Privacy Policy             

VR Oxygen, Inc. (“VR Oxygen” or “we”, or “us”) provides this Privacy Policy to let you know our policies and procedures regarding the collection, use, and disclosure of information through www.vroxygen.com or www.vro2.com (the “Site”), and any other websites, features, applications, widgets or online services that are owned or controlled by VR Oxygen and that post a link to this Privacy Policy (together with the Site, the “Service”), as well as any information VR Oxygen collects offline in connection with the Service. It also describes the choices available to you regarding the use of, your access to, and how to update and correct your personal information. Note that we combine the information we collect from you from the Site, through the Service generally, or offline.

Please note that certain features or services referenced in this Privacy Policy may not be offered on the Service at all times. Please also review our General Terms and Conditions and other documents which govern your use of the Service, and which are accessible at https://www.vroxygen.com/legal/terms.

We’ve provided short summaries in this Privacy Policy to help you understand what information we collect, how we use it, and what choices or rights you may have. While these summaries help explain some of these concepts in a simple and clear way, we encourage you to read the entire Privacy Policy to understand our data practices.

‍

TABLE OF CONTENTS

1. INFORMATION COLLECTION
   1.1. GDPR clause
   1.1.2. Categories of Recipients of Personal Data
   1.1.3. Purposes of Processing and Legal Bases
   1.1.4. Staying in Control of Your Information: Your Rights
   1.2. Information You Provide to Us
   1.2.1. WEBSITE VISITORS
   A. What personal data do we collect and why?
   B. How do we use your data?
   C. Social Media, Widgets and Open Forums
   1.2.2. TEST ROUND CREATOR (“Client”)
   A. What personal data do we collect and why?
   B. How do we use your data?
   1.2.3. CONTRIBUTOR (Test Round Participant)
   A. What Personal Data Do We Collect And Why?
   B. Vr Service Session Data & Biometric Collection
   C. Data Collection Methods
   D. Categories Of Sensitive Session Data
   E. How Do We Use Your Data?
   1.2.4. Other Data We Collect
   1.2.5. Consent To Data Collection (Condition Of Participation)
   1.2.6. Children's Privacy
   1.2.7. De-Identification And Anonymization
   1.2.8. Third Parties
   1.2.9. Automated Processing
   1.2.10. Parental Consent For Minors
   1.3. Information Received From Third Parties
   1.4. Information Collected Automatically
   1.5. How We Respond To Do Not Track Signals
   1.6. User Profiles
   1.7. Messaging
   1.8. Community Forums
   1.9. Testimonials
   1.10. Work Listings Through the Service
   1.11. Feedback
   1.12. Email to Friends and Referral Program
   1.13. Social Networking Services
   
   
2. USE OF INFORMATION
   2.1. We Use Information We Collect
          2.1.1. Advanced Analytics, R&D and products and services improvement, And System Optimization
          2.1.2. The Legal Grounds For Our Processing Activities
             A. Explicit Consent (Primary Basis)
             B. To Honor Our Contractual Commitments
             C. For Our Legitimate Interests
             D. To Comply with Legal Obligations
             E. Providing and Managing the Service
             F. Internal Development and Platform Improvement
         2.1.3. Third-Party Developers And Data Compliance
   
   
3. DATA RETENTION
   3.1. How and when is my data deleted?
   3.1.1. Raw Personal Data For Minors (Under 18)
   3.1.2. Raw Personal Data For Adults (18+)
   3.1.3. Anonymized And Business Data (Low-Risk)
   3.1.4. Backup Retention
   3.1.5. Other types of data stored in your account
   3.1.6. Cancellations
   
   
4. INFORMATION SHARING AND DISCLOSURE
   
   
5. THIRD-PARTY ANALYTICS PROVIDERS, AD SERVERS, AND SIMILAR THIRD PARTIES
   5.1. Your Choices and Controls
   

                5.1.1. Consent Management
         5.1.2. Specific Opt-Out Rights

          5.2. Subprocessors

6. YOUR CHOICES AND RIGHTS
   
   
7. SECURITY
   

           7.1. Strict Access Controls for Raw Media

8. INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION
   
   
9. LINKS TO OTHER SITES
   
   
10. PUBLIC PROFILE
    
    
11. PHISHING
    
    
12. CALIFORNIA RESIDENTS – YOUR CALIFORNIA PRIVACY RIGHTS

          12.1. Information we collect and ways we may use it

          12.2. Collection

          12.3. Uses

          12.4. Examples

          12.5. Sharing Personal Information

          12.6. Sale of Personal Information

          12.7. Your Rights and Choices

          12.8. Access to Specific Information and Data Portability Rights

          12.9. Deletion Request Rights

          12.10. Exercising Access, Data Portability, and Deletion Rights

          12.11. Response Timing and Format

          12.12. We will deliver our written response by mail or electronically.

          12.13. Contact Us

13. CHANGES TO THIS POLICY
    
    
14. INTERNATIONAL DATA TRANSFERS - ADDITIONAL EEA/UK TERMS
    
    
15. CONTACTING US

‍

1. INFORMATION COLLECTION

1.1. GDPR clause

This GDPR clause will inform you of our legal bases for processing your Personal Data, onward transfers of your Personal Data and which additional rights you have regarding the processing of your Personal Data.

VR Oxygen processes Personal Data both as a Processor and as a Controller (as defined in the European Union’s General Data Protection Regulation ("GDPR")) as follows:

• VR Oxygen is the Controller of Customer Data and Contributor Account Data, as well as Recording Data for Tests developed by VR Oxygen.
• With respect to Recording Data collected during Customer’s utilization of the Platform and Services, the Customer is the Controller in accordance with GDPR and VR Oxygen is the Processor. As such, VR Oxygen collects Recording Data on behalf of the Customer and the Platform enables the Customer to view the Recording Data that is correlated with demographic information (such as age range, gender, country or state). Customer does not see the Recording Data as correlated to any other Contributor Account Data.

‍

1.1.2. Categories of Recipients of Personal Data

The categories of recipients of Personal Data with whom we may share your personal data are listed in the How do we use your data and Information Sharing And Disclosure sections of the VR Oxygen Privacy Policy.

‍

1.1.3. Purposes of Processing and Legal Bases

VR Oxygen uses your Personal Data for a number of different purposes, as explained in Section 2 of the VR Oxygen Privacy Policy. Some are essential for us to provide the Services you use or to fulfill our legal obligations. Some help us run the Services efficiently and effectively and some enable us to provide you with more relevant and personalized offers and information. In all cases we must have a Legitimate Business Purpose and a legal ground for processing your Personal Data. Some of the most common legal grounds we rely on are briefly explained below:

• Performance of a Contract: we may process your Personal Data for the purposes of a contract to which you are a party, in other words your ability to use the Services. For instance, if you want to be a Contributor, we need to process your Personal Data in order to enable you to do so.
• Legitimate Business Purposes: we may process Personal Data where it is necessary for our legitimate business interests as listed in the VR Oxygen Privacy Policy, but only to the extent that they are not outweighed by your own interests or fundamental rights and freedoms. When we rely on these legal bases, we will carry out a legitimate interest assessment to ensure we consider and balance any potential impact on you (both positive and negative), and your rights under applicable data protection laws.
• Consent: VR Oxygen may rely on consent where it is required, such as with respect to Recording Data being accessible to Customers and certain information collected via cookies and similar technologies (other than strictly necessary cookies), or when we are asking you to confirm your marketing preferences. When we rely on consent, you’ll be asked to confirm that you give your permission to VR Oxygen to process your Personal Data. Details of the processing, such as why VR Oxygen would like to process your data, how it will be used and if your Personal Data will be shared, will be provided at the time of asking you for your consent. You have the right to withdraw your consent at any time if you no longer wish to have VR Oxygen process your Personal Data.
• Legal Obligation: VR Oxygen will on occasion be under a legal obligation to obtain and disclose your Personal Data. Where possible, we will notify you when processing your data due to a legal obligation, however this may not always be possible. For instance, VR Oxygen may need to provide your data in order to prevent criminal activity or help to detect criminal activity, in which case we may share information with law enforcement. This is done in a safe and secure manner. It’s essential that VR Oxygen complies with its legal, regulatory and contractual requirements, so if you object to this processing, VR Oxygen will not be able to provide its Services to you.

The following table illustrates in more detail how the above legal bases for processing may apply to our primary purposes for processing different types of Personal Data:

‍

1.1.4. Staying in Control of Your Information: Your Rights

If the GDPR applies to you, you have certain rights in relation to your Personal Data:

• The right to be informed – our obligation to inform you that we process your personal data (and that's what we're doing in this Privacy Policy);
• The right of access – your right to request a copy of the personal data we hold about you (also known as a 'data subject access request');
• The right to rectification – your right to request that we correct personal data about you if it is incomplete or inaccurate (though we generally recommend first making any changes in your account settings);
• The right to erasure (also known as the ‘right to be forgotten’) – under certain circumstances, you may ask us to delete the personal data we have about you (unless it remains necessary for us to continue processing your personal data for a legitimate business purpose or to comply with a legal obligation as permitted under the GDPR, in which case we will inform you);
• The right to restrict processing – your right, under certain circumstances, to ask us to suspend our processing of your personal data;
• The right to data portability – your right to ask us for a copy of your personal data in a common format (for example, a .csv file);
• The right to object – your right to object to us processing your personal data (for example, if you object to us processing your data for direct marketing); and
• Rights in relation to automated decision-making and profiling – our obligation to be transparent about any profiling we do, or any automated decision-making.

