Biometric Data Policy and Notice

Date of Last Revision: 18^th August 2025

1. Purpose

This Biometric Data Policy and Notice describes how AI-Media Technologies Ltd (together with its subsidiaries and affiliated companies “AI-Media,” “we”, “our” or “us”) collects, stores, uses and discloses biometric data. This adopted Policy and Notice (this “Policy“) governs the treatment of our Biometric Information and Customer Data, when they concern Biometric Data. Protecting the confidentiality and integrity of Biometric Data is a critical responsibility that must be taken seriously at all times. Compliance with this Policy is mandatory.

2. Biometric Data Definitions

Biometric Information / Identifiers: a subset of “sensitive personal data” consisting of a person’s physiological, biological, or behavioral characteristics that allow or confirm unique identification, regardless of how it is captured, converted, stored, or shared, that is based on a biometric identifier. Under Illinois Biometric Information Privacy Act (BIPA), Texas Capture or Use of Biometric Identifiers or Biometric Information Act (Texas CUBI), and Washington’s Biometric Privacy Act (BPA), this includes “voiceprints” or “voiceprint templates” derived from voice recordings.

Voice Recordings: raw audio files provided, or to which you provide consent for the provision and use, with any voice-driven features of the Services.

Voiceprint Template / Voice Embedding: a digital representation (“template”) of your unique vocal characteristics (e.g., fundamental frequency, spectral features, embeddings) derived from voice recordings. These are considered Biometric Information under applicable statutes and legislation.

You are not legally required to provide us with any category of personal data and may do so (or avoid doing so) at your own free will. If you do not wish to provide us with your personal data, or to have it processed by us or any of our Service Providers (defined below), please avoid any interaction with us including visiting our Sites or using our Services. If you are a user of the Services on behalf of any of our customers, we suggest that you contact your account administrator with any questions.

Voice Recordings and Biometric Information: we collect and process Biometric Information -specifically, voice data – in two forms:

Raw Voice Recordings (Identifiable Voice Data)

• Audio captured with User Content when voice-driven feature are included within the Services (e.g. speaker recognition with LEXI Toolkit).
• Stored in an identifiable form (hashed and linked to User Data) for up to 30 days.
• We collect raw voice recordings only after you have provided explicit, written consent. Consent is stored with Customer Data.

De-identified Voiceprint Templates / Voice Embeddings (Biometric Templates)

• After the 30-day window, we strip all direct identifiers from raw recordings creating a “de-identified voiceprint.”
• These templates remain regulated as Biometric Information under BIPA, Texas CUBI, and Illinois BPA until they are permanently deleted.
• Retained for up to three (3) years from your last interaction, or sooner if no longer needed.

Important: At no point do we transmit or store your raw voice recording to any third party unless explicitly required for a Service feature you have consented to (e.g., cloud-based speaker recognition). Any third party receiving raw recordings or templates must handle them under the same strict privacy terms described in this Policy.

3. Biometric Data Collection

AI-Media and its partners and providers collect, store, and use Biometric Information / Identifiers, Voice Recordings, Voiceprint Template / Voice Embedding for purposes of providing the service offering whereby Intelligent Speaker Recognition (ISR) (being a technological system that, autonomously or partly autonomously, processes data related to human activities through the use of a genetic algorithm, a neural network, machine learning or another technique in order to generate content or make decisions, recommendations or predictions), is requested by the Customer to be utilized by Ai-Media in connection to the LEXI Text AI Powered Live Automatic Captioning service. Before collecting Biometric Data from any individual, the Company will obtain the individual’s written consent to the collection.

4. Retention and Deletion Schedules

In connection with providing the Services, we retain User Content on our customer’s behalf, in accordance with their reasonable instructions and as further stipulated in our data processing addendum and other commercial agreements with such customer. We also retain Customer Data and de-identified User Content for the purposes of improving our Services and technology, including machine learning by our automatic speech recognition engine.

Please note that except as required by applicable law or our specific agreements with you, we will not be obligated to retain your personal data for any particular period, and we are free to securely delete it or restrict access to it for any reason and at any time, with or without notice to you.

