Platform Privacy Policy

1. About This Policy

This Website Privacy Policy ("Policy") explains how Nextpro Technologies, Inc., doing business as ZYLX ("ZYLX," "we," "us," or "our"), collects, uses, and protects information when you visit getzylx.io and any other website we operate that links to this Policy (collectively, the "Website"). This Policy covers the Website only. It does not govern data collected through the ZYLX access control platform (door readers, mobile credentials, cameras, or facial recognition features deployed at a customer's premises), which is covered by the separate ZYLX Global Privacy and Biometric Data Policy, available at getzylx.io/privacy-platform.

If you become a ZYLX customer, reseller, or an individual end user credentialed through the ZYLX platform, the Platform Privacy Policy applies to that relationship in addition to this Website Policy.

By using the Website, you acknowledge that you have read and understood this Policy. If you do not agree, please do not use the Website.

2. Who We Are and How to Contact Us

Legal entity Nextpro Technologies, Inc.

Trading as ZYLX

Website getzylx.io

Registered address 8 The Green, Dover, Delaware 19901, United States

Privacy contact admin@getzylx.io

If you are located in the European Economic Area, United Kingdom, or Switzerland and wish to exercise rights under GDPR, the UK GDPR, or the Swiss FADP, please use the contact details above and reference Section 9 (Your Privacy Rights).

3. Information We Collect on the Website

3.1 Information you provide to us

When you fill out a contact form, demo request form, newsletter sign-up, or any other web form on the Website, we collect the information you voluntarily submit, which may include:

• your name and job title;

• your business email address and phone number;

• your company or organization name;

• the nature of your inquiry, intended use case, or message;

• your country or region (where requested); and

• any other information you choose to include in a free-text field.

We use this information to respond to your inquiry, send you the information you requested, follow up regarding a demo or sales conversation, and, where you have opted in or we have a legitimate basis to do so, send you marketing communications about ZYLX products and updates.

3.2 Information collected automatically

When you visit the Website, we and our third-party service providers (such as Google Analytics) automatically collect certain technical and usage information, including:

• your IP address (which may be used to infer your approximate geographic location at the city or region level);

• browser type, version, and language settings;

• operating system and device type;

• the pages you visit on the Website, the time and duration of your visit, and the page you came from (referral URL);

• search terms you used to find the Website;

• interactions with content on the Website, such as links clicked or videos played; and

• cookie identifiers and similar tracking data, as described in Section 4.

We use this information to understand how visitors use the Website, to improve content and navigation, to diagnose technical problems, to monitor security, and to measure the effectiveness of our marketing.

3.3 Information we do not collect on the Website

The Website does not collect biometric data, facial recognition data, RFID or physical access credential data, or video surveillance footage. Those categories of data are collected only through the ZYLX access control platform in connection with a specific customer deployment, and are governed exclusively by the Platform Privacy Policy.

4. Cookies and Similar Technologies

The Website uses cookies, web beacons, pixel tags, and similar technologies (collectively, "cookies") to operate, secure, and improve the Website and to measure the effectiveness of our marketing. The table below summarizes the categories of cookies we use.

4.1 Your cookie choices

When you first visit the Website from the European Economic Area, United Kingdom, Switzerland, or another jurisdiction where cookie consent is required by law, you will be presented with a cookie consent banner that allows you to accept or decline non-essential cookies by category. You can change your preferences at any time by clicking the cookie settings link in the footer of the Website. Withdrawing consent does not affect the lawfulness of processing based on consent before withdrawal.

You may also control cookies through your browser settings (most browsers allow you to block or delete cookies), through Google Analytics' browser opt-out add-on available at tools.google.com/dlpage/gaoptout, and through industry opt-out tools such as the Digital Advertising Alliance (optout.aboutads.info) or the Network Advertising Initiative (optout.networkadvertising.org). Note that blocking some cookies may affect the functionality of the Website.

4.2 Do Not Track

Some browsers transmit a Do Not Track (DNT) signal. The Website does not currently respond to DNT signals in a standardized way, as no universally accepted standard for responding to such signals exists. We will revisit this position if a clear standard emerges. You can use the cookie choices described in Section 4.1 to limit tracking independently of your browser's DNT setting.