These rights are subject to certain rules around when you can exercise them. If you are located in the European Economic Area (EEA) and wish to exercise any of the rights set out above, please contact us at privacy@vroxygen.com.

‍

You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights) unless your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request under those circumstances.

‍

We may need to request specific information from you to help us confirm your identity. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. Please note that if we are unable to reasonably confirm your identity, we will not be able to honor certain requests.

‍

We will respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated as required by law.

‍

In addition, if you no longer wish to receive our marketing/promotional information you may withdraw your consent to direct marketing at any time directly from the unsubscribe link included in each electronic marketing message we send to you. If you do so, we will update our databases, and will take all reasonable steps to meet your request at the earliest possible opportunity, but we may continue to contact you to the extent necessary for the purposes of providing our Services.

‍

Finally, you have the right to make a complaint at any time to the supervisory authority for data protection issues in your country of residence. We would, however, appreciate the chance to address your concerns before you approach the supervisory authority, so please contact us directly first.

‍

1.2. Information You Provide to Us

When you use the Service, you may provide us with information about you. This may include your name and contact information, financial information to make or receive payment for services obtained through the VR Oxygen Site, or information to help us fill out tax forms. When you use the Service, we may also collect information related to your use of the Service and aggregate this with information about other users. This helps us improve our Services for you. You may also provide us with information about your contacts or friends if, for example, you’d like to add those contacts to a message room.

‍

1.2.1. WEBSITE VISITORS 

VR Oxygen is your data controller, to the extent that we collect or you provide your personal data.

‍

A. What personal data do we collect and why? 

We collect information from you when you visit our website, book a call with VR Oxygen or creat an account on VR Oxygen, contact us by email or other means (i.e. the chat function) or receive a communication from us or otherwise interact with us on our social media channels, our advertising or our other properties that we operate.

‍

We may collect the following types of data from you: 

• Identity Data. This is information that helps us identify who you are, like your name, email address or organisation.
• Contact Data. This is information that details how we can contact you, like your email address, telephone number or postal address.
• Observed Data. This is information about your online browsing behaviour on our website, including information about any devices or applications you have used to access our services (including the make, model and operating system, IP address, general location, browser type and mobile device identifiers) or information about how and when you used the website and to gather demographic information about our user base as a whole.
• Referral Data. This is information about how you arrived at our site (i.e. if you arrive on our website from an external source, such as a link on another website or in an email, we record information about the source that referred you to us).
• Voluntary Data. This is any other information that you voluntarily provide to us, for example in correspondence between you and any VR Oxygen employee through any means of communications, including through email or other support means, or via our social media channels.

‍

B. How do we use your data?

We may use the data we collect about you for a variety of purposes. European data protection legislation sets out specific “lawful bases” for processing personal data. The below sets out the basis under which we may process different information about you, and explains the purpose of that processing.

‍

C. Social Media, Widgets and Open Forums

Our website may allow you to engage with social media services, such as LinkedIn, Facebook and Twitter ("Social Networks"), and widgets such as the "Share this" button, or interactive mini-programs that run on our website or which link from Social Networks to our website ("Social Functions"). These Social Functions may access, collect, and integrate with your Social Network accounts and information. For example, these Social Functions may collect your IP address, identify which page you are visiting on our website, or set a cookie. If you choose to use these Social Functions, you may be sharing certain Social Network profile elements with us, including your name, birthday (month/day), comments, contacts, email address, photos, or favourite teams. This sharing is subject to each Social Network's own privacy policy and terms of use. We do not control those Social Networks or your profiles on those services. We cannot modify your privacy settings on those services or establish rules about how your personal information on those services will be used. Please refer to the privacy settings in your Social Network account to manage the data that is shared with us through your account. Information you include and transmit online in a publicly accessible blog, chat room, or Social Network, or that you share in an open forum such as in response to a help center article, may be viewed and used by others without any restrictions. We do not control such uses of your personal information, and by using such services you assume the risk and acknowledge that the personal information provided by you may be viewed and used by us and/or third parties for any number of purposes and that the usage restrictions set forth in this Privacy Policy do not apply to such services.

‍

1.2.2. TEST ROUND CREATOR (“Client”) 

Client Data (Test Results): To the extent that you provide or commission the collection of Contributor Session Data as part of a test, you are the Data Controller, and VR Oxygen acts as a Data Processor. We do not control how your organization uses or shares Contributor Session Data internally. You will need to contact your organization directly for information about their privacy practices or to exercise rights you may have.

‍

VR Oxygen Data (Client Information): VR Oxygen is the Data Controller for all other personal data we collect from you (the Test Creator), such as your name, contact information, billing details, and platform login credentials, as we determine the purpose and means of processing that administrative data.

‍

A. What personal data do we collect and why? 

We collect information from you when you use the applicable self-service digital user testing and customer experience measurement solution(s) (the “Platform”), including to create test rounds (studies), contact us by email or other means (i.e. any other ticketing function) or otherwise interact with us on other properties that we operate.

‍

We may collect the following types of data from you: 

• Identity Data. This is information that helps us identify who you are, like your name, email address/userID and organisation or workgroup name.
• Contact Data. This is information that details how we can contact you, like your email address, telephone number or postal address.
• Survey Data. This is any information which you upload to the Platform or which is generated through Studies carried out on the Platform, like Test questions, responses and other data.
• Observed Data. This is information about your online browsing behaviour on the Platform, including information about any devices or applications you have used to access our services (including the make, model and operating system, IP address, general location, browser type and mobile device identifiers) or information about how and when you used the Platform.
• Referral Data. This is information about how you arrived at our site (i.e. if you arrive on our website, Site, or app from an external source, such as a link on another website or in an email, we record information about the source that referred you to us).
• Voluntary Data. This is any other information you provide to us voluntarily, for example via the Platform or in correspondence between you and any VR Oxygen employee through any means of communications, including through email or other support means, or via our social media channels.

‍

B. How do we use your data?

We may use the data we collect about you for a variety of purposes. European data protection legislation sets out specific “lawful bases” for processing personal data. The below sets out the basis under which we may process different information about you, and explains the purpose of that processing.

‍

1.2.3 CONTRIBUTOR (Test Round Participant) 

Session Data (Video, Metrics): For all Session Data (defined in Section D), you, as the Contributor, are the Data Subject. The Test Round Creator (Client) is the Data Controller for this information, as they determine the test's purpose. VR Oxygen acts solely as a Data Processor for the Client to facilitate the test and delivery of the final report. Once the Session Data is transferred to the Client, we have no control over their subsequent use. You will need to contact the Client directly to exercise rights (like deletion or restriction) regarding that specific Session Data.

‍

Registration and Account Data: VR Oxygen is the sole Data Controller for all personal data collected during your registration and participation unrelated to the specific test content (e.g., your name, email, payment information, and demographic data used for screening).

‍

A. What personal data do we collect and why? 

We collect information from you when you visit or participate in studies operated by us on the applicable digital user testing and customer experience measurement solution(s) (the “Platform”). 

We may also collect information about you from our customers who create studies or upload your data to such Platform(s) (“Test Round Creators”), including when you participate in studies operated by that Test Round Creator on the Platform. 

‍

When you register an account with us as a Contributor (Test Round Participant), we may collect the following types of data from you:  

• Contact and Personal Data: Full legal name, email address, date of birth, country of residence, and preferred language, telephone number or postal address.
• Payout (payment) Data. This is information that you have provided in order to receive an incentive or payment (if applicable) for having completed a test round, including payment details. E.g., location of your payment institution t enable you to create ane Account on the VR Oxygen Platform for compensation (e.g., Stripe or other designated third-party payment services).
• Platform Identifiers: Platform-specific account identifiers, including but not limited to the Meta email address and associated display name, collected where technically necessary for content distribution.
• Survey Data. This is any information which you provide as part of a Test, which may include any information recorded in your survey responses, audio and video recordings and/or any information collected during screen recording, including behavioural data. Please note, all survey data is voluntary. You can always choose not to provide Survey Data, however, this may prevent you from participating in Tests if the Test Round Creator has required this.
• Observed Data. This is information about your online browsing behaviour on the Platform, including information about any devices or applications you have used to access our services (including the make, model and operating system, IP address, general location, browser type and mobile device identifiers) or information about how and when you used the Platform.
• Referral Data. This is information about how you were invited to participate in such Test
• Voluntary Data. This is any other information you provide to us voluntarily, for example demographic information provided through your Contributor profile, or in correspondence between you and any VR Oxygen employee through any means of communications, including through email or other support means, or via our social media channels.