Retention of Identifiable Voice Recordings & Transcription Data (0 – 30 Days)

• Purpose: to allow access to transcripts, verify accuracy and provide quality assurance.
• Storage: raw voice data and any corresponding transcription data that contains direct identifiers are encrypted at rest and accessible only by a minimal set of authorized personnel.

Deletion Timeline

• 30 Days After Recording Date: we purge all direct identifiers from raw recordings, raw recordings transform into de-identified voiceprint templates; transcripts with identifiers are moved to “non-identifiable” storage.
• Earlier Deletion on Request: if you withdraw consent or request deletion before 30 days, we will delete raw voice recordings and any identifiable transcripts within 30 days of your request.

Retention of De-identified Voiceprint Templates (Biometric Data)

• Purpose: enable continuous improvement of our machine learning models, provide voice recognition within specified Services, and conduct aggregated analytics.
• Duration:
  • Retained for up to three (3) years from your last interaction, or sooner if no longer needed (whichever is earlier), in compliance with Illinois BIPA, Texas CUBI, and the BPA.
  • After three years of inactivity or once internal teams confirm “no longer needed” for any legitimate business purpose, these templates are permanently and securely deleted.
• Deletion on Request:
  • If you request deletion of all your data, we will:
    1. immediately delete any remaining identifiable recordings and associated identifiable transcripts.
    2. initiate permanent deletion of de-identified voiceprint templates within 30 days or earlier if no legitimate business use remains.

5. Biometric Information and Consent

Under Illinois BIPA (740 ILCS 14/10), Texas CUBI (Texas Business & Commerce Code § 503), and Washington’s Biometric Privacy Act (RCW 19.375), “Biometric Information” includes “a record of an individual’s voiceprint” and any digital representation of a voice. In our Service, “Biometric Information” means:

1. Raw Voice Recordings
2. Voiceprint Templates, Embeddings, or any numeric/graphical representation derived from those recordings (e.g., spectral features, vector metrics).

Why We Collect Biometric Information

• Speaker Recognition & Personalization: to generate tailored transcriptions and tailored captioning.
• Research & Model Training: to improve speech recognition, creating a better user experience over time.

How We Obtain Consent

Affirmative, Written Consent Required Before Collection: before collecting any voice recording, we will ensure you are aware:

• Which Biometric Information is collected (raw recording; derived voiceprint).
• Why it is being collected (Services, Security, R&D).
• How long it will be stored (30 days for identifiable recordings; up to 3 years for de-identified templates).
• How you can withdraw consent and the consequences of doing so.

Withdrawing Consent

How to Withdraw: email   with subject “Withdraw Biometric Consent.”

What Happens on Withdrawal:

1. 1. We immediately cease collecting any new voice recordings or Transcription Data.
   2. Any identifiable voice recordings and transcription data still within the 30-day window are permanently deleted within 30 days of withdrawal.
   3. De-identified voiceprint templates are deleted within 30 days if no longer needed for any legitimate business purpose.
   4. We will confirm deletion in writing (email).

Third Party Service Providers

These providers:

• Process data only on our instructions.
• Are contractually obligated to maintain confidentiality and cybersecurity measures at least as stringent as ours.
• Are prohibited from using personal, transcription, or biometric data for any purpose other than providing the contracted service.
• We may share aggregated, truly de-identified datasets (no linkage keys remain) with industry partners strictly for research on voice analytics. All data shared in this manner is irreversibly de-identified (no way to re-link to an individual).

5. Data Disclosure

Service Providers: we engage selected third-party companies, sub-processors and individuals to perform services complementary to our own. Such service providers include content review, transcription, voice recognition and translation services, synthetic voice translation, hosting and server co-location services, sub-processing, communications and content delivery networks, API integrations, media hosting and streaming services, data and cyber security services, billing and payment processing services, fraud detection, investigation and prevention services, web analytics, data enrichment, email and communication distribution, monitoring services, call, session or activity recording and analysis services, remote access services, performance measurement, data optimization and marketing services, social and advertising networks, content providers, email, voicemails, support and customer relation management systems, and our legal, financial and compliance advisors (collectively, “Service Providers“). These Service Providers may have access to your personal data, depending on each of their specific roles and purposes in facilitating and enhancing our Services, and may only use it for such limited purposes as determined in our lawful agreements with them.

