Koruoakhouse Privacy Policy Agreement：

Welcome to the Koruoakhouse independent website (hereinafter referred to as 'this website'). This website is legally operated by Koruoakhouse Company (hereinafter referred to as 'we'). We highly value the protection of your personal information (hereinafter referred to as 'you') and strictly abide by the relevant laws and regulations such as the *Personal Information Protection Law of the People's Republic of China*, the *Cybersecurity Law*, the *Data Security Law*, and the *Regulations on the Administration of Network Data Security*. We also consider international rules such as the EU's General Data Protection Regulation (GDPR) (if you are an overseas user). Therefore, we have formulated this Privacy Policy Agreement to clarify the methods and scope of our collection, use, storage, transmission, and disclosure of your personal information, as well as your related rights. Please read and understand this agreement carefully. Your access to, browsing, registration, or use of this website and related services constitutes your full understanding and agreement to all terms of this agreement. If you do not agree to this agreement, please do not use this website and related services.

I. Definitions and Interpretations

Unless otherwise expressly agreed in this agreement, the following terms have the following meanings:

- This website: refers to the independent website legally operated by Koruoakhouse Company, used to provide functions such as product display, transactions, customer service, and information dissemination.

- User: Refers to any individual or legal entity (hereinafter collectively referred to as 'you') who accesses, browses, registers, or uses this website and related services.

- Personal Information: Refers to various information recorded electronically or otherwise that relates to an identified or identifiable natural person, excluding anonymized information, including but not limited to name, contact information, address, device information, etc.

- Sensitive Personal Information: Refers to personal information that, if leaked, illegally provided, or misused, may endanger personal or property safety, and is highly likely to cause damage to personal reputation, mental or physical health, or discriminatory treatment, including but not limited to ID card number, bank card number, payment information, and whereabouts.

- Processing: Refers to a series of operations including collection, storage, use, processing, transmission, provision, disclosure, and deletion of personal information.

- Anonymization: Refers to the process of processing personal information to make it impossible to identify a specific natural person and to restore it.

II. Our Commitment

1. Legality and Compliance Principle: We strictly adhere to the principles of legality, legitimacy, necessity, and good faith in processing your personal information, without violating laws and regulations, and without collecting or using personal information beyond a reasonable scope.

2. Principle of Openness and Transparency: We will clearly and explicitly inform you of the purpose, method, and scope of your personal information processing, without concealment or misleading you, ensuring your right to know.

3. Principle of Security: We will take necessary technical and management measures to protect the security of your personal information, preventing information leakage, tampering, and loss, and assume primary responsibility for the security of the personal information we process.

4. Principle of Consistency of Rights and Responsibilities: We will process your personal information in accordance with this agreement, assume corresponding legal responsibilities, and respect and protect your legally protected rights to personal information.

5. Principle of Dynamic Adaptation: We will revise this Privacy Policy in a timely manner according to updates to relevant laws and regulations and adjustments to the business of this website, and will publish it in a prominent position on this website to ensure that the terms always comply with compliance requirements.

III. Collection of Personal Information

3.1 Scope of Collection

We collect your personal information solely to provide this website's services, fulfill contractual obligations, ensure service security, and comply with legal and regulatory requirements. This includes the following categories, all collected based on the principle of 'minimum necessary,' and will not exceed the scope of collection:

- Basic Identity Information: Your name, gender, nationality, contact information (mobile phone number, email address), mailing address, etc., which you proactively provide when registering or using this website's services, for identity verification, account management, and service communication.

- Account Information: Your username, password (stored in encrypted form), security questions and answers, social media account association information, etc., which you set when registering your account on this website, for account login, identity verification, and security.

- Transaction Information: Order numbers, product information, payment methods, payment amounts, invoice information, and delivery information (recipient's name, address, contact information), etc., generated when you conduct transactions on this website, for processing orders, completing transactions, providing after-sales service, and fulfilling tax obligations.

- Usage Behavior Information: Your browsing history, viewed products, search keywords, clickstream data, page dwell time, device information (including but not limited to device model, operating system, browser type, IP address, and IP geolocation), cookie information, and log files, used to optimize website functionality, improve user experience, conduct market research and business analysis, and mitigate security risks.

- Preference Settings Information: Your chosen website language, font size, and willingness to receive marketing information, used to provide you with personalized services.

- Other Information: Information you voluntarily provide for feedback, participation in activities, and other information required by laws and regulations (such as information necessary to fulfill legal procedures).

If you are a minor (under 14 years old), please use this website's services under the supervision of a guardian, and the guardian must provide relevant consent documents. We will only collect the minor's personal information necessary to provide the service and will take special protective measures.

3.2 Collection Methods

- Voluntary Provision: Personal information you voluntarily provide to us when registering an account, filling out orders, submitting feedback, or participating in activities.

- Automatic Collection: When you visit or browse this website, we automatically collect your usage behavior information and device information through technical means. This collection is solely for the purpose of ensuring the normal operation of services and optimizing user experience.

- Third-Party Acquisition: With your explicit consent, we may obtain your relevant personal information from legitimate and compliant third parties (such as payment service providers and logistics service providers) to complete transactions and provide services. We will require third parties to provide proof of the legality of the information source and supervise its information security.

3.3 Legal Basis for Collection

We collect your personal information based on the following legal basis to ensure compliance:

- Your Explicit Consent: By checking the box to agree to this Privacy Policy, registering an account, or submitting personal information, you indicate your consent to our collection of the corresponding personal information.