‍

B. VR SERVICE SESSION DATA & BIOMETRIC COLLECTION

In addition to the Personal Information described above, when a registered user ("Contributor") participates in a testing session related to our proprietary VR Service, we collect the following sensitive data, the method of collection for which is detailed below. This data is treated as Biometric Information under applicable law.

‍

C. Data Collection Methods

The specific method of data capture is determined by the requirements of the individual test session.

‍

D. Categories of Sensitive Session Data

Regardless of the collection method, the following categories of data are collected during a VR test session:

• Positional and Kinematic Data: Information reflecting the user's movement, orientation, and physical interaction points within the testing environment. Movement and gameplay activity.
• Visual Attention Data: Information derived from the user's gaze direction and focus areas (where supported by the testing device or discernible from media).
• Acoustic Data: Recordings and analysis of vocal input collected during the test session for behavioral and sentiment metric generation.
• Session Media: Audio/visual recordings (video and audio data) of the user’s experience in the content (“VR view recording”). Synchronized Real-Life Video (“Synced VR and IRL view”): For specific test rounds requested by the client, we collect a separate, third-person video feed of the participant's real-life physical movements and activity. This real-life video is synchronized with the VR view recording for detailed behavior analysis. This synchronized video captures the participant's physical surroundings, and is only collected when explicitly requested as a deliverable for the test.
• Technical Telemetry: Device, network, and application performance data, including public IP address, hardware model, unique identifiers, and internal system and proprietary software identifiers.
• Proprietary Metrics: Data generated from VR Oxygen's computational analysis of the raw user input, including proprietary behavioral and experience indicators.

‍

E. How do we use your data?

We may use the data we collect about you for a variety of purposes. European data protection legislation sets out specific “lawful bases” for processing personal data. The below sets out the basis under which we may process different information about you, and explains the purpose of that processing.

‍

‍

1.2.4. Other data we collect

‍

1.2.5. Consent to Data Collection (Condition of Participation)

Participation in a VR Oxygen test session is strictly voluntary. By initiating and engaging in a VR test session, the user provides explicit consent for the collection and processing of their Positional, Visual, and Acoustic Data (as defined in Section 1.2.3.D) via either method (Proprietary Service Capture or User-Initiated Submission) for the express purpose of generating the insights for the commissioning client and for the purpose of R&D and products and services improvement (as defined in Section 1.2.3.E.). If a user does not consent to this use, they must not begin the test session and must delete the application or client integration.

‍

1.2.6. Children's Privacy

VR Oxygen permits participation from users aged 10 years or older with documented, verifiable parental consent. If a user is under the age of 18, their parent or legal guardian must provide verifiable consent before the minor is allowed to participate in any test session or submit any data via the Service. We do not knowingly collect Personal Information, Spatial Data, or Biometric Data from children under the age of 10. If we learn that we have collected such data from a child under 10 without proper consent, we will promptly delete the data.

‍

1.2.7. De-identification and Anonymization

Prior to sharing Session Data with our Clients, all direct Personal Information (name, email, address, date of birth, etc.) is stripped from the Session Data and replaced with a random Contributor ID.

Crucial Caveat: For tests utilizing Manual Capture or Automated Capture of the physical environment, the video recording inherently contains the user's image and likeness. While Clients are bound by strict Non-Disclosure Agreements (NDAs) prohibiting the identification of Contributors, the visual data remains visible to them.

‍

1.2.8. Third parties

We may receive some information from you from Test Round Creators, as a processor for that Test Round Creator. In all cases, such sharing is related to your participation in their Test, such as sharing a video recording of your participation in a Test. Please note, we do not control how Test Round Creators use and share your information once they receive it. You will need to contact such Test Round Creators directly for information about their privacy practices or to exercise rights you may have (including if you would like to opt-out of receiving future emails from a Test Round Creator).

We treat your Test questions, responses and data as information that is private to you. We do not sell your survey data to third parties.

We may receive Identity Data and Voluntary Data about you from third-party providers that you authorize to provide third party sign in, authentication and authorization features. These features may share your personal information with us, including your name, birthday (month/day), workplace, education and person ID verifications and will be used by us consistent with this policy. This sharing is subject to each third party site’s own privacy policy and terms of use. You can control what they share with us through your account's privacy settings on those services. You understand that we have no influence over third party management of your data, and that any such third party’s processing of your data will be subject to the privacy policy and terms of use of that provider.

‍

1.2.9. Automated Processing 

Some features within the Platform may automatically process your information or be used to make judgments about you or your experience or to make recommendations to Test Round Creators based on Observed Data and/or Test Round Data. Some of these features rely on proprietary automated computational systems. Specifically:

• If you agree to your audio being recorded as part of a Test, Test Round Creators may request that a written transcript of what you said be generated
• Test Round Creators may request automated analysis of any such transcript in connection with your other Test results, in order to analyse your comments, reviews or feedback to determine the overall sentiment of your experience during a Test, identify keywords that Contributors use most frequently or identify common themes within the results of a Test

General Audience Service: The Service is for a general audience and intended for users 18 and older. You must be at least 18 years old to participate in user research and testing via our Site without parental consent. If you are under 18, you must have a parent or legal guardian:

• Provide consent for your participation in user research activities, including the collection of Spatial, Behavioral, and Biometric Data derived from eye-tracking (if supported by the headset and required by the , and
• Set up and manage a Stripe account to receive any monetary rewards on your behalf.

We do not knowingly collect Personal Information from anyone younger than age 18 without verified parental consent. If we become aware that a user younger than 18 has provided us with Personal Information without parental consent, we will use commercially reasonable efforts to delete such information from our files. You can request to delete your personal information at any time by contacting legal@vroxygen.com. If you are the parent or legal guardian of a user younger than age 18 and believe that VR Oxygen has collected Personal Information from your child without parental consent, please contact us at: legal@vroxygen.com.

‍

1.2.10. Parental Consent for Minors

NOTICE FOR PARENTS AND LEGAL GUARDIANS: VR Oxygen collects Personal Information, which may include, where supported by the user’s hardware and utilized in the test, sensitive data such as biometric identifiers (e.g., attention and movement data), from minors aged 10 to 17.
To ensure full compliance with the Children's Online Privacy Protection Act (COPPA) and other international standards, we require verifiable parental consent prior to any data collection.

‍

Before reviewing the full legal details below, we require all minors (kids, children and teens), parents and guardians to read our simplified, plain-language disclosure document: CLICK HERE FOR THE VR OXYGEN CHILDREN'S AND PARENTS' PRIVACY SUMMARY. The detailed legal requirements for obtaining verifiable parental consent are outlined below.

‍

If you are a parent or guardian of a child between the ages of 10 and 12 (age may vary by region) and wish to create a VR Oxygen account for your child, please review the Parent Privacy Disclosure that describes how VR Oxygen collects, uses, and discloses your child’s personal information.

‍

Users under the age of 18 must obtain verified parental or legal guardian consent before participating in any user research activities on the VR Oxygen platform. Users aged 16 and 17 may participate in some of the studies without parental consent, but are still considered minors in most jurisdictions and cannot receive monetary rewards directly.

• For participation in user research studies, a Parental Consent Form must be completed for users under the age of 16.
• For receiving monetary rewards, a Parental Authorization for Stripe Setup and Payouts must be completed for all users under 18.

‍

Additional Notes:

• We may collect gameplay feedback, survey responses, and, in some cases, video or audio recordings as part of the user research process.
• Users under 18 cannot set up their own Stripe accounts; payouts are made to a parent or guardian on their behalf.
  
  

Parental Rights: As a parent or guardian, you have the right to:

• Access, update, or delete your child’s data at any time.
• Withdraw your consent at any time by contacting VR Oxygen at legal@vroxygen.com, which will discontinue your child’s participation 
• Update or revoke this authorization Parental Authorization for Stripe Setup and Payouts at any time by contacting VR Oxygen at legal@vroxygen.com 
• Receive any monetary rewards on behalf of your child (all payouts are issued to the parent/guardian).

For assistance or questions, please contact us at legal@vroxygen.com.

• Non-Identifying Information/Usernames: We also may collect other information, such as zip codes, demographic data, information regarding your use of the Service, and general project-related data (“Non-Identifying Information”). We may aggregate information collected from VR Oxygen registered and non-registered users (“VR Oxygen Users”). We consider usernames to be Non-Identifying Information. Usernames are made public through the Service and are viewable by other VR Oxygen Users.
• In some cases, we may render Personal Information (generally, email address) into a form of Non-Identifying Information referred to in this Privacy Policy as “Hashed Information.” This is typically accomplished using a mathematical process (commonly known as a hash function) to convert information into a code. The code does not identify you directly, but it may be used to connect your activity and interests.
• Combination of Personal and Non-Identifying Information: Certain Non-Identifying Information would be considered a part of your Personal Information if it were combined with other identifiers in a way that enables you to be identified (for example, combining information with your name). But the same pieces of information are considered Non-Identifying Information when they are taken alone or combined only with other non-identifying information (for example, your viewing preferences). We may combine your Personal Information with Non-Identifying Information, but VR Oxygen will treat the combined information as Personal Information.
• Collection of Third Party Personal Information: We collect the following personal information from you about your contacts or friends: First name, last name, and email address when you provide it to us for the purpose of adding your contacts to a message room.

