Asia-Pacific Privacy Supplement

Last updated: July 9, 2026

This Asia-Pacific Privacy Supplement ("Supplement") provides additional information about how TerminalStreet LLC ("TerminalStreet," "we," "us," "our") processes personal data of individuals located in the Asia-Pacific region. This Supplement complements our general Privacy Policy and applies to our processing of personal data in accordance with the privacy laws of various Asia-Pacific jurisdictions.

1. Japan - Act on the Protection of Personal Information (APPI)

1.1 Data Controller (Business Operator)

For the purposes of Japan's Act on the Protection of Personal Information (APPI), TerminalStreet is considered a "business operator handling personal information."

1.2 Categories of Personal Information

Under the APPI, we collect and process the following categories of personal information:

• Basic personal information (name, address, email, phone number)
• Service usage information
• Device and technical information
• Payment information
• Communication records

We collect and use this information in accordance with our Privacy Policy and this Supplement.

1.3 Retained Personal Data and Disclosure Requests

Under the APPI, you have the right to request disclosure of your retained personal data that we hold. Upon receiving such a request from you, we will disclose to you:

• The purpose of use of your retained personal data
• The categories of retained personal data that we hold about you
• The specific content of your retained personal data

You also have the right to request correction, addition, or deletion of your retained personal data, as well as the right to request that we cease using your personal data.

1.4 Cross-Border Transfers

When transferring your personal data from Japan to foreign countries, we implement appropriate safeguards in accordance with the APPI, which may include obtaining your consent for such transfers when required.

2. China - Personal Information Protection Law (PIPL)

2.1 Data Controller (Personal Information Processor)

For the purposes of China's Personal Information Protection Law (PIPL), TerminalStreet is considered a "personal information processor."

2.2 Legal Basis for Processing

Under the PIPL, we process your personal information based on one or more of the following legal bases:

• Your consent
• Necessary for the conclusion or performance of a contract to which you are a party
• Necessary for fulfilling statutory duties or obligations
• Necessary for responding to public health emergencies or protecting natural persons' life and health in emergency situations
• Processing personal information that has been disclosed by you or otherwise lawfully disclosed within a reasonable scope
• Other circumstances as stipulated by laws and regulations

2.3 Separate Consent Requirements

Under the PIPL, we will obtain your separate consent when:

• Providing your personal information to third parties
• Publicly disclosing your personal information
• Using facial recognition and biometric identification
• Processing sensitive personal information (including health information, financial information, biometric information)
• Transferring your personal information outside of China

2.4 Your Rights Under PIPL

Under the PIPL, you have the right to:

• Be informed about the processing of your personal information
• Restrict or refuse the processing of your personal information
• Access and copy your personal information
• Transfer your personal information to another processor
• Request correction or completion of inaccurate or incomplete personal information
• Request deletion of your personal information under certain circumstances
• Request an explanation of personal information processing rules
• Withdraw your consent to the processing of your personal information

2.5 Cross-Border Transfers

For cross-border transfers of personal information from China, we:

• Obtain your separate informed consent
• Conduct security assessments where required by the Cyberspace Administration of China
• Enter into data transfer agreements based on standard contract templates provided by Chinese authorities
• Ensure that the recipient of your personal information provides the same level of protection as required by the PIPL

3. Singapore - Personal Data Protection Act (PDPA)

3.1 Data Controller (Organization)

For the purposes of Singapore's Personal Data Protection Act (PDPA), TerminalStreet is considered an "organization" that collects, uses, and discloses personal data.

3.2 Collection, Use, and Disclosure

We collect, use, and disclose personal data only with your consent or as permitted under the PDPA. We will notify you of the purposes for which we intend to collect, use, or disclose your personal data before doing so.

3.3 Your Rights Under PDPA

Under the PDPA, you have the right to:

• Access your personal data in our possession or under our control
• Request correction of any error or omission in your personal data
• Withdraw your consent for the collection, use, or disclosure of your personal data
• Request the portability of your personal data in certain circumstances
• Request that we stop using your personal data for marketing purposes

3.4 Data Breach Notification

In the event of a notifiable data breach affecting your personal data, we will notify both you and the Personal Data Protection Commission of Singapore as required by the PDPA.

