WISEWELL PRIVACY POLICY

Last Updated: 08 October 2026

This Privacy Policy describes how Wisewell Trading LLC, a company registered in Dubai Mainland under commercial licence number 1083555, holding Tax Registration Number 104014990600003 (“Company”, “Wisewell”, “we”, “us”, or “our”)”), with its registered office at Ground Floor, Unit No. GO-14, The Curve Building, Plot No. 358-574, Al Quoz 3, Dubai, UAE, collects, uses, stores and discloses your personal data when you use our website (www.wisewell.ae), mobile applications, connected devices and Internet of Things (“IoT”) products, services, tools and features, or otherwise interact with us (collectively, the “Services”).

Please read this Privacy Policy carefully. By using any of the Services, you acknowledge the collection, use and disclosure of your personal data as described in this Privacy Policy. If you do not understand or agree to this Privacy Policy, please do not use or access the Services.

1. CHANGES TO THIS PRIVACY POLICY

We may modify this Privacy Policy from time to time, in which case we will update the “Last Updated” date at the top of this Privacy Policy. We encourage you to review this Privacy Policy periodically to stay informed about our practices. If we make material changes to how we collect, use or disclose personal data, we will notify you at least thirty (30) days in advance through reasonable means (such as by emailing you at the last email address you provided us or by posting notice of such changes on the Services) and will take additional steps as required by applicable law. If you do not agree to any updates to this Privacy Policy, please do not continue using or accessing the Services.

2. COLLECTION AND USE OF INFORMATION

When you use or access the Services, we collect certain categories of personal data about you from a variety of sources. In addition to the specific uses discussed below, we may use this information to provide and improve the Services and to maintain our business relationship, including by enhancing the safety and security of our Services, providing customer support, complying with applicable legal obligations, enforcing any applicable terms of service and protecting our rights and the rights of our employees, users or other individuals.

Information You Provide to Us

Some features of the Services may require you to directly provide certain information, including information about yourself. You may elect not to provide this information, but doing so may prevent you from using or accessing these features. Information that you directly submit through our Services includes:

• Contact and delivery information, such as your name, email address, phone number, delivery address, precise delivery location and service address. We use this information to create and maintain your account, process orders and subscriptions, provide the Services, arrange delivery and servicing, and communicate with you ( including to tell you about products or services that may be of interest to you). For your protection, we may need to verify your identity before processing your requests. This could include verifying your account or providing copies of identification so that we can verify you.
• Account and profile information, such as username, password, your name, date of birth, gender, security questions that you select and the answers you provide, email address and/or phone number, and other information you add to your account or profile. We use this information to provide the Services and to create, maintain and secure your account with us. If you choose to register an account, you are responsible for keeping your account credentials safe. We recommend you do not share your access details with anyone else. If you believe your account has been compromised, please contact us immediately.
• Payment and subscription information, such as bank account, credit or debit card information, and billing address, which is collected on our behalf by our payment processor(s), and information about your subscription tier, order history, subscription history, and and transaction history We use this information to process payments, manage subscriptions and provide the Services and to provide you with different account features and options.
• User-content, such as messages, photos, and recordings, submitted by you through our websites or mobile applications. We or others may store, display, reproduce, publish or otherwise use such content, and may or may not attribute it to you.
• Customer service information, such as your inquiries, complaints, feedback, troubleshooting information, your reviews and communications with us by email, phone, live chat, WhatsApp or other support channels. Support chats inside the app are provided by third parties, including through Freshworks (Freshchat). We use this information to respond to you, provide support and improve the Services.
• Any other information you choose to provide us or otherwise include in communications with us for example, when you contact our customer experience team or respond to a survey, such as photos attached to a support request, photographs used to scan a machine QR code, reviews and other information included. We do not intentionally collect or process sensitive personal data in connection with the Services.

