---

Shenzhen Norman Intelligent Lighting Co., Ltd. (hereinafter referred to as "we" or "Norman Intelligent") is the operator and personal information processor of the Norman Intelligent website ("www.nomanlighting.com"). We are fully aware of the importance of personal information to users (hereinafter referred to as "you"), and we respect and are committed to protecting your personal information. We have formulated this Privacy Policy (hereinafter referred to as "this Policy"), which covers the terms on how we collect, use, disclose, protect, transmit, and store your personal information when you visit and use the Norman Intelligent website or interact with us through other means.

Understanding the content of this policy is crucial for you to exercise your personal rights and protect your personal information. Before you start using our services or providing us with your personal information, please be sure to carefully read and understand this policy, and confirm that you can make the choices you deem appropriate according to the guidance of this policy.

You promise that you are at least 18 years old when you start using our services. If you are a minor under 18 years old, your guardian needs to agree to your use of our services and guide you in using them.

1. Definition and Scope of Application

(I) Basic definitions

1. Personal information: Personal information refers to various types of information recorded electronically or through other means that is related to an identified or identifiable natural person, excluding information that has been anonymized.

2. Sensitive personal information: Sensitive personal information refers to personal information that, once leaked or illegally used, is likely to cause infringement of a natural person's personal dignity or harm to their personal and property safety. We will identify sensitive personal information in a prominent manner in this policy and separately inform you of it before collection to remind you to pay attention.

3. Services: The term "services" as mentioned in this policy encompasses the relevant services we provide to you through the Norman Smart website and other interactive channels, as well as through other third parties (such as third-party recruitment platforms). However, it does not include products and/or services for which we have established personal information processing rules.

(II) Exceptions to the scope of application

1. Our services may contain domain links to third-party websites, products, and services. All links to third-party websites, products, and services are provided solely for your convenience. We have no control over such third parties and their linked content, and cannot provide any express or implied warranties for the linked content. Such links should not be deemed as our recommendation or authorization of the linked content. These third parties are bound by their own personal information protection rules. Therefore, before submitting personal information to these third parties, you need to separately review the personal information processing rules disclosed by the subject.

2. This policy does not apply to products and/or services for which we have separate personal information processing rules. For personal information collected by the aforementioned products and/or services, you need to separately consult the personal information processing rules disclosed in those products and/or services.

II. How we collect, use, and store your personal information

(I) Overview:

1. We will adhere to the principles of legality, necessity, and integrity, and for the explicit and reasonable purposes outlined in this policy, we will adopt the method that minimally impacts your rights and interests to collect and use personal information that you actively provide during the service usage process or that is generated as a result of using the service, or obtain your personal information from third parties in accordance with laws and regulations. If we intend to use your personal information for purposes or objectives not specified in this policy, or if there are changes in the methods and types of processing, we will inform you in a reasonable manner and seek your consent again when processing personal information based on individual consent.

2. As our information and product information publishing platform, the Norman Intelligence website will provide the public with content and services such as corporate news, Norman Intelligence product and/or service promotion, vulnerability collection, job posting display, and corporate contact information. In order to provide you with browsing services, we must collect and use the necessary information corresponding to the legal requirements. If you refuse to provide the corresponding information, you may not be able to use our corresponding services normally.

3. For personal information provided by users in different regions, we will adhere to the locally applicable personal information protection regulations and requirements in the collection, use, storage, and other processing and protection of your personal information.

4. In order to provide you with services other than our browsing services, you may choose to agree or disagree to our collection and use of corresponding personal information. If you refuse to provide it, you will only be unable to use the services corresponding to the relevant personal information normally, but it will not affect your use of browsing or our other services.

(II) We will collect and use the following types of personal information about you for the following purposes and in the following ways:

1. Browse the Norman Intelligence website

When you browse the Norman Smart website, in order to show you our products and/or services, we will use Google Analytics to collect your device service log information, including: access time, access region, access device, access browser, access system, behavior flow, dwell time, etc.

2. Contact us

When you are interested in our products/services, submit product vulnerability information, submit reports/suggestions, or need to contact us for business inquiries, we may collect your name, the business you are interested in, the industry you belong to, the company/organization you work for, your department/position, the province/city where you work, your mobile phone number, your work email, the type of personnel you expect to communicate with, the preferred communication method, and your specific needs/comments. Among them, your name, the business you are interested in, the industry you belong to, the company/organization you work for, your department/position, the province/city where you work, your mobile phone number, your work email, the type of personnel you expect to communicate with, and the preferred communication method are required information. Your specific needs/comments are optional information. Collecting required information is to understand your demands and get in touch with you, while collecting optional information is to provide you with better and faster processing results, solutions, responses, and other information. If you do not agree to provide us with the necessary personal information mentioned above, we may not be able to communicate with you and respond to your demands.

3. Business partner management

If you or your organization is our business partner, we may collect your name, contact information, and mailing address during your interactions with us, in order to establish and carry out business cooperation with you or your organization.