Ai-Media Subsidiaries and Affiliated Companies: we may share Biometric Data internally within our group, for the purposes described in this Policy. In addition, should AI-Media or any of its affiliates undergo any change in control or ownership, including by means of merger, acquisition or purchase of substantially all or part of its assets, personal data may be shared with or transferred to the parties involved in such an event. If we believe that such change in control might materially affect your personal data then stored with us, we will notify you of this event and the choices you may have via email or a prominent notice on our Services.

6. Biometric Data Security

We and our hosting services implement systems, applications and procedures to secure your Biometric Data, to minimize the risks of theft, damage, loss of information, or unauthorized access or use of information. These measures provide sound industry standard security. However, although we make efforts to protect your privacy, we cannot guarantee that our Services will be immune from any wrongdoings, malfunctions, unlawful interceptions or access, or other kinds of abuse and misuse. To learn more, please visit our Trust Centre.

We implement and maintain industry standard technical, administrative, and physical safeguards to protect your data, including:

• Encryption: all data— Customer Data, User Content, raw Voice Recordings, de-identified templates, transcription data, and usage logs – is encrypted both in transit (TLS 1.2+ / HTTPS) and at rest (AES-256).
• Access Controls & Logging: only a minimal, role-based subset of employees may access identifiable voice data or identifiable transcription data. All access to Personal Information, Biometric Information, and Transcription Data is logged and audited by our security team.
• Secure De-identification Process: Voice Recordings are de-identified in a secure environment; transcripts containing personal information are subject to the retention and destruction within this Policy.
• Vulnerability Management & Penetration Testing: third-party penetration tests; any identified vulnerabilities are remediated within 30 days.
• Incident Response Plan: A documented security incident response playbook governing notifications, root cause analysis, and remediation steps.

Note: No system can be 100 % secure. If you suspect any unauthorized access or misuse of your data, please contact us immediately at cyber..

7. Data Breach Notification

We adhere to all applicable breach notification laws:

U.S. Requirements

• General U.S. Law: we will notify affected individuals “as soon as practicable” and no later than 30 days after confirming a security breach that materially compromises personal information, Transcription Data containing direct identifiers, or Biometric Information.
• State-Specific Rules: additional notice to California residents if their personal information, identifiable transcription data, or biometric data is compromised. If biometric templates or voiceprints are breached, we will notify affected Illinois residents promptly and coordinate with the Illinois Attorney General if required.

EU & GDPR Requirements

For EU residents, if a breach affects personal data (including any Personal Information or transcription containing identifiers), we will notify the relevant Data Protection Authority within 72 hours of becoming aware of the breach and inform affected individuals without undue delay. Notifications will include:

• Description of the breach, including date/time discovered and date/time occurred (if known).
• Types of data involved (e.g., “voiceprint template,” “text transcript containing name,” “email address”).
• Steps taken to contain and remediate.
• Recommendations for users to protect themselves (e.g., reset passwords, monitor accounts).
• Contact information for questions and further assistance.

8. Your Rights & Choices

European Union (GDPR): If you reside in the EU, you have:

• Right of Access: request a copy of any personal data we hold about you (including Account Information, transcription data, and biometric templates).
• Right to Rectification: request correction of inaccurate or incomplete data.
• Right to Erasure (“Right to Be Forgotten”): request deletion of personal data (including transcription data containing direct identifiers and biometric templates) when no longer necessary or if you withdraw consent.
• Right to Restrict Processing: temporarily halt processing under certain circumstances (e.g., accuracy contested).
• Right to Data Portability: receive your data (e.g., your account information and non-identifiable usage logs) in a structured, machine-readable format.
• Right to Object: object to our processing of your data for direct marketing or legitimate interest.
• Right to Withdraw Consent: withdraw any previously granted consent (e.g., for voice recordings).

To exercise these rights, contact us at . We will respond within 30 days (plus one 30-day extension if needed).

