Kozi Data Protection Policy for the EU/UK (GDPR Addendum)

Effective Date: May 15, 2025

Applies to: Users in the European Economic Area (EEA), United Kingdom, and Switzerland

1. Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you upload an image or choose to store a try-on result.
• Performance of a contract: To provide our core Service features.
• Legitimate interest: To prevent fraud, improve service quality, and support platform operations.
• Compliance with legal obligations: Where applicable (e.g., data retention for law enforcement).

2. Your GDPR Rights

If you are located in the EU/UK, you may:

• Access your personal data
• Correct or update inaccurate information
• Delete your personal data
• Restrict or object to processing
• Request data portability
• Withdraw consent at any time

To exercise any of these rights, contact us at: privacy@bearishfh.com (Subject: Kozi GDPR Request)

3. Data Transfers Outside the EU/UK

Kozi is operated by Bearish FH INC in the United States. Data may be transferred to and stored in countries outside the EEA/UK that may not have equivalent data protection laws.

We rely on standard contractual clauses (SCCs) and other safeguards where required to ensure your data remains protected.

4. Data Protection Contact

For GDPR inquiries or complaints:

Kozi Data Protection Officer (DPO Representative)

Email: privacy@bearishfh.com

Subject: Kozi DPO – EU/UK Inquiry

5. Supervisory Authority Contact

You may lodge a complaint with your local data protection authority at any time.

6. Retention

All user images and associated data are deleted:

• Immediately upon user request
• Within 30 days of account deletion
• Unless legally required to retain