes.

1.5. User Information. When you use our Services, we may automatically receive and record information from your device and browser, including your IP address, advertiser identifiers (for iOS devices), Identifier for Advertising (for iOS devices) and Google Advertiser IDs (for Android devices) (such identifiers are collected herein for the following purposes, among other things: frequency capping, attribution, conversion events, estimating the number of unique users, advertising fraud detection, and debugging) cookie information, search history, device ID, Android ID, your regional and language settings, the

physical location of your device (if you have permitted your mobile or other location-aware device to transmit location data), network status (WiFi/3G), and software and hardware attributes. We may use your location (city) (if you have permitted your mobile or other location-aware device to transmit location data) to learn how to adjust and personalize your use of the Services. Our systems may automatically record and store technical information regarding the method and nature of your use of the Services, including without limitation which pages of the Services our visitors view and impressions. An IP address is a numeric code that identifies your device on a network, or in this case, the Internet. Your IP address is also used to gather broad demographic information.

1.6. The Company uses all of the Personal Data that we collect for various reasons We need the Personal Data in order to provide or operate the for example:Services, including to provide customer support and process your requests, questions and concerns; to understand the usage trends and preferences of our users; assist our users with online purchasing decisions; using information to personalize content and features on our sites and the services; collecting our services usage, analytics and performance data relating to our services, in order to maintain, analyze, develop, update, and improve our products and services; protecting against activities that may threaten the security, integrity, systems, and services; for or availability of our or another party’s products,personalizing interest based ads; marketing and selling our products and maintaining corporate or business records consistent with our services;retention policies and applicable law. We also use aggregated data for monetization.

1.7. Chatbot Feature. As part of the Services you have the option to use Company’s chatbot feature. To the extent you agree to provide Company with your Facebook Messenger application (“Facebook Messenger”) information through this chatbot feature you hereby agree that: (i) Company may connect with you directly via Facebook Messenger; (ii) Company may send you news, updates, promotional and commercial communications in respect of the Services through Facebook Messenger; (iii) Company may send you interest based ads, based on the Personal Data provided to Company; (iv) Company may collect and use your Facebook ID in order to provide you with the Services, including without limitation sending you interest based ads; and (v) Company may collect any information provided by you in your communications through the chatbot feature and through Facebook Messenger.

1.8. Customer Success Video Conference. As part of the Services, you have the option to participate in conference calls with our customer support team for the purpose of providing you with assistance in the use of our platform, products and services. We may retain the recordings and textual output of any meetings between you and our customer team for purpose of enabling your use of the Services, training and further improving our Services.

1.9. Surveys and Contents. From time to time, we may issue surveys regarding your use of the Services and/or promotional contests. To fill out any surveys or

participate in contests you may be requested to provide certain personal information, for example your email address. Registration to surveys and participation in contests is optional and at your sole discretion.

2. Cookies; web beacons and third-party processors. In order to collect the data described herein we may use temporary cookies that remain on your device for a limited period of time. We may also use persistent cookies that remain on your device until manually removed in the settings of your device/browser, in order to manage and maintain the services and record your use of the Services. Cookies by themselves cannot be used to discover the identity of the user. A cookie is a small piece of information which is sent to and stored on your device. Cookies do not damage your device.

Some of the cookies that we set when you visit our Services are essential to the working functionality of the Services. Performance cookies are another type of cookies uses to provide with you a better user experience and to improve how content on our website is presented.

Most browsers or devices may allow you to block cookies block cookies but you may not be able to use some features on the Services if you block them. You may set most browsers to notify you if you receive a cookie (this enables you to decide if you want to accept it or not). We may also use web beacons via the Services to collect information. Web beacons or “gifs”, are electronic images that may be used in our Services or in our emails. We use Web beacons to deliver cookies, count visits and to tell if and when an email has been opened and acted upon.

We also use third party tracking technologies (including technologies of Rakuten Marketing LLC, Amazon Services LLC and eBay Partner Networks Inc.), such as cookies and web beacons and various third party providers to process and analyze your Personal Data, profile end user activities and provide targeted ads, including without limitation tracking your use of the Services and third party services and sites. To learn more about interest based ads and for , www.aboutads.info/choicesout options see for example: -certain opt, www.allaboutcookies.org, https://tools.google.com/dlpage/gaoptout.http://optout.networkadvertising.org/?c=1#!/

Company is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn .www.amazon.com advertising fees by advertising and linking to

3. Links. Links to other services, sites and applications may be provided by the Company as a convenience to our users. The Company is not responsible for the privacy practices or the content of other sites and applications and you visit them at your own risk. This privacy statement applies solely to Personal Data collected by us.

4. Children. If you are a child under the age of 16, you must not use our Services or provide us with your Personal Data. The Company will not knowingly contact or engage with children under the age of 16. If you have reason to believe that a child has provided us with their Personal Data, please contact us at the email address

privacy@roundforest.com and we will endeavor to delete that Personal Data from our databases.

