Version No.: 【202607】 Release Date: 【20260719】 Effective Date: 【20260719 】

1. Introduction

Personal Information Controller (Data Controller/Website Operator): Zhongji Innolight Co., Ltd.

Contact Address: Building 1, InnoLight Photonics Industrial Park, 168 Shengpu Road, Wuzhong District, Suzhou, Jiangsu Province

Personal Information Protection Contact: shrek.tang@innolight.com

We respect and protect your personal information rights. This Privacy Policy explains how we collect, use, store, entrust for processing, share, transfer, publicly disclose, and protect your personal information when you access and use this website, as well as how you can exercise your rights.

Please read this policy carefully before using this website. For processing activities that require your consent, we will obtain your consent through page prompts, checkboxes, pop‑ups, or other appropriate means in applicable scenarios. You may withdraw your consent as described in this policy, but withdrawal does not affect the lawfulness of processing based on consent before the withdrawal.

2. Scope

This policy applies to the corporate website, mobile pages, and online functions explicitly listed in this policy (collectively referred to as the “Website”) operated by the above‑mentioned Personal Information Controller.

The Website may contain links to third‑party websites/services such as recruitment platforms, investor relations platforms, maps, videos, social media, or other third‑party services. When third parties independently collect and process personal information on their pages, their own privacy rules apply; this policy does not apply to processing activities that we do not control. If a third‑party component is directly embedded in the Website or processes information on our behalf, we will provide additional explanation based on the actual legal relationship.

3. How We Collect and Use Personal Information

We follow the principles of lawfulness, fairness, necessity, and good faith, and process personal information only to the minimum extent necessary to achieve clear and reasonable purposes. The following scenarios are common examples for a simple corporate website; the actual functions enabled on the Website shall prevail.

3.1 Access, Browsing and Security

When you visit the Website, the server and security systems may automatically record IP address, access date and time, visited pages, referrer pages, browser type and version, operating system, device type, network status, language settings, error logs, security event records, and Cookie/similar technology identifiers for purposes such as page display, network connection, troubleshooting, traffic analysis, security protection, and preventing fraud or abuse.

3.2 Site Search

When you use the site search function, we may process the keywords you enter and the access logs related to your search requests to return search results, optimise content structure, and troubleshoot anomalies. Please do not enter sensitive personal information unrelated to the query in the search box.

3.3 Contact, Feedback and Business Enquiries

When you contact us via contact forms, email, phone, or other channels, we may process the following information based on the form settings: name or salutation, contact number, email address, company name, city/region, enquiry type, enquiry or message content, and communication records.

The purposes include verifying and understanding your request, replying to you, providing product or service materials, arranging business contact, handling complaints and suggestions, and retaining necessary communication and compliance records. Information not marked as required is provided at your discretion.

Please avoid submitting sensitive personal information such as ID numbers, financial account details, health information, or precise location in free‑text fields. If such information is indeed necessary, we will separately explain the purpose, methods, necessity, and impact on your rights, and obtain your separate consent where applicable.

3.4 Email Subscriptions and Event Information

If you actively subscribe to news, events, or other updates, we may process your email address, subscription time, subscription source, consent records, and unsubscribe status to send you the selected content and manage subscriptions. You may withdraw consent via the unsubscribe link in the email or through the contact methods listed in this policy.

3.5 Recruitment and External Platforms

The Website may provide links to third‑party recruitment platforms. If you submit a resume or other job application information to such platforms after clicking through, that platform will usually process the information under its own privacy policy. If we obtain candidate information through that platform, or if the Website directly offers job application functions, we will supplement the processing purposes, information types, retention periods, and recipients through a recruitment privacy notice or this policy.

3.6 Investor Relations and Other Third‑Party Links

The Website may provide links to investor relations pages, announcements, maps, videos, or other third‑party pages. After you click on a link, the third party may independently collect device information, access logs, or information you actively submit. We recommend that you read the respective third‑party privacy policies before using such services.

3.7 Cookie and Similar Technologies

We may use Cookie and similar technologies to ensure website operation, save language or privacy preferences, conduct access statistics, or provide other functions. For the names, providers, purposes, and durations of different types of Cookie, please refer to the separately published Cookie Policy. Non‑essential Cookies will be enabled only with your consent where required by applicable law.

3.8 Personal Information Processing Inventory

4. Sensitive Personal Information

Generally, the public browsing, search, contact, and subscription functions of the Website do not require you to provide sensitive personal information. Please do not actively submit sensitive personal information unrelated to your request in search boxes, message content, emails, or attachments.

If a particular function indeed requires processing sensitive personal information, we will explain the specific purpose, full necessity, processing methods, and the impact on your rights, obtain your separate consent where applicable, and adopt stricter security measures. When it involves personal information of minors under the age of 14, we will formulate special rules in accordance with the law and obtain the consent of their parents or other guardians.

