# PAVO Privacy Policy

Effective Date: May 21, 2026  
Last Updated: June 25, 2026  
Version: v1.1 Overseas

This Privacy Policy explains how SHENZHEN SHIJING INNOVATION CO LTD ("PAVO," "we," "us," or "our") collects, uses, stores, shares, and protects personal data when you use the Pavo Fitness mobile application and connected PAVO fitness devices. This policy applies to users outside mainland China who use the Pavo Fitness Android application.

If you are a resident of the EEA, UK, Australia, or California / other U.S. states with comprehensive privacy laws, please also review the jurisdiction-specific sections below (see Section 8).

## 1. Data We Collect

We collect personal data only as needed to provide and improve our services, including:

- Account data: email address, unique account identifier, registration time, login status, authentication tokens, and, when you choose Google sign-in, the identifier, name, or email address returned by Google through AWS Cognito Hosted UI.
- Profile data: nickname, avatar, gender, date of birth, height, weight, self-reported location (city or region you choose to share for profile display), and other information you choose to provide.
- Region selection at registration: when you create your account, the country or region you select is used to route your account to the corresponding regional backend (EU/UK/EEA → eu-central-1; Australia → ap-southeast-2; other regions → us-east-1). This selection is fixed for the account.
- Workout and device data: workout start and end time, duration, calories, distance, resistance or strength values, workout level, workout mode, repetition count, workout records, device name, model, firmware version, battery level, charging status, and device error information.
- Course and usage data: course browsing, favorites, playback records, workout history, statistics, login timestamps, device model, Android version, network request logs, and error logs.
- Image data: avatar images you upload, and workout result images you choose to generate or save.

### Sensitive / Special Categories of Personal Data

Some of the information above may be treated as sensitive or special-category personal data under applicable laws. Where this applies, we handle that data with heightened safeguards as described in this Policy and the Annex I mapping.

Items that may be sensitive depending on jurisdiction:

- Account credentials, including passwords processed by our authentication provider and authentication tokens stored on your device.
- Health-related metrics: height, weight, BMI, calories burned, workout duration, resistance / force / strength values, training intensity, and repetition count when linked to those health metrics.

We do NOT collect:

- Biometric identifiers such as facial recognition templates, fingerprints, or voiceprints.
- Precise geolocation or continuous GPS tracks.
- Racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership.
- Sexual orientation or sex-life data.
- Health diagnoses, medical records, prescriptions, or clinical data.
- Google Fit, Health Connect, or other medical/health-platform data. The Pavo Fitness Android app does not integrate with those services.
- Android Advertising ID or other cross-context behavioral advertising identifiers.

Four commitments regarding sensitive personal data:

- (a) We do not sell sensitive personal data.
- (b) We do not use sensitive personal data for targeted advertising or cross-context behavioral advertising.
- (c) We do not use sensitive personal data to infer characteristics about you.
- (d) We use sensitive personal data only within the scope reasonably necessary to deliver the service you request.

Dual-track legal basis. In jurisdictions where health metrics qualify as special-category data under GDPR Article 9 (or equivalent UK GDPR provisions), our processing of those metrics relies on Article 9(2)(a) explicit consent obtained at the relevant point in the app, such as when you complete your profile or start a workout that records those values. In other jurisdictions where such metrics are not classified as special-category data, our processing relies on Article 6(1)(b) performance of a contract together with Article 6(1)(a) consent. The full per-activity mapping appears in Annex I.

## 2. How We Use Data

We use your personal data to:

- Create and manage your PAVO account;
- Authenticate your identity through AWS Cognito or Google sign-in;
- Connect to PAVO devices and synchronize workout data;
- Generate workout records, statistics, and personalized experiences;
- Display course content, play workout videos, and cache necessary media;
- Upload and display avatars;
- Save workout result images you generate, or let you choose a sharing method through the Android share sheet or a target app;
- Protect account, API, and service security;
- Troubleshoot issues, fix errors, and improve the app;
- Enable cross-border remote access by Pavo HQ personnel for support, diagnostics, and structured queries, subject to the safeguards described in Section 8;
- Comply with applicable legal, regulatory, and security requirements.

We do not sell your personal data and do not use your personal data for third-party advertising.

