FLOSSOM Privacy Policy

This "Privacy Policy" (hereinafter referred to as the "Policy") outlines how FLOSSOM (Shanghai) Beauty Technology Co., Ltd. or its affiliated companies (collectively referred to as "the Company" or "we") handle your personal information when you use FLOSSOM's products and/or services, as well as the ways we provide you access, update, delete, and protect such information. Your trust is paramount to us, and we understand the importance of your personal information. We will adhere to legal and regulatory requirements and implement appropriate security measures to safeguard your user information.

Special Notice: Please read and fully understand this Privacy Policy (key points are highlighted for your attention) before using our products or services, and make an informed choice. By using or continuing to use our products or services, you agree to our processing of your relevant information in accordance with this Privacy Policy.

Should you have any questions regarding this Privacy Policy, please contact us using the information provided in the "How to Contact Us" section.

I.How We Collect and Use Your Personal Information

During your use of FLOSSOM services, we will collect information generated from or necessary for the use of the service, in accordance with the principles of legality, propriety, necessity, and transparency.

To fulfill our basic business functions, we need to collect personal information from you. Refusal to provide such information may affect our ability to offer certain services.

If we intend to use your personal information for purposes not specified in this Policy, we will inform you in a reasonable manner and obtain your consent before proceeding.

Please note: If you provide personal information that does not belong to you, ensure that you have obtained the consent of the relevant individual.

Details of our purposes and usage of your personal information are as follows:

(a) Core Functions

1.Account Registration, Login, and Verification

To facilitate service delivery, you need to provide basic registration or login information, including an email address for account login. Upon login, we will access your profile picture, nickname, region, as well as corresponding open_ID, user_ID, etc., and use such information within the scope of your consent. Refusal to provide this information may result in limited or no access to our services.

If you navigate from our platform to a third-party product or service page, please note that the products or services are provided by third-party entities. If personal information is collected directly from you by third parties, we recommend thoroughly reviewing and understanding their privacy policies or regulations.

2.Customer Service or Complaints

When filing complaints, appeals, or inquiries related to FLOSSOM services, you need to provide your contact information for order verification. For online customer service, you may choose to provide feedback through the FLOSSOM user center.

3.Profile Picture Modification

When modifying your account profile picture, you may need to take a photo or select an image from your album.

(b) Expanded Business Functions and Services

1.Device Permissions

During service delivery, we may request access to certain device permissions on your mobile device. The following table outlines the corresponding business functions, the purpose of accessing these permissions, whether we ask for your consent, whether you can disable these permissions, and whether they are mandatory for service provision.

Note: Enabling any permission signifies your authorization for us to collect and use the related personal information to provide corresponding services. Disabling a permission cancels your authorization, and we will cease collecting and using the relevant information for that specific

2.Other Service Functions

If you use other service functions we provide that involve the collection of your personal information, we will separately explain the scope and purpose of information collection to you and obtain your consent. We will use, store, provide externally, and protect your information in accordance with this policy and the relevant service agreement. If you choose not to provide it, we may not be able to provide you with the corresponding services.

Under the premise of complying with laws and regulations, in order to ensure the security of your account and provide you with better services, we will collect and use the following information generated during your use of the [HUAZHI] service:

(1) Device Information

This information is the unique identifier of the device, and we may associate it with you so that we can provide you with consistent services.

When you use related services through [HUAZHI], we will collect your device information, including device type, device serial number, IMEI number, and operating system version number.

If you use our services through [HUAZHI], we will collect your device type, IMEI number, operating system version number, carrier information and usage, information related to the device's location, IP address, device model, operating system version number, Android ID (Android only).

(2) Log Information

We collect your log information to help us statistically analyze the usage of [HUAZHI]-related services, optimize [HUAZHI]-related service functions, and provide you with a better service experience.

When you use [HUAZHI]-related services, we will automatically collect detailed information about your use of [HUAZHI] services and save it as a network log, including device type, browsing history, click events, and the success or failure of events.

If you use our services through [HUAZHI], in addition to the above information, we may also collect your network diagnosis and lag information.

(3) Care Operation Information

When you perform care operations through [HUAZHI], we will collect the care time, usage mode, and number of care days generated during the care operation process, both online and offline.