Information Collected Automatically

We and third parties also automatically collect certain information about your interactions with the Services, including through cookies, pixels, session-recording tools and other tracking technologies (“Tracking Technologies”). This information is collected and used to tailor your experience with the Services, provide you with offers or promotions, run analytics, and better understand user interactions with the Services. Such information includes:

• Device and network information, such as device type, hardware model, mobile and other application version, operating system, unique device and cookie identifiers, IP address, browser type, internet protocol (IP) address, diagnostic or log information.
• Connected-device and IoT information, such as device registration, serial number, machine ID (including MAC ID), model, connectivity information, device usage, water consumption, water quality (TDS), filter life, filter status and error alerts, and related information generated or provided through use of our connected device. During setup, you enter your Wi-Fi network name, IoT products, and password; these may be sent directly from your phone to the machine and mobile and other applications and are stored on the machine only. Wisewell does not store your Wi-Fi password, although the network name is retained in setup diagnostic logs.
• Location information, such as approximate location based on IP address and, if you permit it, precise location. The app requests location permission to show the appropriate regional support contacts.
• Other information regarding your interaction with the Services, such as browser type, log data, date and time stamps, referring URLs, clickstream data(e.g., page requests, page views, how much time is spent on a page, features used, content viewed or interacted with, text entered and navigation paths, etc.), session information, log and diagnostic information browsing activity, session recordings, interactions with our marketing emails, text messages, other communications and ad impressions.

For further information on the use of Tracking Technologies and your choices, see the section below, Cookies and Other Tracking Technologies.

Information Collected from Other Sources

We may obtain your personal data from outside sources, including information that we collect directly from third parties, such as payment, subscription, e-commerce, delivery, logistics, fulfillment, advertising, analytics, social media, review, referral providers, and information from third parties that you choose to share with us. Such information may include:

• Information we receive from our payment, subscription and e-commerce providers, such as order details, billing information, payment card identifier, payment status, subscription information which we use to process your orders and manage your subscription and billing. Payment card details are processed and held by our payment providers, not by Wisewell.
• Information we received from delivery, logistics and fulfillment providers, such as delivery address, precise delivery location, delivery status, other delivery information which we use to coordinate and complete delivery, installation, servicing and returns.
• Information we receive directly from third-party social media and review platforms, such as when you interact with us on Facebook, Instagram, LinkedIn, or Google Reviews, including publicly available profile information, comments, reviews, ratings, and messages, which we use to communicate with you, personalize our Services and display your reviews on our website (www.wisewell.ae).
• Information we receive from advertising and analytics platforms, such as information about your interactions with our advertisements, campaigns, websites and digital content, including campaign attribution and engagement information, and website data received under the applicable platforms’ own terms, in each case, which we use to better customize advertising and marketing to you.
• Information we receive from our business customers, partners and referral or promotional partners, such as contact and professional information about employees, representatives and points of contact provided in connection with a business relationship, and contact or campaign information provided in connection with referrals, co-branded initiatives and promotions, which we use to establish and manage the relevant relationship.

Any information we receive from outside sources will be treated in accordance with this Privacy Policy. We are not responsible for the accuracy of the information provided to us by third parties and are not responsible for any third party’s policies or practices. For more information, see the section below, Third-Party Websites and Materials.

Deidentified Information

Finally, we may deidentify or anonymize your information such that it cannot reasonably be used to infer information about you or otherwise be linked to you (“deidentified information”) (or we may collect information that has already been deidentified/anonymized), and we may use deidentified information for any purpose. To the extent we possess or process any deidentified information, we will maintain and use such information in deidentified form and not attempt to re-identify the information, except for the purpose of determining whether our deidentification process satisfies legal requirements.

Automated Processing and Profiling

Wisewell does not use automated decision-making for personalised pricing, subscription recommendations or credit or eligibility decisions. Profiling is used for advertising purposes only, including audience-building through third-party advertising platforms and lookalike audiences derived from customer data. Other automated elements include product recommendations on the website and fraud screening by payment processors. Wisewell may in the future use predictive analytics to target marketing communications, such as win-back campaigns. You have the right to object to decisions based solely on Automated Processing that produce legal effects or significantly affect you, and to request human review of such decisions.