## 3. Data Storage and Security

Personal data is stored on Amazon Web Services (AWS) infrastructure. To respect regional expectations and reduce unnecessary cross-border flows, the storage region is determined by the user's region of residence:

- EU / UK / EEA users: AWS eu-central-1 (Frankfurt, Germany).
- Australia users: AWS ap-southeast-2 (Sydney, Australia).
- All other regions, including the United States: AWS us-east-1 (N. Virginia, USA).

Routing of a new account to a specific region is determined at registration based on the country or region you select (see Section 1).

The AWS services used to host and process personal data include:

- AWS Cognito User Pool — authentication, registration, and session management.
- AWS API Gateway — routing of application requests to backend services.
- AWS S3 — storage of avatars, course images, video sources, and other media, provisioned per region.
- AWS CloudFront — global edge delivery network used solely to deliver media that is identical for all users (such as course images and course videos). CloudFront does not store personal data at the edge and is not used to cache user-specific content.

Your password is processed by AWS Cognito and is not stored by us in plaintext. Sensitive credentials such as authentication tokens may be stored using Android system security mechanisms such as Android Keystore or equivalent protected storage. Some course images, video cache, preferences, local database records, and temporary data may be stored locally on your device and are protected by the Android app sandbox and system data protection mechanisms.

We use reasonable technical and organizational safeguards, including encrypted transmission (TLS), access controls, authentication, least-privilege management, and operational audit logging. However, no internet service can guarantee absolute security.

## 4. Third-Party Services

To provide the current app functions, we may use the following third-party or system services:

- AWS Cognito: account registration, email verification, login authentication, and session management;
- AWS API Gateway / backend APIs: processing account, course, workout, and device-related requests;
- AWS S3 / CloudFront: storing and delivering avatars, course images, videos, or other media resources;
- Google sign-in through AWS Cognito Hosted UI: account registration or login when you choose to use your Google account;
- Android system capabilities: Bluetooth scanning and connection, system photo picker or media access, image saving, share sheet / Intent sharing, FileProvider URI sharing, deep-link redirection, network access, and local secure storage;
- Coil, Media3 / ExoPlayer, Room, Retrofit / OkHttp, Moshi, and other Android open-source components: image loading, video playback, local caching, local database storage, API communication, or JSON processing.

For details of each third party's purpose, data fields, and applicable privacy policy, please refer to the [Third-Party List for Personal Information Collection](./Third-Party%20List%20for%20Personal%20Information%20Collection.md) in the same directory.

## 5. App Permissions

- Network access: used to register or log in, call backend APIs, upload avatars, load course images and videos, and synchronize workout or device-related data.
- Bluetooth scan / connect permissions: used to discover, connect to, and control PAVO fitness devices and synchronize workout data. The Android app declares Bluetooth scan with `neverForLocation`; if Bluetooth permissions are disabled, device connection and Bluetooth workout functions will not be available.
- Photos / media access: used through Android system photo picker, MediaStore, or equivalent system capability to select avatar images, save workout result images, or share images at your request. If the relevant system access is disabled, avatar upload, image saving, or some sharing functions may be limited.
- Location permission: declared only for compatibility with Android 11 and below Bluetooth scanning requirements and limited by `maxSdkVersion=30`. The current Android app does not use location for precise geolocation or continuous GPS tracking.
- Camera and local-network permissions: the current version does not actively use these permissions. If a future feature requires them, the app will request authorization on first use of that feature.

We request and use permissions only in the relevant feature scenarios. You can manage these permissions at any time in Android system settings.

For the personal information fields collected by the App, collection scenarios, and purposes of use, please refer to the [Personal Information Collection List](./Personal%20Information%20Collection%20List.md) in the same directory. For third-party SDKs and services involved in the App, please refer to the [Third-Party List for Personal Information Collection](./Third-Party%20List%20for%20Personal%20Information%20Collection.md) in the same directory.

## 6. Sharing, Transfer, and Disclosure

We share or disclose only the necessary data in the following circumstances:

- When needed to provide the services you request through AWS, Google sign-in, Android system services, or backend services;
- When you actively use Android sharing, by passing the content you select to the Android share sheet, FileProvider, or the target app you choose;
- When required by law, regulation, legal process, or to protect the rights and safety of users, the public, or us;
- In connection with a merger, acquisition, asset transfer, or similar transaction, provided that the recipient remains bound by privacy obligations no less protective than this policy.

