Dear Users,
Thank you for visiting Westwell Official Website (www.en.westwell-lab.com, “Official Website”), which is operated by Shanghai Westwell Technology Co., Ltd. and its related parties (“Westwell”, “we” or “us”). We respect your privacy and value the trust you place in us when you provide your personal data with us. This Privacy Policy Westwell Official Website (“Policy”) sets out how we, including how any member of Westwell Group Company to which we legitimately transfer your personal data, collect and use personal data you provide to us through this Official Website. We also inform you why we use your personal data collected through the Official Website, with whom we share it, the rights to which you may be entitled and your choices about our use of such personal data.

This Policy will help you understand the following information:
I. The scope of this Policy
II. How we collect and use your personal data
III. Exceptions which do not require authority and consent
IV. How we use Cookies
V. How we store your personal data
VI. How we share, transfer, and publicly disclose your personal data
VII. How we protect your personal data
VIII. Your rights to personal data
IX. How we protect personal data about minors
X. Revision to this policy

I. THE SCOPE OF THIS POLICY
This Policy applies to the services we provide to you through the Official Website. In particular, this Policy does not apply to services provided to you by other third parties, such as the third-party services or websites you link to through the Official Website. You understand that these services are provided to you independently by third parties who will be solely responsible for the processing of your personal data in accordance with their policies.
We may formulate specific personal data protection policies, statements, notices, etc. (“Specific Policies”) with respect to specific online or offline services or products. If there are specific provisions in other Specific Policies, these Specific Policies shall prevail. For matters not provided in the Specific Policies, this Policy shall prevail.

II. HOW WE COLLECT AND USE YOUR PERSONAL DATA
Personal data means any information saved in electronic form or otherwise that can be used independently or together with other information to identify a natural person or reflect the activities of a natural person.
Sensitive personal data means the personal data that may cause harm to personal or property security, or is very likely to result in damage to an individual’s personal reputation or physical or mental health or give rise to discriminatory treatment, once it is leaked, unlawfully provided or abused.
When you use the Official Website, we will collect and use the personal data necessary for the provision of relevant services as follows; if you do not use the services, we will not collect the corresponding information.
1.Browse the Official Website
When you browse the Official Website through a computer or mobile device, we will collect your following information:
a)Technical information, such as Internet Protocol (IP) addresses, browser types and versions, time zone settings and locations, browser plug-in types and versions, operating systems and platforms, and other technologies you use on your device to access and browse Official Websites.
b)Use information, such as information about how you use our website, products and services.
2.Apply for trial of our products and services
When you request to try our products and services on Official Website, we need to collect your name, position, email address, contact number, company name, company address, industry, project name and key requirement description to understand your specific requirements.
We may also use the above information for (i) handling and replying your or your organization’s questions and opinions; (ii) providing information about products and services that you or your organization may be interested in; and (iii) seeking information and feedback from you or your organization, including through surveys and questionnaires.
3.Business cooperation
When you apply for business cooperation with us, we need to collect your name, position, email address, contact number, country or region, industry, company name, specific requirements of business cooperation, etc. to understand your specific needs and contact you for business cooperation.
We may also use the above information for (i) handling and replying your or your organization’s questions and opinions; (ii) providing information about products and services that you or your organization may be interested in; and (iii) seeking information and feedback from you or your organization, including through surveys and questionnaires.
4.Apply for our jobs
When you choose to send us your resume to apply for our positions online, you need to log in through WeChat authorization, we will collect your WeChat login information. You may also choose to register through mobile number directly without WeChat login authorization and we will collect your mobile phone number. We need to collect your identity information and resume information, such as your name, date of birth, gender and native place, your education background, work experience and contact information, to initially understand your situation.
5.Use of anonymized information
Please note that we also collect, use and share aggregated information, such as statistics or structural data. Aggregate data is not personal data but may be derived from your personal data, because it does not directly or indirectly show your identity, and we have the right to use it for any legitimate purpose (for example, we may aggregate your usage information to find out how many users visit specific website functions, study consumer and market preferences, improve existing products and services, and conduct financial forecasting and modeling). If we combine or associate the aggregate data with your personal data so that it can directly or indirectly identify you, we will treat the combined information as personal data and will process it in accordance with the provisions of this Policy.