You do not have a statutory obligation to provide us with any information, but you may have a contractual obligation to do so, and if we do not receive certain information from you, then we will not be able to provide our Service to you. If you have any questions regarding whether provision of information is mandatory and the consequences for withholding such information, please contact us using the contact information below.

‍

1.3. Information Received from Third Parties

Third parties may also give us information about you. If we combine that information with information about you collected through the Service, we will still treat that combined information as set forth in this Privacy Policy.

We also may receive information about you from third parties. For example, we may supplement the information we collect with outside records or third parties may provide information in connection with a co-marketing agreement or at your request (such as if you choose to sign in with a third-party service). If we combine the information we receive from others with information we collect through the Service, we will treat the combined information as described in this Privacy Policy.

‍

1.4. Information Collected Automatically

Like other online companies, we receive technical information when you use our Services. We use these technologies to analyze how people use our Services, to improve how our Site functions, to save your log-in information for future sessions, and to serve you with advertisements that may interest you.

We and our third-party service providers, including analytics and third-party content providers, may automatically collect certain information from you whenever you access or interact with the Service. This information may include, among other information, the browser and operating system you are using, the URL or advertisement that referred you to the Service, the search terms you entered into a search engine that led you to the Service, areas within the Service that you visited, which links you clicked on, which pages or content you viewed and for how long, other similar information and statistics about your interactions, such as content response times, download errors and length of visits to certain pages and other information commonly shared when browsers communicate with websites. We may combine this automatically collected log information with other information we collect about you. We do this to improve services we offer you, and to improve marketing, analytics, and site functionality.

The information we collect also includes the Internet Protocol (“IP”) address or other unique device identifier (“Device Identifier”) for any device (computer, mobile phone, tablet, etc.) used to access the Service. A Device Identifier is a number that is automatically assigned or connected to the device you use to access the Service, and our servers identify your device by its Device Identifier. Some mobile service providers may also provide us or our third-party service providers with information regarding the physical location of the device used to access the Service.

‍

VR Oxygen and its partners use cookies or similar technologies to analyze trends, administer the website, track users’ movement around the website and across any of our integrated digital platforms and proprietary operational components, and to gather demographic information about our user base as a whole. The technology used to collect information automatically from VR Oxygen Users may include the following:

• Cookies: Like many websites, we and our marketing partners, affiliates, analytics, and service providers use “cookies” to collect information. A cookie is a small data file that we transfer to your computer’s hard disk for record-keeping purposes. We use both persistent cookies that remain on your computer or similar device (such as to save your registration ID and login password for future logins to the Service and to track your compliance with the VR Oxygen Terms of Service) and session ID cookies, which expire at the end of your browser session (for example, to enable certain features of the Service, to better understand how VR Oxygen Users interact with the Service and to monitor aggregate usage by VR Oxygen Users and web traffic routing on the Service). You can control the use of cookies at the individual browser level, but if you choose to disable cookies, it may limit your use of certain features or functionality of the Service. For further information on cookies and how they are used for the Service, please visit our Cookie Policy at https://www.vroxygen.com/legal/privacy-center/cookie-policy.
• Web Beacons: We and our marketing partners, affiliates, analytics, and service providers may also employ software technology known as “web beacons” and/or “tracking tags” to help us keep track of what content on our Service is effective and to serve relevant advertising to you. Web beacons are small graphics with a unique identifier that may be invisible to you, and which are used to track the online activity of Internet users. Web beacons are embedded in the web pages you review or email messages you receive. Web beacons or similar technologies may be used for a number of purposes, including, without limitation, to count visitors to our Service, to monitor how VR Oxygen Users navigate the Service, to count how many emails that were sent were actually opened, or to count how many particular articles or links were actually viewed.
• Embedded Scripts: We and our marketing partners, affiliates, analytics, and service providers may also employ software technology known as an Embedded Script. An Embedded Script is a programming code that is designed to collect information about your interactions with the Service, such as the links you click on. The code is temporarily downloaded onto your computer or other device and is deactivated or deleted when you disconnect from the Service.

In addition, we and our marketing partners, affiliates, analytics, and service providers may use a variety of other technologies (such as tags) that collect similar information for security and fraud detection purposes and we may use third parties to perform these services on our behalf.

‍

1.5. HOW WE RESPOND TO DO NOT TRACK SIGNALS

VR Oxygen does not respond to Do-Not-Track signals.

Please note that your browser setting may allow you to automatically transmit a “Do Not Track” signal to websites and online services you visit. There is no consensus among industry participants as to what “Do Not Track” means in this context. Like many websites and online services, VR Oxygen does not alter its practices when it receives a “Do Not Track” signal from a visitor’s browser. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.

‍

1.6. User Profiles

Contributors may create a profile, with certain or all information publicly available. Clients and Agencies may also create organization profiles.

You may have the opportunity to create a profile, which consists of information about you, and may include Personal Information, photographs, examples of your work, information on work previously performed via the Service and outside the Service, skills, tests taken, test scores, hourly pay rates, and earnings information, feedback/rating information and other information, including your username (“Profile”). The information in your Profile may be visible to all VR Oxygen Users and the general public subject to the privacy choices you make within your VR Oxygen Profile. You may edit certain information in your Profile via your account and may choose to limit who is able to view certain content you post to your Profile. Clients and Agencies of associated individual users or companies may also have the opportunity to create an organization Profile. If, in any case, you believe that an unauthorized profile has been created about you, you can request for it to be removed by contacting us at legal@vroxygen.com.

‍

1.7. Messaging

Contributors, Agencies, and Clients may communicate with each other through the Service. For example, Contributors, Agencies, and Clients may wish to discuss Client needs and Contributor work proposals. If you communicate with an Agency or Client, that Agency or Client will also be a “data controller” with respect to such communications.

‍

1.8. Community Forums

We may offer public forums or blogs. If you participate, your comments and questions will be publicly displayed.

The Service may provide you the opportunity to participate and post content publicly in forums, on blogs, through interactive features on VR Oxygen, and through other communication functionality (“Community Forums”). You may choose, through such features or otherwise, to submit or post questions, comments, or other content (collectively, “User Forum Content”). Please note that certain information, such as your name and Profile may be publicly displayed on the Service along with your User Forum Content. Please note that your use of Community Forums is subject to the VR Oxygen Forum Rules and our Terms of Service.

‍

Note that anything you post to a Community Forum is public — others will have access to your User Forum Content and may use it or share it with third parties. If you choose to voluntarily disclose Personal Information in your User Forum Content or use Community Forums to link to your Profile, that information will be considered public information and the protections of this Privacy Policy will not apply.

‍

To request removal of your personal information from our blog or community forum, contact us at  legal@vroxygen.com. In some cases, we may not be able to remove your Personal Information, in which case we will let you know if we are unable to do so and why.

‍

1.9. Testimonials

We display personal testimonials of satisfied customers on our Service, in addition to other endorsements. With your consent, we may post your testimonial along with your name. If you wish to update or delete your testimonial, you can contact us at legal@vroxygen.com.

‍

1.10. Work Listings Through the Service

If you choose to post a work listing via the Service as a Client, the contents of such listing will be viewable publicly, unless you designate the listing as only viewable through the Service or as private using the settings available on the applicable website. Work listings include information such as reward, location, it may also include history of work listing(s) by the Client, the number of other Contributors performing work for the Client, Client feedback and rating information, and timing of project performance, and other information.

‍

1.11. Feedback

We collect feedback from VR Oxygen Users about their experience with other VR Oxygen Users of our Service. Please note that any feedback you provide via the Service or feedback provided about you is publicly viewable via the Service. On very rare occasions, we may remove feedback pursuant to the relevant provisions of our General Terms and Conditions, including the Terms of Use - Study Respondents, Contributor Terms of Service, Customer Terms and Conditions.

‍

1.12. Email to Friends and Referral Program

VR Oxygen lets you send project postings to friends via email. VR Oxygen also offers the ability to send friends emails about providing or purchasing services through the Service. If you choose to use either feature, your friend’s email address will be used to send the requested posting and your email address will be used to copy you on the message to your friend or to send the message on your behalf. VR Oxygen stores this information for the sole purpose of sending this one-time email and tracking the success of our referral program.

Your friend may contact us at legal@vroxygen.com to request that we remove this information from our database.

‍

1.13. Social Networking Services

You may register for an account directly with our Site, or through a social networking service. If you register with a social networking service (or later link your account to one), we will collect certain information about you from that social networking service, and what we collect depends on your privacy settings with that social networking service. The Service may also allow you to “like” or share content with social networking services.

