PRIVACY POLICY

Last Updated: October 5, 2026 Company Name: 10Ten Labs Website: 10tenlabs.com Hosted/Powered by: Zid.sa Platform

1- Introduction

Welcome to 10Ten Labs("we,""our," "us," or "the Company"). We respect your privacy and are committed to protecting your Personal Data. This Privacy Policy explains how we collect, use, disclose, retain, protect and otherwise process Personal Data whenyou visit 10tenlabs.com, use our services, communicate with us, or purchase through our online store.

Our online store is operated using Zid.sa. Depending on the actual processing activity and contractual arrangement, Zid may process Personal Data on our behalf as a processor, or may act independently as a controller for certain activities. We do not classify Zid as our processor for every activity solely because we use its platform.

This Policy is prepared in accordance withapplicable Saudi lawsand regulations, including the Personal Data Protection Law (PDPL), its Implementing Regulations, the Regulation on Personal Data Transfer outside the Kingdom, and applicable electronic-commerce requirements.

2- Personal Data We Collect

We collect only personal data that is necessary and relevant to the stated purposesof processing. Depending on howyou interact with the Store, this may include:

Identity and contact data: name, email address, telephone number and delivery/billing address.
Account data: username, account identifiers and authenticationinformation. We do not request or store passwords in plain text.
Order and transactiondata: products/servicespurchased, order details, amounts, delivery details, returns/refunds and transaction references. Full payment-card details are handled by the applicable payment service provider and are not stored by us unless expressly stated at the point of collection.
Communications: messages, customer-service requests, correspondence and related records.
Technical and usage data: IP address, browser/device information, operating system, language, time zone, pages viewed, session information, referring URLs and similar technical information.
Cookie and similar-technology data, as described in Section 10.
Any other data specifically identified to you at or before collection.

3- How We Collect Data

We may collect Personal Data directly from you; through use of our website/store; orders and transactions; communications; cookiesand similartechnologies; service providers supporting our services; and other lawful means. We collect only the minimum data necessary for the relevant purpose and take reasonable steps to ensure accuracy, completeness, currency and relevance.

4- Purposes and Legal Bases

We process personal data only for specified and legitimatepurposes andon an applicablelegal basis. The main purposes are:

Orders, payment, delivery, returns, refunds and customer support – necessary to perform a contract with you and, where applicable, to comply with legal obligations.
Account administration – necessary to provide the requested account/service.
Fraud prevention, information security and protection of the Store – legitimate interests, subject to the PDPL requirements and ed assessment where required.
Legal, accounting, tax, regulatory and dispute-related requirements – compliance with a legal obligation or other applicable legal basis.
Website/service analytics and improvement – where applicable, consent or legitimate interests, depending on the

technology and processing involved.

Direct marketing – consent where required by the PDPL and its Implementing Regulations. We will provide an easy mechanism to stop marketing communications.
Any additional purpose not covered by the original purpose will be processed only where permitted by the PDPL, including where a new consent or other lawful basis is required.

5- Marketing Communications

We will not use personaldata for direct marketing in a manner inconsistent with the PDPL. Where consent is required, we will obtain andretain evidence of that consent. Marketing messages will clearly identify 10Ten Labs as the sender and will include a simple, free and readily accessible mechanismto stop receiving marketing communications. We will stop such communications without undue delay after an opt-out request, subject to messages that are necessary for transactions or service administration.

6- Disclosure and Sharing

We may disclose the minimum personal data necessary to:

Zid.sa or other platform/technology providers supporting the Store;
payment service providers and financial institutions, to process payments and refunds;
delivery and logistics providers, to deliver orders and process returns;
hosting, IT, security, analytics and customer-support providers, where necessary for the stated purposes;
professional advisers, auditors and insurers where necessary and lawful;
competent governmental, regulatory,judicial or law-enforcement authorities where disclosureis required or permitted by law; and
a successor or transaction party in connection with a lawful business transfer, merger, acquisition or sale of assets,

subject to applicable privacy requirements.

Where a third party acts as our data processor, we will select and manage it in accordance with the PDPL and its ImplementingRegulations, includingcontractual requirementsconcerningpurpose, categories of data, processing period, breach notification and sub-processors. We remain responsible for processing under our control as required by law.

