00 Contents

01 Introduction

GENYX Labs respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how GENYX Labs collects, uses, stores, shares and protects personal data when you:

• visit or interact with our Website;
• create or manage an account;
• place or receive an order;
• contact customer support;
• subscribe to marketing communications;
• participate in promotions, surveys or other Website features; or
• otherwise interact with GENYX Labs.

This Privacy Policy applies to www.genyx-labs.com, including its associated pages, checkout facilities, customer accounts and related online services, collectively referred to as the "Website". For the purposes of this Privacy Policy, "GENYX Labs", "GENYX", "we", "us" and "our" refer to the controller of the personal data described in this Policy. This Policy is intended to provide information required by the General Data Protection Regulation (EU) 2016/679 (GDPR), Malta's Data Protection Act and applicable electronic-privacy rules. This Privacy Policy should be read together with our Terms & Conditions, Cookie Policy, Shipping Policy, Returns & Refund Policy, Payment Policy and Research Use Disclaimer. Where those documents deal with contractual purchases or permitted Product use, they apply in addition to this Privacy Policy. This Privacy Policy governs how personal data is handled.

02 Data Controller

GENYX Labs is the controller responsible for determining why and how the personal data covered by this Privacy Policy is processed. You may contact us regarding privacy or data-protection matters through:

• Website: www.genyx-labs.com
• Email: support@genyx-labs.com

Please include "Privacy Request" in the subject line of any privacy-related email so that your request can be identified and handled appropriately. GENYX Labs has not appointed a Data Protection Officer unless and until such an appointment becomes legally required or is otherwise considered appropriate.

03 Scope Of This Policy

This Privacy Policy applies to personal data relating to:

• Website visitors;
• prospective and existing customers;
• account holders;
• purchasers and authorised recipients of orders;
• individuals who contact us;
• newsletter and marketing subscribers;
• representatives of laboratories, companies or other organisations;
• suppliers, contractors and business contacts; and
• persons whose information is lawfully provided to us in connection with an order, enquiry, transaction or legal

obligation.

This Privacy Policy does not apply to the independent processing activities of third-party websites, payment providers, social-media platforms, couriers or other external organisations where those parties determine their own processing purposes.

04 Personal Data We Collect

The personal data we collect depends on how you interact with GENYX Labs.

4.1 Identification and contact information

This may include:

• full name;
• email address;
• telephone number;
• billing address;
• delivery address;
• country or region;
• account username; and
• other contact information you choose to provide.

4.2 Account information

Where customer accounts are available, we may process account login information, encrypted or securely hashed password data, account preferences, saved addresses, communication preferences, account activity, order history and account-verification information. You are responsible for keeping your login details confidential and for notifying us promptly if you believe your account has been accessed without authorisation.

4.3 Order and transaction information

This may include Products ordered, quantities, order value, discounts or promotional codes, payment status, transaction reference, billing and delivery details, order confirmations, fulfilment status, courier and tracking information, customs or import-related information, returns, refunds or disputes, fraud-prevention results, order communications and information required for batch traceability, safety communications, withdrawal or recall activity.

4.4 Payment information

Payments may be processed through external payment-service providers. Where a third-party payment provider handles a payment, full card numbers, security codes, cryptocurrency wallet credentials or other complete payment credentials are normally collected directly by that provider and are not intended to be stored by GENYX Labs. GENYX Labs may receive and retain limited payment-related information, such as the payment-provider name, transaction reference, payment status, payment-method category, billing name and address, partial or masked payment details, refund information and fraud or security alerts. Payment providers may process personal data under their own privacy notices and legal responsibilities.

4.5 Research-use and eligibility information

To protect GENYX Labs, comply with our Terms & Conditions and assess whether an order may be accepted, we may collect confirmation that the customer has read and accepted the Research Use Disclaimer, age confirmation, declared research or analytical purpose, professional or organisational details, business name, role or position, laboratory or institutional information, VAT or company information where voluntarily provided or required, jurisdiction or destination-country information and information reasonably necessary to review suspicious, restricted or non-compliant orders. Any such information will be limited to what is reasonably necessary for the relevant purpose.

4.6 Communications and customer-service information

When you contact us, we may collect the contents of your message, email correspondence, support enquiries, complaints, feedback, call or contact records, documents or photographs you voluntarily provide and records of how your enquiry was handled.

