Updated: [2026] Year [09] Month [25] Day

Effective Date: [2026] Year [09] Month [25] Day

Welcome to our products and services! This privacy policy applies to the business-facing products and services provided by TRUE GENIUS PRIVATE LIMITED, as identified in the applicable service agreement, order form, product interface, or service documentation. Xiaodu‘s products (in this Privacy Policy referring to Xiaodu's Singapore entity, TRUE GENIUS PRIVATE LIMITED, hereinafter also referred to as "we") attaches great importance to your privacy protection and personal data protection. This Privacy Policy applies to your access to and use of products and services under the control of us in any manner.

Introduction

We endeavour to present this Privacy Policy in a clear and comprehensible manner, so as to convey to you the information we wish to communicate, and to enable you to have a clear understanding of the purposes for which certain information is collected, the possible uses thereof, and other related matters, before you provide us with certain information (which may include your personal data) and permit us to process and share certain information. For ease of reading and comprehension, we have defined certain terms used in this Privacy Policy. Please refer to "Annex 1: Definitions" for the specific contents of those definitions.

This Privacy Policy applies to all products and services on the Xiaodu Platform (for the scope of coverage, see Annex 1: Definitions) and all products and services under Xiaodu.

If a specific Xiaodu product has its own separate privacy policy, that product's privacy policy shall take precedence. Matters not covered by that product's privacy policy shall be governed by this Privacy Policy. In the event of any conflict between a product's privacy policy and this Privacy Policy, the product's privacy policy shall prevail.

This Privacy Policy is intended to help you understand what data we collect, why we collect it, what we do with it, and how we protect it.

Unless otherwise required by applicable law, with respect to how we handle your personal data, you have the right to be informed and to make decisions, and the right to restrict or refuse the processing of your personal data by us or others. You also have the right to request that we explain our personal data processing rules to you.

This Privacy Policy will help you understand the following:

• Section I: How We Collect and Use Your Personal data

• Section II: How We Use Cookies and Similar Technologies

• Section III: How We Share, Transfer, and Publicly Disclose Your Personal data

• Section IV: How We Store and Protect Your Personal data

• Section V: Your Rights

• Section VI: How We Handle Minors' Personal data

• Section VII: How Your Personal data is Transferred Across Borders

• Section VIII: Updates to This Privacy Policy

• Section IX: How to Contact Us

We fully appreciate the importance of personal data to you, and recognise that providing effective protection for your information is the cornerstone of our healthy and sustainable business development. Thank you for using and trusting the xiaodu ‘s products and services. We are committed to maintaining your trust in us, adhering to the law and our commitments to you, and doing our utmost to ensure the security and reasonable use of your personal data.

At the same time, we solemnly undertake that we will adopt appropriate security protection measures in accordance with mature industry security standards to protect your personal data.

Definitions

For the purposes of this Privacy Policy, ‘Xiaodu Products’ means, collectively, the following products and services provided by us:

（1） Xiaodu Hotel Management Platform (Xiaodu Platform)

（2）Xiaodu Smart Screen for International Hotels

（3）Dumo Hotel App (Android version and iOS version)

Any reference in this Privacy Policy to the‘Xiaodu Products’ or the ‘Services’ shall be construed in accordance with this definition, as the context requires. Where a provision applies only to a specific product, that product is named expressly.

Section I: How We Collect and Use Your Personal data

We will process your personal data strictly in accordance with the requirements of applicable law and the personal data processing rules we have provided to you.

We generally collect and use your personal data for the following purposes:

1. Personal data Processing Activities Required for User Registration/Login

When registering a Xiaodu International account, you must provide us with at least an account name, mobile phone number and/or email address, and create a password. If you only need to use basic services available without logging in, such as browsing and searching, you may choose not to register as our user and not to provide the above information.

Certain features may allow you to add and manage multiple accounts, in which case you will need to provide us with the name, account name, user ID, SMS reminder settings preferences, user type, and user role of the new account. If you provide personal data of other individuals, you must obtain the consent of such individuals in accordance with the requirements of applicable law.

Where required by mandatory applicable law or necessary for the use of specific product features, when you use certain specific products and need to fill in information such as a mobile phone number that has already been provided during account registration, we may display by default the mobile phone number and other information associated with your Xiaodu International account for your convenience. You may modify this in accordance with the relevant product features.