7- Transfers outside Saudi Arabia

Some service providersor technologies used by the Store may involve access to or processing of personal data outside the Kingdom of Saudi Arabia. Before any transfer or disclosure outside the Kingdom, we will comply with the applicable

requirements of the PDPL and the Personal Data TransferRegulations, including the applicable conditions concerning purpose, minimum necessary data, an adequate level of protection and appropriate safeguards. Where a specific international recipient or countryis known and applicableto the processing, the Store’s collection notice may identify it or the relevant category

8- Data Storage, Retention and Disposal

We use appropriate organizational, administrative and technical measures to protect personal data. Personal data is retained only for as long as necessary to fulfill the purpose for which it was collected, unless a legal or regulatory requirement, contractual obligation, dispute or other lawful basis requires or permits longer retention.

Different categories of data may havedifferent retention periods. We maintain retention rules appropriate to the purpose and applicable legal requirements and securely dispose of or anonymize personal data when retention is no longer required, subject to lawful exceptions.

9- Security and Personal Data Breaches

We implement reasonable and appropriate organizational, administrative and technical security measures to protect personal data against loss, unauthorizedaccess, alteration, disclosure or other unlawful processing, taking into account the nature and sensitivity of the data and applicable cybersecurity requirements.

If a personal data breach occurs that triggers notification obligations, we will notify the competent authority within the period required by the ImplementingRegulationsand notifyaffected data subjects where required by law. In particular, the applicableregulations require notification to the competent authority within 72 hours from becoming aware of a qualifying breach, sub

10- Cookies and Similar Technologies

The Store may use cookies and similar technologies for essential storefunctions, account/session management, security, preferences, analytics and,whereapplicable, marketing. Whereconsent is required for a particular technology, we will obtain it through the applicable consent mechanism. Youmay also manage cookies through your browser or the Store’s cookie controls. Disabling essential cookies may affect the functionality of the Store.

The Store should publish a cookienotice or cookiesettings interface that identifies the categories of cookies used, their purposes and, where applicable, the relevant third part

11- Your Privacy Rights

Subject to the PDPL and its Implementing Regulations, you may have the following rights:

to be informed about the legal/practical basis and purposes of collection and processing;
to access your personal data held by us;
to request a clear copy of your personal data, subject to legal limitations;
to request correction, completion or updating of inaccurate or incomplete data;
to request destruction of personal data when the legal conditions for destruction are met;
to withdraw consent at any time where processing is based on consent, subject to lawful exceptions;
to submit a complaint to the competent authority; and
other rights provided by the PDPL and its Implementing Regulations.

We will respond to requests to exerciseapplicable rights within 30 days, with a possible extension of up to an additional 30 days where permitted and where the required notice and reasons for the extension are provided

12- How to Exercise Your Rights and Make Complaints

You may submit a privacy request or complaint by email to [email protected]. We may request reasonable information necessary to verify your identity and protect your data from unauthorized disclosure. We will use appropriate organizational procedures to review and respond to requests.

If you are not satisfied with our handling of a privacymatter, you may exercisethe complaint rights available under the PDPL by contacting the competent authority in Saudi Arabia through its official channels.

13- Children

The Store is not intended to knowingly collect personaldata fromchildren in circumstances whereapplicable law requires parental/guardian involvement or prohibits the collection. Where processing concerns a minor or legally incapacitated person, we will apply the requirements of the PDPL and its Implementing Regulations regarding the legal guardian and the rights of the data subject.

14- Third-Party Links

The Store may contain links to third-party websites, applicationsor services. We do not control those third parties. Their own notices and termsgovern theirprivacy practices. This Privacy Policy applies to processing carriedout by or on behalf of 10Ten Labs through the Store and our services.

15- Changes to This Policy

We may update this Privacy Policy to reflect changes in our processing activities, technology, service providers or applicable legal requirements. The updated version will be published on the Store with a revised “Last Updated” date. Material changes will be communicated through an appropriate notice where required.

16- Contact and Controller Information

Legal/Registered Company Name: [INSERT EXACT NAME AS SHOWN IN COMMERCIAL REGISTRATION] Trade Name: 10Ten Labs

Commercial Registration No.: [INSERT CR NUMBER]

Registered Address / National Address: [INSERT] Telephone: [INSERT]

Email: [email protected] Website: 10tenlabs.com

Data Protection Officer (if appointment is legally required): [INSERT NAME/ CONTACT OR STATE THAT NO DPO IS REQUIRED, AFTER ASSESSMENT]

This Privacy Policy should be made readily available on the Store before or at the time personal data is collected.