5. Information Sharing. As part of providing the Services and/or generating and processing analytics, our affiliates, agents representatives and third party providers may have access to your Personal Data. The Company may also share Personal Data in the following circumstances: (a) as required for the provision, maintenance and improvement of the Services; (b) if we become involved in a reorganization, merger, consolidation, acquisition, or any form of sale of some or all of our assets; and/or (c) to satisfy applicable law or prevention of fraud or harm or to enforce applicable agreements and/or their terms, including investigation of The Services may link to third party content, products potential violations thereof.and services. Any Personal Data that you provide in connection therewith is provided to a third party. We are not responsible for the privacy and data protection practices of such third parties, or for such content, products and services, and we encourage you to read the terms and conditions and privacy policy of each third party that you choose to use or interact with. Our business affiliates on whose website or platform you use the Services will also have access to your Personal Data. For more information about how they collect and process Personal Data please see their privacy policy on their website. We require each of them to collect and process Personal Data lawfully and to obtain your consent where required.

6. Information Security. We follow generally accepted industry standards to protect against unauthorized access to or unauthorized alteration, disclosure or destruction of Personal Data. However, no method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, while we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

7. Retention periods. We keep your Personal Data only for as long as reasonably necessary for the purposes for which it was collected or to comply with any applicable legal or ethical reporting or document retention requirements, and delete any Personal Data that is no longer useful or relevant to our operations.

8. Data Integrity. The Company processes Personal Data only for the purposes for which it was collected and in accordance with this policy or any applicable service agreements. We review our data collection, storage and processing practices to ensure that we only collect, store and process the Personal Data needed to provide or improve our Services. We take reasonable steps to ensure that the Personal Data we process is accurate, complete, and current, but we depend on our users to update or correct their Personal Data whenever necessary. Nothing in this policy is interpreted as an obligation to store information, and we may, at our own discretion, delete or avoid from recording and storing any and all information.

9. Data Subjects’ Rights. Depending on the law that applies to your Personal Data, you may have various data subject rights, such as rights to access, erase, and correct Personal Data, and information rights. We will respect any lawful request to exercise those rights

Right of Access and Rectification. Depending on your location, you may have the right to know what Personal Data we collect about you and to ensure that such data is accurate and relevant for the purposes for which Company collected it. We allow our users the option to access and obtain a copy of their Personal Data and to rectify such Personal Data if it is not accurate, complete or updated. However, we may first ask you to provide us certain credentials to permit us to identify your Personal Data.

Right to Delete Personal Information or Restrict Processing. You may have the right to delete your Personal Data or restrict its processing. We may postpone or deny your request if your Personal Data is in current use for the purposes for which it was collected or for other legitimate purposes such as compliance with legal obligations.

Right to Withdraw Consent. Where the processing is based on consent, you have the right to withdraw your consent to the processing of your Personal Data. Exercising this right will not affect the lawfulness of processing your Personal Data based on your consent before its withdrawal.

You may exercise the above rights by sending a request to privacy@roundforest.com.

Right to Lodge Complaint. You also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your Personal Data.

Right of Data Portability. Where technically feasible, you have the right to ask to transfer your Personal Data in accordance with your right to data portability

10. Enforcement. The Company regularly reviews its compliance with this policy. Please feel free to direct any questions or concerns regarding this policy or our treatment of Personal Data by contacting our data protection officer at . When we receive formal written complaints it is the @roundforest.comprivacyCompany’s policy to contact the complaining user regarding his or her concerns. The user may also lodge complaint with relevant data protection authorities, we will cooperate with the appropriate regulatory authorities in accordance with applicable law, including local data protection authorities, to resolve any complaints regarding the processing of Personal Data that cannot be resolved between the Company and an individual.

11. Changes to This Privacy Policy. We reserve the right, in our sole and absolute discretion, to change this Privacy Policy at any time. Such change will be effective following posting of the revised Privacy Policy on our Services, and your continued use of our Services shall mean that you accept those changes.

We will notify you about significant changes in the way we treat Personal Data by sending a notice to the primary email address specified in your account or by placing a prominent notice on the Services. We encourage you to periodically review this policy for the latest information about our privacy practices.

12. International Transfers of Personal Data. By providing any Personal Data to us pursuant to this policy, all users, including, without limitation, users in the United

States, Israel, member states of the European Union, and other regions, fully understand and unambiguously consent to this policy and to the collection and processing of such Personal Data abroad. The server on which the Services are hosted and/or through which the Services are processed may be outside the country from which you access the Services and may be outside your country of residence. Some of the uses and disclosures mentioned in this policy may involve the transfer of your Personal Data to various countries around the world that may have different levels of privacy protection than your country. By submitting your Personal Data through the Services, you acknowledge that we may collect, use, transfer, and disclose your Personal Data as described in this policy. If you do not agree to the terms of this policy, please do not use the Services. If we transfer your Personal Data outside of the EEA we will, in the absence of an EC Adequacy decision relevant to the destination country or to the transfer, seek to rely on appropriate safeguards such as appropriate EC approved standard contractual -protection/international-http://ec.europa.eu/justice/dataclauses (see ).ransfers/transfer/index_en.htmt

13. Questions. If you have any questions about this policy or concerns about the way we process your Personal Data, please contact our Data Protection Officer at .@roundforest.comprivacy

14. Your U.S. Privacy Rights; Do Not Track Notices. Depending on your residency you may request certain information regarding our disclosure of Personal Data to third parties for direct marketing purposes, as well as to delete, correct and refraining from sharing/selling your information. To exercise your rights, please contact us using the contact details provided above. Please note that we are only required to respond to one request per customer each year. You are also advised that Company does not respond to “Do Not Track” signals.

Last Date Updated: July 26, 2023.