1. Information Collection and Use

We follow the principles of lawfulness, legitimacy and necessity, and collect and use your personal information for the purposes set forth in this Policy, including information you actively provide, information generated from your use of products and/or services, and information obtained from third parties. If we need to use your personal information for any other purpose not specified in this Policy, or use information collected for a specific purpose for other purposes, we will inform you in a reasonable manner and obtain your consent again before such use.

Circumstances for Collection and Use of Personal Information

Our products and/or services include core functions essential to the operation of Hi-Service. We may collect, store and use the following information about you to realize these functions. If you do not provide the relevant information, you will not be able to enjoy the products and/or services we provide.

1.1 Information You Provide Directly

When you register an account, complete your profile, use after-sales functions or contact us, we may collect:

• Email address (if you choose to provide)
• Email verification code data (if you choose to provide)
• Password or password-related credential data
• Full name (if you choose to provide)
• Phone number (if you choose to provide)
• Language preference
• Street, house number, postal code, city and country/region (if you choose to provide)
• Group-related images (e.g. photos associated with device groups, if you choose to upload)
• After-sales service request details and related communication records

1.2 Device, Service and Operation Data

When you bind and use devices through the Application, we may collect:

• Device identification and binding information, such as device ID and account-device association information
• Device metadata and configuration information, such as device name, room or group settings, and time zone
• Device status and operation data, such as on/off status, operation mode, temperature, supported humidity data, and other functional parameters reported by the device
• Control command data, such as commands issued through the Application, scene settings, automation settings, and schedule settings
• Energy-related data, such as supported power consumption and energy statistics
• Fault, alarm and diagnostic data, such as device error codes and technical logs required for troubleshooting and service assurance
• Room, group, member and sharing data, such as invitation records, shared access records, role or permission settings, and authorized member identifiers
• Application interaction and service operation records required for service provision, security maintenance and troubleshooting support

Please understand that our products and/or services will be continuously updated and developed. If you choose to use other products and/or services not listed in this Policy, we will explain the purpose, method and scope of information collection in detail through agreements, page prompts, etc. and obtain your consent before collecting your personal information. If you do not agree to provide the aforementioned information, you may be unable to use such product and/or service, but it will not affect your use of existing products and/or services.

2. Information Sharing, Entrusted Processing, Transfer and Public Disclosure

(1) Sharing

We will not share your personal information with any company, organization or individual outside Qingdao Hisense Hitachi Air-conditioning Systems Co., Ltd., except in the following circumstances:

1. Prior explicit consent or authorization from you is obtained;
2. Required to be provided in accordance with mandatory requirements of laws and regulations, administrative and judicial authorities;
3. Sharing is necessary for the conclusion and performance of a contract to which you are a party;
4. Sharing your personal information is the only way to realize the core functions of our products and/or services or provide the services you need;
5. Handling disputes or controversies between you and others at your request;
6. Provided in accordance with relevant agreements signed with you (including electronically signed online agreements and corresponding platform rules) or other legal documents;
7. Used for social and public interests and public health emergencies in compliance with laws and regulations.

(2) Entrusted Processing

We may entrust authorized partners to process your personal information in order to provide you with corresponding products or services. However, we will only share your personal information for lawful, legitimate, necessary, specific and clear purposes, and will only share the personal information necessary to provide the products or services. If our partners use your personal information for purposes not entrusted by us, they shall separately obtain your consent.

Our partners include the following types:

1. Technology service providers. We may provide your personal information to third parties that support our functions, including suppliers providing infrastructure technology services, data analysis services and data processing services.
2. Advertising and analysis service partners. We will comply with laws, regulations and industry-standard security technologies, and entrust these partners to process information related to advertising delivery, coverage and effectiveness.

For the entrusted processing of personal information by our partners, we will sign data protection agreements with them, requiring them to process personal information in accordance with the agreements, this Policy and relevant laws and regulations. To ensure that data is safe and controllable with third parties, we have launched the Yunding Service, which provides a safe and reliable cloud environment for data use and storage to ensure the security of user data.

(3) Transfer

If personal information needs to be transferred due to merger, division, dissolution, declared bankruptcy or other reasons, we will inform you of the name and contact information of the recipient, and require the company or organization receiving your personal information to continue to be bound by this Privacy Policy. Otherwise, we will require the company or organization to seek your authorization and consent again.