This information will be stored through the system and provide users with a review of historical care records to facilitate users' confirmation of their care history. We may use care operation information for product upgrade and optimization analysis to improve the service experience.

(4) Skin Data Information

When you conduct online care and moisture testing modes through Bluetooth connection, we will collect the total energy value and moisture test level generated during the care process, and provide users with a review of historical care records to facilitate users' understanding of changes in the instrument's output energy and users' moisture levels. We may use care operation information for product upgrade and optimization analysis to improve the service experience.

(5) Email Information

When you register for a personal account, we will collect your email information, which is mainly used to match user and device information to provide you with more accurate services.

(6) Other Information

After you register for a personal account, you can improve your avatar, nickname, region, birthday, and other personal information based on your personal wishes and needs. However, this information is not necessary, and not filling it in will not affect your normal use.

When you participate in activities, you may need to upload your experiences, photos, videos, and other information about product usage, but this information is not necessary, and not filling it in will not affect your normal use. We may use care operation information for product upgrade and optimization analysis to improve the service experience.

Other necessary information related to the purpose of this policy.

3.Your Personal Information We Obtain from Third Parties

To provide services, we may need to indirectly obtain your personal information from third parties (our partners). We will require third parties to explain the source of the information and ensure the legality of the information they provide. If the personal information processing activities we need to carry out for business exceed the scope of your original authorization and consent when providing personal information to third parties, we will obtain your explicit consent before processing such personal information. Third parties may have separate privacy policies/personal information protection policies and user agreements. Please read them carefully. If you refuse to allow third parties to collect, use, or transmit your personal information when providing services, it may result in your inability to use our products or services.

4.Special Circumstances for Collection, Use, and External Provisi

According to laws and regulations, your personal information can be collected and used without your consent in the following circumstances:

(1) Related to fulfilling obligations stipulated by laws and regulations;

(2) Directly related to national security and national defense security;

(3) Directly related to public safety, public health;

(4) Directly related to criminal investigation, prosecution, trial, and execution of judgments;

(5) Related to safeguarding your or other users' significant legitimate rights and interests, such as life and property, where obtaining consent from the individual is difficult;

(6) The personal information involved is voluntarily disclosed by you to the public;

(7) Necessary for signing and fulfilling contracts upon your request;

(8) Collecting personal information from legally disclosed sources, such as legitimate news reports, government information disclosures, and other channels;

(9) Necessary for maintaining the secure and stable operation of provided products and/or services, for example, detecting and resolving faults in our products and/or services;

(10) Other circumstances stipulated by laws and regulations.

II.How We Store Your Personal Information

We will store your personal information collected within the territory of the People's Republic of China within the territory of the People's Republic of China.

In cases where certain businesses involve cross-border operations and we need to transmit relevant personal information collected domestically to overseas institutions, we will comply with domestic laws, administrative regulations, and the provisions of relevant regulatory authorities. We will also inform you of the purpose of the personal information transfer and the types of personal information involved, and obtain your consent. We will require the information recipient to keep your personal information confidential in accordance with the requirements of this privacy policy and any other relevant security and confidentiality measures.

We will retain your personal information for the shortest period necessary based on your use of the platform services and within the period stipulated by laws, regulations, or supervisory requirements to achieve the processing purpose. If you terminate the use of our products and/or services, we will stop collecting and using your personal information, except as otherwise stipulated by laws, regulations, or regulatory authorities. If our products and/or services cease to operate, we will also promptly stop collecting and using your personal information. At the same time, we will notify you of the cessation of operations through official channels or in-site messages, and will delete or anonymize the stored personal information of yours.

III.How We Use Your Personal Information

Pursuant to the provisions of relevant national laws and regulations, and for the purposes of providing services to you and enhancing service quality (including supporting the development of new products or improving the functionality of existing products), we may use your relevant information under the following circumstances, taking adequate measures to ensure security in the process:

1.To Provide "HuaZhi"-related Services: Based on the aforementioned collection purposes and to provide you with "HuaZhi"-related services.

2.Compliance with Governmental Requests: In accordance with the requirements of relevant national departments, we may report your information to such departments.