Lawful Bases for Processing

Wisewell processes your personal data on the following lawful bases under applicable law:

• Consent — advertising profiling and audience-building (including uploading customer data to advertising platforms and the use of lookalike audiences); deployment of non-essential Tracking Technologies (analytics and advertising cookies, pixels and session-recording tools); future use of predictive analytics for targeted marketing communications; and any other processing for which we specifically request your consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Performance of a contract — creating and maintaining your account; processing orders, subscriptions and payments; arranging delivery, installation and servicing; providing customer support; managing connected-device functionality; and product returns and replacements.
• Compliance with legal obligations — retaining transaction and tax records; responding to lawful requests from courts, regulators and law enforcement; and fraud screening by payment processors.
• Protection of the data subject’s interests — data security measures, breach detection and notification, and product safety communications.
• Public interest — cooperating with government authorities and regulatory inquiries, and complying with applicable sanctions and anti-money laundering requirements.

3. COOKIES AND OTHER TRACKING TECHNOLOGIES

As described above, we and third parties use Tracking Technologies to collect certain information about your interactions with the Services. Most browsers accept Tracking Technologies automatically, but you may be able to control the way in which your devices permit the use of certain Tracking Technologies. If you so choose, you may block or delete certain Tracking Technologies from your browser; however, blocking or deleting cookies may cause some of the Services, including login features and general functionality, to work incorrectly.

The Services use the following third-party technologies. Where your consent is required under applicable law, these technologies will not be activated until you provide it through our consent management tool. These may include, without limitation: (a) analytics and product improvement: Google Analytics 4, PostHog, Wicked Reports; (b) advertising and audience measurement: Google Ads, Meta Pixel, TikTok Pixel, Snapchat Pixel (with Tapad), Google Merchant Center; (c) session recording and testing: Hotjar (including session recording), VWO (A/B testing); (d) tag management: Google Tag Manager; (e) email and SMS marketing: Klaviyo, ElectricSMS; (f) customer support: Freshworks; (g) Affiliate tracking: UpPromote; (h) translation: GTranslate; and (i) app infrastructure: Google Firebase (login, crash reporting, diagnostic logs). You can manage your preferences at any time through https://www.wisewell.ae/pages/cookie-settings.

Your browser settings may allow you to transmit a signal or other mechanism for exercising your choice regarding the collection or processing of your information when you visit various websites. Our website is not currently designed to respond to such signals.

Subject to applicable laws, you may also opt-out of the collection and use of information for interest-based advertising by advertisers that are part of certain industry alliances, including through tools offered by the Network Advertising Initiative, the Digital Advertising Alliance or the European Interactive Digital Advertising Alliance, by clicking the links provided.

4. DISCLOSURE OF YOUR INFORMATION

We may disclose personal data for the following legitimate business and legal purposes, subject to this Privacy Policy and applicable laws, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “UAE PDPL”):

• Vendors or other service providers who help us provide the Services, including for: administration, accounting and invoicing; advertising and analytics; affiliates; analytics; app login, user profiles and diagnostic logs; cloud storage, hosting and infrastructure; connected device and IoT platform services; connected operations, inventory, logistics and automation; customer and machine databases; customer relationship management; customer service; customer support; delivery and UAE 3PL warehousing; email marketing; fraud prevention and verification; external software development and backend support; firmware and over-the-air device updates; machine connectivity and telemetry; marketing and testing; marketing communications; payments (without Wisewell storing card data); product certification and water-quality testing; reviews; SMS and push notifications; shipping and other logistics management; security; store and e-commerce operations; subscriptions; and warranty, returns and repair management; and the deployment of Tracking Technologies.
• Our affiliates and other entities within our corporate group, including where systems are shared across the group, such as customer support and an operations platform. Group personnel access shared systems only on a need-to-know basis for customer support and operations.
• Advertising, analytics and social media partners, including Google, Meta, TikTok, Snapchat and Tapad, which may collect or receive information about your interactions with our websites, applications, emails and advertisements through Tracking Technologies and, where enabled, hashed contact information, and who use this information to measure, attribute and deliver advertising and may use platform audiences, including lookalike audiences and targeted advertising on other platforms. These platforms process information under their own terms.
• Professional advisers, such as auditors, lawyers, accountants and insurers, where disclosure is reasonably necessary for professional advice, compliance, accounting firms, or risk management.
• Third parties in connection with or in anticipation of an asset sale, merger, acquisition, or other business transaction, including in the context of a bankruptcy proceeding or other restructuring matter.
• For legal and security reasons, including government authorities, regulators, courts, law enforcement and other third parties where disclosure is required or permitted by, and to protect our services and business, including to cooperate with law enforcement, judicial orders and regulatory inquiries, , or is necessary to detect or prevent against fraudulent or illegal activity, protect the Services and our business, exercise or defend legal claims and to ensure the safety and security of our business, employees and users, and to enforce our terms or other agreements.

