FROMKO PRIVACY POLICY

Effective date: 1 September 2026 BRIGHTON AI HOLDINGS PTY LTD (the "Company") values the personal information of customers who use the FROMKO app, related websites and purchasing agency service. This Privacy Policy explains what personal information the Company collects, how it uses, shares and stores that information, and what rights customers may exercise in relation to their personal information. 1. Company information Company name: BRIGHTON AI HOLDINGS PTY LTD ABN: 67 692 023 135 ACN: 692 023 135 Registered address: Level 19, 144 Edward St, Brisbane City QLD 4000, Australia Service name: FROMKO Privacy enquiries: info@brightongroup.ai 2. Personal information we collect The Company may collect the following personal information to the extent necessary to provide the service. Information provided by customers • name, email address and telephone number; • account ID and login information; • delivery and billing addresses; • ordered products, options, quantities and order history; • recipient information required for customs clearance; • customer support enquiries and return and refund requests; and • product photographs, videos and other material submitted by the customer. Payment information Payments may be processed through an external payment service provider. The Company may receive the payment status, payment amount, type of payment method and transaction identifiers needed to process a transaction. Sensitive payment information, such as full card numbers and card security codes, is generally not stored by the Company and is processed by the payment service provider. Information collected automatically When a customer uses FROMKO, the following information may be collected automatically: • IP address; • device type, operating system and app version; • access times and service usage records; • error and security logs; • identifiers from cookies or similar technologies; and • device tokens for push notifications. The Company does not intentionally collect sensitive information that is not necessary to provide the service. 3. How we collect personal information The Company may collect personal information in the following ways: • when a customer creates an account or places an order; • when a customer enters payment, delivery or customs information; • when a customer contacts customer support or requests a return or refund; • when a customer uses the app or website; and • when the Company receives information needed to process a transaction from payment providers, carriers or other service providers. Customers may refuse to provide some personal information. However, if a customer does not provide information needed for ordering, payment, delivery or customer verification, the customer may be unable to use the related services. 4. Purposes of use The Company may use personal information for the following purposes: • creating and managing accounts; • receiving orders and purchasing Korean products on the customer's behalf; • confirming payments and preventing fraudulent payments; • receipt at the Korean warehouse, inspection, packing and international delivery; • supporting customs clearance and delivery tracking; • processing order cancellations, exchanges, returns and refunds; • handling customer enquiries and disputes; • providing product safety information and recall notices; • operating the service, resolving errors and maintaining security; • complying with legal, tax, accounting and regulatory obligations; and • providing marketing information with the customer's consent. Where required by applicable law, the Company processes personal information on the basis of the performance of a contract, compliance with legal obligations, the customer's consent or the legitimate interests of the Company and the customer. 5. Disclosure of personal information To provide the service, the Company may disclose personal information to the following recipients to the extent necessary: • Korean online retailers selected by the customer; • Korean warehouses and logistics providers; • international carriers and local delivery companies; • customs, customs brokers and related government agencies; • card companies, banks and payment service providers; • cloud hosting, data storage, customer support and security providers; • the Company's accountants, auditors, lawyers and professional advisers; and • courts, government agencies or regulators that require information under law. The Company does not disclose personal information beyond what is necessary to provide the service, comply with legal obligations or fulfil purposes to which the customer has consented. If the Company undergoes a merger, business transfer or restructuring, relevant personal information may be provided to a potential acquirer or its advisers. In that case, the Company will take reasonable steps to protect the personal information. The Company does not sell personal information to third parties for payment. 6. Overseas disclosure of personal information Because FROMKO is a worldwide purchasing agency and delivery service, customers' personal information may be disclosed to recipients in countries other than Australia. The countries to which personal information may be disclosed include: • the Republic of Korea, for product purchasing, warehouse operations and international delivery; • the country to which the customer has asked for products to be delivered; and • countries where payment, hosting, customer support or technology service providers are located or process information. Before disclosing personal information to overseas recipients, the Company endeavours to apply contracts, security standards and other reasonable safeguards so that the personal information is appropriately protected. Overseas recipients may process personal information under the laws of their country or may be required to disclose information at the request of a lawful government authority. 