(4) Public Disclosure

We will only publicly disclose your personal information under the following circumstances and on the premise of adopting industry-standard security protection measures:

1. Disclose corresponding personal information within the scope of authorization based on your separate consent;
2. If you seriously violate laws and regulations or relevant agreements and rules, we may disclose your relevant violations and the measures we have taken against you.

3. Information Storage and Protection

(1) Storage of Your Personal Information

1. In principle, we will store personal information of users collected within the territory of China in accordance with the provisions of laws and regulations.
2. We will only conduct cross-border transmission (including remote access) of your personal information on the premise of legality and compliance. If the transmission is not subject to an adequacy decision or regulatory constraints, we will take appropriate measures to ensure that recipients of your personal information perform confidentiality obligations and implement appropriate measures to protect your personal information in accordance with this Privacy Policy and applicable laws. For example, necessary de-identification processing, encrypted transmission, regular evaluation and audit of the security capability of recipients, and signing data processing agreements/clauses.
3. We will only retain your personal information for as long as necessary to achieve the purposes described in this Policy, unless applicable laws and regulations impose a mandatory retention period. After the retention period expires, we will delete your personal information or anonymize it in accordance with the requirements of applicable laws.
4. If we terminate our services or operations, we will notify you at least 30 days in advance, and delete or anonymize your personal information after the termination of services or operations.

(2) Technologies and Measures for Protecting Your Personal Information

We attach great importance to personal information security and take all reasonable and feasible measures to protect your personal information.

1. Technical Measures for Data Security

We will adopt industry-standard security protection measures, including establishing reasonable institutional norms and security technologies, to prevent your personal information from unauthorized access, use and modification, and to avoid data damage or loss. For example:

• We adopt transport layer security encryption technology and provide browsing services through HTTPS to ensure the security of user data during transmission;
• We adopt encryption technology to encrypt and store user personal information, and isolate it through isolation technology;
• When using personal information, we adopt various data desensitization technologies including content replacement and SHA-256 to enhance the security of personal information in use.

2. Other Security Measures for Personal Information Protection

We manage and standardize the storage and use of personal information by establishing a data classification and grading system, data security management specifications, and data security development specifications. We conduct comprehensive security control over data through confidentiality agreements for information contacts, monitoring and audit mechanisms. We have established a data compliance management committee with a dedicated information protection department and a data security emergency response organization to promote and ensure personal information security.

We only allow employees and partners who have a need to know such information to access personal information, and have set up strict access permission control and monitoring mechanisms for this purpose. We also require all personnel who may have access to your personal information to perform corresponding confidentiality obligations.

The Internet is not an absolutely secure environment, and communication methods such as email, instant messaging and social networking software cannot be confirmed as fully encrypted. We recommend that you use complex passwords when using such tools and pay attention to protecting the security of your personal information. When conducting online product and/or service transactions with third parties through Qingdao Hisense Hitachi Air-conditioning Systems Co., Ltd., you will inevitably disclose your personal information to the counterparty or potential counterparty, such as contact information or postal address. Please properly protect your own personal information and only provide it to others when necessary.

3. Security Incident Handling

To address possible risks such as personal information leakage, damage and loss, we have formulated multiple systems to clarify the classification and grading standards of security incidents and vulnerabilities and corresponding handling procedures. We have also established a dedicated emergency response team for security incidents, which activates security plans for different security incidents in accordance with security incident handling specifications, to conduct damage control, analysis, positioning, formulate remedial measures, and cooperate with relevant departments for traceability and crackdown.

In the event of a personal information security incident, we will promptly inform you of the following in accordance with the requirements of laws and regulations: the basic situation and possible impact of the security incident, the measures we have taken or will take, suggestions for you to independently prevent and reduce risks, and remedial measures for you. At the same time, we will timely inform you of the relevant situation of the incident by email, letter, telephone, push notification or other means. Where it is difficult to inform each individual information subject one by one, we will issue a notice in a reasonable and effective manner. We will also proactively report the handling of the personal information security incident in accordance with the requirements of regulatory authorities.