3.Platform Service Operations: When you use our platform services, we will use your information for identity verification, customer service, security precautions, etc., to ensure the security of the products and services we provide to you.

4.Statistical Analysis and Personalization: We may conduct comprehensive statistical, analytical, or processing of your identity information, transaction information, etc., to provide you with more accurate, personalized, and seamless products and services, or to assist us in evaluating, improving, and designing our products and services. This enables us to understand how you access and use our platform services, thereby fulfilling your personalized needs.

5.User Profiling for Enhanced Experience: To enhance user experience and improve our products and services, we may create user profiles based on your information, which may be used to send you marketing notifications, commercial electronic messages, and advertisements relevant to you. If you have any questions about this, please contact us through customer service.

6.Other Purposes with Your Authorization: For other purposes authorized by you.

If we intend to use your personal information for purposes not specified in this policy or that exceed the scope directly or reasonably related to the purposes for which the information was collected, we will, prior to such use, seek your consent again in accordance with laws, regulations, and national standards, through methods such as clicking to confirm an agreement or specific in-context confirmation actions.

IV. How We Disclose Your Personal Information

(a) Sharing

1.We will not share your personal information with any third-party companies, organizations, or individuals, except in the following circumstances:

(1) Based on your own request or with your explicit consent or authorization in advance;

(2) Required by mandatory provisions of laws, regulations, administrative, or judicial departments;

(3) Necessary to protect the interests, property, or safety of ourselves, our affiliates or partners, you, or other "HuaZhi" users, or the public, within the scope permitted by laws and regulations;

(4) Only by sharing your personal information can we achieve the core functions of our products and/or services or provide services you require;

(5) To handle disputes or controversies between you and others upon your request;

(6) In accordance with relevant agreements signed with you (including electronically signed agreements and corresponding platform rules) or other legal document provisions;

(7) For academic research purposes;

(8) For public health emergencies or social public interests in compliance with laws and regulations.

2.To ensure that we can provide you with products and services through our platform, recommend information that may interest you, or protect the personal and property safety of our affiliates, other users, or the public from infringement, your personal information may be shared with our affiliates. We will only share necessary personal information and be bound by the purposes stated in this policy. If we share your sensitive personal information or if our affiliates change the purpose of using or processing your personal information, we will seek your authorization and consent again.

Please note that the information you voluntarily share or even publicly disclose when using our services may involve your or others' personal information, including sensitive personal information. Please consider and decide carefully before sharing.

(b)Entrusted Processing

We may entrust authorized partners to process your personal information in order to provide you with corresponding products or services. However, we will only share your personal information for lawful, legitimate, necessary, specific, and explicit purposes, and will only share the personal information necessary to provide the products or services. If our partners use your personal information for purposes that we have not entrusted them to, they will separately obtain your consent.

Our partners include the following types:

(1) Suppliers providing technical services. We may provide your personal information to third parties that support our functions, including suppliers who provide us with infrastructure technical services, data analysis services, data processing services, etc.

(2) Advertising and analytics service partners. We will comply with laws and regulations as well as industry-standard security technologies, and entrust these partners to process information related to advertising placement, reach, and effectiveness.

For partners entrusted by us to process personal information, we will sign data protection agreements with them, requiring them to handle personal information in accordance with the agreements, this Privacy Policy, and relevant laws and regulations. To ensure that data is secure and controllable in the hands of third parties, we have launched cloud services, providing a secure and reliable data usage and storage environment in the cloud to ensure the security of user data.

(c)Transfer

In cases where personal information needs to be transferred due to reasons such as mergers, divisions, dissolutions, or being declared bankrupt, we will inform you of the name or identity and contact information of the receiving party, and require the company or organization receiving your personal information to continue to be bound by this Privacy Policy. Otherwise, we will require that company or organization to seek your authorization and consent anew.

(d)Public Disclosure

We will only publicly disclose your personal information under the following circumstances, and only after taking security measures that meet industry standards:

(1) Disclosure of corresponding personal information within the scope of authorization that you have separately agreed to;

(2) If you seriously violate laws and regulations or relevant agreements and rules, we may disclose your relevant violations and the measures we have taken against you.