In addition to being used to identify you, registration information will also be used in other service-related scenarios. For example, we may use the information collected (such as your mobile phone number and email address) to communicate or interact directly with you; if we or a company using the Xiaodu International account system detects suspicious activity (such as an attempt to log in to your Xiaodu International account from an unusual location), a notification may be sent to you; or we or a company using the Xiaodu International account system may contact you to inform you of upcoming changes or improvements to the services provided to you, or to invite you to experience new products.

To ensure the security of your account and assets, and to carry out risk control and prevention, when you register/log in to your account, we will collect your device information and information related to the registration/login environment (including IMEI, IDFA, ICCID, device name, device model, operating system version, Wi-Fi information including BSSID, SSID, and IP address information).

Certain products also allow you to log in using a third-party account (such as WeChat, Weibo, or QQ). In such cases, you will authorise the product to obtain the publicly available information registered under your third-party account (including your nickname, profile picture, and other information you have authorised).

Certain products offer you a "One-Click Login" option, which you may choose to use. This login method is provided by the carrier. If you select this method, the carrier will process your mobile phone number information. We are unable to obtain your plaintext mobile phone number before you actively log in.

To meet mandatory requirements of applicable law, because it is necessary for the use of certain product features, or based on your need to enhance the level of account protection, when using certain services or when you have further requirements, you may need to provide your real name, ID card number, and facial information to complete real-name authentication. Failure to complete real-name authentication may affect your ability to use features that require such authentication. To verify the accuracy and completeness of the information you provide, or to protect the security of your account, we may compare the real-name information you provide to Xiaodu against corresponding information held by institutions permitted by applicable law or institutions authorised by government authorities. To safeguard your account security, ensure real-name consistency, and provide you with convenient services, upon completion of real-name authentication on your Xiaodu International account, the above real-name information will serve as the universal authentication information for that account across all products that integrate the Xiaodu International account service. To protect the security of your personal data, please do not transfer or lend your account to others.

If the scope of processing exceeds the above, we will, unless otherwise required by applicable law, seek your additional consent in accordance with the requirements of applicable law.

Our processing of the relevant personal data is necessary to provide services to you. Refusing to provide us with the above personal data will result in your inability to use our services. The legal basis for our processing of your personal data is the necessity to perform the contract with you.

2. Personal data Processing Activities Required for Service Provision

Depending on the services you choose, in the course of providing services we may collect personal data relating to your use of products and/or services (including how you use them) in order to fulfil the service purposes. In cases where certain services are provided jointly by Xiaodu and third parties, we and such third parties may process your personal data jointly as necessary to provide the services to you.

The categories and content of personal data required for service provision are determined by the specific services and features you have activated, and generally include:

Product Usage Information

We may record information that you actively provide or leave when using our products and/or services. For example, text, images, audio and video information that you actively publish, provide feedback on, comment on, or upload, as well as contact information submitted by you when participating in product operations activities.

Device Information

This may include device attribute information of your terminal device (such as the end user's hardware model, operating system version, device configuration, and device identifiers including IMEI, IMSI, MAC address, IDFA, IDFV, MEID, OAID, ICCID, Android ID, and hardware serial number), device connection information (such as browser type, telecommunications carrier, language used, and Wi-Fi information), and device status information (such as a list of installed applications and device sensor information).We do not collect government identification numbers, biometric information, precise location data, installed application lists or sensor data unless such collection is necessary for a specific feature, clearly disclosed to you, and supported by an appropriate legal basis under applicable law.

Log Information

When you use products and services on the Xiaodu Platform, our servers will automatically record certain information, such as your usage of our products and/or services, IP address, URL of the accessed service, browser type and language used, information on downloading, installing, or using mobile applications and software, information on communications via communication software, and the date, time, and duration of access to the service.

Our processing of the relevant personal data is necessary to provide services to you. Refusing to provide us with the above personal data will result in your inability to use our services. For processing activities subject to data protection laws such as the Personal Data Protection Act of Thailand, our collection and processing of your personal data is based on the necessity to perform the contract with you.