You may register to join the Service directly via the Service or by logging into your account with a third party social networking service (“SNS”) via our Service (e.g., Facebook, Github, and other third-party services that let you sign in using your existing credentials with those services). If you choose to register via an SNS or to later link your account with the Service to your account with an SNS, we will use the Personal Information you have provided to the SNS (such as your name, email address, gender, and other information you make publicly available via the SNS) to create your account. Note that the information we collect from and through an SNS may depend on the privacy settings you have set with the SNS and the permissions you grant to us in connection with linking your account with the Service to your account with an SNS. Other than what we may share with the SNS as described below, the Personal Information an SNS has about you is obtained by the SNS independent of our Service, and VR Oxygen is not responsible for it.

The VR Oxygen Service also may permit additional interactions between it and a third party website, service, or other content provider, such as enabling you to “like” or share content to a third party SNS. If you choose to “like” or share content, or to otherwise share information from or via our Service with a third-party site or service, that information may be publicly displayed, and the third party may have access to information about you and your use of our Service (and we may have access to information about you from that third party). These features may collect your IP address, which page you are visiting on our site, and may set a cookie to enable the feature to function properly. Your interactions with third parties through an SNS or similar features are governed by the respective privacy policies of those third parties.

You represent that you are entitled to use your SNS account for the purposes described herein without breach by you of any of the terms and conditions that govern the SNS, and without obligating VR Oxygen to pay any fees or making VR Oxygen subject to any usage limitations imposed by such SNS. You can disable the link between your VR Oxygen account and your SNS account at any time through the “Settings” section of our Service. Please note that your relationship with any SNS is governed solely by your agreement(s) with such SNS. If your SNS account terminates, then functions enabled through the link between your VR Oxygen account and your SNS account will terminate as well.

‍

‍

2. USE OF INFORMATION

We may use the data we collect about you for a variety of purposes.

‍We use information collected through the Service to provide and improve the Service, process your requests, prevent fraud, provide you with information and advertising that may interest you, comply with the law, and as otherwise permitted with your consent. 

‍

2.1. WE USE INFORMATION WE COLLECT:

• To provide and improve the Service, complete your transactions, address your inquiries, process your registration, verify the information you provide is valid, and for compliance and internal business purposes.
• To contact you with administrative communications and VR Oxygen newsletters, marketing or promotional materials (on behalf of VR Oxygen or third parties), and other information that may be of interest to you. If you decide at any time that you no longer wish to receive such communications from us, please follow the instructions in the Your Choices and Rights section, below.
• To tailor content we display to you and offers we may present to you, both on the Service and elsewhere online.
• To administer and develop our business relationship with you and, if applicable, the corporation or other legal entity you represent.
• To assess your proposal to perform a freelance project for VR Oxygen and prepare related governmental and internal statistics reports.
• To enforce and comply with the law, including to conduct an investigation, to protect the property and rights of VR Oxygen or a third party, to protect the safety of the public or any person, or to prevent or stop activity we may consider to be or to pose a risk of being, illegal, fraudulent, unethical or legally actionable activity. We may also use Device Identifiers to identify VR Oxygen Users.
• For the purposes disclosed at the time you provide your information, with your consent, and as further described in this Privacy Policy.

‍

2.1.1. ADVANCED ANALYTICS, R&D AND PRODUCTS AND SERVICES IMPROVEMENT, AND SYSTEM OPTIMIZATION

The core functionality of the VR Oxygen Service is dependent upon the continuous development and optimization of our Proprietary Computational Systems. These systems process collected data to generate actionable product intelligence for our Clients.

• R&D and products and services improvement: We reserve the right to use all Sensitive Session Data (as defined in Section 1.2) to continuously develop, validate, and refine our proprietary data analysis systems and algorithms, which generate specialized insights for our Clients.
• System Development and Validation: We also use this data to continuously develop and optimize the accuracy and capability of the broader VR Oxygen analytical processes and platform components.
• Information Abstraction: To remove elements that directly identify or link the data to a specific user account. This resulting abstracted and aggregated data is considered the exclusive Intellectual Property of VR Oxygen.
• Data Minimization: We adhere to the principle of using only the minimum necessary data required to achieve the purpose of generating and validating our proprietary intelligence.

‍

2.1.2. THE LEGAL GROUNDS FOR OUR PROCESSING ACTIVITIES

We must have a valid legal reason (or "lawful basis") to process your Personal Information. We rely on the following grounds for the different types of data processing we conduct:

‍

A. Explicit Consent (Primary Basis)

This is the required basis for processing your most sensitive data. We process Personal Information, including all Sensitive Session Data (Kinematic, Visual, and Acoustic Data), only after receiving:

• Verifiable Parental Consent (VPC): Required by COPPA/GDPR-kids for minors aged 10-17.
• Explicit Consent: Required under GDPR for processing Special Categories of Personal Data (which includes biometric data used for unique identification).

We rely on your or your parent’s Explicit Consent for the following core activities:

• Collecting and analyzing the Sensitive Session Data from the VR headset.
• Using this data to develop, validate, and refine our proprietary automated data analysis systems and algorithms.
• Sharing your anonymized or aggregated test results with our Clients (Game Creators). You or your parent can withdraw consent for this processing at any time.

‍

B. To Honor Our Contractual Commitments

We use your Personal Information to fulfill our contractual obligations to you, such as:

• Providing you with access to the testing platform and services.
• Processing your eligibility and payment for the test session.
• Taking steps at your request (e.g., setting up your account) in anticipation of a contract.

‍

C. For Our Legitimate Interests

We rely on our Legitimate Interests for a limited set of non-core, routine business activities, but we do not rely on this basis for processing Sensitive Session Data or children’s personal information where it requires explicit consent. This basis applies to:

• Analyzing and Improving our Business: General analysis of our website performance and user experience (excluding in-test session data).
• Communications: Responding to your inquiries about our services, or sending necessary service updates.
• Security: Addressing information security needs and protecting our Users, VR Oxygen, and others.

‍

D. To Comply with Legal Obligations

We need to use and disclose Personal Information in certain ways to comply with our legal obligations, such as retaining records for tax purposes or responding to lawful requests from government or law enforcement agencies.

We use the information we collect, including your Personal Information, for the following purposes:

‍

E. Providing and Managing the Service

• To process and manage your account registration.
• To fulfill payment obligations to you.
• To facilitate communication between you and VR Oxygen.
• To provide Clients with testing reports and associated data.

‍

F. Internal Development and Platform Improvement

We use collected information for our internal business purposes, including:

• Enhancing the quality and functionality of the Service.
• Performing research and development for new features.
• Internal auditing and compliance.
• Developing, validating, and refining our proprietary automated data analysis systems and algorithms.
• Developing and testing new products and services.

‍

European data protection legislation sets out specific “lawful bases” for processing personal data. The below sets out the basis under which we may process different information about you, and explains the purpose of that processing.

‍

2.1.3 THIRD-PARTY DEVELOPERS AND DATA COMPLIANCE

All Test Rounds and applications available through the VR Oxygen platform are developed and operated by independent third-party developers or companies. These third-party developers are solely responsible for the content, safety, and data collection or processing practices of their respective applications.

By using the VR Oxygen platform, developers agree to handle all personal data in strict compliance with applicable privacy laws, including but not limited to the Children’s Online Privacy Protection Act (COPPA), the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other relevant data protection regulations.

VR Oxygen does not control, monitor, or assume any liability for the data collection, processing, or privacy practices of these third-party developers. Users and parents/guardians are encouraged to review the privacy policies and terms of use of any third-party apps accessed through our platform.

‍

3. DATA RETENTION

Unless you request that we delete certain information (see Your Choices and Rights below), we may only retain your personal information for the purposes set out in this policy and for as long as we have a legal or business requirement to do so. By law, different retention periods apply to different types of records and data, however the longest we will normally hold any personal data is 7 years from the date of your last interaction with us. Your information may persist in copies made for backup and business continuity purposes for additional time. If you choose to provide us with Personal Information, we encourage you to routinely update the data to ensure that we have accurate and up-to-date information about you.

3.1 How and when is my data deleted?

• By default, all your data is stored within the USA region of the public cloud infrastructure managed by AWS (Amazon Web Services).
• To prevent accidental loss of data caused by user error, certain entities should not be deleted immediately.
• Specifically, feedback documents are marked for removal and are securely deleted after:
  
  • Two weeks if the data was deleted manually by the user.
  • Two months if the data was deleted as a result of an automation rule. 

‍

3.1.1. RAW PERSONAL DATA FOR MINORS (UNDER 18): 

For raw, personally identifiable data collected from users under the age of 18 (including video, voice, and movement metrics), we will delete or fully anonymize this data no later than ninety (90) days following the completion of the specific testing phase for which the data was collected. This strict, short timeline is necessary to comply with the mandated deletion requirements of COPPA and the GDPR.