4.7 Technical and Website information

When you access the Website, certain information may be collected automatically, including internet protocol address, browser type and version, operating system, device type, language and time-zone settings, Website pages viewed, referring website or link, date and time of access, session identifiers, interactions with Website functions, error logs, security and authentication events and approximate location derived from an IP address. This information may be collected through server logs, cookies, pixels, software development kits and similar technologies.

4.8 Marketing and preference information

This may include newsletter subscription status, marketing consent, product or content interests, communication preferences, advertising interactions, email opening or link-interaction information where lawfully enabled and records of consent, refusal, withdrawal or unsubscribe requests.

4.9 Information concerning another person

Where you provide another person's information, such as the name, telephone number or delivery address of an authorised recipient, you must ensure that you are authorised to provide that information, the information is accurate, its use is lawful and the person is informed about this Privacy Policy where appropriate. You should not provide more information about another person than is necessary to complete the relevant transaction.

05 How We Obtain Personal Data

5.1 Directly from you

For example, when you create an account, complete a checkout form, place an order, contact us, subscribe to communications, submit a return or refund request, respond to an identity, payment or order-verification request or provide information through the Website.

5.2 Automatically

Technical and usage information may be collected automatically when you use the Website, subject to the choices available through our cookie-consent system.

5.3 From service providers and other third parties

We may receive information from payment providers, fraud-prevention and security providers, couriers and fulfilment providers, Website hosting and technical providers, customer-support platforms, analytics and advertising providers, social-media platforms, banks and payment networks and public authorities or legally authorised bodies. We only use third-party information where there is an appropriate lawful basis and where its use is relevant to the purpose for which it was obtained.

06 Purposes And Legal Bases For Processing

GENYX Labs processes personal data only where an appropriate legal basis applies.

6.1 Website operation and account management

We process personal data to provide and maintain the Website, create and administer accounts, authenticate users, provide requested Website features, remember essential preferences and respond to technical or account-related enquiries. Legal basis: Performance of a contract or steps requested before entering into a contract; compliance with legal obligations; and our legitimate interests in operating a functional and secure Website.

6.2 Processing and fulfilling orders

We process personal data to review and accept or reject orders, process payments, issue confirmations and invoices, prepare and dispatch orders, arrange delivery, communicate order updates, manage returns and refunds and provide customer support. Legal basis: Performance of a contract or steps requested before entering into a contract; compliance with legal obligations; and legitimate interests relating to transaction administration and dispute prevention.

6.3 Eligibility, Research Use Only and regulatory compliance

We may process personal data to record acceptance of our Terms & Conditions and Research Use Disclaimer, confirm age or eligibility, assess whether a transaction appears consistent with the declared research-only purpose, apply product or destination restrictions, comply with customs, trade, product-safety or regulatory obligations, respond to competent authorities and prevent unlawful, unauthorised or prohibited transactions. Legal basis: Compliance with legal obligations; performance of the contract; and our legitimate interests in operating lawfully, protecting GENYX Labs and preventing misuse.

6.4 Payment, security and fraud prevention

We may process personal data to confirm payment, detect suspicious transactions, protect accounts, investigate unauthorised activity, prevent fraud, chargebacks and abuse, enforce Website security and protect GENYX Labs, customers and third parties. Legal basis: Performance of a contract; compliance with legal obligations; and our legitimate interests in fraud prevention, cybersecurity and protection of legal rights.

6.5 Customer service and communications

We process personal data to respond to enquiries, investigate complaints, provide order assistance, maintain appropriate communication records, resolve disputes and improve customer-service procedures. Legal basis: Performance of a contract; compliance with legal obligations; consent where applicable; and our legitimate interests in providing support and maintaining appropriate records.

6.6 Legal, accounting and record-keeping obligations

We may process and retain information to maintain financial and transaction records, comply with taxation, accounting and consumer-law obligations, comply with product-safety, traceability, withdrawal or recall obligations, respond to legal proceedings, establish, exercise or defend legal claims, respond to lawful requests from authorities and maintain evidence of consent and contractual acceptance. Legal basis: Compliance with legal obligations and our legitimate interests in maintaining lawful and defensible business records.

6.7 Website analytics and improvement

Subject to the required consent, we may use analytics technologies to understand Website traffic, measure performance, identify technical problems, understand how visitors interact with pages, improve Website design and functionality and assess the effectiveness of content or campaigns.

Legal basis: Consent where analytics technologies require consent; and legitimate interests for strictly necessary, privacy-preserving or aggregated operational analysis where legally permitted.