3. Providing Security Protection

To enhance the security of products and services provided by us, Xiaodu's affiliates, and partners, we may use your information for identity verification, customer service, security prevention, fraud prevention, account security, risk management and compliance checks, in order to prevent, detect, and/or investigate fraud, security threats, and other unlawful activities or activities that violate our agreements, policies, or rules, thereby protecting the legitimate rights and interests of you, our other users, us, Xiaodu's affiliates and partners, and the public. To prevent and combat the publication and dissemination of illegal and harmful information, and to ensure content security when you use our products and services, we use computer algorithm models to automatically calculate and comprehensively analyse online information content. If illegal or harmful information is detected, transmission is immediately stopped and appropriate measures are taken.

4. Improving Our Products and Services, and Conducting Internal Audits, Data Analysis, and Research

We may use the information collected to improve our products and services and to carry out necessary business operations and analytical research, such as operating products or providing services, assessing, maintaining, and improving the performance of products and services, developing new products and services, and providing customer support.

To improve the products and services of Xiaodu, its affiliates, and partners, we may also conduct statistical analysis of product usage. Xiaodu may share such statistical information with the public to demonstrate overall usage trends for our services, but such statistical information will not contain any information that identifies you personally.

Your refusal to allow us to process the relevant personal data will not affect your normal use of our services. The legal basis for our processing of your personal data is your consent.

5. Improving the Security and Personalisation of Products and Services

To meet the reasonable needs of improving the security and personalisation of products and services, we may, in accordance with applicable law or based on your valid authorisation, receive your personal data and other information from providers of products and services on the Xiaodu Platform, Xiaodu's affiliates, partners, collaborators, and other trusted third-party suppliers, and may process such information accordingly. We will require personal data providers to explain the source of personal data in advance and will verify the lawfulness of the source, ensuring that we have a sufficient legal basis for processing your personal data. For example, if we process your personal data based on consent, and the personal data processing activities required for our business operations exceed the scope of the authorisation and consent already obtained, we will seek your consent within a reasonable period after obtaining the personal data or prior to processing it, or obtain your consent through the personal data provider.

6. Other Processing Purposes

We may carry out personal data processing activities to achieve other specific processing purposes in connection with providing different products or services. You may refer to the privacy policy of the specific Xiaodu product or contact us for further explanation.

7. Personal data We Process on a Commissioned Basis

Unlike the personal data we process when providing services to you, this Privacy Policy does not apply to your business data that you entrust us to process through your use of our services. You retain full control over user business data. With respect to personal data contained in such data, we act as a processor and will process such data strictly in accordance with the instructions in the separately executed data processing agreement.

Section II: How We Use Cookies and Similar Technologies

To ensure the proper functioning of our websites, we store small data files called cookies on your computer or mobile device. Cookies typically contain identifiers, site names, and certain numbers and characters. The primary function of cookies is to facilitate your use of website products and services, and to help websites count unique visitors. Through cookie technology, we are able to provide you with more personalised services and allow you to set specific service preferences.

When you use Xiaodu products and services, we will send

one or more cookies or anonymous identifiers to your device. When you interact with services we provide to partners (such as advertising and/or promotional services, and service features provided by Xiaodu that may appear on other websites), we allow cookies (or other anonymous identifiers) to send information about your visits to and use of products or services to Xiaodu's servers.

We will not use cookies for any purposes other than those described in this Privacy Policy or in specific product privacy policies. You may manage or delete cookies according to your preferences. You may restrict Xiaodu's use of cookies in accordance with the instructions in the relevant product privacy policies.

Section III: How We Share, Transfer, and Publicly Disclose Your Personal data

1. Sharing

We will treat your information with a high degree of diligence. Unless otherwise expressly permitted by applicable law, we will not share your information with any company, organisation, or individual other than Xiaodu without your separate consent. Certain of our services are provided by authorised partners. We will only share your personal data with third parties for lawful, legitimate, necessary, specific, and explicit purposes, and will only share personal data relevant to the services provided by such third parties. Unless separately authorised by you or otherwise required by applicable law, our partners are not permitted to use the shared personal data for any other purpose. We will enter into strict agreements with the companies, organisations, and individuals with whom we share personal data, requiring them to handle the shared personal data in accordance with our instructions, this Privacy Policy, and any other applicable confidentiality and security measures.

Our authorised partners currently generally include the following types:

Service Platforms or Service Providers

Xiaodu's products are integrated with a wide range of third-party services. When you choose to use a third-party service, and to the extent necessary for such third party to provide the service to you, we will provide the necessary information to the third-party service platform or service provider so that it can provide services to you based on such information.

