Privacy Policy for Kids Color Art

1. Responsible Entity The responsible entity (controller) for the collection, processing, and use of your personal data is: Neutik GmbH Bahnhofplatz 10 8853 Lachen Switzerland info@neutik.ch For any question concerning this privacy policy or the processing of your personal data, you can reach us at info@neutik.ch.

2. Applicable Data Protection Law Neutik GmbH is a company domiciled in Switzerland. Our processing of personal data is therefore governed in the first instance by the revised Swiss Federal Act on Data Protection (nFADP/nDSG) and its implementing ordinance. Where we offer our services to users in the European Economic Area, the EU General Data Protection Regulation (GDPR) applies in addition. Where this policy cites a legal basis under Article 6 of the GDPR, that citation applies to users covered by the GDPR. Under Swiss law, we process personal data where this is necessary for the performance of a contract with you, where you have consented, where we are subject to a legal obligation, or where we have an overriding legitimate interest (Art. 30 f. nFADP). Where both laws apply, we apply the standard that offers you the greater protection.

3. Collection and Storage of Personal Data and the Nature and Purpose of Their Use a) When Visiting the Website When you access our web app Kids Color Art, the browser used on your device automatically sends information to the server of our website. This information is temporarily stored in a so-called log file. The following information is collected without your intervention and stored until automated deletion: IP address of the requesting computer, date and time of access, name and URL of the accessed file, website from which the access occurred (referrer URL), browser used, and possibly the operating system of your computer as well as the name of your access provider. We process the mentioned data for the following purposes: ensuring a smooth connection to the website, ensuring a comfortable use of our web app, evaluating system security and stability, and for other administrative purposes. The legal basis for this processing is our overriding legitimate interest under Art. 31 nFADP and, for users covered by the GDPR, Article 6(1)(f) of the GDPR. Under no circumstances do we use the collected data to draw conclusions about your person. b) When Using the Web App or a Kiosk Terminal When using Kids Color Art to create personalized coloring pages, we collect the following personal data: the photo you upload, your email address (if you provide it), your order and payment data, and other information you voluntarily provide to us. The collection of this data is carried out to enable you to use the service, to process your order and your inquiries, and to correspond with you. Data processing is carried out at your request and is necessary for the performance of the contract with you (Art. 31(2)(a) nFADP; Article 6(1)(b) of the GDPR).

4. How Your Photo Is Processed We want to be transparent about what technically happens to an uploaded photo, because we know this is the question parents care about most. When you upload a photo, an automated process locates the face in the image and measures the geometric position of its outline points (for example the position of the eyes, nose, and jawline). These measurements are used for one purpose only: to correctly position, scale, and blend the face into a pre-drawn hero template, and to convert the result into a line drawing you can color in. Specifically, we wish to make the following clear: - The uploaded photo is not used for biometric identification. We do not create a biometric profile or template, we do not compare your photo against any database, and we do not use it to recognize or identify any person. - No generative AI model creates a new likeness of the person in the photo. The result is a line drawing derived from the photo you supplied and a pre-existing hero template. - Uploaded photos are never used to train AI models, and never used for marketing or advertising. - The geometric measurements described above exist only in memory for the duration of the processing and are not stored as a separate profile.

5. Processing of Photos by Cutout.Pro We use the image-processing service Cutout.Pro, provided by WINROAD HOLDINGS LIMITED, for the technical isolation of faces and detection of facial outlines. When a user uploads a photo to create a personalized coloring page, the photo is transmitted to Cutout.Pro through an encrypted SSL/TLS connection. This transmission occurs exclusively to isolate the face or its outline from the uploaded photo and return the data required for further image processing to our system. The face is then scaled using standard image-editing software and placed onto a pre-drawn design template. This process creates the completed coloring page and a watermarked preview. No biometric identification takes place. The face is not compared with other people or databases. No new likeness of the person is created by a generative AI model. According to Cutout.Pro, transmitted photos are used exclusively to perform the requested image-processing service. The transmission is encrypted. Cutout.Pro uses infrastructure provided by Amazon Web Services for parts of the technical processing. The photos may be temporarily cached during processing. According to Cutout.Pro, facial photos are automatically deleted within 24 to 48 hours after the most recent editing operation. The transmitted photos are not used to train AI models, for advertising purposes, or for any purpose unrelated to the requested image processing. Only the image data required for face isolation and outline detection is transmitted to Cutout.Pro. Payment details, order information, contact details, and login information are not transmitted together with the photo. Processing by Cutout.Pro is technically necessary to create the requested personalized coloring page. Without this processing, this function cannot be provided.

6. Photos of Children Our service is designed to be used by adults, including on behalf of their children. The contract, the user account, and the order (both online and at a kiosk terminal) must be concluded by an adult. Children may use the service under the supervision and with the consent of their parents or legal guardians. When a photo of a child is uploaded, the person uploading it confirms that they are authorized to do so and that the necessary consent has been obtained, either as a legal guardian or with the permission of the legal guardians. We treat photos of children with particular care: - They are processed exclusively to create the coloring page that was ordered. - They are never used for marketing, advertising, or the training of AI models. - At kiosk terminals, original photos are not stored permanently. They are deleted immediately after the coloring page has been produced, and in any event no later than 15 minutes after completion or cancellation of the session. - Access to uploaded photos is restricted to what is technically necessary to provide the service. If you believe a photo of your child has been uploaded without the necessary authorization, please contact us at info@neutik.ch and we will delete it without delay.