III. EXCEPTIONS WHICH DO NOT REQUIRE AUTHORITY AND CONSENT
Subject to the applicable laws and regulations, we may collect and use your personal data without the need to obtain your consent under any of the following circumstances:
1.where the collection and use are in direct relation to performance of our obligations under laws and regulations;
2.where the collection and use are in direct relation to State security or national defense;
3.where the collection and use are in direct relation to public security, public sanitation, or major public benefits;
4.where the collection and use are in direct relation to criminal investigations, prosecutions, court trials, enforcement of rulings, etc.;
5.where the collection and use are for the sake of safeguarding significant legal rights and interests, such as the life and property of personal data subjects or other individuals, but it is difficult to obtain your consent;
6.where the personal data collected is information voluntarily published by you to the general public;
7.where the personal data is collected from information that has been lawfully and publicly disclosed, such as legal news reports and information published by the government;
8.where the collection and use are necessary for ensuring the safe and stable operation of our products or services, such as identifying and disposing of defects in our products or services;
9.where the collection and use are necessary for releasing news reports in a legal manner;
10.where academic research institutions use the information for statistics and academic research purposes for the sake of public interest, or publish the research results or provide them to other parties to the extent that such results are de-identified and cannot re-identify the data subjects; and 11.other circumstances specified by laws and regulations.

IV. HOW WE USE COOKIES
A cookie is a small text file that a website stores on your computer or mobile device when you visit the site. The Official Website uses the following types of cookies:
·Strictly necessary cookies. These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services.
·Social media cookies. These cookies allow you to share what you have been doing on a website on social media, such as Facebook or Twitter. This information may be linked to targeting or advertising activities.
Most web browsers have the function of blocking Cookies. But if you do so, you need to change the user settings by yourself every time you visit our Official Website.

V. HOW WE STORE YOUR PERSONAL DATA
The personal data we collect will be stored in the region of the People’s Republic of China.
We will retain your personal data only for a limited period of time needed to fulfil the purposes of processing mentioned above. After that time your personal data will be erased. If we process your personal data based on your consent, we will retain your personal data for a limited period of time needed to fulfil the purposes of processing it.
Where we enter into a contract with you, we will keep your information for the duration of the contractual relationship you have with us, and, to the extent permitted, after the end of that relationship for as long as necessary to perform the purposes set out in this Policy. The criteria to determine the storage period are statutory and contractual requirements, the nature of our relationship with you, the nature of the data concerned and the technical requirements. Laws may require us to hold certain information for specific periods.
Where we process personal data for marketing purposes or with your consent, we process the data until you ask us to stop and for a short period after this (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing or to process your data so that we can respect your request in future.

VI. HOW WE SHARE, TRANSFER, AND PUBLICLY DISCLOSE YOUR PERSONAL DATA
（一）Share
We will not share your personal data except in the following circumstances:
1.with your explicit consent, we will share your personal data with other parties.
2.we may share your personal data with others in accordance with laws and regulations, the needs of litigation dispute settlement, or the requirements of administrative and judicial authorities.
3.to the extent permitted by laws and regulations, it is necessary to share your personal data in order to protect us, our affiliates or partners, you or other users of Westwell or the public interest, property or security from damage.
4.In order to provide services to you, we may share your personal data with our affiliates. However, we will only share necessary personal data, and the use of your personal data by our affiliates is subject to this Policy, or the affiliate’s policy which you authorized and consented and provides your personal data with substantially the same level of protection as this Policy. Our affiliates and we will strictly comply with this Policy and other security policies of Westwell.
（二）Transfer
We will not transfer your personal data to any other company, organization or individual except:
1.obtain your explicit consent or authorization in advance;
2.provide such data in accordance with the applicable laws and regulations, requirements of legal procedures, mandatory administrative or judicial requirements;
3.provide such data in accordance with the relevant agreements entered between you and us (including the electronic agreements signed online and the corresponding platform rules);
4.with the development of our business, it is possible for us and our affiliates to carry out merger, acquisition, asset transfer or other similar transactions. If the relevant transaction involves the transfer of your personal data, we will require the company, organization and individual acquiring your personal data to continue to be bound by this Policy, otherwise we will require the company, organization and individual to obtain your consent again.
（三）3.Publicly disclose
We may only publicly disclose your personal data under the following circumstances:
1、after obtaining your explicit consent; and
2、disclosure under the law: we may publicly disclose your personal data as required by laws, under legal procedures, in lawsuits or upon compulsory requirements of competent authorities under the government.
VII. HOW WE PROTECT YOUR PERSONAL DATA
We have taken security protection measures in line with industry standards to protect the personal data you provide, so as to prevent unauthorized access, public disclosure, use, modification, damage or loss of data.
1.Westwell has appointed special persons in charge of personal data protection, who is responsible for dealing with all matters related to products and services of Westwell that may involve users’ personal data, as well as planning and formulating the company’s policies, reviewing the data protection policies for each product, supervising the working principle and information processing mechanism of each product, etc.
2.We have carried out tiered cybersecurity protection systems in accordance with the PRC laws. According to the requirements of tiered cybersecurity protection systems, we have formulated the general policies and security strategy for information security, established the security management system with respect to the host, data, application, management and other aspects, set up the information security management committee and the information security executive committee, designate the system platform department to take charge of security management activities, delineate the security protection responsibility for each department and position, and formulated security management norms with respect to personnel recruitment and resignation.
3.We will encrypt the transmission and storage of the identifiable sensitive personal data, and the encryption intensity meets the security requirements to ensure the confidentiality of the data. Our application system provides identity authentication, user identity uniqueness verification, role-based access control and other functions, and uses HTTPS security protocol for communication. We deploy the access control mechanism on the server side, adopt the principle of minimum authorization for the staff who may contact your personal data, and regularly check the logs of visitors and access. Our operating system and database system have password complexity requirements, adopt SSH security protocol for remote management and strictly restrict access to the default account. We keep comprehensive audit records for our systems which cover all users.
4.Our server systems for storing user’s personal data are all operating systems with security hardening. We will audit and monitor the account of the server operation. If we find the server operating system has any security loopholes, we will upgrade the server security in time to ensure the security of all server systems and applications.
5.We hold regular training on laws and regulations related to personal data protection for our staff to enhance their awareness of personal privacy protection.
6.We have formulated the emergency plan for network security incidents and allocated sufficient resources to ensure the implementation of the emergency plan. We conduct training and emergency drill on the emergency plan every year. If our physical, technical or management protection measures are unfortunately damaged, we will launch the emergency plan in time to prevent the expansion of the safety incident, report to the national competent authority in accordance with the requirements of laws and regulations, and inform you of the basic situation, possible impact, measures taken or measures to be taken in a reasonable and effective way such as push or announcement, etc.

