PRIVACY POLICY

Sunrider recognises protection of personal data of natural persons as an extremely important issue. By entrusting us with your personal data, you expressed your trust in us that we will process them responsibly.  This Policy concerns the following cases of data processing:

Based on the above and in accordance with the Act CXII of 2011 on the right of informational self-determination and on freedom of information (hereinafter referred to as ”InfoAct”, REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as ”GDPR”), the Act C of 2003 on electronic communications (hereinafter referred to as ”ECA”), the Act CVIII of 2001 on electronic commercial services (hereinafter referred to as ”ECSA”), the Act XLVIII of 2008 on the fundamental conditions and certain limitation of business advertising activities (hereinafter referred to as ”BAA”) and the Act C of 2000 on accountancy (hereinafter referred to as ”AA”), Sunrider publishes a Policy, as set out below. Sunrider reserves the right to modify this Policy at any time. We will strive to inform you about any modification of this Policy in each case but we also recommend that you check the up-dated contents of this Policy in each case, regardless. I. DATA CONTROLLER The name of the Data Controller: Sunrider Hungary Kft. (hereinafter referred to as ”Sunrider”) Seat: H-1139 Budapest, Váci út 99 Company registration number: 01-09-268284 The authority maintaining the register of the company: The Company Court of the Appeal Court of the Budapest Region Telefon: +36 1 350 5373 Fax: +36 1 350 5374 Email: sunrider@sunrider.hu II. WHAT KINDS OF DATA DO WE COLLECT ABOUT YOU?  The personal data concerning you are collected directly from you when you visit our website, register as a customer, conclude an agreement with us as Independent Business Owner or contact us at the contact details indicated under “Contact us”

2.1 Data Processing of Customers 2.1.1 If you are an Independent Business Owner (’IBO’) or a consumer, we process about you the following data:

2.1.2. Data processing for direct marketing purposes Insofar as you grant your consent that we may send you newsletters, correspondence and promotional offers via e-mail regularly, then your following data are processed:

 2.2 Data processing in the course of using the website 2.2.1 Cookies

2.2.2 Collection of the data related to the visitors of the website You can browse on our website even without providing your registration number or any other personal data and, this way, no trace of your visit is left behind.  Sunrider, however, stores the IP (Internet Protocol) address of each visitor of the website, the date and the time of the entry and the identity of the reviewed pages. At the same time, Sunrider also stores your registration number which you used when you entered the page. It is only for the sake of security that we store these data to prevent any unauthorised entry with the use of your data and to reveal such attempts. III. WHAT IS THE LEGAL BASIS OF DATA PROCESSING? Sunrider processes the data as aforesaid, in part, on the basis of your voluntary, informed consent you give as data subject and with the aim of accomplishing a purchase in the web-shop and accomplishing the contract concluded with the IBOs (paragraphs a) and b) of point 1 of article 6 of the GDPR) and, in part, on the basis of a legal obligation in accordance with section 154 (3) of the TCA, section 13/A (3) of the ECSA, section 6 (5) of the BAA, and article 169 of the AA. - 2.1.1 this LINK shows the legal basis for processing data as referred to in paragraph 2.1.1 Please note that insofar as you do not make data available for us, which are needed to conclude a contract on the website or where it is needed to fulfil a legal obligation, then it is possible that Sunrider may be unable to conclude or perform a contract. If you contact us at the contact details indicated on the website under „Contact us” please provide us only with those personal data which are relevant and necessary in order to respond to your query.   - 2.1.2 The table below shows the legal basis for processing data as referred to in paragraph 2.1.2

Personal data Legal basis name consent (section 6 (5) of the BAA) e-mail address consent (section 6 (5) of the BAA) With regard to the data processing set out in 2.2 above regarding cookies Except for the cookies which are strictly needed to the use of the website the use of the cookies rely upon your explicit and informed consent, this is the legal bases of the data processing. Cookies are only applied if you provide explicit consent for their use by the relevant features of the website. You may change or withdraw consent any time. IV. FOR WHICH PURPOSES DO WE PROCESS YOUR DATA? 4.1 The purpose of the processing of those personal data by Sunrider that are listed in point 2.1.1 is the operation of the website, performance and administration of the contracts that are concluded on the website, fulfilling the claims under guarantees and warranties that are related to the contracts, calculation and payment of bonuses (in case of IBOs) and maintaining contact with you in connection with the contract.  4.2. If you granted your express consent to it, we process your personal data referred to in point 2.1.2 for the purpose of direct marketing such as regularly sending you newsletters, product information sheets, advertisements, promotional materials and invitations to trainings via e-mail. Please note that you can withdraw your consent that you gave to the processing of personal data for direct marketing purposes based on point 2.1.2 at any time and without indicating a reason. Insofar as you wish to exercise this right you can do so by sending an e-mail to sunrider@sunrider.hu  or a request by post, at any time. Upon receipt of the request, Sunrider will erase your data from its files and records immediately but not later than in 3 days. 4.3. Sunrider processes the cookies that are referred to in point 2.2 to facilitate the operation of the website and to enhance the appropriate operation of the website in connection with your orders. Sunrider also processes the cookies for increasing the efficiency of the website.  V. WHO MAY HAVE ACCESS TO YOUR PERSONAL DATA? 5.1. Your personal data are accessible and may be learned by the employees of Sunrider to the extent needed to fulfil their jobs who have authorisation to act as administrators and also third parties who are engaged by Sunrider to do jobs including especially certain organisations with which Sunrider maintains contractual relations. 5.2. In the course of operations, Sunrider engages the following entities as data processors:

