Sincoole Global Privacy Policy (Including EU GDPR Compliance)

I. Introduction

• EU General Data Protection Regulation (GDPR)
• China's Personal Information Protection Law, Cybersecurity Law, Data Security Law
• U.S. California Consumer Privacy Act (CCPA/CPRA), FCC Privacy Standards
• India's Digital Personal Data Protection Act and BIS Certification Privacy Requirements
• Brazil's General Data Protection Law (LGPD)
• Local privacy regulations of other countries/regions where our business operates

II. Legal Bases for Data Processing (Pursuant to GDPR Article 6)

1. Consent: Explicit, voluntary and specific consent given by Users (e.g., checking the consent box, written confirmation), applicable to scenarios such as marketing communications and collection of non-essential information. Consent can be withdrawn at any time.
2. Performance of a Contract: Processing of necessary information to fulfill purchase contracts, cooperation agreements with Users, such as order processing, product delivery, technical support, etc.
3. Compliance with a Legal Obligation: Processing of information to comply with national laws, regulations and regulatory requirements (e.g., tax declaration, import and export compliance, product certification and filing).
4. Legitimate Interests: Processing of information for legitimate business purposes such as optimizing product performance, improving service quality and preventing security risks, provided that such processing does not undermine User rights and interests (a balancing test will be conducted).
5. Vital Interests: Emergency processing of information to protect the life, property and other major legitimate rights and interests of Users or others (e.g., product safety recall notifications).

III. Scope and Methods of Information Collection

(I) Personal Data (Pursuant to GDPR Definition)

1. Identity and Contact Data: Name, gender, contact information (phone number, email address, postal address, postcode), position of corporate contact person, passport/visa information (for cross-border delivery), collected through User registration, order submission, cooperation negotiations, etc.
2. Account Data: Username, password (stored in encrypted form), account login records, permission settings, provided voluntarily by Users when registering an account.
3. Product Usage Data:
   • Device activation code, hardware serial number, usage logs (power-on duration, function call records, battery status, error codes);
   • Technical support communication records (including text, voice, image and other feedback information);
   • Usage data of specialized functions such as sunlight-readable displays and glove touch control, automatically collected through built-in product sensors and backend systems.
4. Location Data: Only collect the approximate location of the device after obtaining User authorization (for customized scenarios such as outdoor scientific research and logistics tracking), which can be disabled at any time.

(II) Corporate/Organizational Data

• Corporate name, unified social credit code, registered address, business scope, tax registration certificate information;
• Purchase orders, cooperation agreements, project requirement documents, technical parameter requirements;
• Industry application scenario data (e.g., logistics and warehousing scale, number of equipment on production lines, department configuration of medical institutions), collected through cooperation negotiations, order docking, demand research, etc.

(III) Anonymized/De-identified Data (Non-Personal Data)

(IV) Customized Service-Related Data

• Business requirement documents, scenario environment parameters (temperature, humidity, dust concentration, etc.);
• Industry-specific data format requirements and interface protocol standards, collected through User voluntary provision or demand research.

(V) Explanation of Collection Methods

1. Voluntary Provision by Users: Account registration, order submission, filling out questionnaires, contacting customer service, etc.;
2. Automatic Collection: Collected through technical means such as built-in product sensors, website Cookies/SDKs, and backend server logs (a separate Cookie Notice will be provided);
3. Third-Party Assisted Collection: After obtaining User consent, necessary data is obtained from third parties such as logistics service providers, payment institutions, and certification bodies (third parties are required to provide data compliance certificates).

IV. Purposes of Information Use

1. Fulfill contract obligations: Order processing, product production and cross-border delivery, installation and commissioning, after-sales maintenance, invoice issuance;
2. Product R&D and optimization: Iterate hardware design (e.g., enhance the performance of shockproof magnesium alloy frames) and optimize software systems (e.g., improve 5G/Wi-Fi 7 connection stability) based on usage data;
3. Realize customized services: Develop special modules and adapt to industry software according to User needs (e.g., medical data collection complies with HIPAA standards);
4. Security guarantee: Prevent risks such as account theft, device tampering, and cyber attacks, and troubleshoot product faults;
5. Compliance and auditing: Comply with national import and export regulations, tax requirements, and product certification standards (e.g., CE, FCC, BIS certification and filing);
6. Marketing communications: Only send product updates, industry trends, preferential activities and other information after obtaining explicit User consent, which can be withdrawn at any time.