VIII. YOUR RIGHTS TO PERSONAL DATA
When you use the Official Website, you may at any time exercise certain rights with regard to your personal data you may have under applicable law and regulation, including the following rights:
（一）Access and rectify your personal data You can contact us to access and rectify your personal data.
（二）Delete your personal data Under any of the following circumstances, you may raise a request for deletion of your personal data:
1.When our collection of personal data does not obtain your consent and violates laws and regulations
2.When our processing of personal data violates laws or regulations.
3.When our use and processing of personal data violates our agreement with you.
4.When you no longer use our products or services.
5.When we no longer provide you with any products or services.
You can contact us to delete your personal data. When we delete your personal data from the server, we may not delete the corresponding data from the backup system immediately, but we will delete this information when the backup is updated.
（三）Withdraw your consent
Our services can only be provided with certain basic personal data. In terms of the collection and use of additionally collected personal data, you may grant or withdraw your authority and consent at any time. After you have withdrawn your consent, we will cease processing the corresponding personal data. However, your decision to withdraw your consent does not affect the previous processing of personal data based on your authority. You can contact us to withdraw your consent.
（四）Accounts Cancellation You may cancel the account you registered for employment. You can contact us to cancel your account.
（五）Request of a copy of your personal information
You have the right to obtain a copy of your personal information through the contact information. When it is technically feasible, e.g. with matched data interface, we can directly transmit the copy of your personal information to the third party designated by you upon your request.
IX. HOW WE PROCESS INFORMATION ABOUT MINORS
The Official Website mainly target adult users. Without the consent of the parents or guardians, minors under the age of 14 may not use our products or services.
For our collection of minors’ personal data with parents’ consent, we will only use or publicly disclose this information subject to laws and regulations with the explicit consent of the parents or guardians, or as necessary to protect the minors.
If we find that we have collected minors’ personal data without prior verifiable parents’ consent, we will try to delete the relevant data as soon as possible.
X. REVISION TO THIS POLICY We may revise this Policy from time to time. We will not reduce your rights due under this Policy, without your explicit consent.
In the case of material changes, we will provide your prompt and conspicuous notification. You can also browse the Official Website at any time to view the latest Policy.
For the purpose of this Policy, major changes include but are not limited to:
1.Significant changes to our service mode, such as the purposes of processing personal data, categories of personal data to be processed, the ways to use personal data, etc.;
2.Significant changes to the ownership structure, organizational structure, etc., such as changes to the owners as a result of business adjustments, bankruptcy, mergers and acquisitions;
3.Changes to recipient with whom we may share or transfer personal data, or public disclosure of personal data;
4.Significant changes to your rights to personal data and the ways in which you can exercise such rights;
5.Changes to the security policy with respect to personal data, contact information of such department, or complaint channels;and
6.Changes made due to high risks identified in the security impact assessment report for personal data.
After such changes and modifications, if you continue to use our Official Website, it means that you agree to be bound by this revised Policy.