Website Privacy Policy

Last updated: 12 August 2026

Light Robotics respects the privacy and personal data of visitors to its websites. LIGHT ROBOTICS PTE. LTD. ("Light Robotics", "we", "us" or "our") is the data controller responsible for personal data processed through lightorigins.com and any related webpages that link to this Privacy Policy (collectively, the "Website"), unless a specific page or notice identifies another controller.

This Policy explains how we collect, store, use, disclose and otherwise process your personal data when you browse the Website, subscribe to updates, contact us or use other functions made available through the Website, and how you may exercise your rights.

This Policy does not apply to personal data processed in connection with job applications or recruitment, which is governed by our Candidate Privacy Policy and, where applicable, the privacy notice of the relevant recruitment platform. The Website may also contain links to websites or services operated by third parties. Those third parties process personal data under their own privacy notices, and we encourage you to review those notices before using their services.

1. How We Collect Your Personal Data

We may collect your personal data from the following sources:

1. Directly from you, for example when you subscribe to updates, contact us, communicate with us, or submit a data subject right request;

2. Automatically from your browser or device when you visit or interact with the Website, including through server logs, cookies and similar technologies; and

3. From service providers that support the Website, such as website hosting, analytics, cookie consent management, email delivery, information technology and security providers.

We use cookies and similar technologies to operate the Website, remember your choices and understand how the Website is used. For more information, please see our Cookie Policy.

2. Personal Data We Process and Why

The personal data we actually process will depend on how you interact with the Website, the functions you choose to use, your device and browser settings, and the requirements of applicable law.

You may choose whether to provide personal data. However, if certain data is necessary to respond to your request, provide a function you select or comply with legal obligations, a refusal to provide that data may prevent us from completing the relevant activity.

The Website is not designed to collect sensitive personal data, such as identity document numbers, financial account information, health data or precise location data. Please do not provide such data through general Website or contact channels unless we specifically request it. If sensitive personal data is required for a particular purpose, we will provide an appropriate notice, apply enhanced safeguards and obtain separate consent where required by law.

3. Lawful Bases for Processing

For visitors in China, we will process personal data where one or more statutory grounds under applicable law apply, including:

• We have obtained your consent;

• The processing is necessary to enter into or perform a contract to which you are a party, or to take steps at your request before entering into a contract;

• The processing is necessary for us to perform statutory duties or comply with legal obligations;

• The processing is necessary to respond to a public health emergency or, in an emergency, to protect the life, health or property of a natural person;

• The processing concerns personal data that you have made public or that has otherwise been lawfully made public and is carried out within a reasonable scope in accordance with law; or

• Another ground prescribed by applicable laws or administrative regulations applies.

For visitors outside China, we may process personal data on one or more of the following lawful bases, as permitted by applicable law:

• The processing is necessary to perform a contract with you or to take steps at your request before entering into a contract;

• The processing is necessary to comply with a legal obligation;

• You have provided consent where consent is required or permitted under applicable law;

• The processing is necessary for our legitimate interests, such as operating and securing the Website, understanding and improving Website performance, communicating with you and managing potential disputes, provided that those interests are not overridden by your interests, fundamental rights or freedoms;

• The processing is necessary to protect your vital interests or those of another individual; or

• Another lawful basis available under applicable law applies.

The lawful basis used for a particular activity depends on the applicable law and the circumstances. For example, we generally rely on consent for non-essential analytics technologies and promotional subscriptions where consent is required, and on contractual necessity, legal obligations or legitimate interests where those grounds are available for Website operation, security, communications and the establishment or defense of legal claims.

4. How We Share, Disclose and Transfer Personal Data

4.1 Sharing of Personal Data. We disclose personal data to third parties only for lawful, legitimate and necessary purposes and in accordance with the principle of data minimization. This may include:

• Disclosing personal data as required by applicable laws and regulations, for litigation or dispute resolution, or in response to a lawful request from an administrative authority, court, law enforcement agency or other competent authority;

• Sharing personal data, to the extent necessary, with Light Robotics affiliates for Website operation, technical support, security, communications, internal administration, audits and compliance management;

• Disclosing personal data to auditors, accountants, lawyers and other professional advisers where necessary for professional services, compliance or the establishment, exercise or defense of legal claims; and

• Sharing personal data with another person or entity where we have obtained your consent or where otherwise permitted by applicable law.

Where required by applicable law, we will separately inform you of the recipient's name, contact details, purposes and means of processing, and the categories of personal data involved, and obtain your separate consent.

4.2 Processors and Service Providers. To operate and support the Website, we may engage service providers to process personal data on our behalf, including:

• Website hosting, cloud infrastructure, content delivery network, website development and maintenance providers;

• Analytics, cookie consent management and Website performance providers;

• Email subscription, communications and delivery providers;

• Information technology, cybersecurity, monitoring and technical support providers; and

• Other vendors that support data protection requests, audits, records management or business continuity.