6.8 Advertising and social-media measurement

Subject to your consent, advertising technologies may be used to measure advertising performance, understand whether advertisements lead to Website visits or transactions, create or measure audiences, display more relevant advertising and limit repeated advertising. This may include services such as Meta Pixel where enabled. Legal basis: Consent.

6.9 Direct marketing

We may process contact and preference information to send newsletters, product announcements, availability updates, promotions, educational content and other marketing communications. Legal basis: Consent or another lawful basis expressly permitted by applicable direct-marketing law. You may withdraw consent or unsubscribe at any time.

6.10 Business administration and protection

We may process personal data for internal reporting, supplier and business relationship management, professional advice, corporate restructuring, sale, merger or reorganisation of the business, insurance, audits and protection of GENYX intellectual property and legal rights. Legal basis: Legal obligations and our legitimate interests in managing and protecting the business.

07 Legitimate Interests

Where processing is based on legitimate interests, those interests may include:

• operating and improving the Website;
• administering transactions;
• preventing fraud and misuse;
• protecting accounts and systems;
• maintaining appropriate business records;
• responding to enquiries and disputes;
• enforcing contractual terms;
• protecting GENYX Labs and its customers;
• obtaining professional advice;
• understanding general business performance; and
• establishing, exercising or defending legal claims.

Before relying on legitimate interests, we consider whether the processing is necessary, whether a less intrusive method is reasonably available, the nature of the personal data, the individual's reasonable expectations, the potential effect on the individual and the safeguards available. You may object to processing based on legitimate interests as explained in Section 15.

08 Cookies And Similar Technologies

The Website may use cookies, pixels, tags, local storage and similar technologies. These technologies may be classified as strictly necessary, security or authentication, preference or functionality, analytics or performance and advertising or marketing technologies. Strictly necessary technologies may be used where required to provide the Website, maintain security, process a transaction or remember privacy choices. Non-essential analytics, advertising and marketing technologies will not be activated until the required consent has been obtained. Subject to consent, the Website may use services such as Google Analytics and Meta Pixel or equivalent technologies.

Where available, you may accept non-essential technologies, reject them, select individual categories and change or withdraw your consent through the Website's cookie settings. Withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal. Further information about specific technologies, providers and durations will be contained in the separate Cookie Policy.

09 Direct Marketing

GENYX Labs may send electronic marketing communications where you have actively consented, the communication is otherwise permitted by applicable law or the communication is sent to a business contact in a legally permitted context. Marketing consent is separate from acceptance of the Terms & Conditions and is not a condition of purchasing Products unless a specific promotional service necessarily requires it. Every electronic marketing communication will provide a reasonable method of unsubscribing. You may also withdraw marketing consent by contacting support@genyx-labs.com. Service communications concerning an account, transaction, security issue, legal notice, Product safety matter, batch communication or recall are not marketing communications and may still be sent where necessary. GENYX Labs may maintain a minimal suppression record after an unsubscribe request so that the individual's preference can continue to be respected.

10 Sharing And Disclosure Of Personal Data

10.1 Payment providers

Payment providers, banks, card networks, wallet services and fraud-prevention providers may receive information required to process or verify transactions. Depending on the service, a payment provider may act as a processor acting on our instructions, an independent controller or a controller with separate legal obligations.

10.2 Delivery and fulfilment providers

Couriers, postal operators, fulfilment providers and customs intermediaries may receive the recipient name, delivery address, telephone number, email address, shipment information, customs information and other information necessary to deliver or clear an order. Couriers and customs operators may process this information under their own legal obligations.

10.3 Website and technology providers

We may use providers for Website hosting, cloud storage, account authentication, cybersecurity, email delivery, customer support, order management, analytics, cookie management, advertising measurement and technical maintenance. Where acting as processors, they must process personal data only for authorised purposes and subject to appropriate contractual safeguards.

10.4 Professional advisers

Information may be shared with lawyers, accountants, auditors, insurers, consultants and other professional advisers where necessary to obtain advice, maintain records, resolve disputes, comply with legal obligations or protect legal rights.

10.5 Public authorities and legal recipients

We may disclose personal data where reasonably necessary to comply with law, respond to a lawful request, cooperate with courts, regulators, customs authorities, tax authorities or law-enforcement bodies, prevent or investigate fraud or illegal activity, protect the safety or rights of GENYX Labs or others or establish, exercise or defend legal claims. We will not voluntarily disclose personal data to a public authority without an appropriate legal basis.