Software/Hardware and System Service Providers

When third-party software/hardware or system products or services are combined with Xiaodu's products or services to provide services to you, with your authorisation, we will provide the third-party software/hardware or system service provider with your necessary personal data to enable you to use the service, or for us to analyse product and service usage in order to improve your experience.

2. Commissioned Processing and Joint Processing

In order to provide better services to you, we may commission affiliated companies or third-party partners to process your personal data. We will only commission affiliated companies or third-party partners to process your information for lawful, legitimate, necessary, specific, and explicit purposes. We will strictly limit the scope of information processing by commissioned parties and require them to adopt adequate data security safeguards. If an affiliated company or third-party partner uses your information for purposes not commissioned by us, it will seek your separate consent. Our affiliated companies may access your data in order to provide necessary system operations and maintenance support services. Our commissioned authorised partners include partners providing advertising and analytics services. Subject to compliance with industry-standard security practices, we may commission such partners to process information related to advertising placement, advertising effectiveness, and advertising reach. Without your valid authorisation, we will not commission third-party partners to process information that directly identifies you personally.

If you actively leave your contact details, address information, or other personal data with a specific third-party partner for the purpose of allowing them to contact you, such partner will process your personal data directly.

In joint processing scenarios, we will likewise enter into agreements with our partners that comply with applicable law, and fulfil the relevant personal data protection obligations.

3. Transfer

We will not transfer your personal data to any company, organisation, or individual other than Xiaodu and its affiliates, except in the following circumstances, unless prohibited by applicable law:

(1) We have obtained your prior explicit authorisation or consent;

(2) The requirements of applicable law, legal process, mandatory government requirements, or judicial orders are met;

(3) If we or our affiliates are involved in a merger, demerger, liquidation, acquisition or sale of assets or business, or similar transaction, your personal data may be transferred as part of such transaction. We will ensure the confidentiality of such information at the time of transfer, notify you of the name and contact details of the recipient, and require the new company or organisation holding your personal data to continue to be bound by this Privacy Policy. Otherwise, we will require such company or organisation to seek your authorisation and consent anew.

4. Public Disclosure

We will only publicly disclose your personal data in the following circumstances, unless prohibited by applicable law:

(4) With your separate consent;

(5) Where required by applicable law, legal process, litigation, or mandatory requirements of a competent government authority.

5. Exceptions to Prior Authorisation for Sharing, Transferring, and Publicly Disclosing Personal data

Unless prohibited by applicable law, in the following circumstances, we may share, transfer, or publicly disclose your personal data without obtaining your prior authorisation and consent:

(6) Where necessary to perform statutory duties or statutory obligations (such as statutory obligations directly related to national security, defence security, criminal investigation, prosecution, adjudication, and enforcement of judgments);

(7) Where necessary to respond to a public health emergency, or in an emergency to protect the life, health, or property safety of a natural person;

(8) Where your personal data that you have voluntarily made public or that has been otherwise lawfully made public is processed within a reasonable scope (such as through lawful news reports or government information disclosure channels);

(9) Where necessary to enter into and perform a contract at the request of the data subject;

(10) Where personal data is processed within a reasonable scope for the purpose of carrying out news reporting, public opinion oversight, or similar activities in the public interest;

(11) Other circumstances provided by applicable law.

In accordance with applicable law, sharing or transferring personal data that has been anonymised and where the data recipient has been confirmed to be unable to restore or re-identify the data subject does not constitute external sharing, transfer, or public disclosure of personal data. The storage and processing of such data will not require separate notification to or consent from you.

Section IV: How We Store and Protect Your Personal data

1. Retention Period

We will retain your personal data for the period necessary to provide services, unless applicable law stipulates a different retention period, you consent to a longer retention period, it is necessary to ensure the security and quality of the service, for dispute resolution purposes, or it is technically difficult to do so otherwise. Following the expiry of the foregoing retention period, we will extend the retention period in accordance with law, contract, or within a reasonable scope.

After the retention period has expired, we will delete your personal data or anonymise it in accordance with applicable law.

2. Storage Location

Your personal data is generally stored in Malaysia. Where cross-border elements are involved in certain products or services, or where necessary to provide technical support or for group management purposes, we may need to provide your personal data to affiliated companies, partners, or third-party service providers located in Singapore, China, or other countries or regions outside your country. In such cases, we will strictly comply with applicable law and ensure the security of your personal data.