‍

3.1.2. RAW PERSONAL DATA FOR ADULTS (18+): 

For raw, personally identifiable data collected from users aged 18 or older, we retain this data only for as long as is necessary to provide the requested service and fulfill our contractual obligations to our Clients. This retention period is determined by the duration of the project cycle, quality control needs, and dispute resolution. Users may request deletion of their data at any time.

‍

3.1.3. ANONYMIZED AND BUSINESS DATA (LOW-RISK): 

We retain data that has been fully and irreversibly anonymized (such as the Objective Engagement Score, or OES, and aggregated metrics) for up to seven (7) years for the purpose of historical benchmarking, long-term  R&D and products and services improvement, and meeting essential legal and financial audit requirements. This anonymized data is the basis for providing long-term performance benchmarks and historical analysis to our Clients.

‍

3.1.4. BACKUP RETENTION: 

All data is backed up daily and stored in an offsite, encrypted storage. All backups containing Personal Data are retained for a maximum of thirty-one (31) days. This short retention period is maintained to ensure that any Personal Data subject to the deletion or anonymization schedules described above is also promptly purged from our disaster recovery systems.

‍

3.1.5. Other types of data stored in your account are subject to the following:

• Uploaded files (For example, images, videos, documents) are deleted when their associated resources (For example, Reports, Documents) are deleted permanently.
• Member profile can be deleted either manually or via our API. In either case, data is deleted immediately when it is a user-initiated action.
  
  • Member profiles not connected to any document for more than 90 days from the last time they were imported or connected to at least one document (whichever happened last) will be deleted automatically with no chance of recovery.
• Stripe profile can be deleted either manually or via our API. In either case, data is deleted immediately when it is a user-initiated action.
• Projects, Test Rounds (along with their Ongoing, Completed, and Report sections), Saved Searches, Labels, Charts, and Dashboards are deleted immediately when directly deleted via a user-initiated action.

‍

3.1.6. Cancellations

60 days or less: Your account is marked for deletion. All data is deleted but can still be recovered if needed.

After 60 days: All data is permanently removed from our systems. Data recovery is not possible.

‍

4. INFORMATION SHARING AND DISCLOSURE

We may share information about you to provide the Services, for legal and investigative purposes, in connection with sweepstakes and promotions, or if we are part of a merger or acquisition. We may also share non-identifying information with third parties. You have choices as to whether we share your personal information with third parties for their own marketing purposes.

‍

We may share aggregated Non-Identifying Information and we may otherwise disclose Non-Identifying Information (including, without limitation, Hashed Information) to third parties. We do not share your Personal Information with third parties for those third parties’ marketing purposes unless we first provide you with the opportunity to opt-in to or opt-out of such sharing. We may also share the information we have collected about you, including Personal Information, as disclosed at the time you provide your information, with your consent, as otherwise described in this Privacy Policy, or in the following circumstances:

‍

• Information about Contributors Shared with Clients, Agencies, VR Oxygen Payout Vendors, and Partners of The VR Oxygen Foundation Initiative: We share information regarding Contributors who have entered into a contract with a Client or who have elected to participate in VR Oxygen Payout, including work history, with Clients, Agencies and VR Oxygen Payout vendors. Note that if a Contributor is suspended from the VR Oxygen Service, we may share that information with Clients for whom that Contributor has worked or submitted proposals for work. We may also share information with Agencies to whom Contributors are associated with a particular work project. If you choose to view a job post or submit a proposal for work as a Contributor via the Service, we may share relevant information with the applicable Client(s), including, but not limited to, the information contained in your Contributor Profile. If you choose to participate in The VR Oxygen Foundation Initiative as a Contributor, we may share information relevant to your participation in the program with partners of VR Oxygen who provide support to Contributors through that program.
• Disclosure of Test Data to Clients: The primary purpose of the VR Oxygen Service is to provide actionable user research to the clients whose applications are being tested. When you participate in a test session, you understand and agree that the following will be shared with the client who commissioned the test:

• Raw and Processed Test Data: The full video recording, audio recording, survey responses, and all collected Spatial and Motion Data.
• Proprietary Automated Insights: The specific reports, charts, and metrics, including behavioral analysis scores, engagement metrics, and emotional classification data, generated by the VR Oxygen Service's computational analysis

‍

The client is responsible for the lawful handling of this data under their own privacy policies. VR Oxygen acts as a Data Processor on behalf of our clients in this specific instance.

• Information about Clients and Agencies Shared with Contributors: If you have entered into a service contract or agreed to use VR Oxygen Payout with another user, we may provide him/her with your name, company address, billing address, or tax ID or VAT number in order to complete the transaction or to facilitate the resolution of a claim or dispute. The user receiving your information is not allowed to use it for purposes unrelated to the transaction, such as to contact you for marketing purposes, unless you have expressly consented to it.
• Service Providers: We may employ third party companies and individuals to facilitate our Service, to provide the Service on our behalf, to perform Service-related services (e.g., without limitation, maintenance services, database management, web analytics and online advertising, payment processing, fraud detection and improvement of VR Oxygen’s features) or to assist us in analyzing how our Service is used. These third parties may have access to your Personal Information in order to perform these tasks on our behalf.
• What Happens If You Agree to Receive Information from Third Parties or Request that We Share Your Information: You may be presented with an opportunity to receive information and/or marketing offers from one or more third parties. If you agree at that time to have your Personal Information shared, your Personal Information will be disclosed to that third party (or parties) and will be subject to the privacy policy and practices of that third party. We are not responsible for the privacy policies and practices of third parties, and, if you later decide that you no longer want to receive communications from a third party, you will need to contact that third party directly. You also may request, sometimes through your use of an SNS or similar interactive feature or third-party application, that we share information about you with a third party and we will typically do so under those circumstances.
• Legal and Investigative Purposes: VR Oxygen will share information with government agencies as required by law in response to lawful requests by public authorities, including to meet national security or law enforcement requirements and, including without limitation, in connection with reporting earnings. We cooperate with government and law enforcement officials and private parties to enforce and comply with the law. We will disclose information about you to the government or law enforcement officials or private parties as we, in our sole discretion, believe necessary or appropriate to respond to claims and legal process (including but not limited to subpoenas), or, at the request of governmental authorities or other third parties conducting an investigation where we determine in our sole discretion the disclosure is necessary to (a) protect the property and rights of VR Oxygen or a third party, (b) protect the safety of the public or any person, or (c) prevent or stop activity we may consider to be, or pose a risk of being, illegal, fraudulent, unethical or legally actionable activity. We may also use Device Identifiers to identify VR Oxygen Users and may do so in cooperation with third parties at our discretion.
• Internal and Business Transfers: VR Oxygen may share information, including Personal Information, with its parent company VR Oxygen Inc., and any current or future subsidiaries or affiliates, primarily for business and operational purposes. We may sell, transfer, or otherwise share some or all of our assets, including your Personal Information, in connection with a merger, acquisition, reorganization, or sale of assets (including, in each case, as part of the due-diligence process with any potential acquiring entity) or in the event of bankruptcy.
• Sweepstakes, Contests, and Promotions: We may offer sweepstakes, contests, and other promotions (any, a “Promotion”) that may require registration. By participating in a Promotion, you are agreeing to the official rules that govern that Promotion, which may contain specific requirements of you, including, except where prohibited by law, allowing the sponsor(s) of the Promotion to use your name, voice, likeness, or other indicia of persona in advertising or marketing associated with the Promotion. If you choose to enter a Promotion, your Personal Information may be disclosed to third parties or the public in connection with the administration of such Promotion, including, without limitation, in connection with winner selection, prize fulfillment, and as required by law or permitted by the Promotion’s official rules, such as on a winner’s list.

‍

5. THIRD-PARTY ANALYTICS PROVIDERS, AD SERVERS, AND SIMILAR THIRD PARTIES

VR Oxygen may engage analytics service providers, advertising agencies, network advertisers, and other vendors (collectively, "Third-Party Partners") who use technologies to help us understand how people use our Service, to measure the effectiveness of our advertisements, and to serve advertisements to you on other websites and services.

These Third-Party Partners may set and access their own tracking technologies on your device (including cookies, web beacons, and similar technologies) and may collect certain information about your visits to and activity on the Service as well as other websites or services, including your IP address, device identifiers, and browsing activity. This information is used for targeted advertising and cross-contextual behavioral advertising.

We may also share certain Non-Identifying Information, including Hashed Information, with these Third-Party Partners in connection with the services they provide to us.

‍

5.1 Your Choices and Controls

‍

5.1.1. Consent Management

We manage your preferences for these tracking technologies and services through our Consent Management Platform. You can review and change your consent choices at any time by clicking the "Cookie Settings" link.

‍

5.1.2. Specific Opt-Out Rights

 If you are a California resident, you have the right to opt-out of the "Sale" or "Sharing" of your Personal Information, which may include the use of certain third-party tracking technologies for targeted advertising. This can be exercised via the "Do Not Sell or Share My Personal Information" link on our website footer, and/or through the Global Privacy Control signal.

