Hangzhou CMR Magnetics Co., Ltd. (hereinafter referred to as “we”, “CMR” or “the Company”) has always regarded user privacy protection as the core principle of business operations. We sincerely appreciate your trust and support for the Company’s magnetic material products and related services.

This Privacy Policy aims to clearly explain the collection, use, storage, protection and other related matters of your personal information when you use CMR’s official website, product consulting, after-sales service and other scenarios, and at the same time clarify the information rights and interests you enjoy and the ways to exercise them. Please carefully read this policy before providing personal information and conduct subsequent operations only after fully understanding it.

If you do not agree with the personal information processing methods described in this policy, please do not submit personal information to us or stop using related services. Your continued use of CMR’s website and services indicates that you have fully understood and agreed to our processing of your personal information in accordance with this policy.

In view of the industry-specific nature of CMR’s product system and service scenarios (such as customized demand docking, sample delivery, after-sales technical support, etc.), this policy is a general specification. For personalized information processing needs of specific products or services, we will formulate special privacy statements separately, which shall prevail at that time.

1. Scope of Personal Information We Process

Personal information refers to various types of information recorded by electronic or other means that can identify a specific natural person’s identity alone or in combination with other information (excluding anonymized information). We follow the principles of “legality, legitimacy, necessity and good faith” stipulated in the *Personal Information Protection Law*, and only collect information within the scope necessary to achieve service purposes. Specific scenarios are as follows:

(1) Active Provision Scenarios

When you consult product information, apply for samples, submit customized demands, handle after-sales services or participate in offline technical exchange activities, you may need to actively provide the following information:

(2) Automatic Collection Scenarios

When you visit CMR’s official website, our server may automatically record the following non-identifiable information to optimize website experience and technical maintenance:

1. Basic device information: browser type, operating system version, device model;

2. Access behavior information: page browsing path, stay duration, click area (excluding personal identity-related data).

2. Purposes and Legal Bases for Personal Information Processing

All our personal information processing activities have legal bases, mainly including “obtaining your consent”, “performing contractual obligations”, “complying with legal obligations” and “protecting public interests”. Specific purposes are as follows:

• Business docking and service performance: Provide technical schemes, sample delivery and after-sales support according to your product consultation or customized demands, which is necessary to perform contracts or fulfill service commitments. For example, deliver magnetic material samples to the address you provided, and answer product installation technical questions by phone.
• Website and service optimization: Improve website loading speed, optimize product display layout and enhance your browsing and operation experience based on automatically collected access data.
• Compliance and security assurance: Respond to regulatory inspections, prevent false consultation or commercial fraud risks, and protect the legitimate rights and interests of you and the Company.
• Activity notifications and information reach: Push industry technical trends, new product release information or offline seminar invitations to you with your consent.

3. Security Protection and Storage Specifications for Personal Information

CMR has established an information security management system covering the entire life cycle of “collection-storage-use-deletion” and strictly implements data security protection responsibilities:

(1) Security Assurance Measures

• Technical protection: Adopt SSL encryption transmission protocol to ensure data transmission security, deploy intrusion detection systems (IDS) and firewalls on servers, conduct regular vulnerability scanning and repair; adopt desensitized storage for sensitive information such as mobile phone numbers and addresses (e.g., hiding partial digits).
• Management control: Set up a security and confidentiality department, implement hierarchical management of information access rights, and only authorized personnel can access necessary information; conduct regular data security training and assessment for employees and sign confidentiality agreements.
• Third-party supervision: If a third party is entrusted to provide website technical support, a data processing agreement will be signed with it to clarify confidentiality obligations and conduct regular compliance checks.

(2) Storage Period and Method

• Storage period: We strictly follow the “storage limitation principle”, “minimization principle” and “accuracy principle” of personal information protection, and only retain your personal information for the shortest time necessary to achieve the processing purposes specified in this policy. The specific storage period will be determined by comprehensively considering the following factors: (1) the necessary cycle for providing products or services, such as the response period for your consultation needs, and the production and after-sales guarantee period for customized products; (2) the retention period stipulated by laws, regulations and regulatory requirements, such as the statutory retention period required for contract dispute resolution and tax audits; (3) the reasonable period required to protect public interests or respond to possible legal risks. After exceeding the above necessary storage period, we will timely delete or anonymize your personal information on the premise of confirming no retention necessity and not violating applicable laws and regulations.
• Storage region: Your personal information is stored on compliant servers in mainland China. We currently have no business needs or scenarios for transferring your personal information to overseas storage. If it is necessary to adjust the storage region due to business expansion in the future, we will strictly perform necessary approval procedures and take corresponding security assurance measures in accordance with the *Personal Information Protection Law* and relevant cross-border data transmission management regulations to ensure the security of your personal information.