3. Security Measures

(1) We collect, use, store, and transmit user information in accordance with mature industry security standards and specifications, and inform you of the purposes and scope of use of the relevant information through user agreements and privacy policies.

(2) We place great importance on information security. We have established dedicated teams responsible for researching and applying various security technologies and procedures. We conduct security background checks on persons responsible for security management and persons in key security positions. We have established comprehensive information security management systems and internal security incident handling mechanisms. We will take reasonable and practicable security measures and technical means that meet industry standards to store and protect your personal data, in order to prevent your information from being lost, subject to unauthorised access, public disclosure, use, modification, damage, or leakage. We will take all reasonable and practicable measures to protect your personal data. We use encryption technology to ensure data confidentiality, and trusted protection mechanisms to prevent data from malicious attacks.

(3) We conduct awareness and capability training on data security for our employees, and strengthen employees' understanding of the importance of protecting personal data. We have deployed access control mechanisms for identity authentication and permission management for employees handling personal data. We will also enter into confidentiality agreements with employees and partners who have access to your personal data, setting out their job duties and codes of conduct, and ensuring that only authorised personnel may access personal data. Any breach of confidentiality obligations will be subject to accountability.

(4) We remind you that the internet is not an absolutely secure environment. When you exchange information with other users via email, text messages, or similar means, it is uncertain whether third-party software fully encrypts the transmission of such information. Please take care to protect the security of your personal data. We recommend that you refrain from sending personal data via such means to avoid leakage. Please use a complex password and do not share your Xiaodu International account and password with others, so as to help us protect the security of your account and personal data.

4. Security Incident Notification

(1) We will develop emergency response plans for cybersecurity incidents and promptly address security risks such as system vulnerabilities, computer viruses, cyberattacks, and network intrusions. In the event of an incident that endangers cybersecurity, we will immediately activate the emergency response plan, take appropriate remedial measures, and report to the competent authorities as required.

(2) Leakage, damage, or loss of personal data constitutes a company-level critical security incident. We will take responsibility for regularly organising members of the working group to conduct drills of security contingency plans to prevent such security incidents. In the unfortunate event that such an incident occurs, we will activate the emergency response plan with the highest priority, and form an emergency response team comprising multiple departments including the security department, government relations department, and legal department, in order to trace the root cause and minimise losses in the shortest possible time.

(3) In the unfortunate event of a personal data security incident, we will, in accordance with the requirements of applicable law, promptly inform you of the basic situation and possible impact of the incident, the remedial measures we have taken or will take, suggestions for risks you can independently prevent and mitigate, and remedial measures available to you. We will promptly notify you of relevant details through in-platform notifications, SMS notifications, telephone calls, emails, or other contact methods you have provided. Where it is not practicable to notify each individual, we will adopt reasonable and effective means to issue a public notice. We will also proactively report the handling of personal data security incidents to the regulatory authorities as required.

Section V: Your Rights

You enjoy all rights relating to personal data granted to you by applicable law, including:

1. Accessing and Copying Your Personal data

You have the right to access and copy your personal data, except in circumstances specified by applicable law. You may access and copy your personal data yourself in the following ways:

Account Information — You may log in to the Xiaodu International Account website at any time to access or edit your account profile information, change your password, link accounts, or complete identity authentication.

If you are unable to access such personal data through the above link, you may contact us at any time through Personal data Protection Feedback (hyperlink).

For other personal data generated during your use of our products and services, if you wish to exercise your right of access or right to copy, please refer to the specific product's privacy policy or contact us through Personal data Protection Feedback. To ensure security, we may verify your identity before you exercise your right of access or right to copy.

2. Correcting or Supplementing Your Personal data

If you find that the personal data we process about you is inaccurate or incomplete, you have the right to correct or supplement inaccurate or incomplete information. You may refer to the specific product's privacy policy or contact us at any time through Personal data Protection Feedback. To ensure security, we may verify your identity before you exercise your right to correction or supplementation.

3. Deleting Your Personal data

In the following circumstances, you may contact us at any time by referring to the instructions in the specific product's privacy policy or through Personal data Protection Feedback to request deletion of personal data:

(1) The processing purpose has been achieved, cannot be achieved, or is no longer necessary for the purpose for which processing was carried out;

(2) We have ceased to provide the product or service, or the retention period has expired;

(3) You withdraw your consent;

(4) We process personal data in violation of applicable law or in breach of our agreements;

(5) Other circumstances provided by applicable law.