4. South Korea - Personal Information Protection Act (PIPA)

4.1 Data Controller (Personal Information Controller)

For the purposes of South Korea's Personal Information Protection Act (PIPA), TerminalStreet is considered a "personal information controller."

4.2 Collection and Use of Personal Information

We collect and use the minimum amount of personal information necessary to provide our services. We inform you of the following when collecting personal information:

• The purpose of collection and use
• The items of personal information to be collected
• The retention period of personal information
• Your right to refuse consent and the consequences of such refusal

4.3 Retention and Destruction

We destroy your personal information without delay when:

• The personal information is no longer necessary for the purpose for which it was collected
• The retention period agreed by you has expired
• The purpose of collection has been achieved
• Our business is terminated

4.4 Your Rights Under PIPA

Under PIPA, you have the right to:

• Access your personal information
• Request correction of errors in your personal information
• Request suspension of processing of your personal information
• Request deletion of your personal information
• Receive information about the items of personal information being transferred to third parties and the status of such transfers

5. Australia - Privacy Act 1988 and Australian Privacy Principles (APPs)

5.1 Data Controller (APP Entity)

For the purposes of Australia's Privacy Act 1988, TerminalStreet is considered an "APP entity" subject to the Australian Privacy Principles.

5.2 Collection of Personal Information

We collect your personal information by lawful and fair means, and generally directly from you. When we collect your personal information, we will take reasonable steps to notify you of:

• Our identity and contact details
• The purposes for which we collect the personal information
• The types of entities to which we usually disclose personal information
• The fact that our Privacy Policy contains information about how you may access and correct your personal information
• The fact that our Privacy Policy contains information about how you may complain about a privacy breach
• Whether we are likely to disclose your personal information to overseas recipients

5.3 Your Rights Under the APPs

Under the Australian Privacy Principles, you have the right to:

• Request access to your personal information
• Request correction of your personal information
• Make a complaint about a breach of the APPs
• Request that we not use your personal information for direct marketing
• Request that we not adopt, use or disclose a government-related identifier except in prescribed circumstances

5.4 Cross-Border Disclosures

Before disclosing your personal information to an overseas recipient, we take reasonable steps to ensure that the recipient does not breach the APPs in relation to the information.

6. New Zealand - Privacy Act 2020

6.1 Data Controller (Agency)

For the purposes of New Zealand's Privacy Act 2020, TerminalStreet is considered an "agency" that collects, uses, and discloses personal information.

6.2 Collection, Use, and Disclosure

We comply with the Information Privacy Principles (IPPs) under the Privacy Act 2020, which govern:

• How we collect personal information
• How we store and secure personal information
• How you can access and correct your personal information
• How we use and disclose your personal information
• How we use unique identifiers

6.3 Your Rights Under the Privacy Act 2020

Under the Privacy Act 2020, you have the right to:

• Access your personal information
• Request correction of your personal information
• Request that a statement of correction be attached to your information if correction is refused
• Make a complaint to the Privacy Commissioner if you believe there has been a breach of your privacy

6.4 Cross-Border Disclosures

Under the Privacy Act 2020, we may disclose your personal information to an overseas recipient only if:

• The recipient is subject to privacy laws that provide comparable safeguards to the New Zealand Privacy Act
• The recipient is a participant in a prescribed binding scheme
• The recipient is subject to the privacy laws of a prescribed country
• You authorize the disclosure after being expressly informed that the overseas recipient may not be required to protect your information in the same way

7. How to Exercise Your Rights

If you wish to exercise any of your rights under applicable Asia-Pacific privacy laws, please contact us at [email protected].

When making a request, please provide us with sufficient information to identify you and describe your request in detail. We may require additional information to verify your identity before processing your request.

We will respond to your request within the timeframe required by applicable law. In some cases, we may deny your request as permitted by law, in which case we will explain the reasons for our denial.

8. Updates to this Supplement

We may update this Supplement from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes as required by applicable law. We encourage you to review this Supplement periodically.

9. Contact Information

If you have any questions about this Supplement or our privacy practices, please contact us at:

[email protected]