4. Rules for Sharing, Transferring and Disclosing Personal Information

CMR strictly protects your information privacy and will never disclose personal information to third parties without permission, except in the following cases:

(1) Information Sharing

• Information may be shared only when the following conditions are met, and the scope and purpose of sharing will be clearly informed before sharing:
• Obtaining your explicit consent: For example, when you request to synchronize customized demands to our supporting processing partners;
• Legally necessary situations: In accordance with the provisions of laws and regulations, or the inquiry requirements put forward by administrative or judicial organs in accordance with the law;
• Necessary for service performance: For example, when entrusting a logistics enterprise to deliver samples, only provide the recipient’s name, address and phone number (excluding other commercial information) to it.

(2) Information Transfer

We will not transfer your personal information to any third-party subject. If transfer is required due to special circumstances such as company merger or division, we will notify you through official website announcements and emails 7 working days in advance, and ensure that the transferee continues to perform information protection obligations.

(3) Public Disclosure

Relevant information will be publicly disclosed only with your active authorization (such as agreeing to use your cooperation cases for industry promotion), and sensitive contact information will be deleted in advance.

(4) Exceptions Without Needing Consent

• According to the provisions of the *Personal Information Protection Law*, sharing or disclosing information in the following cases does not require prior consent from you:
• Involving national security, national defense security or major public interests;
• To protect the life and property safety of you or others and it is impossible to obtain consent in a timely manner;
• Information obtained from legally public channels (such as government public information).

5. Your Personal Information Rights

According to relevant laws and regulations, you have full control over your personal information, and specific rights include:

• Right to inquire and copy: You may request to inquire about your personal information stored by us and apply for a copy of the duplicate at any time;
• Right to correct and supplement: If you find errors in personal information (such as changes in contact phone numbers), you may request us to correct them in a timely manner;
• Right to delete: You may request to delete information when the service purpose has been achieved, you withdraw consent, or we process information in violation of legal provisions;
• Right to withdraw consent: You may withdraw consent to information processing at any time (such as no longer receiving product pushes), but this does not affect the legitimate processing activities completed before the withdrawal;
• Right to cancel: If you no longer use our services, you may apply for account cancellation, and we will complete the cancellation and information cleaning within 7 working days after verifying your identity.

Methods of exercising rights: Please submit an application through the channels provided in the “Contact Information” chapter of this policy, and we will respond within 15 working days (after verifying the authenticity of your identity first). If the application is obviously fraudulent or may harm the rights and interests of others, we have the right to refuse it in accordance with the law and explain the reasons.

6. Instructions on the Use of Cookies and Similar Technologies

To optimize website access experience, we may use Cookies (small data files) and similar technologies. Specific rules are as follows:

• Purpose of use: Mainly used to remember your browsing preferences (such as the last viewed product category) and avoid re-entering commonly used information; we will not collect your identity information through Cookies;
• Control right: You can choose to disable Cookies in browser settings, but this may cause some website functions (such as product comparison, historical browsing records) to fail to work normally;
• Third-party restrictions: We prohibit cooperating third-party service providers (such as website statistics tool providers) from collecting your personal information through Cookies.

7. Instructions on Cross-border Transfer of Personal Information

In view of the fact that CMR’s production, sales and services are all carried out in mainland China, there is currently no scenario for cross-border transfer of personal information. If cross-border information transfer is required due to business expansion in the future, we will strictly take security measures such as data desensitization and signing cross-border transfer agreements in accordance with the provisions of the *Personal Information Protection Law*, and inform you of the transfer situation and protection plan in advance.

8. Update Mechanism of the Privacy Policy

We will regularly optimize and update this policy according to the revision of laws and regulations, adjustment of business models and changes in technological development. The update process is as follows:

• Update announcement: The revised policy will be publicly posted in a prominent position on the homepage of CMR’s official website for a public notice period of no less than 7 working days;
• Major change notification: If it involves major changes such as expansion of information collection scope or adjustment of sharing rules, we will separately notify you through email, SMS and other means and obtain your confirmation;
• Historical inquiry: The official website will retain the historical versions of the policy for the past 3 years, and you can inquire about the past revision content through the “Privacy Policy” section.

9. Contact Information and Complaint Channels

We have set up a special data protection position and a security and confidentiality department to handle your privacy-related consultations, complaints and rights applications:

(1) Regular Consultations and Rights Applications

• Responsible Department: Data Protection Department
• Contact Email: info@cmrmagnetics.com

(2) Information Security Complaints and Reports

• Responsible Department: Security and Confidentiality Department
• Contact Email: info@cmrmagnetics.com
• Contact Phone: 0571-64266030