After you delete information from our services, we may not immediately delete the corresponding information from our backup systems, but will delete it when the backup is updated.

In the course of product design and in the final presentation and user experience, we will endeavour to provide you with more convenient means to control your personal data. As different products have different features and services, the means and design of personal data controls we provide may vary. Please read the relevant product's privacy policy when using a specific product for further information.

4. Withdrawing Consent

Each product feature requires some basic personal data to function. For personal data that we process based on your consent, you may at any time give or withdraw your authorisation and consent. For example:

(1) You may log in to the [Account & Security] page to unlink your Xiaodu International account from a third-party account, and manage your search record settings through [Search Privacy Settings].

(2) If you have authorised us to obtain certain mobile device system permissions and thereby consented to our processing of your personal data, you may withdraw such authorisation through the APP system permission settings.

When you withdraw your consent or authorisation, we will no longer be able to provide the service corresponding to the withdrawn consent or authorisation, and will cease to process your corresponding personal data. However, your decision to withdraw consent or authorisation will not affect personal data processing that has already been carried out based on your prior consent or authorisation.

5. Requesting Restriction or Cessation of Processing Your Personal data

Where provided by applicable law, in the following circumstances you may request that we restrict or cease processing your personal data:

(1) If you dispute the accuracy of the personal data we process about you, in which case processing needs to be restricted or stopped in order to verify the accuracy of the personal data;

(2) You object to processing activities we have carried out for purposes inconsistent with those to which you consented;

(3) Our processing activities violate applicable law;

(4) Processing is no longer necessary to achieve the processing purpose.

In addition, where personal data is necessary for asserting rights or participating in legal proceedings, you may request that we retain your personal data.

6. Deregistering Your Account

You may deregister a previously registered account at any time. You may log in to [Account & Security] and follow the relevant operating instructions to deregister your Xiaodu International account. Please note that once you deregister your Xiaodu International account, you will no longer be able to use all Xiaodu products and services (except for certain service features that do not require registration/login to a Xiaodu International account). Please proceed with caution. To protect your or others' legitimate rights and interests, we will assess whether to support your deregistration request based on your usage of the various Xiaodu products and services. For example, if you still have data in your cloud storage, we will not immediately process your request. If you log in to Xiaodu via a third-party account authorisation, you will need to apply to that third party to deregister the account.

7. Advance Notice of Service Suspension

Xiaodu wishes to accompany you always. However, should Xiaodu's platform products and services be forced to cease operations for special reasons, we will notify you in accordance with applicable law through a prominent notice on the product and/or service homepage, in-platform messages, email, or other appropriate means capable of reaching you, cease collecting your personal data, and delete or anonymise your personal data that we hold in accordance with applicable law.

8. Right to Data Portability

Where permitted by applicable law, if you request that your personal data be transferred to a personal data processor designated by you, we will provide the means for such transfer in accordance with the relevant provisions.

9. Responding to Your Requests

To ensure security, your exercise of the above rights requires you to submit a written request or otherwise verify your identity. We may require you to verify your identity before processing your request.

For reasonable requests, we generally do not charge a fee. However, for repeated requests that exceed a reasonable threshold, we may charge a certain cost at our discretion. We may decline requests that are groundlessly repetitive, require excessive technical means (such as developing a new system or fundamentally changing existing practices), pose risks to the legitimate rights and interests of others, or are highly impracticable (such as involving information stored on backup tapes).

In the following circumstances, unless required by applicable law, we will be unable to respond to your requests:

(1) Where directly related to national security or defence security;

(2) Where directly related to public safety, public health, or major public interests;

(3) Where directly related to criminal investigation, prosecution, adjudication, or enforcement of judgments;

(4) Where we have sufficient evidence that you have acted with subjective malicious intent or are abusing your rights (such as where your request would endanger public safety or the legitimate rights and interests of others, or where your request exceeds the scope of what can be accommodated by ordinary technical means and commercial costs);

(5) Where responding to the data subject's request would cause serious harm to your or another individual's or organisation's legitimate rights and interests;

(6) Where trade secrets are involved;

(7) Where related to our fulfilment of obligations prescribed by applicable law;

(8) Other circumstances provided by applicable law.