7. Cookies and analytics technologies The Company may use cookies or similar technologies for the proper operation of the app and website, maintaining logins, security, error checking and usage analysis. Where the law requires consent for non-essential analytics or advertising technologies, the Company provides customers with a choice. Customers may limit some cookies and tracking functions through their browser or device settings. In that case, some features of the service may not work properly. 8. Marketing The Company may send promotional information by email, app notification or other means only where the customer has consented or the relevant law permits it. Customers may opt out of marketing at any time using the unsubscribe function in marketing messages or through FROMKO settings. Essential notifications relating to order confirmation, payment, delivery, security, refunds and product safety may be sent regardless of the customer's marketing preferences. 9. Retention of personal information The Company retains personal information for as long as necessary to achieve the purposes for which it was collected and to comply with legal, tax, accounting, consumer protection, fraud prevention and dispute resolution obligations. Even if an account is deleted, information needed to process orders, refunds or disputes in progress and transaction records that must be retained by law may be retained in a limited way for the period necessary for those purposes. When the retention purpose ends, the Company securely deletes personal information or anonymises it by reasonable means. 10. Protection of personal information The Company applies reasonable administrative, technical and physical safeguards to prevent the loss, misuse, unauthorised access, modification or disclosure of personal information. However, the Company cannot guarantee that the internet or electronic storage is completely secure. If a personal information breach occurs, the Company will take steps to reduce harm in accordance with applicable law and, where necessary, notify the affected customers and regulators. Customers must keep their passwords and devices secure and must notify the Company immediately if they suspect unauthorised use of their account. 11. Customers' rights Subject to the relevant law, customers may exercise the following rights: • request access to personal information held by the Company; • request correction of personal information that is inaccurate or out of date; • request deletion of personal information or restriction of processing; • withdraw consent to receive marketing; • object to the processing of personal information; • request a copy of personal information they have provided; and • make a complaint about the handling of personal information. The Company may ask for reasonable information to verify the customer's identity before processing a request. Some requests may be limited because of legal retention obligations, transactions in progress, fraud prevention or the establishment, exercise or defence of legal claims. If a request cannot be processed, the Company will explain the reason to the extent possible. Personal information requests may be submitted to info@brightongroup.ai. 12. Account deletion Customers may request account deletion through the account settings of the FROMKO app or by email to info@brightongroup.ai. When an account deletion request is received, the Company will check for orders, refunds and disputes in progress and legal retention obligations, and will then delete or anonymise the personal information that can be deleted. 13. Children's personal information FROMKO is intended for customers who can enter into a legally valid purchase contract. Where a minor uses the service, the consent and supervision of a parent or legal guardian may be required under the laws of the relevant country. If the Company becomes aware that it has collected a child's personal information without appropriate consent, it will take reasonable steps to delete that information. 14. Privacy complaints Enquiries or complaints about the handling of personal information may be submitted to: Email: info@brightongroup.ai Address: Level 19, 144 Edward St, Brisbane City QLD 4000, Australia The Company will review the enquiry and endeavour to respond within a reasonable time. If the matter is not resolved by the Company's response, the customer may make a complaint to the Office of the Australian Information Commissioner or to the privacy authority of the region that applies to the customer. Office of the Australian Information Commissioner Website: www.oaic.gov.au 15. Third-party services FROMKO may include services or links provided by payment providers, carriers or other third parties. Personal information that a third party collects and processes independently may be subject to that third party's privacy policy. The Company recommends that customers review the relevant policies. 16. Changes to this Privacy Policy The Company may change this Privacy Policy to reflect changes in law, technology or the way the service is operated. Where there is a significant change, the Company will notify customers by reasonable means through the app, the website or the customer's contact details before the change takes effect. The changed policy applies from the stated effective date. 17. Contact Enquiries about this Privacy Policy or the handling of personal information: BRIGHTON AI HOLDINGS PTY LTD Level 19, 144 Edward St, Brisbane City QLD 4000, Australia Email: info@brightongroup.ai