Sunrider declares that the data processors it engages are exclusively such who use appropriate safeguards to make their data processing compliant with the requirements of the GDPR and to apply appropriate technical and organisational measures which duly protect your rights. In case you are engaged to Sunrider in a contractual relation as an IBO, your name, telephone number, and e-mail address, your personal downline volume, bonus calculation, registration number and the management reports concerning you are accessible for your sponsor and other IBOs to facilitate communication and the performance of contracts and to arrange trainings. 5.3. In case you are engaged to Sunrider in a contractual relation as an IBO, your name, telephone number, and e-mail address, your personal downline volume, bonus calculation, registration number and the management reports concerning you are accessible for your sponsor and other IBOs to facilitate communication and the performance of contracts and to arrange trainings.  5.4. In case you are a sponsored consumer, then your name, telephone number and e-mail address, your personal volume and registration number are accessible for your sponsor to facilitate communication and performance of contracts. Insofar as you do not wish that these data of yours be visible for a sponsor, then you do not need to request a sponsor but, instead, you can directly check in to the Data Processor as a consumer or, as an alternative, you can purchase in the shop of the Data Processor personally.  5.5.  We inform you that Sunrider may transfer personal data of consumers and IBO’s within the company group to Sunrider International for internal administration purposes. This data transfer is based on the legitimate interest of the Data Processor (GDPR 48). 5.6. We also inform you that your personal data may be anonymised and used for statistical and research purposes that way. 5.7. Please note, further, that your personal data may be disclosed to the courts, the criminal prosecutor, the investigating authorities and the authorities who adjudicate misdemeanours or to other authorities where the applicable laws provide for such disclosure as well as for its means. 5.8. If the Data Processor transfers your personal data to a third country (e.g. the USA) where the adequate level of security of the personal data is not provided, then Sunrider will use its best efforts in order to prevent that your rights regarding personal data be compromised and for serving the same aim, (i) it applies the model contract clauses that are approved by the European Commission for data transfers (e.g. when data are transferred to Sunrider Internationalor to The Rocket Science Group LLC d/b/a MailChimp) (For more information on this please visit https://mailchimp.com/help/mailchimp-european-data-transfers/ oldalon. VI. HOW LONG DO WE STORE YOUR DATA? 6.1. We process your personal data as long as it is reasonably needed for fulfilment of the purpose of the particular processing.  6.2. Sunrider stores the personal data referred to in point 2.1.1 above for 2 years of the date when the purchase – or the last out of more than one purchases – occurred except where the data need to be stored longer due to legal requirements. Sunrider has to store accountancy documents and records for 8 years according to section 169 (2) of the AA.  6.3 Where it is a statutory requirement to store certain data, we store them as long as it prescribed by the law.  6.4 Where the processing is based on your consent we store the data concerned until withdrawal of the consent. In this case, you are entitled to withdraw your consent and request that the data be erased any time without the need to give a reason. If you so requested, we erase the personal data which concern you or which can be attributed to you immediately but not later than in 3 days unless we are allowed or required to process them longer by virtue of law. 6.5 Please note that you may withdraw your consent which you gave for the processing of your personal data for direct marketing purposes based on point 2.1.2 at any time without giving the reason why you do so. Insofar as you wish to exercise this right you can do so by sending an e-mail to sunrider@sunrider.hu  or a request by post, at any time. Upon receipt of the request, Sunrider will erase your data from its files and records immediately but not later than in 3 days.  6.6. Cookies will be stored for a duration set out in point 2.2.1. d.) above. VII. WHAT DO WE DO TO KEEP YOUR DATA SAFE? 7.1. Please be informed that Sunrider applies all appropriate measures to keep your data safe especially against unauthorised access, modification, transfer, publication, erasure or disruption, accidental disruption or loss, and inaccessibility due to a change in the applied technology. Sunrider and the data processor engaged by it adopt and implement measures to procure that the natural persons who are authorised to access the personal data may process them strictly and exclusively in accordance with the instructions given by Sunrider. 7.2. Safety of bank card-related data  If you place an order via the Internet, your personal data and those of your bank card are encrypted by the use of the SSL technology before they are transmitted through the Internet. This renders it practically impossible that your data could be stolen or intercepted until they reach the network of Sunrider through cyber space, and the technology of Sunrider is protected by state-of-the-art firewalls. Your bank card number is used exclusively for effecting the payment concerned; Sunrider neither processes nor stores it. Sunrider uses the SSL Encryption software of VeriSign which firm provides the world’s leading SSL Encryption technology.  7.3. Security of information  Unfortunately, data transfers on the Internet cannot be 100% safe. We assert our best endeavours to protect your personal data but we still cannot guarantee total safety.  Since safety is at least as important for us as it is for you, we will continue to strive to use the most developed security procedures whereby we wish to promote the protection of your personal data.  7.4. Registration number, username and password  We kindly request that you keep your registration number, username and password safe and do not share or surrender them to any other person. By your acceptance of this Policy, you undertake liability for all activities which occurs through the use of your username and password on the website and, therefore, we recommend that your password be unique and frequently changed.  7.5. Stolen or lost information  Please inform Sunrider immediately if your username and/or password is lost, stolen or is threatened to be used by unauthorised persons. In such a case, we erase your username and password in our system and then we modify them in light of the new information you may furnish us. 7.6. Data processing of Independent Business Owners Sunrider procures that it makes IBOs contractually bound to process personal data of other IBOs and consumers who are below them within the organisation of Sunrider, as strictly confidential both as date processors and as data controllers. We note however, that IBO’s may be deemed data controllers with regard to personal data of other subordinated IBOs and sponsored consumers with regard to their specific activity. VIII. WHAT KIND OF RIGHTS YOU HAVE IN CONNECTION WITH DATA PROCESSING? 8.1 You have the following rights with regard to your personal data:

