1 INTRODUCTION

1.1. This Privacy Policy explains how Novo World Ltd (“Ampere”, “we”, “us”) processes personal data in connection with Ampere eSIM, including our website, app, free and paid data plans, and customer support (the “Services”).

1.2. Novo World Ltd is the controller for the processing described in this Policy. Company number: 13894648. Registered office: Meridien House, 42 Upper Berkeley Street, London, England, W1H 5QL. Privacy enquiries: [email protected]

1.3. The eSIM product is separate from Ampere financial services. If you choose to apply for a financial account, the relevant provider’s privacy notice will explain that application and any additional processing.

2 PURPOSE AND PROCESSING PRINCIPLES

2.1. This Policy describes the information we use, our purposes and legal grounds, the organisations involved, retention and your rights. We apply applicable UK data protection law and, where relevant, EU data protection law.

2.2. We aim to keep information accurate, limit it to what is needed, use it for stated purposes and protect it against unauthorised access or loss. This Policy provides information; accepting it or using the Services does not by itself constitute consent to optional processing.

3 HOW WE COLLECT INFORMATION

3.1. We receive information directly from you when you register, choose a destination or plan, purchase additional data or contact support. We also collect technical information through the website and app and receive eSIM activation and usage information from our Third Party Providers.

3.2. “Third Party Providers” means the independent eSIM platforms, mobile network operators and other suppliers involved in providing the Services.

4 INFORMATION WE PROCESS

4.1. Account details: first name, surname, telephone number, email address, date of birth, account identifier and authentication information. The current registration process requires these fields. Your date of birth is used to confirm your age eligibility. Your telephone number and email address are used to manage your account and communicate with you about the Services.

4.2. Plan and usage records: destination you select, eSIM identifiers such as ICCID, plans, activation and expiry details, data consumption, purchases, top ups and service history.

4.3. Technical information: device information, IP address and connection country. Your chosen destination is not necessarily your current location. IP and network information may indicate approximate location. We do not collect precise location data, such as GPS coordinates or precise location derived from mobile networks.

4.4. Purchase and support records: order references, amounts, currency, payment status, refund records and communications you send to us. Payments are processed through Stripe. Ampere receives payment-related information needed to manage orders, confirm payment status and process refunds.

4.5. Cookies and similar technologies: information stored on or accessed from your device, as explained in the Cookie Policy available through the website or app. We use account, purchase and service usage data to compile internal statistics, including the number of users, sales volumes and sales by country, to understand how our Services are used and improve them.

5 PURPOSES AND LEGAL GROUNDS

5.1. We use information necessary to create and manage your account, supply eSIM plans, display usage, complete purchases and refunds and provide support on the basis of our contract with you or steps taken at your request before entering it.

5.2. We use proportionate technical and account records to maintain security, investigate faults and prevent fraud or misuse. Our basis is our legitimate interests in operating a secure and reliable service, balanced against your rights. The fact that a field is mandatory in a form does not itself make it necessary for a contract.

5.3. We process records needed to comply with accounting, tax and other applicable legal duties on the basis of legal obligation. Handling disputes and defending legal claims may rely on our legitimate interests.

5.4. Where optional tracking relies on consent, we obtain it before that tracking begins. You can withdraw consent without affecting processing lawfully carried out before withdrawal. We plan to measure app downloads and purchases; any identifiable measurement introduced will be explained before it starts. Genuinely anonymous statistics do not identify individual users.

6 AMPERE OFFERS

6.1. The app may show a banner inviting you to explore an Ampere financial account. Seeing the banner does not create a financial account or authorise transfer of your eSIM registration data for an application.

6.2. If you decide to apply, any reuse or transfer of your existing information will be explained before it occurs. Our current marketing plan for this product is an in-app banner. Any future promotional email, SMS or personalised tracking will be subject to the applicable information and consent requirements.

6.3. You may object at any time to the use of your personal data for direct marketing, including related profiling.

7 SHARING INFORMATION

7.1. We share technical, service and transaction information reasonably necessary for our connectivity providers to provision, activate, operate and support the eSIM Services. These providers may also process activation, network and usage information needed to deliver connectivity.

7.2. Information may also be accessible to suppliers supporting hosting, payment processing and customer support, to the extent needed for their role. Suppliers acting on our instructions must be subject to appropriate data protection obligations. Operators or payment providers processing information for their own legal or operational purposes may act as separate controllers.

7.3. We may disclose relevant information where lawfully required by an authority, or where necessary to professional advisers in connection with a legal duty or claim. A reference to Third Party Providers does not permit unrestricted sharing.

7.4. Where you follow a link to another provider’s service, review its privacy notice. This does not remove our responsibility for processing for which we are the controller.

8 STORAGE AND INTERNATIONAL TRANSFERS

8.1. We protect personal data using technical and organisational measures appropriate to the risks, including restricting access to authorised people. Please keep your account credentials secure.

8.2. We use trusted third-party service providers to store and process personal data. Where providing the Services involves transferring personal data outside the UK or the European Economic Area, we will ensure that appropriate safeguards are in place in accordance with applicable data protection law. You can contact us for further information about these safeguards.

9 RETENTION AND ERASURE

9.1. We keep account information while needed to operate your account. After closure, we retain only records needed to settle outstanding plans or payments, meet legal requirements, resolve complaints or establish or defend claims.

9.2. Order and payment records are kept for applicable tax and accounting periods. Plan history is retained while needed to administer and display your service history. Detailed technical records are kept only as long as necessary for reconciliation, troubleshooting, security and disputes.

9.3. Support records are retained while an issue is open and afterwards only where justified by unresolved matters or applicable claim periods. Once the relevant purpose ends, information is deleted or irreversibly anonymised, including through the relevant backup cycle. These criteria determine retention where a fixed period is not specified.

10 YOUR RIGHTS

10.1. Subject to applicable conditions and exceptions, you can request a copy of your personal data, correction, deletion, restriction of processing or a portable copy of eligible information. You can withdraw consent where it is the basis for processing.

10.2. You may object to processing based on legitimate interests for reasons relating to your situation. Your right to object to direct marketing is not subject to that condition.

10.3. Contact us using the privacy email in section 1. We may request proportionate identity verification. Requests are normally answered within one month, subject to any lawful extension, which we will explain. Requests are ordinarily free of charge; any permitted fee or refusal will be explained.

10.4. You also have the right to complain to the UK Information Commissioner’s Office (ICO) about our processing of your personal data. Where EU data protection law applies, you may also have the right to complain to the competent supervisory authority in the relevant EU Member State.

11 CHANGES TO THIS POLICY

11.1. We update this Policy when relevant processing changes and revise its effective date. We will notify you of material changes where appropriate and obtain fresh consent where legally required.