Additionally, many of these Third-Party Partners participate in industry opt-out programs. You may wish to visit the following organizations to learn more and exercise opt-out rights:

• Network Advertising Initiative (“NAI”): http://www.networkadvertising.org/managing/opt_out.asp
• Digital Advertising Alliance (“DAA”): http://www.aboutads.info/choices/
• European Choices: www.youronlinechoices.com/uk/your-ad-choices 

Important Note: If you use your browser settings to block all cookies (including strictly necessary cookies), you may not be able to access all or parts of our website. Opting out of interest-based advertising means you will continue to receive generic, non-personalized advertisements.

‍

5.2. Subprocessors

VR Oxygen engages the products and services of other vendors. As a step in ensuring GDPR compliance, VR Oxygen has reviewed and continues to assess vendors for compliance assurances. You can view current vendors and status here.

‍

‍

6. YOUR CHOICES AND RIGHTS

You have certain choices regarding how we may communicate with you.

Registered VR Oxygen Users may update their choices regarding the types of communications you receive from us through your online account. You also may opt-out of receiving marketing emails from us by following the opt-out instructions provided in those emails. Please note that we reserve the right to send you certain communications relating to your account or use of the Service (for example, administrative and service announcements) via email and other means and these transactional account messages may be unaffected if you opt-out from receiving marketing communications. You may opt-out of receiving text messages by replying “STOP” to any text message received. Registered VR Oxygen Users who access the Service by using a VR Oxygen mobile application may, with permission, receive push notifications. Similarly, registered VR Oxygen Users who access the Service by using certain desktop browsers may, with permission, receive push notifications. Notification preferences can be modified in the settings menu for the mobile application or the applicable browser.

‍

All Users may request access to or correction of any Personal Information we have about them or close their account and/or request deletion of all Personal Information we have about them. In certain jurisdictions, Users may have certain rights with regard to their Personal Information. We will honor User requests to the extent we can reasonably do so and as required by law, but some information will remain on the Services, such as information you posted publicly.

‍

Upon request, VR Oxygen will provide you with information about whether we hold any of your personal information. You are responsible for maintaining the accuracy of the information you submit to us, such as your contact information. You may access, correct, or request the deletion of your personal information by making updates to that information or by contacting VR Oxygen through your online account. If you request to access all personal information you’ve submitted, we will respond to your request to access within 30 days or as otherwise required by law. If your information is deleted, then your account may become deactivated. If your account is deactivated or you ask to close your account, you will no longer be able to use the Service. If you would like to close your account in our system, you can do so through the VR Oxygen Service (once you have logged in, visit settings / user settings, and then click on the close my account link).

‍

Depending on where you are located, you may have certain rights with regard to your Personal Information (including Standard Contractual Clauses (SCCs) approved by the European Commission). For example, if you are located in the European Economic Area (“EEA”), in addition to the rights described above, you may contact us at the contact information provided below to (1) request a restriction on the processing of your Personal Information, (2) object to the processing of your Personal Information, or (3) exercise other rights with respect to your Personal Information. Depending on where you are located, you may have the right to object to or request a review of any decision made by automated means concerning your Personal Information. If you wish to exercise this right, please contact us at legal@vroxygen.com. For more information or to submit a request to us regarding your Personal Information please contact us at legal@vroxygen.com.

‍

We will use commercially reasonable efforts to honor your requests for deletion; however, certain information will actively persist on the Service even if you close your account, including messages you posted to the Service. In addition, the rights described above may be limited, for example, if fulfilling your request would reveal personal information about another person, or if you ask us to delete information we are required by law to keep or have compelling legitimate interests in keeping (such as for fraud prevention purposes). Your Personal Information may remain in our archives and information you update or delete, or information within a closed account may persist internally for our administrative purposes, to the extent permitted by law. It is not always possible to completely remove or delete information from our databases. In addition, we typically will not remove information you posted publicly through or on the Service. Bear in mind that neither you nor VR Oxygen can delete all copies of information that has been previously shared with others on the Service.

‍

‍

7. SECURITY

We take a number of steps to protect your data, but no security is guaranteed.

‍

VR Oxygen takes commercially reasonable steps to help protect and secure the information it collects and stores about VR Oxygen Users. All data transmitted to the Site, including sensitive information (such as tax identification number), is encrypted using industry-standard Transport Layer Security technology (“TLS”). We also use HTTP Strict Transport Security (HSTS) to add an additional layer of protection for our VR Oxygen Users. We use a combination of physical, technical, and administrative safeguards to protect the information we collect through the VR Oxygen Platform against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These safeguards include:

‍

• Encryption: We use encryption technologies to protect data both in transit (when it's being sent) and at rest (when it's stored on our servers).
• Access Control: Access to raw data, including video and audio recordings, is strictly limited to authorized VR Oxygen employees, contractors, and human analysts who require it to perform their job duties.
• Secure Hosting: We rely on industry-leading, secure cloud infrastructure providers (such as AWS or Google Cloud) to host and manage all platform data.

But remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. Thus, while we strive to protect your Personal Information, VR Oxygen cannot ensure and does not warrant the security of any information you transmit to us.

‍

7.1. Strict Access Controls for Raw Media 

Access to sensitive content, including raw video, audio, including VR view recording, Synced VR and IRL view, is restricted to the VR Oxygen personnel and authorized analysts who have a strict, defined need-to-know for analysis, quality assurance, or customer support purposes.

‍

‍

8. INTERNATIONAL TRANSFER OF PERSONAL INFORMATION

Because we are a U.S. company, we process and store your information in the United States and our service providers may process and store it elsewhere.

VR Oxygen is a U.S. company. If you are located outside the United States and choose to provide information to us, VR Oxygen transfers Personal Information to the United States for processing, and our service providers may process Personal Information in the United States and elsewhere. These countries may not have the same data protection laws as the country in which you initially provided the information. When we transfer your information to the United States, we will protect it as described in this Privacy Policy.

When we transfer Personal Information from territories in the EEA or with similar laws to our affiliates or service providers in the United States and elsewhere outside the EEA, we rely on approved data transfer mechanisms, including standard contractual clauses approved by the European Commission. You may request a copy of the standard contractual clauses relevant to your Personal Information, if any, using the contact information below.

‍

‍

9. LINKS TO OTHER SITES

Our Service contains links to other websites. If you choose to click on a third party link, you will be directed to that third party’s website. The fact that we link to a website is not an endorsement, authorization, or representation of our affiliation with that third party, nor is it an endorsement of their privacy or information security policies or practices. We do not exercise control over third party websites. These other websites may place their own cookies or other files on your computer, collect data or solicit Personal Information from you. We encourage you to read the privacy policies or statements of the other websites you visit.

‍

‍

10. PUBLIC PROFILE

The profile you create on our Site will be publicly accessible unless otherwise indicated. You may change the privacy settings of your profile through your account portal.

‍

‍

11. PHISHING

Phishing websites imitate legitimate websites in order to obtain personal or financial information. Identity theft and the practice currently known as “phishing” are of great concern to VR Oxygen. For more information about phishing, visit the website of the Federal Trade Commission at http://www.consumer.ftc.gov/articles/0003-phishing. In addition, if you believe you have received an email or had a similar interaction with a third party pretending to be VR Oxygen, please report it at legal@vroxygen.com.

‍

‍

12. CALIFORNIA RESIDENTS – YOUR CALIFORNIA PRIVACY RIGHTS (CCPA clause)

This CCPA clause supplements the information contained in this VR Oxygen Privacy Policy as well as other agreements you have with VR Oxygen, such as the VR Oxygen Contributor Terms of Service and Customer Terms of Service. It applies to visitors, participants, customers, and users of VR Oxygen’s Platform and Services who reside in the State of California. Any terms we use in this clause that aren’t defined here will have the meanings we give them in those agreements.

The California Consumer Privacy Act (CCPA) is a privacy law that provides a variety of privacy rights to California consumers. The law includes a provision that gives California residents the right to opt out of the “sale” of their “personal information” through a prominent link that says “Do Not Sell My Personal Information” on the “selling” party’s homepage. The CCPA includes certain exceptions to the definition of “sale”, including transfers to “service providers”.

This clause provides California consumers with additional information about our collection and use of your Personal Information.

‍

12.1. Information we collect and ways we may use it

Through our Site, Platform and Services, we collect information that can be used to identify or describe you or that could reasonably be linked, directly or indirectly, with a particular consumer or device as defined in the CCPA (“Personal Information”).

‍

12.2.Collection

As explained in more detail in our Privacy Policy, VR Oxygen obtains Personal Information from the following categories of sources:

• Directly from you
  
  • For example, when you sign up to receive information from VR Oxygen, to register an account with VR Oxygen or to use our Platform or Services; and
• Indirectly through other sources
  
  • For example, from observing your actions on our Site, including by the use of cookies, or from third parties.