V. Data Sharing and Disclosure

1. Obtain Explicit User Consent: Before sharing, explain the sharing object, purpose and scope to Users, and obtain written or electronic confirmation.
2. Third-Party Service Providers (Data Processors):
   • Only share with third parties necessary to fulfill contracts (e.g., logistics service providers for product delivery, payment institutions for fund settlement, certification bodies for product compliance testing);
   • Sign Data Processing Agreements (DPA) with all third-party service providers in accordance with GDPR Article 28, clarifying data protection obligations, processing rights and liability division, and regularly auditing third-party compliance.
3. Legal and Regulatory Requirements: Disclose necessary information in accordance with legal subpoenas and mandatory orders from judicial authorities and administrative regulatory bodies to cooperate with law enforcement investigations.
4. Corporate Restructuring and Mergers and Acquisitions: In the event of business adjustments such as mergers, acquisitions, and bankruptcy liquidation, data will be transferred as legal assets to the successor entity, which shall continue to fulfill the privacy protection obligations stipulated in this Policy and notify Users in advance.
5. Protect Legitimate Rights and Interests: Disclose information within a reasonable and necessary scope to protect the legitimate rights and interests of Users, Sincoole or the public (e.g., reporting fraudulent activities, product safety recalls).

VI. Cross-Border Data Transfer (Pursuant to GDPR Articles 44-50)

1. Transfer Premises: Cross-border transfer will only be conducted if any of the following conditions are met:
   • The receiving country/region is recognized by the European Commission as an "adequate country/region" (e.g., Canada, Japan, New Zealand);
   • Sign EU Standard Contractual Clauses (SCCs, 2021 version) with the receiving party;
   • The receiving party has passed GDPR certification or meets equivalent data protection standards (e.g., U.S. Privacy Shield replacement framework, India BIS data protection requirements);
   • Obtain explicit User consent and adopt security measures such as encrypted transmission.
2. Security Guarantee: Cross-border transmission adopts SSL/TLS 1.3 encryption technology, establishes data transmission audit logs, and regularly verifies the integrity of transmitted data.
3. Compliance Declaration: If it involves transferring personal data of EU residents to countries/regions outside the EU, we will complete a Data Protection Impact Assessment (DPIA) in accordance with GDPR requirements and file with relevant regulatory authorities.

VII. Data Storage and Retention

1. Storage Method: Adopt encrypted storage (data transmission encryption, static storage encryption), stored on servers certified to ISO 27001 information security standards (including self-built servers and compliant third-party cloud service providers such as AWS and Alibaba Cloud International Edition).
2. Retention Period: Only retain data for the shortest period necessary to achieve the purpose:
   • Personal data: Retained for 5 years after order completion (for after-sales support and compliance auditing), automatically encrypted and deleted after the expiration of the retention period;
   • Corporate cooperation data: Retained for 7 years after the termination of cooperation (in line with tax and contract dispute statute of limitations requirements);
   • Anonymized data: Can be retained for a long time for product R&D, but shall not be reversely restored to personal data.
3. Deletion Mechanism: After the expiration of the data retention period, adopt a dual method of "physical deletion + logical deletion" to ensure that data cannot be recovered; if a User requests deletion, it will be completed within 1 month after verifying the identity (complex cases can be extended to 3 months, with a written explanation required).