V. Your Rights

(a)Access, Modify, Delete Your Personal Information or Change, Withdraw the Scope of Your Authorization and Consent

1.In order for you to use our services normally, you need to provide us with some basic personal information. If you wish to modify your previously saved email, you can enter the personal information page to make the change. You have the right to log in and access your account at any time to view your personal information.

2.If you wish to access, modify, delete your other personal information, or change, withdraw the scope of your authorization and consent, or encounter difficulties in exercising the above rights, you can contact us through the contact information provided in Article IX of this policy. We will respond to your request promptly after verifying your identity, unless otherwise stipulated by laws and regulations or agreed upon in this policy.

(b)Stop Using and Deactivate Your Account

Unless otherwise stipulated by laws and regulations or agreed upon in this policy, when you no longer wish to continue using the services we provide or deactivate your account, you can contact our customer service for assistance. We will complete the deactivation within 15 working days after receiving your deactivation request.

Please note that we may send you some service-related announcements when necessary (e.g., service suspension for maintenance), and such announcements do not constitute personalized push notifications.

VI. Disclaimer

1.We serve solely as the provider of the platform for "Huazhi" services,and are not a participant in the services or service transactions conducted between you and any third party. We make no express or implied warranties regarding the legality or validity of third-party services. We shall not be held liable for any disputes or controversies that may arise from your use of third-party services.

2.Under no circumstances shall we be responsible for any indirect, consequential, exemplary, incidental, special, or punitive damages, including losses incurred from your use of third-party services.

3.You should keep your relevant materials, information, and hardware devices securely, and ensure that your mobile phones and other mobile terminal devices operate and are used in a secure, virus-free, unhacked, unmonitored, and not illegally controlled environment. Risks and losses arising from your improper storage or management shall be borne by you. Furthermore, you shall assume the corresponding risks for your actions taken while using the "Huazhi" services.

VII. Protection of Personal Information of Minors

Our products/services are primarily intended for adults (aged 18 and above). Minors should not create their own personal information subject accounts without the consent of their parents or guardians. If you are a minor under the age of 18, in cases where your information is collected with the consent of your parents or guardians, we will only use, share, transfer, or disclose such information when permitted by laws and regulations, with explicit consent from your parents or guardians, or when necessary to protect the minor.

If we discover that personal information of minors has been collected without prior verifiable consent from their parents or guardians, we will endeavor to delete the relevant data as soon as possible.

If you are the parent or guardian of a minor and have any questions regarding the personal information of the minor under your guardianship, you may contact us through the means provided in the "How to Contact Us" section of this Privacy Policy.

VIII. Changes and Revisions to the Privacy Policy

1.This Policy may be updated from time to time. In addition to publishing any changes to this Policy on this page, we may also provide a pop-up notification when you log in to our "Huazhi" platform or use our products and/or services.

2.Significant changes to this Policy may include, but are not limited to, the following circumstances:

(1)Significant changes to the service models we provide, such as the purpose of processing personal information, the types of personal information processed, and the manner in which personal information is used;

(2) Major changes to our basic circumstances, such as ownership changes due to business adjustments, bankruptcies, mergers, or acquisitions;

(3) Changes to the primary parties to whom we provide personal information externally;

(4) Significant changes to the way you access and manage your personal information;

(5) Changes to the channels, mechanisms, or contact information for your inquiries and complaints;

(6) Other changes that may have a significant impact on your rights and interests related to personal information.

IX.How to Contact Us

To better realize your user rights as described in this Policy, if you have any questions, complaints, or suggestions regarding this Policy, you may contact us via this email address (app@flossom.com). For security purposes, in response to your request, we will, in principle, first require you to submit corresponding proof to verify your identity. Once your identity is verified, we will promptly process your request.

X.Dispute Resolution

The interpretation and dispute resolution of this Privacy Policy shall be governed by the laws of the People's Republic of China. You agree to submit any disputes arising from this Privacy Policy or our handling of your personal information to the people's court where our company is located.

If you believe that our handling of your personal information has infringed upon your legitimate rights and interests, you may report it to relevant government departments.

IX X