Section VI: How We Handle Minors' Personal data

Our products, websites, and services are primarily intended for adults. If you are a minor, please do not use our products, websites, or services. If a guardian discovers that we have collected a minor's personal data without the guardian's consent, please contact us through Personal data Protection Feedback, and we will endeavour to delete the relevant data as soon as possible.

Section VII: How Your Personal data is Transferred Across Borders

The servers required for our operations are primarily located in Malaysia, and your personal data will be transferred to and stored on servers in Malaysia. To support business operations, provide technical support, or for group management purposes, affiliated companies, partners, or third-party service providers located in China, Singapore, or other countries or regions where we conduct business may remotely access or process your personal data. When conducting such cross-border data transfers, we will strictly comply with applicable legal requirements and ensure that the country or region of the data recipient has an appropriate safeguards for protecting personal data. Where applicable, we will enter into data processing agreements with recipients that comply with applicable law, such as the ASEAN Model Contractual Clauses for Cross-Border Data Flows, or adopt other legally recognised compliance mechanisms, to ensure that your personal data receives a level of protection no lower than that required by the laws of your country or region.

Section VIII: How This Privacy Policy Is Updated

We may revise this Privacy Policy from time to time. If such changes would result in a material reduction of your rights under this Privacy Policy, we will notify you in advance of the changes taking effect by means such as a prominent notice on the relevant page or by sending you an email. We will post any changes to this Privacy Policy on this page.

If you do not agree to such changes, you may stop using the products and services on the Xiaodu Platform.

Material changes referred to in this Privacy Policy include, but are not limited to:

(1) Material changes to our service model, such as the purposes of processing personal data, the types of personal data processed, or the manner in which personal data is used;

(2) Material changes to the principal recipients of shared, transferred, or publicly disclosed personal data;

(3) Material changes to your rights in relation to personal data processing and the manner in which such rights are exercised;

(4) Other changes that may have a material impact on your personal data rights and interests.

Section IX: How to Contact Us

If you have any comments or suggestions regarding this Privacy Policy, you may contact us through Personal data Protection Feedback.

You may also contact us through the following means:

Legal Department, TRUE GENIUS PRIVATE LIMITED

To ensure that we can handle your issue efficiently and respond to you in a timely manner, you are required to submit proof of identity, valid contact information, a written request, and relevant evidence. We will process your request after verifying your identity. Under normal circumstances, we will respond within the period stipulated by applicable law.

If you are not satisfied with our response, or in particular if you believe that our personal data processing activities have infringed your legitimate rights and interests, you may also seek resolution through the following external channel: file a complaint with the data protection supervisory authority in your region in accordance with applicable law.

Annex 1: Definitions

Specific terms used in this Privacy Policy have the following meanings:

1. "We", "Xiaodu", "Xiaodu Company", "Xiaodu Singapore", or "Xiaodu's Singapore entity" refers to TRUE GENIUS PRIVATE LIMITED.

2. "You" refers to users of our products and services, as well as purchasers of paid services.

3. "Personal data" refers to various types of information recorded electronically or otherwise relating to an identified or identifiable natural person, excluding information that has been anonymised. Personal data includes basic personal data, personal identity information, personal biometric information, network identity information, personal health and physiological information, personal education and employment information, personal financial information, personal communications information, contact information, personal internet records, commonly used personal device information, personal location information, and so on. For the avoidance of doubt, personal data includes but is not limited to sensitive personal data.

4. "Data Subject" (Personal data Subject) refers to the natural person identified by the personal data.

5. "Sensitive Personal data" refers to personal data that, once leaked or unlawfully used, is likely to cause harm to the dignity of a natural person or endanger their personal or financial safety. This includes biometric information, religious beliefs, specific identity information, medical and health information, financial account information, location and movement information, personal data of minors under the age of 14, and other special categories of data as provided by applicable law.

6. "De-identification" refers to the process of technically processing personal data so that, without the aid of additional information, the data subject cannot be identified.

7. "Anonymisation" refers to the process of technically processing personal data so that the data subject cannot be identified and the processed information cannot be restored.

8. "Applicable Law" refers to all laws and regulations relating to privacy, personal data, and data protection that are applicable to personal data processing activities under this Privacy Policy. Depending on the country or region in which the data subject is located and other factors relating to personal data processing, the applicable law may differ for different processing activities.