4. Recruitment and job seeking

You can view our job details through "Social Recruitment" and "Campus Recruitment" under "Contact Us" on our website. This webpage links to third-party recruitment platforms. If you are interested in joining us, you can submit your resume by registering/logging in to an account on the third-party recruitment platform. We will obtain your resume containing personal information through the third-party recruitment platform, so that we can understand your personal background, contact you, and complete the recruitment-related processes. Your resume may contain sensitive personal information. If you do not provide a resume containing your personal information, you may not be able to participate in our recruitment activities. Please review the personal information processing rules and/or service agreements informed to you by the third party before using the services of the third-party recruitment platform and providing your personal information.

(III) How do we use your personal information

You agree and authorize us to retain the information collected and use it for the following purposes:

1. Provide you with services under this policy;

2. For purposes required by laws and regulations, court orders, or other legal procedures, or by authorized government agencies;

3. Other circumstances where you have authorized or consented, or where required by applicable laws.

If we intend to use your personal information for purposes not covered by this policy, or collect additional personal information from you, we will seek your consent in advance. Without your consent, we will not use your personal information for any other purposes, nor will we collect any additional personal information from you.

(IV) How do we store your personal information

We will store your personal information collected within China in accordance with the requirements of applicable Chinese laws and regulations. Some of your personal information may also be stored outside China or transmitted outside China for the purposes specified in this policy. (Please refer to the description in the "How do we cross-border transfer your personal information" section below for details.)

We will retain your personal information for the period necessary to fulfill the purpose of collection, in accordance with any legal, accounting, or reporting requirements. If you withdraw your consent, request the deletion of your personal information, or if we retain your personal information beyond the necessary period, we will delete or anonymize your personal information, except in the following circumstances:

• Comply with the requirements of laws and regulations regarding information retention;

• Reasonable extension of time is required for financial, auditing, dispute resolution, and other purposes;

• Other situations where it is necessary to achieve the purposes described in this policy within the scope permitted by law.

(5) Other legal reasons other than consent

According to relevant laws and regulations, in the following situations, we may collect and use some necessary personal information without obtaining your authorization and consent:

1. Necessary for the formation and performance of a contract to which you are a party;

2. Necessary for the performance of our statutory duties or legal obligations;

3. To respond to public health emergencies, or to protect the life, health, and property safety of natural persons in emergency situations;

4. Process personal information that individuals voluntarily disclose or that has been legally disclosed within a reasonable scope, in accordance with the provisions of the Personal Information Protection Law of the People's Republic of China;

5. Other circumstances stipulated by laws and administrative regulations.

III. How do we use cookies and similar technologies

To ensure the normal operation of the website, provide you with a more convenient browsing experience, recommend content that may interest you, store preferences, and avoid repeatedly filling in form content, we will store small data files called cookies on your computer or mobile device. Additionally, we also use cookies from third-party service providers such as Google Analytics and Baidu Statistics to conduct necessary statistical analysis. A cookie is a small text file that the website saves on your computer or mobile device during your browsing session. Cookies typically contain an identifier, site name, and some numbers and characters that distinguish your computer or mobile device from others.

You can restrict/reject our use of cookies by changing your browser settings. You can choose to clear your cookies through your browser's "Settings/Privacy Settings & Security/Clear Browsing Data". Most web browsers have a function to block cookies. For more information on how to change your browser settings, please refer to the relevant settings page of the browser you are using.

IV. How we entrust, process, share, and disclose your personal information

(1) Commissioned processing

In order to provide services to you or achieve the purposes of using the aforementioned information, we may need to entrust third-party service providers with the handling of your personal information. For instance, in the context of recruitment and job seeking, we will entrust third-party service providers with the collection and processing of your personal information related to job seeking, resumes, and so on.

For companies, organizations, and individuals entrusted by us to handle personal information, we will reasonably assess the personal information protection capabilities of the entrusted party, sign strict confidentiality agreements or legal documents with them, stipulate matters such as the purpose, duration, processing methods, types of personal information, protection measures, as well as the rights and obligations of both parties, require and supervise the entrusted party to strictly comply with this policy, and require the entrusted party to take adequate organizational or technical measures to protect your privacy and personal information. When the entrusted party no longer provides services to you, we will delete or notify the entrusted company to delete your personal information.

(II) Sharing

Sharing refers to the process where we provide personal information to other personal information controllers, and both parties have independent control over the personal information. Generally, we will not share your personal information externally, except in the following circumstances:

1. Sharing with individual consent: With your individual consent or upon your initiative, we will share information within your authorized scope with the third party you have designated;

2. Sharing under statutory circumstances: We may share your personal information externally in accordance with legal and regulatory provisions, the need to resolve litigation disputes, or as required by administrative and judicial authorities in accordance with the law.

(III) Transfer

We will not transfer your personal information to any company, organization, or individual, except in the following circumstances:

1. Transfer with explicit consent: Upon obtaining your explicit consent, we will transfer your personal information to other parties;

2. In cases involving mergers, acquisitions, or bankruptcy liquidation, if personal information transfer is involved, we will require the new company or organization holding your personal information to continue to be bound by this policy. Otherwise, we will require the company or organization to seek your authorization and consent again.