Except as described above, we do not proactively disclose your personal data to unrelated third parties.

## 7. Legal Bases for Processing

For users in the EEA, the United Kingdom, and other jurisdictions that recognise comparable concepts, we rely on the following legal bases under the GDPR and UK GDPR.

### 7.1 Performance of a contract (Article 6(1)(b))

To take steps at your request and to perform the agreement between you and us, we process personal data for:

- Account creation, login, and account management, including authentication via AWS Cognito and Google sign-in;
- Connecting to PAVO devices and synchronizing workout data;
- Recording, storing, and displaying your workout records and training metrics;
- Course browsing, video playback, and media delivery;
- Customer support requests you initiate.

### 7.2 Legitimate interests (Article 6(1)(f))

Where the processing is necessary for our legitimate interests and not overridden by your interests or fundamental rights and freedoms, we process personal data for:

- Service security, abuse prevention, and fraud prevention;
- IT diagnostics, troubleshooting, and error analysis;
- Product improvement based on aggregated usage signals;
- Cross-border remote access by Pavo HQ personnel in China for ongoing support, structured queries, and operational maintenance, subject to the safeguards described in Section 8.

### 7.3 Consent (Article 6(1)(a), and for special-category data Article 9(2)(a))

Where consent is the appropriate basis, we ask for your consent before processing. This applies to:

- Sensitive health-related metrics in jurisdictions where they are classified as special-category personal data, on the basis of Article 9(2)(a) explicit consent;
- Access to photos / media and, if introduced in a future version, the camera;
- Other optional features that we may introduce.

You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

### 7.4 Compliance with a legal obligation (Article 6(1)(c))

We process personal data to comply with tax, accounting, and other regulatory obligations applicable to us, and to respond to lawful requests from competent law-enforcement and regulatory authorities.

See Annex I for the per-activity legal basis mapping.

## 8. International Data Transfer

### 8.1 Storage location by user region

The default storage location for personal data is determined by your region of residence:

- EU / UK / EEA users: AWS eu-central-1 (Frankfurt, Germany).
- Australia users: AWS ap-southeast-2 (Sydney, Australia).
- All other regions, including the United States: AWS us-east-1 (N. Virginia, USA).

Pavo does not, in normal operation, transfer EU/UK/EEA user data to the United States. EU/UK/EEA user data remains stored in the Frankfurt region for service delivery.

The applicable region for your account is determined by the country or region you select at registration; this routing is fixed for the account and does not change based on later travel.

### 8.2 Remote access from Pavo HQ (China)

Pavo's principal place of business is in the People's Republic of China. Authorized personnel in China may remotely access the regional nodes described in Section 8.1 to perform support, technical maintenance, troubleshooting, and structured queries. This remote access constitutes a cross-border transfer of personal data under the GDPR, UK GDPR, the Australian Privacy Act, and certain U.S. state privacy laws.

China currently does not benefit from an EU or UK adequacy decision and is not on the list of jurisdictions with substantially similar protection published by the OAIC. We therefore rely on the following safeguards:

- For transfers from the EEA to China, the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), in the modules applicable to the relationship between the parties, including controller-to-controller and controller-to-processor modules.
- For transfers from the United Kingdom to China, the UK International Data Transfer Addendum (IDTA) to the EU SCCs, issued by the UK Information Commissioner's Office.
- The AWS Data Processing Addendum, including the AWS Supplementary Addendum, which supplements the contractual safeguards described above.
- Operational controls: role-based access control, minimum necessary access, encryption in transit, audit logging of administrative access, and internal review of access requests.
- For Australian users, contractual safeguards consistent with Australian Privacy Principle 8.1, requiring the overseas recipient to handle personal information in a manner consistent with the Australian Privacy Principles.
- For U.S. users, contractual commitments and disclosures consistent with the California Consumer Privacy Act and other applicable U.S. state privacy laws.

### 8.3 Adequacy decision background

The United States benefits from a partial adequacy decision under the EU-US Data Privacy Framework, which applies only to U.S. organisations that self-certify under that Framework. China does not currently benefit from an EU or UK adequacy decision. The list of adequacy decisions adopted by the European Commission is published at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.

### 8.4 Requesting a copy of the safeguards

To request a copy or summary of the contractual safeguards used for transfers of your personal data, including the relevant SCCs or IDTA, please contact info@pavofitness.com.