5. How We Use the Information We Collect

We use information collected through the Website for the following purposes:

• to respond to inquiries, demo requests, and support questions submitted through the Website;

• to send you information, resources, or follow-up communications you requested;

• to send marketing emails, newsletters, or product updates where you have opted in or where we have a legitimate interest in doing so for existing business contacts, subject to your right to opt out at any time;

• to analyze how the Website is used and to improve content, navigation, and performance;

• to measure the effectiveness of marketing campaigns and advertising;

• to protect the security and integrity of the Website;

• to comply with applicable law and legal obligations; and

• to establish, exercise, or defend legal claims.

We do not use Website visitor data or form submission data to build biometric profiles, infer health or demographic attributes, or for any purpose unrelated to operating and improving the Website and our business relationship with you.

6. Legal Bases for Processing (GDPR and Equivalent Frameworks)

Where GDPR, the UK GDPR, or an equivalent framework applies, we rely on the following legal bases:

• Consent (Article 6(1)(a)): for non-essential cookies and marketing emails where you have affirmatively opted in.

• Legitimate interests (Article 6(1)(f)): for analytics that help us improve the Website, for following up with business contacts who have expressed interest in ZYLX, and for Website security, where our interests are not overridden by your privacy rights.

• Performance of a contract or pre-contractual steps (Article 6(1)(b)): where you have submitted a demo or purchase inquiry and we process your contact information to respond.

• Legal obligation (Article 6(1)(c)): where we are required to retain records under applicable law.

You may withdraw consent at any time for any processing based on consent, including by unsubscribing from marketing emails or withdrawing cookie consent, without affecting the lawfulness of prior processing.

7. How and With Whom We Share Information

7.1 Service providers

We share information collected through the Website with carefully selected service providers who process it on our behalf, including: website hosting and content delivery providers; analytics providers (such as Google Analytics); email marketing and CRM platforms; customer support tools; and advertising platforms (where applicable). These providers are contractually required to use your information only as instructed by us and to implement appropriate security measures.

7.2 Google Analytics

The Website uses Google Analytics, a web analytics service provided by Google LLC. Google Analytics uses cookies to collect information about how you use the Website, which is transmitted to and stored by Google on servers in the United States. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. We have enabled IP anonymization, where available, to reduce the precision of IP address data sent to Google. You can opt out of Google Analytics tracking using the browser add-on at tools.google.com/dlpage/gaoptout. For more information on Google's data practices, see Google's Privacy Policy at policies.google.com/privacy.

7.3 No sale of personal data

We do not sell, rent, or trade your personal information to third parties for their own independent marketing or commercial purposes, consistent with the ZYLX Platform Privacy Policy and applicable laws including the CCPA/CPRA.

7.4 Legal and safety disclosures

We may disclose information where required by law, legal process, or government authority, or where necessary to protect the rights, property, or safety of ZYLX, our users, or the public.

7.5 Corporate transactions

If ZYLX is involved in a merger, acquisition, or sale of assets, Website visitor and contact data may be transferred as part of that transaction, subject to confidentiality obligations consistent with this Policy.

8. International Data Transfers

Nextpro Technologies, Inc. is based in the United States, and information collected through the Website may be stored and processed on servers located in the United States or in other countries where we or our service providers operate. If you are located in the European Economic Area, the United Kingdom, or Switzerland, your data may be transferred to countries that may not provide the same level of data protection as your home country.

Where such transfers occur, we rely on appropriate safeguards recognized under applicable law, such as the European Commission's Standard Contractual Clauses (and, for UK transfers, the UK International Data Transfer Addendum), or other lawful mechanisms. Where a hosting provider participates in an approved transfer framework, we may rely on that framework as an additional safeguard.

For analytics data transferred to Google in the United States, Google LLC participates in the EU-U.S. Data Privacy Framework and UK-U.S. Data Bridge, which provide an adequacy mechanism for such transfers to the extent those frameworks remain valid under applicable law.