7. Data Disclosure and Processors Your personal data will not be transmitted to third parties for purposes other than those listed below. We will only disclose your personal data to third parties if: - You have given your explicit consent (Article 6(1)(a) of the GDPR), - Disclosure is necessary for the establishment, exercise, or defense of legal claims, and there is no reason to believe that you have an overriding legitimate interest in not disclosing your data (Article 6(1)(f) of the GDPR), - There is a legal obligation for disclosure (Article 6(1)(c) of the GDPR), or - It is legally permissible and necessary for the performance of contractual relationships with you (Article 6(1)(b) of the GDPR). In addition, we use carefully selected service providers who process personal data on our behalf and strictly according to our instructions (processors within the meaning of Art. 9 nFADP and Article 28 of the GDPR). These providers support us with hosting and infrastructure, image processing, payment processing, sending emails, and user authentication. They are contractually bound to confidentiality and to appropriate technical and organizational security measures, and they may not use the data for their own purposes. Some of these providers process data outside Switzerland and the European Economic Area. Where a country does not offer an adequate level of data protection, we secure the transfer by appropriate safeguards, in particular the Standard Contractual Clauses recognized by the FDPIC and the European Commission (Art. 16 f. nFADP; Article 46 of the GDPR). You can request further information about the providers used and the safeguards in place at info@neutik.ch.

8. Cookies We use cookies on our site. These are small files that your browser creates and stores on your device (laptop, tablet, smartphone, etc.) when you visit our site. Cookies do not damage your device and do not contain viruses, trojans, or other harmful software. We currently use only cookies that are strictly necessary to provide the service you have requested: - A session cookie, which keeps you signed in and preserves your progress while you use the web app. It is deleted when your session ends. - A cookie that records your choice regarding this cookie notice, so that we do not ask you again on every visit. We do not currently use analytics, tracking, advertising, or profiling cookies, and we do not embed third-party tracking technologies for these purposes. The strictly necessary cookies described above are used to provide a service you have expressly requested and, on that basis, do not require your prior consent. Should we introduce analytics or other non-essential cookies in the future, we will obtain your consent in advance, and you will be able to refuse or withdraw that consent at any time without any disadvantage. Most browsers automatically accept cookies. However, you can configure your browser to prevent cookies from being stored or to display a notification before a new cookie is created. Disabling cookies completely may result in you not being able to use all the functions of our website.

9. Your Rights Under Swiss data protection law you have, in particular, the following rights: - The right to information (Art. 25 nFADP): you may request confirmation as to whether we process personal data about you and, if so, receive the information necessary to enable you to assert your rights, including the data itself, the purpose of processing, the retention period, the origin of the data, any automated individual decision-making, and the recipients to whom data is disclosed. - The right to have inaccurate data corrected (Art. 32(1) nFADP). - The right to request the deletion of your data or that processing cease, and to object to processing (Art. 32(2) nFADP). - The right to data portability: to receive the personal data you have provided to us in a common electronic format, or to have it transferred to another controller (Art. 28 nFADP). If the GDPR applies to you, you additionally have the right to request information (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), and data portability (Article 20), the right to object (Article 21), and the right to withdraw consent you have given us at any time with effect for the future (Article 7(3)). To exercise any of these rights, an email to info@neutik.ch is sufficient. We may need to verify your identity before responding, in order to ensure that we do not disclose your data to another person. Supervisory authority: if you believe that our processing of your personal data infringes data protection law, you may report the matter to the Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland (www.edoeb.admin.ch). Users covered by the GDPR may in addition lodge a complaint with the supervisory authority of their habitual residence or place of work (Article 77 of the GDPR).

10. Right to Object Where your personal data is processed on the basis of our legitimate interests, you have the right to object to that processing if there are grounds arising from your particular situation, or where the objection is directed against direct marketing. In the latter case, you have a general right to object, which we will implement without you having to specify a particular situation. If you wish to exercise your right of withdrawal or objection, an email to info@neutik.ch is sufficient.

11. Data Security and Breach Notification We use the widely used SSL/TLS procedure in conjunction with the highest level of encryption supported by your browser during the website visit. You can recognize whether a page of our website is encrypted by the closed lock symbol displayed by your browser. In addition, we use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments. If a breach of data security occurs that is likely to result in a high risk to your personality or fundamental rights, we will notify the Swiss Federal Data Protection and Information Commissioner (FDPIC) as soon as possible in accordance with Art. 24 nFADP, and we will inform you where this is necessary for your protection or where the FDPIC requires it. Where the GDPR applies, we will additionally comply with the notification obligations under Articles 33 and 34 of the GDPR.

12. Storage Duration We store your personal data only as long as necessary to achieve the purposes stated in this privacy policy or as required by retention periods prescribed by law. After the purpose ceases to apply or the periods expire, the relevant data will be routinely deleted or anonymized. In particular: - Photos uploaded at a kiosk terminal are deleted immediately after the coloring page has been produced, and in any event no later than 15 minutes after completion or cancellation of the session. - Coloring pages generated through a user account remain available in your profile so that you can download them again, until you delete them or your account. - Order and payment records are retained for as long as required by applicable commercial and tax law. You can request the deletion of your account and the associated data at any time at info@neutik.ch.

13. Changes to This Privacy Policy This privacy policy is currently valid and has the status of August 14, 2026. Due to the further development of our website and offers, or due to changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. The most current version can be accessed and printed at any time on our website at kidscolorart.com/privacy.

14. Contact For questions regarding the collection, processing, or use of your personal data, requests for information, correction, or deletion of data, as well as withdrawal of consents given or objection to a specific data use, please contact: Neutik GmbH Bahnhofplatz 10 8853 Lachen Switzerland info@neutik.ch This privacy policy was last updated on August 14, 2026.