Your privacy is important to us. This privacy statement explains the personal data CBRI processes, how CBRI processes it, and for what purposes.

This statement applies to the interactions CBRI has with you and all CBRI websites that display this statement.

1 Personal data we collect

CBRI collects data from you, through our interactions with you and through our websites. You provide some of this data directly, and we get some of it by collecting data about your interactions, use, and experiences with our websites. The data we collect depends on the context of your interactions with CBRI and the choices you make, including your privacy settings and the features you use.

If you represent an organisation CBRI cooperates with, such as a business or school, in the event of a conflict between this CBRI Privacy Statement and the terms of any agreement(s) between you and CBRI for cooperation, the terms of those agreement(s) will control.

You have choices when it comes to the technology you use and the data you share. When we ask you to provide personal data, you can decline. Some features of our websites require some personal data to provide you with a service. If you choose not to provide data required to provide you with a feature, you cannot use that feature. Likewise, where we need to collect personal data by law or to enter into or carry out a contract with you, and you do not provide the data, we will not be able to enter into the contract; or if this relates to an existing feature you're using, we may have to suspend or cancel it. We will notify you if this is the case at the time. Where providing the data is optional, and you choose not to share personal data, features like personalisation that use such data will not work for you.

2 How we use personal data

CBRI uses the data we collect to provide you with rich, interactive experiences. In particular, we use data to:

• Provide our services, which includes updating, securing, and troubleshooting, as well as providing support.
• Improve and develop our services.
• Personalise our services and make recommendations.

We also use the data to operate our business, which includes analysing our performance, meeting our legal obligations, developing our workforce, and doing research.

In carrying out these purposes, we combine data we collect from different contexts (for example, from the CBRI official website and the backend server for our WeChat account) or obtain from third parties to give you a more seamless, consistent, and personalised experience, to make informed business decisions, and for other legitimate purposes.

Our processing of personal data for these purposes includes both automated and manual (human) methods of processing. Our automated methods often are related to and supported by our manual methods. This manual review may be conducted by CBRI employees or vendors who are working on CBRI's behalf.

3 Reasons we share personal data

We share your personal data with your consent. We also share data:

• when required by law or to respond to legal process;
• to protect our customers;
• to protect lives;
• to maintain the security of our websites;
• and to protect the rights and property of CBRI and its customers.

4 How to access and control your personal data

You can also make choices about the collection and use of your data by CBRI. You can control your personal data that CBRI has obtained, and exercise your data protection rights, by contacting CBRI or using various options we provide. In some cases, your ability to access or control your personal data will be limited, as required or permitted by applicable law. How you can access or control your personal data will also depend on which service you use.

Not all personal data processed by CBRI can be accessed or controlled via the websites. If you want to access or control personal data processed by CBRI that is not available via the websites or directly through your CBRI account, you can always contact CBRI by means listed in the How to contact us section (11).

5 Cookies and similar technologies

Cookies are small text files placed on your device to store data that can be recalled by a web server that placed the cookie. We use cookies and similar technologies for storing and honouring your preferences and settings, enabling you to sign in, analysing how our services perform and fulfilling other legitimate purposes.

Our websites may include web beacons, cookies, or similar technologies from third-party service providers.

You have a variety of tools to control the data collected by cookies, web beacons, and similar technologies. For example, you can use controls in your web browser to limit how the websites you visit are able to use cookies and to withdraw your consent by clearing or blocking cookies.

6 CBRI account

With a CBRI account, you can sign in to CBRI official websites. Personal data associated with your CBRI account includes credentials, name and contact data.

7 Security of personal data

CBRI is committed to protecting the security of your personal data. We use a variety of security technologies and procedures to help protect your personal data from unauthorised access, use, or disclosure. For example, we use HTTPS throughout to protect your access to our websites. CBRI complies with applicable data protection laws, including applicable security breach notification laws.

8 Where we store and process personal data

Personal data collected by CBRI are stored and processed in China. We take steps to ensure that the data we collect under this privacy statement is processed according to the provisions of this statement and the requirements of applicable law in China.

9 Our retention of personal data

CBRI retains personal data for as long as necessary to provide the services and fulfil the transactions you have requested, or for other legitimate purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements. Because these needs can vary for different data types, the context of our interactions with you or your use of services, actual retention periods can vary significantly.

10 Changes to this privacy statement

We update this privacy statement when necessary to provide greater transparency or in response to:

• Feedback from customer, regulators, industry, or other stakeholders.
• Changes in our products.
• Changes in our data processing activities or policies.

When we post changes to this statement, we will revise the "last updated" date at the top of the statement and describe the changes on the Change history page. If there are material changes to the statement, such as a change to the purposes of processing of personal data that is not consistent with the purpose for which it was originally collected, we will notify you either by prominently posting a notice of such changes before they take effect or by directly sending you a notification. We encourage you to periodically review this privacy statement to learn how CBRI is protecting your information.

11 How to contact us

If you have a privacy concern, complaint, or question for CBRI, please contact us via email (info@cbri.group). We will respond to questions or concerns as required by law and within a period no longer than 30 days. You can also raise a concern or lodge a complaint with a data protection authority or other official with jurisdiction.