10.6 Corporate transactions

If GENYX Labs is involved in a merger, acquisition, sale, restructuring, financing, insolvency or transfer of assets, relevant personal data may be disclosed to advisers and prospective or actual counterparties. Any receiving party will be required to process personal data lawfully and subject to appropriate confidentiality and data-protection measures.

10.7 With your instructions or consent

We may share personal data where you expressly request, authorise or consent to the disclosure.

11 Processors, Independent Controllers And Platforms

Some service providers process personal data strictly on behalf of GENYX Labs. Other organisations, including payment providers, couriers, social-media platforms and advertising platforms, may determine some or all of their own processing purposes and therefore act as independent or joint controllers. Where an external organisation acts independently, its privacy notice will govern its processing activities in addition to this Privacy Policy. GENYX Labs is not responsible for processing independently determined by a third party, but we take reasonable steps to select reputable providers and disclose relevant provider categories transparently.

12 International Data Transfers

GENYX Labs aims to process personal data within Malta, the European Economic Area or another jurisdiction recognised as providing an adequate level of data protection where reasonably possible. Some service providers or their subcontractors may process personal data outside the European Economic Area. Where personal data is transferred internationally, GENYX Labs will use a lawful transfer mechanism where required, which may include:

• an adequacy decision adopted by the European Commission;
• European Commission Standard Contractual Clauses;
• approved binding corporate rules;
• another safeguard permitted by data-protection law; or
• a limited statutory derogation applicable to the particular transfer.

Where Standard Contractual Clauses are used, GENYX Labs or the relevant provider may also assess whether supplementary contractual, organisational or technical measures are appropriate. You may contact us to request further information about the relevant transfer safeguard, subject to necessary confidentiality and security limitations.

13 Data Retention

GENYX Labs retains personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, regulatory, security and dispute-resolution requirements. When determining an appropriate retention period, we consider the nature and sensitivity of the data, the volume of data, the purpose of processing, whether the purpose can be achieved through less data, contractual requirements, statutory record-keeping periods, limitation periods for legal claims, fraud and security risks, product-safety, traceability or recall requirements and applicable instructions from competent authorities.

13.1 Account information

Account information may be retained while the account remains active and for a reasonable period after closure or prolonged inactivity, unless a longer period is required for orders, disputes, fraud prevention or legal compliance.

13.2 Order and transaction information

Order, invoice, payment, delivery, refund and transaction records may be retained for the period required by applicable tax, accounting, consumer-protection, customs, product-safety and legal-claims requirements.

13.3 Customer-service records

Customer-support correspondence may be retained for a reasonable period after the matter is resolved and for longer where needed in connection with a transaction, complaint, dispute or legal claim.

13.4 Marketing data

Marketing information is retained until consent is withdrawn, the person unsubscribes, the information is no longer accurate or necessary or continued use is no longer lawful. A limited suppression record may be retained to ensure that an opt-out remains effective.

13.5 Cookie and technical information

Cookie durations will be explained in the Cookie Policy. Technical and security logs will be retained for a limited period proportionate to Website operation, cybersecurity, investigation and fraud-prevention needs.

13.6 Legal disputes and investigations

Relevant personal data may be retained until an investigation, dispute, claim, audit or proceeding is concluded and any applicable appeal or limitation period has expired. When personal data is no longer required, it will be securely deleted, anonymised or otherwise placed beyond ordinary use, subject to lawful backup and archival cycles.

14 Data Security

GENYX Labs uses appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, misuse, alteration, unauthorised disclosure, destruction and other unlawful processing. Measures may include, where appropriate, access restrictions, account authentication, encryption in transit, secure hosting, password protection, logging and monitoring, software updates, backups, provider due diligence, confidentiality requirements and internal procedures for handling security incidents. Access to personal data is limited to persons and providers who reasonably require access for an authorised purpose. No internet transmission or storage system can be guaranteed to be completely secure. Accordingly, while GENYX Labs takes reasonable protective measures, absolute security cannot be guaranteed. Where a personal-data breach occurs, GENYX Labs will assess and manage the incident and will notify the competent authority and affected individuals where legally required.

15 Your Data-Protection Rights

Subject to the conditions, limitations and exemptions under applicable law, you may have the following rights.

15.1 Right of access

You may request confirmation of whether GENYX Labs processes your personal data and obtain access to the personal data and relevant processing information.

15.2 Right to rectification

You may request correction of inaccurate personal data and completion of incomplete personal data.