## 9. Data Retention

We retain personal data for one (1) year from the date of collection or the date of your last activity in the app, whichever is later. While your account remains active, the one-year clock is reset on each activity so that the data necessary for the service stays available to you.

When the retention period expires, or when you delete your account or request deletion, your data is removed through an asynchronous dual-queue deletion pipeline. One queue clears server-side stored data (account, profile, workout records, device data, course history, logs); the other queue clears client-side cached data on your device (local cache, preferences, temporary files). Both queues operate independently and complete deletion within a reasonable processing window.

Retention may be extended beyond one year only where required by applicable law, ongoing legal proceedings, fraud or security investigations, or audit obligations. Local cached data on your device may also be removed earlier by logging out, clearing app data, or uninstalling the app.

## 10. Your Rights

Depending on the laws applicable to your location, you have the rights described below. Where multiple regimes apply, we apply the regime that gives you the broader protection in respect of a specific right. Responses may be partial where applicable law allows us to refuse, limit, or postpone a request.

### 10.1 General rights

Subject to applicable law and identity verification, you may:

- Request access to the personal data we hold about you;
- Request rectification of inaccurate or incomplete data;
- Request deletion of your data;
- Request portability of data you have provided to us in a structured, commonly used, machine-readable format;
- Request restriction of processing in certain circumstances;
- Object to processing carried out on the basis of legitimate interests;
- Withdraw a consent you previously gave, without affecting the lawfulness of processing carried out before withdrawal.

### 10.2 GDPR / UK GDPR additional rights

In addition to the rights listed in Section 10.1, if the GDPR or UK GDPR applies to you:

- Article 21(1) — you may object to processing based on legitimate interests on grounds relating to your particular situation.
- Article 21(2) and 21(3) — you may object to processing for direct marketing at any time. Pavo does not currently conduct direct marketing based on personal data.
- Article 22 — you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Pavo does not carry out such solely automated decision-making.
- Article 77 — you have the right to lodge a complaint with a supervisory authority, in particular the supervisory authority of the Member State of your habitual residence, your place of work, or the place of the alleged infringement.

Example supervisory authorities you may contact:

- United Kingdom — Information Commissioner's Office (ICO). https://ico.org.uk. Helpline: +44 0303 123 1113.
- Germany (one example among the federal and state authorities) — Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.
- Ireland — Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland.
- For other EU and EEA Member States, the full list of national data protection authorities is published by the European Data Protection Board at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

We encourage you to contact us first so that we can address your concerns. Your right to lodge a complaint with a supervisory authority is independent of, and not conditioned upon, prior contact with us.

### 10.3 Australia — Privacy Act 1988

If you are in Australia, the Australian Privacy Principles (APPs) apply, including:

- APP 12 — the right to access personal information we hold about you.
- APP 13 — the right to request correction of inaccurate, out-of-date, incomplete, irrelevant, or misleading personal information.

Complaint path. Please contact Pavo first using the details in Section 13. We will acknowledge your complaint and respond within 30 days. If your complaint is not resolved to your satisfaction, you may escalate it to the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au or by phoning 1300 363 992.

### 10.4 California and other U.S. state privacy laws

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Oregon, Texas, Montana, or another U.S. state with a comprehensive consumer privacy law that grants you equivalent rights, you may have the following rights, subject to that state's law:

- Right to Know what personal information is collected, used, shared, or processed;
- Right of Access and Portability;
- Right to Correct inaccurate personal information;
- Right to Delete personal information you have provided to us;
- Right to Opt Out of the Sale or Sharing of personal information. Pavo does not sell personal information and does not share personal information for cross-context behavioral advertising;
- Right to Limit the Use and Disclosure of Sensitive Personal Information;
- Right to Non-Discrimination for exercising these rights;
- Right to Appeal a denial of your privacy request, where the applicable state law provides for an appeal.

Pavo does not engage in profiling that produces legal or similarly significant effects concerning you.

### 10.5 How to exercise your rights

To exercise any of the rights above, please email info@pavofitness.com from the email address associated with your Pavo account, or include enough information for us to locate your account. We may need to verify your identity before acting on a request. We will not charge a fee for a request unless the law allows us to do so.

Indicative response timelines:

- GDPR / UK GDPR: within 30 days, extendable by up to a further 60 days for complex or numerous requests, with notice to you.
- Australia: within 30 days.
- California: within 45 days, extendable by up to a further 45 days, with notice to you.