We do not disclose your personal data to third parties for those third parties’ own direct marketing purposes, unless you have affirmatively agreed to such disclosure.

We may display reviews that you have posted on third-party platforms (such as Google Reviews) on our website. If you would like your review removed from our website, you may contact us using the details set out in Section 11 below.

5. THIRD-PARTY WEBSITES AND MATERIALS

We may provide links to third-party websites or platforms and display or make available content, data, applications or materials from third parties. If you follow links to sites or platforms that we do not control and are not affiliated with us, you should review the applicable privacy notice, policies and other terms. We are not responsible for the privacy or security of, or information found on, these sites or platforms, or the accuracy, completeness or reliability of third-party materials.

Information you provide on public or semi-public venues, such as third-party social networking platforms, may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use.

Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators. This Privacy Policy does not apply to any third-party websites or platforms, including that may be linked to or accessible via our Services. We encourage you to carefully review the privacy policies of those third parties, as they may have different practices.

6. CHILDREN’S PRIVACY

Our Services are not intended for children or individuals under the age of 18, and we do not seek or knowingly collect any personal information about children. If we become aware that we have unknowingly collected information about a child, in particular any child under 18 years of age, we will make commercially reasonable efforts to delete such information from our database. If you are the parent or guardian of a child under 18 years of age who has provided us with their personal information, you may contact us using the below information to request that it be deleted.

7. DATA SECURITY AND RETENTION

We have implemented commercially reasonable security measures designed to protect your personal data from unauthorized access, use or disclosure. However, despite our efforts to protect your information, no security measures are impenetrable, and we cannot guarantee “perfect security.” Any information you send to us electronically, while using the Services or otherwise interacting with us, may not be secure while in transit. We recommend that you do not use insecure channels to send us sensitive or confidential information.

We retain your information for as long as is reasonably necessary for the purposes specified in this Privacy Policy. When determining the length of time to retain your information, we consider various criteria, including whether we need the information to continue to provide you the Services, resolve a dispute, enforce our contractual agreements, prevent harm, promote safety, security and integrity or protect ourselves, including our rights, property or products.

Generally, we retain Personal Data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy, or as required by law. Without limitation to the foregoing, we may retain your personal data whilst we provide Services to you and for a period of no more than ten (10) years after the cessation of Services. This retention is necessary to comply with legal, tax, accounting, and other regulatory requirements. We may also retain your data to resolve disputes, enforce our agreements, or comply with statutory limitation periods where applicable.

8. DATA BREACHES

If we become aware of a personal data breach that may prejudice the privacy, confidentiality or security of your personal data, Wisewell may, subject to applicable laws, notify the relevant authorities and affected data subjects in accordance with the timeframes and procedures prescribed by the relevant authorities and applicable laws.

9. DATA TRANSFERS

In the course of providing the Services, your personal data may be transferred to, stored and processed in countries outside the United Arab Emirates, including the United States and the European Union. These countries may have data protection laws that differ from those in the UAE.