8.2 Sunrider will respond without unreasonable delay and by no means later than within one month of the date of receipt of your request about the measures taken upon your request whereby you exercise your aforesaid rights. This period may be, if needed, extended by further two months in the light of the complexity of the request and the number of requests to be processed. Sunrider will notify you about the extension also indicating its grounds within one month of the receipt of the request. If you submitted your request electronically, the information will be provided to you the same way unless you request otherwise. 8.3 In case Sunrider does not take any measure upon your request, it will notify you without delay but by no means later than one month from receipt of the requestalso stating why no measures are taken and about your opportunity to lodge a complaint with the data protection authority and to file an action with the courts for remedy. IX. WHERE CAN YOU LOOK FOR REMEDY FOR AN INFRINGEMENT OF YOUR RIGHTS? 9.1. If you believe that your above referred rights have been violated, you may ask Sunrider for remedy using the contact details provided in point 1. 9.2. Sunrider will investigate a request for remedy within the shortest period of time but by no means later than 30 days of the date when it was submitted and respond to it in a comprehensible form in writing, if the data subject so requests.  9.3. You may contact the National Authority for Data Protection and Freedom of Information (http://naih.hu/; 1055 Budapest, Falk Miksa utca 9-11.; telephone: +36-1-391-1400; fax: +36-1-391-1410; e-mail: ugyfelszolgalat@naih.hu) for remedy in case you believe that your rights referred to above have been violated. 9.4. In case of a violation of your rights you may submit an action to the court which has jurisdiction where you reside (permanently) and claim compensation or restitution before the competent court. The general courts have jurisdiction to such procedures. X. MODIFICATION OF THIS PRIVACY POLICY Sunrider reserves the right to change, modify, add to or delete something in this Policy. We strive to notify you about any modification of this Policy in each case but we also recommend that you check the up-dated contents of this Policy in each case, regardless.  Continuous use of this website by you by any means after it has been modified will be deemed as an acceptance of the Policy as modified and its provisions will apply to you. XI. PROTECTION OF CHILDREN The website was created with the express intention of not inviting children to its use but rather for the use of adults. By using the website you express by your conduct that you are at least 18 years of age. Sunrider knowingly does not collect, use or store data of persons who are under 18 years of age. XII. QUESTIONS AND COMMENTS If you have any questions or comments regarding this Policy, please send an e-mail to sunrider@sunrider.hu. Modified version effective from [] 2021 Sunrider Hungary Kft.