(IV) Public disclosure

We will only publicly disclose your personal information in the following circumstances:

1. After obtaining your explicit consent;

2. Disclosure based on law: We may publicly disclose your personal information in the event of legal requirements, legal proceedings, litigation, or mandatory requirements imposed by government authorities.

V. How do we transmit your personal information across borders

As a globally operating enterprise, in our daily business and cooperation with you or your organization, we will collaborate with colleagues and service providers from different countries. To achieve the purposes outlined in this policy, after fulfilling the requirements of applicable Chinese laws and regulations, we may transfer your personal information outside China in the following circumstances. We will require the overseas data recipients to adopt corresponding protection measures to safeguard your personal information (such protection measures should at least be equivalent to the level of personal information protection stipulated by Chinese law) and handle and protect it in accordance with the requirements of this policy.

VI. How do we protect your personal information

Norman Intelligence obtained the ISO27001 information security management system certification in 2019. To ensure the security of your information, we will take reasonable and necessary measures to protect your information within the current technological level. We employ physical protection, security technology, management systems, and other measures to reduce the risks of loss, misuse, unauthorized access, disclosure, and alteration, including but not limited to SSL encrypted transmission, firewalls, encrypted storage, physical access control, and information access authorization control. Although we have taken prudent and reasonable measures, in the Internet environment, we cannot guarantee 100% security of your information.

We have a cybersecurity incident emergency response plan to promptly address security risks such as system vulnerabilities, computer viruses, network attacks, and network intrusions. In the event of an incident that endangers network security, we will immediately activate the emergency response plan, take corresponding remedial measures, and report to relevant authorities or notify individuals in accordance with applicable laws and regulations.

7. Your rights As the subject of personal information, you are entitled to the following rights according to law. We will fully safeguard your exercise of these rights through the following methods. Based on our current service capabilities, you can refer to the guidelines below for operation.

1. Accessing and copying, or transferring to a designated third party, your personal information: If you need to access the personal information we have collected about you, or obtain a copy of the personal information we have collected about you, you can contact us by sending an email. After verifying your identity as necessary, and subject to relevant legal provisions and technical feasibility, we will provide you with a copy of your personal information. If you request to transfer your personal information to a designated personal information processor, and if it meets the conditions stipulated by the national cyberspace administration, we will provide the transfer method.

2. Correct and supplement your personal information: If you find any errors in the personal information we have processed about you, you can contact us and request us to make corrections or supplements.

3. Deletion of your personal information: When you no longer use our services and request the deletion of your personal information, or when we violate laws, regulations, or agreements with you by collecting, using, or sharing your personal information with others, you can inform us of your request and the scope of the personal information to be deleted by sending an email. We will handle it accordingly. If the retention period stipulated by laws and administrative regulations has not expired, or if the deletion of your personal information is technically difficult to achieve, we will cease processing except for storage and taking necessary security protection measures.

4. Withdrawal of Consent: In cases where authorization is based on consent, you may grant or withdraw your consent at any time. You may inform us of your withdrawal of consent and the scope of the withdrawal by sending an email. Please understand that certain service functions require some basic personal information to be completed. When you withdraw your consent or authorization, we will be unable to continue providing the services corresponding to the withdrawn consent and will no longer process your corresponding personal information. However, your decision to withdraw consent will not affect the personal information processing that we have carried out based on your consent previously.

5. Obtaining an explanation of this policy or exercising other rights under applicable data protection laws: You may request an explanation of this policy or exercise other rights under applicable data protection laws by sending an email to us.

6. How we respond to your requests: We will establish convenient channels and mechanisms to accept and handle your requests. To ensure security, we need to verify your identity before processing your request. We will complete identity verification and response processing within 15 working days after receiving your application. If your request is complex or requires excessive technical means, we will complete the response processing within the response time requirements stipulated by laws and regulations. For your reasonable requests, we do not charge fees in principle. However, for repeated requests, requests beyond reasonable limits, or requests requiring excessive technical means, we will charge a certain cost depending on the situation.

VIII. How do we handle personal information of minors? 1. Our services are primarily targeted at adults with certain professional knowledge backgrounds. Therefore, we will not proactively collect personal information directly from minors. For situations where personal information of minors is collected with the consent of their guardians, we will only use, share, transfer, or disclose this information when permitted by law, with the consent of the guardian, or when necessary to protect the minors.

2. If there is evidence that a minor has registered and used our services without the consent of their legal guardian, we will seek to delete the relevant personal information as soon as possible upon being notified by the legal guardian and requested to do so.

IX. Updates to Privacy Policy Our privacy policy may be updated in accordance with changes in laws, regulations, and business conditions.

1. Without your explicit consent, we will not restrict the rights you are entitled to under this policy. We will announce any changes made to this policy on the relevant page ("Norman Smart Home - Bottom - Privacy Policy").

2. In the event of any changes to the personal information processor, processing purpose, processing method, types of personal information processed, retention period, or data subject rights, we will also inform you of the changes.