By using the Services, you acknowledge and, where required by applicable law, consent to the transfer, storage and processing of your personal data outside the UAE. Where your personal data is transferred to a country that does not provide an adequate level of data protection as recognised under applicable laws, we will take appropriate steps to ensure that your personal data remains protected in accordance with this Privacy Policy, including by entering into data transfer agreements or relying on other safeguards permitted by applicable law, such as Standard Contractual Clauses or equivalent mechanisms.

10. DATA SUBJECT RIGHTS

Under applicable laws, including the UAE PDPL, you may exercise the rights described below by contacting Wisewell. These rights are subject to applicable legal conditions and limitations.

• Right to Information (Article 13 of the UAE PDPL). You may request information about the types of your personal data we process, the purposes of processing, recipients or categories of recipients inside or outside the UAE, retention periods and criteria, cross-border transfer safeguards, procedures for correction, erasure, restriction and objection, decisions based on automated processing or profiling, steps taken after a breach or misuse of your personal data, and how to complain to the data protection authorities.
• Right to Data Portability / Request Transfer of Your Personal Data (Article 14 of the UAE PDPL). Where processing is based on your consent or is necessary to perform a contract and is carried out by automated means, you may request your personal data in a structured, commonly used and machine-readable format. In addition, where technically feasible, you may request the transfer of your personal data to another controller.
• Right to Correction or Erasure (Article 15 of the UAE PDPL). You may request correction or completion of your inaccurate personal data without undue delay. You may also request erasure where: (a) the data is no longer necessary for the purposes for which it was collected or processed; (b) you withdraw your consent; (c) you object to the processing or there are no legitimate reasons for us to continue it; or (d) the processing is unlawful and erasure is necessary for compliance. Erasure is subject to exceptions under legal and public-interest requirements, including where the request affects investigation procedures or the claiming and defence of rights, or contradicts other legislation binding on us.
• Right to Restrict Processing (Article 16 of the UAE PDPL). You may request restriction or suspension of processing where: (a) you contest the accuracy of your personal data, for a period enabling us to verify accuracy; (b) the processing violates the agreed-upon purposes; or (c) the processing violates the UAE PDPL or applicable legislation. While processing is restricted, we may retain your personal data but not use it, except for storage, processing necessary for claims and judicial proceedings, protection of third-party rights, or protection of the public interest. You may also require us to retain your personal data after the processing purposes are complete where it is needed to establish, exercise or defend legal claims. We will notify you before lifting any restriction on processing.
• Right to Object to Processing (Article 17 of the UAE PDPL). You may object to and request that we stop processing: (a) for direct marketing purposes, including profiling related to direct marketing; (b) for statistical surveys, unless the processing is necessary to serve the public interest; or (c) where the processing is carried out in violation of the processing controls.
• Right Regarding Automated Processing (Article 18 of the UAE PDPL). You may object to a decision based solely on automated processing, including profiling, particularly where such a decision has legal effects on you or seriously affects you. This right does not apply where the automated processing is agreed under a contract between you and us, is required under other UAE legislation, or where you have given prior consent in accordance with applicable laws. Even in those cases, we will take appropriate measures to protect the privacy and confidentiality of your personal data. Where permitted by applicable laws, you may request human review of any automated decision.

11. HOW TO EXERCISE YOUR RIGHTS, CONTACT US AND COMPLAIN TO AUTHORITIES

In accordance with applicable laws, we provide clear and appropriate ways for you to contact us to exercise any of the rights above. To submit a request to exercise any of your rights above or if you have any other questions, complaints or concerns in respect of this Privacy Policy, please contact us at support@wisewell.com. We will respond without undue delay. We may ask for information to verify your identity before completing a request and may need to retain information necessary to document and comply with the request.

If you believe that your personal data has been processed in violation of applicable laws, you may lodge a complaint with the data protection authorities in accordance with their applicable procedures. The relevant data protection authority is the UAE Data Office (see https://u.ae/en/about-the-uae/digital-uae/data-protection).