5. How We Entrust Processing, Share, Transfer, and Publicly Disclose Personal Information

5.1 Entrusted Processing

We may entrust website hosting, cloud services, content delivery, security protection, data analytics, email sending, customer relationship management, or technical support service providers to process personal information on our behalf. We will agree with the entrusted parties on the purposes, duration, methods, types of information, protection measures, and the rights and obligations of both parties in accordance with applicable laws, and supervise their processing activities.

5.2 Sharing or External Provision

Unless we obtain your separate consent, the sharing is necessary for entering into or performing a contract to which you are a party, for complying with legal obligations, for responding to public health emergencies or protecting life, health, and property in emergency situations, or where otherwise provided by applicable law, we will not provide your personal information to other personal information controllers.

5.3 Transfer

If personal information needs to be transferred due to mergers, demergers, dissolution, bankruptcy declaration, asset or business transfers, etc., we will inform you of the name and contact information of the recipient in accordance with the law, and require the recipient to continue to fulfill the obligations under this policy and applicable laws; if the recipient changes the original purposes or methods of processing, it will obtain your consent again in accordance with the law.

5.4 Public Disclosure

In principle, we will not publicly disclose your personal information. If public disclosure is truly necessary, we will inform you of the purpose, types of information, and possible impact of the disclosure, and obtain your separate consent where applicable.

5.5 Third‑Party Information Sharing List/Third‑Party SDK List

6. Storage Location and Retention Period of Personal Information

We will retain personal information for the shortest period necessary to achieve the processing purposes, unless otherwise provided by laws and regulations. When determining the retention period, we will consider the time required for service provision and request handling, dispute resolution and auditing needs, statutory retention obligations, the sensitivity of the information, and risks. After the expiry of the retention period, we will delete or anonymise the personal information; if the statutory retention period has not expired, or if deletion is technically difficult, we will cease processing other than storage and necessary security protection measures.

Primary storage location of personal information: 【Hong Kong】.

7. Cross‑Border Transfer of Personal Information

Due to the use of overseas hosting, analytics, email, recruitment, or other suppliers, we may provide personal information to overseas recipients. In such cases, we will inform you of the name and contact information of the overseas recipient, the purposes and methods of processing, the types of information, and the ways and procedures for you to exercise your rights against the overseas recipient in accordance with the law, and where applicable, obtain your separate consent, conduct a personal information protection impact assessment, and meet applicable data export compliancerequirements.

8. How We Protect Personal Information

We will adopt technical and management measures appropriate to the types of personal information, processing purposes, risks, and possible damage, including but not limited to access control, identity authentication, transmission and storage protection, log auditing, vulnerability management, backup and recovery, personnel training, supplier management, and emergency response mechanisms for personal information security incidents.

The internet environment is not absolutely secure. If a personal information leak, tampering, or loss occurs or may occur, we will immediately take remedial measures and notify you and report to the authority responsible for personal information protection in accordance with the law, except where the law permits non‑notification.

9. Your Personal Information Rights

To the extent provided by applicable law, you have the right to:

· Be informed and decide whether to consent to or restrict/refuse our processing of your personal information;

· Access and copy your personal information; request the transfer of your personal information to the controller you designate, where statutory conditions are met;

· Request correction or supplementation of inaccurate or incomplete personal information;

· Request deletion of personal information where statutory conditions are met;

· Withdraw consent for processing based on consent; withdrawal does not affect the lawfulness of processing before withdrawal;

· Request an explanation of this policy and the personal information processing rules;

· Make complaints, reports, or seek other statutory remedies regarding personal information processing.

You may submit a request through the channels set out in Section 12 of this policy. For security, we may require you to provide necessary information to verify your identity. We will respond within the time limit prescribed by applicable law; if we cannot respond in accordance with the law, we will explain the reasons. For requests that are manifestly unreasonable, repetitive, or require excessive technical means, we may handle them to the extent permitted by law.

10. Protection of Minors' Personal Information

This Website is primarily intended for adult users with commercial, professional, or investor‑relations needs, and does not target minors under the age of 14 as its main audience. We do not actively collect personal information of minors under 14.

If you are a parent or guardian of a minor and discover that the minor has provided personal information to us without proper consent, please contact us through the methods listed in this policy. After verification, we will handle it in accordance with the law.

11. Policy Updates

We may update this policy due to changes in website functions, processing purposes, suppliers, technology, or applicable laws. After updating, we will publish it on this Website and indicate the update date. For significant changes in purposes, methods, or types of information, we will notify you through prominent notices, pop‑ups, emails, or other appropriate means, and re‑obtain your consent when required by law.

12. Contact Us

If you have any questions, comments, complaints, or requests regarding this policy, our personal information processing activities, or your personal information rights, please contact us through the following methods:

Personal Information Controller: Zhongji Innolight Co., Ltd.

Personal Information Protection Officer/Contact Department:IT Department

Email: shrek.tang@innolight.comPhone: 0535-8573361

After verifying your identity, we will handle your request within the time limit prescribed by applicable law or a reasonable period. If you are not satisfied with our handling, you may also lodge complaints or reports with the authority responsible for personal information protection, or seek judicial relief in accordance with the law.