15.3 Right to erasure

You may request deletion of personal data where the legal conditions for erasure are satisfied. The right to erasure does not apply where continued retention is necessary for legal compliance, contractual records, taxation or accounting, fraud prevention, product traceability or safety, establishment, exercise or defence of legal claims or another lawful exception.

15.4 Right to restriction

You may request that processing be restricted in circumstances provided by law.

15.5 Right to data portability

Where processing is based on consent or contract and carried out by automated means, you may request certain personal data in a structured, commonly used and machine-readable format and, where technically feasible, request its transmission to another controller.

15.6 Right to object

You may object to processing based on legitimate interests on grounds relating to your particular situation. GENYX Labs will stop the relevant processing unless there are compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims. You may object to direct marketing at any time.

15.7 Right to withdraw consent

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

15.8 Rights relating to automated decisions

You may have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you, subject to the conditions and exceptions under applicable law.

15.9 Right to complain

You may lodge a complaint with a competent supervisory authority under applicable data-protection law. GENYX Labs encourages you to contact us first at support@genyx-labs.com so that we have an opportunity to review and address the matter. Privacy requests will ordinarily be answered without undue delay and within one month. The response period may be extended by up to two additional months where permitted because of the complexity or number of requests, in which case you will be informed within the initial month.

16 Exercising Your Rights

To exercise a data-protection right, contact support@genyx-labs.com and use the subject line "Privacy Request". Your request should clearly explain the right you wish to exercise, the personal data or account concerned and any information reasonably necessary to locate the relevant records. GENYX Labs may request reasonable information to verify your identity and protect personal data from unauthorised disclosure. We will not normally charge a fee for handling a valid request. A reasonable fee may be charged, or a request may be refused, where permitted by law because it is manifestly unfounded or excessive, particularly where it is repetitive.

Where we cannot comply fully with a request, we will explain the applicable reason unless the law prevents us from doing so. Authorised representatives may submit requests where adequate evidence of authority and identity is provided.

17 Automated Processing And Fraud Screening

GENYX Labs may use automated tools or risk signals to identify unusual payment behaviour, detect possible fraud, prevent unauthorised account access, assess Website security risks, identify duplicate or suspicious orders and prioritise transactions for manual review. GENYX Labs does not intend to make decisions based solely on automated processing that produce legal or similarly significant effects without an applicable legal basis and appropriate safeguards. A suspicious transaction may be delayed, declined, cancelled or referred for manual review in accordance with the Terms & Conditions.

18 Special-Category And Medical Information

GENYX Labs does not request or require medical diagnoses, treatment records, prescriptions, genetic information, biometric information used for identification, information about sexual life or orientation, religious or political beliefs or other special-category personal data. Customers must not provide medical histories, medical photographs, health records or information about intended human or veterinary use. Where such information is submitted without being requested, GENYX Labs may delete it, redact it, restrict access, retain only the minimum required for a legal claim or compliance matter or take another proportionate action consistent with applicable law. Nothing on the Website should be used as a channel for requesting medical advice or submitting patient information.

19 Children

The Website and Products are intended only for persons aged eighteen years or older. GENYX Labs does not knowingly collect personal data from children. Where we reasonably believe that personal data has been submitted by or concerning a child without an appropriate lawful basis, we may close the relevant account, cancel the transaction, request verification, delete the information or take other appropriate protective action. A parent or legal guardian who believes a child has provided personal data may contact support@genyxlabs.com.

20 Third-Party Websites And Social Media

The Website may contain links to social-media platforms, payment services, courier websites, external reports, laboratories, regulatory sources or other third-party websites. GENYX Labs does not control the privacy practices of independent third parties. Following an external link may allow that third party to collect or process personal data under its own terms and privacy notice. You should review the applicable third-party privacy information before submitting personal data. Interactions with GENYX Labs through social-media platforms may also be processed by the relevant platform independently.

21 Changes To This Privacy Policy

GENYX Labs may update this Privacy Policy where necessary to reflect changes to the Website, processing activities, service providers, law or regulation, security requirements or business and operational changes.

The latest version will be published on the Website with an updated effective date. Where a change materially affects how personal data is used, GENYX Labs may provide an additional notice through the Website, an account notification, email or another appropriate method. Continued Website use after publication of an updated Privacy Policy does not replace consent where new consent is legally required.

22 Contact

For privacy questions, data-protection requests or concerns regarding this Privacy Policy, contact GENYX Labs using the details below. Please use the subject line "Privacy Request" for requests concerning your personal data.

GENYX Labs Website: www.genyx-labs.com Email: support@genyx-labs.com