VIII. Data Subject Rights (Pursuant to GDPR Articles 15-20)

1. Right of Access: The right to inquire about the collection, use, storage and sharing of their own personal data, and request the provision of data processing records;
2. Right to Rectification: The right to request timely correction if personal data is inaccurate or incomplete;
3. Right to Erasure ("Right to be Forgotten"): The right to request the erasure of personal data in the following circumstances:
   • The data is no longer necessary for the agreed purpose;
   • Consent is withdrawn and there is no other legal basis for processing;
   • Object to data processing and there is no overriding legitimate interest;
   • Data processing violates laws and regulations;
4. Right to Restriction of Processing: The right to request the restriction of the processing of personal data (e.g., when the accuracy of the data is in dispute);
5. Right to Data Portability: The right to request the provision of their own personal data in a structured, commonly used and machine-readable format, or to request the transfer of data to another data controller;
6. Right to Object: The right to object to the processing of personal data based on "legitimate interests" and to object to its use for direct marketing (including personalized recommendations);
7. Right to Withdraw Consent: The right to withdraw previously given consent at any time (through account settings, contacting customer service, etc.). Withdrawal does not affect the legality of data processing based on consent before withdrawal;
8. Right to Lodge a Complaint: If it is believed that the data processing behavior violates GDPR or local privacy regulations, the right to lodge a complaint with the EU Data Protection Authority (DPA) or the privacy regulatory authority of the country/region where the User is located.

Methods of Exercising Rights

IX. Data Protection Measures

1. Technical Guarantee:
   • Data transmission adopts SSL/TLS 1.3 encryption, and storage adopts AES-256 encryption;
   • Deploy firewalls, Intrusion Detection Systems (IDS), Data Loss Prevention (DLP) tools to prevent cyber attacks;
   • Product hardware adopts shockproof magnesium alloy frames and corrosion-resistant coatings to ensure the security of built-in data storage;
   • Conduct regular penetration testing and vulnerability scanning.
2. Organizational Guarantee:
   • Appoint a Data Protection Officer (DPO) to supervise the compliance of data processing (if required);
   • Establish a hierarchical authorization system for data processing, only authorizing necessary personnel to access sensitive data;
   • Regularly conduct GDPR, local privacy regulations and data security training for employees, and sign confidentiality agreements.
3. Compliance Certification: Products and data processing systems have passed international certifications such as 3C, FCC, CE, and BIS, complying with global information security standards.
4. Data Breach Notification: In the event of a personal data breach, relevant regulatory authorities (such as EU DPA) will be notified within 72 hours; if the breach may have a significant impact on User rights and interests, affected Users will be notified in a timely manner and remedial measures will be taken.
5. Data Protection Impact Assessment (DPIA): Conduct DPIA in advance for high-risk data processing activities (e.g., large-scale cross-border data transmission, processing of sensitive data in customized services) to assess risks and take mitigation measures.

X. Use of Cookies and Similar Technologies

1. Necessary Cookies: Used for core functions such as website login verification and page navigation, no need for User consent, and cannot be disabled;
2. Functional Cookies: Used to record User browsing preferences and save login status, enabled only after obtaining User consent;
3. Analytical Cookies: Used to count website traffic and optimize page layout, enabled only after obtaining User consent;
4. User Control: Users can enable/disable Cookies or delete stored Cookies through browser settings (disabling some Cookies may cause some website functions to not work properly).

XI. Policy Updates and Notifications

1. This Policy will be updated in a timely manner in accordance with changes in laws and regulations, business development needs and technological updates. The updated Policy will be publicly posted in a prominent position on the website, with the public announcement date as the effective date of the update;
2. If the updated content involves core data processing rules (e.g., expanding the scope of collection, changing the legal basis, adjusting the cross-border transmission mechanism), Users will be actively notified through email, SMS and other methods. Continuing to use our products and services will be deemed as consent to the updated Policy;
3. After the Policy is updated, historical versions will be retained for User inquiry (retention period of not less than 5 years).

XII. Dispute Resolution and Jurisdiction

1. If Users have objections to the implementation of this Policy, they may first try to resolve it through negotiation with us;
2. If negotiation fails, EU Users may lodge a complaint with the data protection authority of the member state where they are located; Users from other regions may lodge a complaint with the relevant data protection regulatory authority in Shenzhen, China, or resolve it through arbitration or litigation;
3. The interpretation and application of this Policy shall prioritize the privacy regulations of the country/region where the User is located. In the absence of clear provisions, Chinese law shall apply.

XIII. Contact Information

• Company Name: Shenzhen Sincoole Information Co., Ltd. (Shenzhen Sincoole Co., Ltd.)
• Data Protection Officer Contact Information:
  • Phone: +86 0755-2302 3855
  • Email: marketing-01@sincoole.com (marked "Privacy Protection Inquiry")
• Company Address: Shenzhen, Guangdong Province, China (detailed address can be obtained through phone inquiry)