California (CCPA): If you are a California resident, you may:

• Know What We Collect: request disclosure of categories of personally identifiable information, Transcription Data, or Biometric Information we have collected, used, or disclosed in the past 12 months.
• Request Deletion: ask us to delete your personal, transcription, or biometric data, subject to certain exceptions (e.g., completing a transaction, detecting security incidents).
• Opt Out of Sale of Data: although we do not “sell” Personal Information, Transcription Data, or Biometric Information as defined by CCPA, you can request a “Do Not Sell My Personal Information” if you believe we are sharing for cross-context advertising or similar.
• Non-Discrimination: we will not discriminate against you for exercising any CCPA rights (e.g., by lowering service quality or charging different prices).

Submit a request via . We will verify your identity (e.g. email verification) and respond within 45 days (may extend another 45 days with notice).

Illinois (BIPA), Texas (CUBI), and Washington BIPA: if you reside in Illinois, Texas, or Washington, you have additional rights regarding Biometric Information:

• Right to Informed Written Consent: we will obtain your detailed, written consent before collecting any biometric data (see Section 4).
• Right to Disclosure: you may request a description of what biometric data (voiceprint templates) we have collected, how it is used and stored, and any third parties with whom it is shared.
• Right to Receive Copies: you may request a copy of any biometric identifiers or templates we hold about you.
• Right to Deletion: you may request that we delete all biometric data if no longer needed for the purpose it was collected (e.g., you have not used the Service in 3 years).

To exercise these rights, email   with subject “Biometric Data Request” and specify which right you wish to exercise. We will comply within 30 days, or sooner if required by state law.

Please note that when you ask us to exercise any of your rights under this policy or applicable law, we may need to ask you to provide us certain credentials to make sure that you are who you claim you are, to avoid disclosure to you of personal data related to others and to ask you to provide further information to better understand the nature and scope of data that you request to access. This would typically include information such as the e-mail address used to identify you in our systems (in which case we might require additional verification steps to ensure that you have access to that e-mail).  Such additional data, along with details and correspondence related to your request, will be then retained by us for legal and compliance purposes.

9. Data Controller / Processor

Certain data protection laws and regulations, such as the EU General Data Protection Regulation (GDPR), UK GDPR or the CCPA, typically distinguish between two main roles for parties processing personal data: the “data controller” (or under the CCPA, “business”), who determines the purposes and means of processing; and the “data processor” (or under the CCPA, “service provider”), who processes the data on behalf of the data controller (or business). Below we explain how these roles apply to our Services, to the extent that such laws and regulations apply.

AI-Media is the “data controller” (or “business”) of AI-Media Website, AI-Media Data, CRM & Event Data. With respect to such data, we assume the responsibilities of data controller (solely to the extent applicable under law), as set forth in this Privacy Policy. In such instances, our Service Providers processing such data will assume the role of “data processor”.

AI-Media is both a “data controller” and “data processor” (or “business” and “service provider”, respectively) of Customer Data. Where we process on behalf of our customer (who is the “data controller” of such data; and our Service Providers who process such AI-Media Customer Data on our behalf are the “sub-processors” of such data), we are a ‘processor.’ Where we process such data for our own processes, namely to improve the Services and our technology, we are a ‘controller.’

AI-Media is both a “data controller” and “data processor” (or “business” and “service provider”, respectively) of Ai-Media User Data. Such data is processed by AI-Media for its own purposes, as an independent ‘controller’; while those certain portions of it which are included in Customer Data will be processed by us on our customer’s behalf, as a ‘processor’.

Accordingly, where it is providing the Services, AI-Media processes User Content and  Customer Data in accordance with our customer’s reasonable instructions and as further stipulated in our data processing addendum and other commercial agreements with such customer. Each customer, as the controller (or business) of their Customer Data, is solely responsible for meeting any legal requirements applicable to data controllers or businesses. This includes establishing a legal basis for proceeding and providing adequate notice to data subjects whose data may be contained in Customer Data – including sufficient reference to the processing of their personal data via the Services, and any other information necessary to comply with all applicable privacy and data protection laws; and to obtain all approvals and consents from such individuals as required under such laws.