We enter into appropriate arrangements with processors governing the purposes, duration and means of processing, the categories of personal data, security measures and the respective rights and obligations of the parties. Processors may process personal data only on our documented instructions and within the agreed scope, subject to applicable law.

4.3 Transfers in Connection with Business Changes. If personal data is transferred as a result of a merger, demerger, financing, restructuring, sale of assets, dissolution, bankruptcy or other business change, we will provide any notice required by applicable law and require the recipient to continue to protect the personal data. If the recipient changes the original purposes or means of processing, it will be required to provide a new notice and obtain consent again where required by law.

4.4 Public Disclosure. We do not publicly disclose your personal data unless permitted or required by law. Where public disclosure is necessary, we will provide a separate notice and obtain your separate consent where required by applicable law.

5. How Long We Retain Your Personal Data and How We Protect it

5.1 How Long We Retain Your Personal Data

We retain personal data only for the minimum period necessary to fulfill the purposes described in this Policy. When determining the applicable retention period, we consider the nature and amount of the data, the purposes of processing, the duration of our relationship or communications with you, applicable statutory retention requirements, limitation periods, dispute management, audit requirements and information security needs.

For example, subscription data is generally retained until you unsubscribe or the subscription is otherwise discontinued, although we may retain a limited suppression record to ensure that your opt-out is honored.

At the end of the applicable retention period, we will delete or anonymize the relevant personal data. Where immediate deletion is technically impracticable, we will cease all processing other than storage and the application of necessary security safeguards.

5.2 How We Protect Your Personal Data

We employ industry-recognized security technologies and administrative measures to protect your personal data from unauthorized access, use, disclosure, alteration, or destruction. We implement strict access control mechanisms and apply tiered access management based on the principle of minimum necessity, ensuring that only authorized personnel with a legitimate business need may access relevant personal data.

6. International Transfers of Personal Data

The personal data we collect is primarily stored in the United States of America and Europe. As Light Robotics operates globally, we may transfer your personal data to Light Robotics group companies or service providers located outside your country or region, or permit authorized personnel located overseas to access your personal data remotely.

We will conduct a personal data protection impact assessment where required and implement applicable cross-border transfer mechanisms, such as entering into the Standard Contract Clauses or completing other applicable regulatory procedures. We will also implement appropriate contractual, technical and organizational measures to protect personal data transferred across borders.

Where required by applicable law, we will separately inform you of the overseas recipient's name, contact details, purposes and means of processing, the categories of personal data transferred, and the procedures through which you may exercise your rights against the overseas recipient. We will also obtain your separate consent where required.

7. Children's Privacy

The Website is intended for a general business audience and is not directed to children. We do not knowingly collect personal data from individuals who are considered children under applicable law through the Website.

If you are a parent or guardian and believe that a child has provided personal data to us without the authorization or consent required by law, please contact us. We will take reasonable steps to verify the circumstances and delete the relevant data where appropriate.

8. Your Data Protection Rights

The specific rights available to you depend on the lawful basis on which we process your personal data and the laws applicable in your country or region. Subject to applicable conditions and exceptions, you may have the right to:

• Access and obtain a copy of your personal data;

• Request correction or completion of inaccurate or incomplete personal data;

• Obtain information about how we process your personal data and request an explanation of our processing rules;

• Request deletion of your personal data;

• Request restriction of, or object to, the processing of your personal data;

• Where the applicable legal conditions are satisfied, request that your personal data be transferred to another data controller designated by you, or receive the relevant data in a structured, commonly used and machine-readable format;

• Withdraw any consent that you have previously provided;

• Opt-out of promotional communications and manage non-essential cookie choices; and

• Lodge a complaint with us or with a competent data protection or privacy authority.

You may submit a request through the contact details set out in Section 10 of this Policy.

If you object to our processing of your personal data or withdraw your consent, we will handle your request in accordance with applicable law. However, this may prevent us from certain activities described in Section 2 of this Policy.

For visitors in China, where we process personal data on a statutory ground other than consent, the withdrawal of consent will not affect our continued processing to the extent that the relevant statutory ground applies. The withdrawal of consent will also not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal.

9. Changes to This Policy

We may update this Policy from time to time to reflect changes in applicable laws or regulatory requirements, recruitment processes, system functions, service providers, industry practices or business arrangements.

The updated Policy will be published on the relevant recruitment page and will state the date on which it was last updated. If an update may materially affect your rights or our processing activities, we will provide additional notice through an appropriate channel and obtain your consent again where required by applicable law.

10. Contact Us

If you have any questions, comments, complaints or suggestions regarding this Policy, believe that your personal data may have been compromised, or wish to exercise any of your data protection rights, please contact us at privacy@lightorigins.com.

We will review and respond to your question or request in a timely manner. To protect your personal data and that of others, we may need to verify your identity before processing your request. We will respond within the period prescribed by applicable law. For example, we will generally respond and provide a reasonable explanation within 15 working days after receiving your request and completing any necessary identity verification, unless otherwise required by applicable law.