This Customer Privacy Notice ("Notice") explains how Puriphy processes personal data about you when you shop at an online store that uses the Puriphy application (the "App"). It is written for shoppers, not for the merchants who install the App — if you are a merchant, please see Puriphy's main Privacy Policy at www.puriphy.eu/privacy-policy for information about how we process your own account data.

The App is provided by One Punch Solutions FZ-LLC, trading as "Puriphy" ("Puriphy", "we", "us", "our"), a company organized under the laws of Dubai, United Arab Emirates, holding license number 103953, with its registered address at Premises No. DMC-BLD05-VD-G00-327, Ground Floor, DMC5, Dubai Media City, Dubai, United Arab Emirates.

Puriphy builds technology that helps online stores measure, report on, and reduce the carbon footprint of their e-commerce operations, and to offer their customers ways to contribute to climate action.

When you place an order at a store that has installed the App, the store owner (the "Merchant") may use the App to calculate the estimated environmental impact of your order (for example, based on shipping method or order value) and to offer you the option to support climate projects.

In this context, the Merchant is the controller of your personal data — they decide to use the App and what it is used for. Puriphy acts as a processor, meaning we process your data on the Merchant's behalf and according to their instructions, under a data processing agreement between Puriphy and the Merchant. If you have questions about how your data is used, you can also contact the Merchant directly, as they remain responsible for decisions about your data.

Depending on how the Merchant has configured the App, we may process the following categories of data about you in connection with your order:

• Order and transaction data, such as order value, order date, shipping method, and destination country/region, used to estimate the environmental footprint of your order.
• Contact details, such as your name and email address, where the App is used to communicate climate-contribution options or receipts to you.
• Payment-related information necessary to process any voluntary climate contribution you choose to make, which is handled by our payment processor (see Section 5) — Puriphy does not itself store your full payment card details.
• Technical data, such as IP address and browser information, collected automatically for security, fraud prevention, and to keep the App functioning correctly.

We do not process special categories of personal data (such as health, religious beliefs, or sexual orientation) through the App, and we do not knowingly collect personal data from children under 18.

We process your personal data to:

• calculate and display the estimated environmental impact of your order;
• offer and process any voluntary climate contribution you choose to make at checkout or afterwards;
• provide the Merchant with aggregated or individual reporting about the environmental footprint of their store's orders;
• maintain the security, integrity, and proper functioning of the App; and
• comply with our legal obligations.

Because Puriphy acts as a processor, our legal basis for processing is the Merchant's instructions under our data processing agreement — the Merchant is responsible for having its own lawful basis (such as legitimate interest or your consent, where required) for using the App in connection with your order.

We may share your personal data with:

• the Merchant whose store you purchased from, who receives order-level and/or aggregated reporting through the App;
• our sub-processors, including cloud hosting and data storage providers, our payment processor, and analytics or support tools, who process data only on our instructions and under contractual data protection obligations; and
• third parties where required by law, to protect our rights, or in connection with a business transfer (such as a merger or acquisition).

We do not sell your personal data, and we do not share it with advertisers for their own marketing purposes.

Your personal data may be processed in the European Economic Area, the United Kingdom, and other jurisdictions where Puriphy or its sub-processors operate, including the United Arab Emirates. Where we transfer personal data outside the EEA/UK to a country not recognised as providing an adequate level of protection, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

We retain personal data processed through the App only for as long as necessary to fulfil the purposes described in this Notice, in line with the Merchant's instructions, or as required by applicable law (for example, tax or accounting requirements). When a Merchant uninstalls the App or requests deletion, we delete or anonymise the personal data we hold on their behalf, subject to any legal retention requirements.

We use appropriate technical and organisational measures to protect your personal data, including encryption of data in transit, access controls, and regular security reviews. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Depending on where you live, you may have rights under applicable data protection law (such as the GDPR if you are in the EEA, or the UK GDPR if you are in the UK) to access, correct, delete, or restrict the use of your personal data, to object to certain processing, or to receive a copy of your data in a portable format.

Because the Merchant is the controller of your data, we generally ask that you first direct such requests to the Merchant whose store you purchased from. You may also contact Puriphy directly at [email protected], and we will either respond directly or forward your request to the relevant Merchant, and assist as needed. If you are in the EEA or UK and believe your data has been processed unlawfully, you also have the right to lodge a complaint with your local data protection authority.

We may update this Notice from time to time to reflect changes in our practices or for legal or regulatory reasons. The "Last updated" date at the top of this Notice indicates when it was last revised. We encourage you to review this Notice periodically.

If you have questions about this Notice or about how your personal data is processed through the App, please contact us at:

One Punch Solutions FZ-LLC (trading as Puriphy)
Premises No. DMC-BLD05-VD-G00-327, Ground Floor, DMC5, Dubai Media City, Dubai, United Arab Emirates
Email: [email protected]