‍

12.3. Uses

The purposes for which we use the Personal Data we collect are set out in our Privacy Policy. We refer to them as the legitimate business purposes in our Privacy Policy and in this clause.

‍

12.4. Examples

For example, we collect the following categories of Personal Information from California consumers.

• Information that can be used to identify you (“Identifiers”)
  
  • Examples include: a real name, unique personal identifier, online identifier, Internet Protocol address, email address, account name
  • Uses: We use Identifiers for all of our legitimate business purposes.
• Personal Information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))
  
  • Examples include: a name, signature, address, telephone number, employment
  • Uses: We use this category of information to provide you access to and use of the Platform and Services, to improve and enhance your experience with the Platform and Services, and to understand how you access, use and interact with the Platform and Services in order to provide technical functionality, develop new products and services, and analyze your use of them.
• Protected classification characteristics under California or federal law
  
  • Examples include: birth year, gender
  • Uses: We use this category of information to improve and enhance your experience with the Platform and Services, and to understand how you access, use and interact with the Platform and Services in order to provide technical functionality, develop new products and services, and analyze your use of them.
• Commercial information
  
  • Examples include: records of products purchased or considered, or other purchasing or consuming histories or tendencies
  • Uses: We use this category of information to receive and make payments, to improve and enhance your experience with the Platform and Services, and to understand how you access, use and interact with the Platform and Services in order to provide technical functionality, develop new products and services, and analyze your use of them.
• Internet or other similar network activity
  
  • Examples include: browsing history, information on a consumer’s interaction with a website or application
  • Uses: We use this category of information to improve and enhance your experience with the Platform and Services, and to understand how you access, use and interact with the Platform and Services in order to provide technical functionality, develop new products and services, and analyze your use of them.
• Geolocation data
  
  • Examples include: physical location or movements.
  • Uses: We use this category of information to protect against fraud and to provide technical functionality.
• Sensory data
  
  • Examples include: video and audio recordings, and visual information
  • Uses: We use this category of information to provide you access to and use of the Platform and Services, to improve and enhance your experience with the Platform and Services, and to understand how you access, use and interact with the Platform and Services in order to provide technical functionality, develop new products and services, and analyze your use of them.

VR Oxygen will not collect additional categories of Personal Information or use the Personal Information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

‍

12.5. Sharing Personal Information

VR Oxygen may share your Personal Information with a third party for a legitimate business purpose. When we disclose Personal Information for a legitimate business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that Personal Information confidential and not use it for any purpose except performing the services for us.

We disclose your Personal Information for a legitimate business purpose to the following categories of third parties:

• Companies that perform tasks to help us provide the following Services: hosting service providers, user engagement and customer support providers, job application service providers, payment service providers, communication tools, and analytics tools; and
• Professional service providers, such as auditors, lawyers, consultants, accountants and insurers.

More information about how we share Personal Information can be found in our Privacy Policy.

‍

12.6. Sale of Personal Information

VR Oxygen does not sell Personal Information and will not sell Personal Information as defined under the CCPA/CPRA, which includes the exchange of data for monetary or other valuable consideration.

For the required 12-month disclosure period, VR Oxygen has not sold any Personal Information. 

Your Right to Opt-Out: Since we do not Sell or Share Personal Information, no further action is required by you to exercise your right to opt-out. Should our practices change in the future, we will update this Privacy Policy and provide a clear and conspicuous mechanism to exercise your right to opt-out of both the Sale and Sharing of your Personal Information.

‍

12.7. Your Rights and Choices

The CCPA provides California Consumers with specific rights regarding their Personal Information. This section describes your CCPA rights and explains how to exercise those rights.

‍

12.8. Access to Specific Information and Data Portability Rights

You have the right to request that VR Oxygen disclose certain information to you about our collection and use of your Personal Information over the past 12 months. Once we receive and confirm your verifiable consumer request (see the following sections below: Exercising Access, Data Portability, and Deletion Rights), we will disclose to you:

• The categories of Personal Information we collected about you.
• The categories of sources for the Personal Information we collected about you.
• Our legitimate business purpose for collecting or selling that Personal Information.
• The categories of third parties with whom we share that Personal Information.
• The specific pieces of Personal Information we collected about you (also called a data portability request).
• If we sold or disclosed your Personal Information for a legitimate business purpose, two separate lists disclosing:
  
  • sales, identifying the Personal Information categories that each category of recipient purchased; and
  • disclosures for a legitimate business purpose, identifying the Personal Information categories that each category of recipient obtained.

‍

12.9. Deletion Request Rights

You have the right to request that VR Oxygen delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your Personal Information from our records, unless an exception applies.

We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

1. Complete the transaction for which we collected the Personal Information, provide a good or service that our customers purchase or request, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
3. Debug products to identify and repair errors that impair existing intended functionality.
4. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
7. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
8. Comply with a legal obligation.
9. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

‍

12.10. Exercising Access, Data Portability, and Deletion Rights

To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by emailing us at privacy@vroxygen.com 

Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your Personal Information. You may also make a verifiable consumer request on behalf of your minor child.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you.

Making a verifiable consumer request does not require you to create an account with us. We will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

‍

12.11. Response Timing and Format

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.

‍

12.12. We will deliver our written response by mail or electronically.

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

‍

12.13. Contact Us

If you have any questions or comments about this clause, the ways in which VR Oxygen collects and uses your information described below and in this CCPA clause, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at privacy@vroxygen.com.

VR Oxygen, Inc.
16192 Coastal Highway,
Lewes, DE 19958, USA
Attn: Legal

‍

13. CHANGES TO THIS POLICY

Under certain circumstances (for example with certain material changes) we will provide notice to you of these changes and, where required by applicable law, we will obtain your consent. Notice may be by email to you, by posting a notice of such changes on our apps and websites, or by other means consistent with applicable law.

‍

‍

14. INTERNATIONAL DATA TRANSFERS, AUTOMATED DECISIONS, AND EUROPEAN REPRESENTATION 

A. INTERNATIONAL TRANSFERS: VR Oxygen is headquartered in the United States. Your Personal Data will be transferred to and stored in the United States and may be further processed by our Service Providers located globally.

Since the European Commission has not issued an "adequacy decision" for the United States, we must rely on alternative legal mechanisms to ensure your data receives adequate protection when it is transferred outside of the EEA or the UK.

We transfer your Personal Data outside of the EEA/UK only on the basis of your explicit, revocable consent (GDPR Article 49(1)(a)). By voluntarily participating in our testing services, you understand and explicitly consent to the transfer of your Personal Data to the United States for the purposes of performing the contract and services you requested.

‍

European and UK Representation: VR Oxygen Inc. is a U.S.–based company with no physical establishment in the European Union or the United Kingdom. At present, our processing of personal data from EU and UK residents is limited to a very small number of voluntary user-testing sessions conducted with explicit consent, robust anonymization, and strict retention controls.

‍

In accordance with Article 27 GDPR and the equivalent provision of the UK GDPR, organizations established outside these territories must appoint a local representative only when their processing is more than occasional, involves large-scale monitoring, or is likely to result in risks to individuals’ rights and freedoms. Given the small scale and low-risk nature of VR Oxygen’s current operations, we have determined that appointment of an EU or UK representative is not proportionate at this stage.

‍

This determination will be reviewed periodically—for example, if participation by EU or UK users increases materially or our processing activities expand in scope. When and if required, VR Oxygen will promptly designate and publish the contact details of its appointed representative(s) within this Privacy Policy.

Data subjects in the EU or UK may continue to exercise all rights provided under the GDPR and UK GDPR by contacting us directly privacy@vroxygen.com. 

‍

B. AUTOMATED DECISION-MAKING AND PROFILING (GDPR ARTICLE 22): VR Oxygen employs algorithmic processing, including our proprietary automated computational systems, to analyze and interpret individual and aggregated usage and interaction data collected through the Service. This processing is performed for the purpose of profiling users to categorize them into behavioral groups, analyze usage patterns, and provide our Clients with specialized insights for content optimization and improved service delivery. This processing may include the algorithmic analysis of data derived from sensitive categories of Personal Data as authorized by your explicit consent. This entire process constitutes profiling under the GDPR.

‍

Your Right to Human Intervention: You have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.

‍

Right to Challenge: If you believe an analytical output or decision based on this automated processing significantly affects you, you have the right to request human intervention, to express your point of view, and to challenge the decision made by our automated system.

‍

‍

15. CONTACTING US

If you have any questions about this Privacy Policy, your account, or VR Oxygen's general practices, please contact us at privacy@vroxygen.com, or by mail addressed to 

VR Oxygen,
16192 Coastal Highway,
Lewes, DE 19958,
Attn: Legal

‍

For matters related to your GDPR data subject rights (such as Right to Access or Right to Erasure) or formal regulatory inquiries, you must submit your request to privacy@vroxygen.com and include "GDPR DATA REQUEST" in the subject line. This is essential to ensure your request is tracked and handled within the statutory response period.

‍

Effective January 12, 2026

‍