9. Your Privacy Rights

Depending on where you are located, you may have some or all of the following rights regarding personal information we hold about you as a Website visitor or contact:

• the right to know or confirm whether we process your personal information;

• the right to access a copy of the personal information we hold about you;

• the right to correct inaccurate information;

• the right to request deletion of your personal information, subject to certain exceptions;

• the right to object to processing based on legitimate interests;

• the right to withdraw consent at any time (including cookie consent and marketing email opt-in), without affecting the lawfulness of prior processing;

• the right to opt out of the sale or sharing of personal information for targeted advertising (we do not sell data, but you may still opt out of cookie-based cross-context advertising using the cookie controls in Section 4.1); and

• the right to lodge a complaint with a supervisory or data protection authority.

To exercise any right, or to unsubscribe from marketing emails, contact us at admin@getzylx.io with the subject line "Privacy Rights Request." We will verify your identity before responding and will respond within the timeframe required by applicable law (typically 30–45 days, with extensions as permitted).

To unsubscribe from marketing emails specifically, you may also click the unsubscribe link included in any marketing email we send you, which will take effect promptly.

9.1 EEA, UK, and Switzerland

If you are located in the European Economic Area, United Kingdom, or Switzerland, you may also have the right to data portability (receiving your data in a structured, machine-readable format) and the right to request restriction of processing in certain circumstances. You have the right to lodge a complaint with your local supervisory authority, such as the Information Commissioner's Office (UK), the relevant EU national data protection authority, or the Swiss

Federal Data Protection and Information Commissioner (FDPIC). We encourage you to contact us first so we can attempt to resolve your concern directly.

9.2 California and other U.S. states

If you are a California resident, you have the rights described above under the CCPA/CPRA, including the right to limit the use of sensitive personal information and the right to non-discrimination for exercising your rights. We do not sell personal information as defined under the CCPA/CPRA. Residents of Virginia, Colorado, Connecticut, and other states with comprehensive privacy laws have equivalent rights under those laws.

10. Data Retention

We retain information collected through the Website for as long as reasonably necessary for the purposes described in this Policy, including to respond to inquiries, maintain our marketing communications relationship with you, and comply with legal obligations. Specifically:

• contact form and demo request data is typically retained for up to 36 months from last contact, or longer if a business relationship develops, in which case our customer records retention schedule applies;

• marketing email subscription records are retained until you unsubscribe and for a reasonable period thereafter to honor your opt-out preference and comply with anti-spam law requirements;

• analytics data collected via Google Analytics is subject to Google's data retention settings, which we configure at 14 months for user-level data; aggregate, non-identifiable analytics data may be retained longer; and

• cookie consent records are retained for as long as necessary to demonstrate compliance with applicable cookie consent law, typically up to three years.

11. Security

We implement reasonable technical and organizational measures to protect information collected through the Website against unauthorized access, loss, destruction, or disclosure, including HTTPS encryption for all data transmitted to and from the Website, access controls limiting who within our organization can access contact form submissions, and periodic review of our security practices. No transmission over the internet is perfectly secure, however, and we cannot guarantee absolute security.

12. Links to Third-Party Websites

The Website may contain links to third-party websites, social media platforms, or resources that are not operated by ZYLX. This Policy does not apply to those sites, and we are not responsible for their privacy practices. We encourage you to review the privacy policy of any third-party site you visit.

13. Children's Privacy

The Website is not directed at children under the age of 16, and we do not knowingly collect personal information from children under 16. If we learn that we have inadvertently collected such information, we will delete it promptly. If you believe a child has submitted information through the Website, please contact us at the email address in Section 2.

14. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the Website, or applicable law. We will post the updated Policy on this page with a revised Effective Date. For material changes, we will provide additional notice where reasonably practicable, such as a notice on the Website home page or an email to contacts whose data is affected by the change. Your continued use of the Website after a change takes effect constitutes acceptance of the revised Policy.

15. Contact Us

If you have questions about this Policy, wish to exercise a privacy right, or want to report a concern, please contact us:

Email admin@getzylx.io

Address 8 The Green, Dover, Delaware 19901, United States

Website getzylx.io

For end users or customers of the ZYLX access control platform with questions about how their platform-specific data is handled, please refer to the ZYLX Global Privacy and Biometric Data Policy, available at getzylx.io/privacy-platform, or contact us at the same address above.