If you have any questions about our personal information protection, you may contact us through the contact information specified in this Privacy Policy. If you find that your personal information has been leaked, especially your account and password, please contact us immediately through the contact information specified in "Section 7 Contact Us" of this Privacy Policy so that we can take corresponding measures.

4. User Rights

We attach great importance to your concerns about personal information and make every effort to protect your rights to access, correct, delete and withdraw consent regarding your personal information, so that you have full ability to protect your privacy and security. Your rights include:

• Right of access to your personal data
• Right to rectification of inaccurate or incomplete personal data
• Right to request erasure of your personal data
• Right to restriction of processing under certain circumstances
• Right to object to processing based on legitimate interests under certain circumstances
• Right to data portability (where applicable)
• Right to withdraw consent at any time where processing is based on consent
• Right to lodge a complaint with the competent supervisory authority

To exercise your rights, please contact: syshhgcss@hisensebosch.com We may need to verify your identity before processing your request.

5. Protection of Minors' Personal Information

1. We attach great importance to the protection of minors' personal information. If you are a minor under the age of 18, you shall obtain the consent of your guardian before using our products and/or services. We protect minors' personal information in accordance with relevant national laws and regulations.
2. We will not actively and directly collect personal information from minors. For the collection of minors' personal information with the consent of guardians, we will only use, share, transfer or disclose such information to the extent permitted by law, agreed by guardians or necessary for the protection of minors.
3. If there is evidence that a minor has registered and used our products and/or services without the consent of a guardian, we will consult with the relevant guardian and seek to delete the relevant personal information as soon as possible.
4. For personal information of children under the age of 14 that may be involved, we further adopt the following measures for protection:
   1. For collected children's personal information, in addition to complying with the provisions of this Policy on user personal information, we will follow the principles of legitimacy and necessity, informed consent, clear purpose, security guarantee and lawful use, strictly abide by the requirements of laws and regulations such as the Provisions on the Network Protection of Children's Personal Information for storage, use and disclosure, and will not exceed the period necessary to achieve the purpose of collection and use. Upon expiration, we will delete or anonymize children's personal information.
   2. When you, as a guardian, choose to use our related services for the child under your guardianship, we may need to collect the child's personal information from you as necessary to perform relevant services for you. Where collection of children's personal information from you is required in specific services, we will obtain your authorization and consent in advance and inform you of the purpose and use of the collection. If you do not provide the aforementioned information, you will not be able to enjoy the related services we provide.
   3. Children or their guardians have the right to access and correct the children's personal information at any time, and may also request correction and deletion from us. If you have any opinions, suggestions, complaints or reports regarding matters related to children's personal information, please contact us. We will provide assistance for you at any time.

6. Notification and Revision

1. To provide you with better services and with the development of our business, this Privacy Policy will be updated accordingly. However, without your explicit consent, we will not reduce the rights you are entitled to under this Privacy Policy. We will issue the updated version and remind you of the update of relevant content through website announcements or other appropriate means before it takes effect, so that you can keep abreast of the latest privacy policy.
2. For major changes, we will also provide more prominent notices (we will explain the specific changes to the privacy policy through means including but not limited to email, SMS or special prompts on the browsing page).

   Major changes referred to in this Privacy Policy include but are not limited to:

   1. Major changes in our service model. Such as the purpose of processing personal information, the type of personal information processed, the way personal information is used, etc.;
   2. Major changes in our ownership structure, organizational structure, etc. Such as owner changes caused by business adjustment, bankruptcy, merger and acquisition, etc.;
   3. Major changes in the main objects of personal information sharing, transfer or public disclosure;
   4. Major changes in your rights to participate in personal information processing and the ways to exercise such rights;
   5. When the department responsible for personal information security, contact information and complaint channels change;
   6. When the personal information security impact assessment indicates high risks.
3. We will also archive previous versions of this Privacy Policy for your inspection.
4. To ensure that you receive notifications in a timely manner, we recommend that you notify us promptly when your contact information is updated. If you continue to use our services after the updated Policy takes effect, it means that you have fully read, understood and accepted the revised Policy and are willing to be bound by the revised Policy. We encourage you to review this Policy every time you use our services. You may view this Policy through [access path example: "Me – Account Settings – About – Privacy Policy"].

7. Contact Us