## 11. Children's Privacy

Pavo Fitness is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided personal data to us, please contact us and we will take appropriate steps after verification, including deletion where required.

## 12. Policy Updates

We may update this Privacy Policy from time to time. If an update materially affects your rights or our data processing practices, we will notify you through in-app notice, an updated policy page, or another reasonable method. The updated policy becomes effective on the date published or stated in the notice.

## 13. Contact Us

If you have questions, requests, or complaints about this Privacy Policy or our personal data processing, contact us at:

SHENZHEN SHIJING INNOVATION CO LTD  
Office 01, 7/F, Building 5A, Phase II, Chuangzhiyuncheng Project, Xingke 1st Road, Xili Community, Xili Street, Nanshan District, Shenzhen, China, 518055  
Email: info@pavofitness.com

EEA / UK users with data-protection inquiries may use the same email; we will route the request to the appropriate team.

## Annex I — Details of Processing

The table below maps each processing activity to the categories of personal data involved, the purposes of processing, and the legal basis under the GDPR and UK GDPR. Where a row references Article 9(2)(a), that basis applies in jurisdictions where the data is classified as a special category of personal data; otherwise the Article 6 basis applies on its own.

| Processing Activity | Categories of Personal Data | Purposes | Legal Basis |
|---|---|---|---|
| Account creation and login (email / password flow) | Email address, password (processed by AWS Cognito), account identifier, registration time, login status, authentication tokens | Create and operate your account; authenticate you; secure sessions | Art. 6(1)(b) performance of a contract |
| Google sign-in | Google-issued identifier, and name or email returned by Google through AWS Cognito Hosted UI when you choose to sign in with Google | Provide an alternative authentication option | Art. 6(1)(b) performance of a contract; Google acts as your identity provider |
| Profile management (non-health attributes) | Nickname, avatar, gender, date of birth, location at the granularity you choose to provide | Personalize your profile and the in-app experience | Art. 6(1)(b) performance of a contract; Art. 6(1)(a) consent for optional fields |
| Health-related profile metrics | Height, weight, BMI | Personalize workout plans; calculate training metrics | Art. 6(1)(b) performance of a contract together with Art. 6(1)(a) consent; Art. 9(2)(a) explicit consent where classified as special-category data |
| Bluetooth device connection and telemetry | Device name, model, firmware version, battery level, charging status, device error information, connection state | Discover, connect to, and control PAVO devices; diagnose device issues | Art. 6(1)(b) performance of a contract; Art. 6(1)(f) legitimate interests for diagnostics |
| Workout records, statistics, and training metrics | Workout start and end time, duration, calories, distance, resistance / strength / force values, workout level and mode, repetition count, workout history and statistics | Record and present your workouts; provide statistics and personalized experience | Art. 6(1)(b) performance of a contract together with Art. 6(1)(a) consent; Art. 9(2)(a) explicit consent where classified as special-category data |
| Course browsing and video playback | Course browsing history, favorites, playback records, playback session metrics | Present course catalogue; play workout videos; resume playback | Art. 6(1)(b) performance of a contract |
| Result image saving and sharing | Workout result images you generate; images you select for sharing | Generate result images; pass content to Android sharing, MediaStore, FileProvider, or the target app at your request | Art. 6(1)(b) performance of a contract; Art. 6(1)(a) consent where system media access requires consent |
| Customer support and user contact | Contact details you provide, content of your request, related account or workout context | Respond to your support request; investigate and resolve issues | Art. 6(1)(b) performance of a contract |
| IT security and diagnostics | Login timestamps, device model, Android version, network request logs, error logs | Protect service security; detect and fix errors; prevent fraud and abuse | Art. 6(1)(f) legitimate interests |
| Compliance with legal and regulatory obligations | Account, transaction, and other records as required by applicable law | Respond to lawful requests and meet statutory record-keeping duties | Art. 6(1)(c) compliance with a legal obligation |
| Cross-border remote access from Pavo HQ (China) for operations and support | All categories above, accessed on a need-to-know basis | Provide centralized technical support, structured queries, and operational maintenance for regional nodes | Art. 6(1)(f) legitimate interests, with the safeguards described in Section 8 (EU SCCs, UK IDTA, AWS DPA, and operational controls) |