- Contractual Needs: Information necessary to fulfill the transaction contract signed with you and to provide the services you request, such as collecting delivery information for logistics and distribution.

- Legal Obligations: Information necessary to fulfill obligations stipulated by laws and regulations, such as information required to fulfill tax, audit, and regulatory requirements.

- Protection of Legitimate Rights: Information necessary to protect the life, physical health, property, and other vital legitimate rights and interests of us, you, or other individuals, such as information needed to prevent fraud and respond to security incidents.

IV. Use of Personal Information

We will strictly comply with the provisions of this agreement and the requirements of laws and regulations when using your personal information, and will not exceed the scope of the purpose clearly stated at the time of collection. If it is necessary to expand the scope of use, we will obtain your explicit consent separately. Specific purposes of use include:

- Account Management: Verifying your identity, managing your account information, providing you with services such as account login, password retrieval, and personalized settings, and ensuring account security.

- Service Provision: Processing your orders, arranging product delivery, providing after-sales service (such as returns and exchanges, after-sales consultation), sending order confirmations, logistics information, service notifications, etc.

- Website Optimization: Analyzing user needs based on your usage behavior information, optimizing the functions, page design, and service processes of this website, and improving user experience.

- Marketing and Promotion: With your consent, we will send you promotional information, product updates, customer care emails or text messages from this website. You may withdraw such consent at any time.

- Security: Detecting, preventing, and responding to security threats, preventing fraud, cyberattacks, malicious access, etc., ensuring the security of this website and your account, and maintaining service order.

- Legal Compliance: Meeting the requirements of tax, audit, and regulatory agencies, responding to legal proceedings, investigations, or arbitrations, and fulfilling other obligations stipulated by laws and regulations.

- Anonymization: We may anonymize your personal information. Anonymized information can be used for business analysis, market research, product development, etc. This type of information is no longer considered personal information and is not subject to the provisions of this agreement.

V. Storage and Protection of Personal Information

5.1 Storage Period

We will store your personal information according to the principle of 'minimum necessary, shortest period,' and the storage period will be strictly controlled within the scope necessary to achieve the collection purpose. If the collection purpose has been achieved, you cancel your account, or the storage period stipulated by laws and regulations expires, we will promptly delete your personal information or anonymize it to ensure that your identity cannot be identified.

If the storage period needs to be extended due to fulfilling legal obligations, responding to security risks, resolving disputes, etc., we will continue to take security protection measures during the extended period, and the extension of the storage period will comply with laws and regulations.

5.2 Storage Method and Location

We will employ encrypted storage (such as SSL/TLS protocols), access control, and security authentication to store your personal information on secure servers, preventing information leakage, tampering, and loss.

Your personal information will primarily be stored within the People's Republic of China. If business needs require the transfer of information overseas, we will strictly comply with legal requirements, ensuring the overseas recipient meets personal information protection requirements through standard contract terms and other means, and obtain your explicit consent. We will also supervise overseas information processing activities.

5.3 Security Protection Measures

We have established and improved our network data security management system and adopted comprehensive security protection measures to safeguard your personal information:

- Technical Measures: We employ data encryption, firewalls, intrusion detection, and data backup technologies to prevent network attacks and data leaks; sensitive personal information undergoes special encryption processing to ensure information security.

- Management Measures: We have established a strict access control system, allowing only authorized personnel to access personal information, clearly defining the privacy protection responsibilities of personnel in each position; and regularly providing personal information protection training to employees to enhance their awareness of privacy protection.

- Emergency Response: We have established an emergency plan for network data security incidents. In the event of a security incident such as leakage, alteration, or loss of personal information, we will immediately activate the emergency plan, take measures to prevent the harm from escalating, eliminate security risks, and notify you within 72 hours via your provided contact information (except where notification is not required by laws and regulations). We will also report to the relevant authorities.

- Third-Party Supervision: If we entrust a third party to process your personal information, we will stipulate their security protection obligations in the contract, supervise their information processing behavior, and require them to take corresponding security protection measures to ensure the security of your personal information.

Please note that the internet environment has a certain degree of uncertainty. Although we have taken the above security measures, we cannot completely eliminate the risk of information leakage. If your personal information is leaked due to force majeure, cyberattacks, third-party infringement, or other reasons not attributable to us, we will do our best to cooperate with you and relevant departments in the investigation and handling, and bear corresponding legal responsibility (if there is any fault on our part).

VI. Sharing, Disclosure, and Transfer of Personal Information

We strictly protect your personal information. Except as provided in this Agreement and as required by laws and regulations, we will not proactively share, disclose, or transfer your personal information. Specific circumstances are as follows:

6.1 Sharing

We may share your personal information with third parties only in the following circumstances, and such sharing complies with legal requirements, while requiring the third party to assume the same privacy protection obligations as us:

- With your explicit consent: With your consent, we will share your personal information with third-party service providers (such as payment processors, logistics service providers, marketing service providers, and technology service providers) to complete transactions and provide services.

- As necessary for providing services: We will share your personal information with third parties that provide the infrastructure or services of this website (such as cloud service providers and server hosting providers) to ensure the normal operation of this website.

- To fulfill legal obligations: Upon receiving a legitimate request from a government agency or judicial authority, we will provide your personal information to them in accordance with legal requirements.

- To protect legitimate rights and interests: To identify, track, and respond to malicious behavior, security incidents, infringements, etc., and to safeguard the legitimate rights and interests of us, you, or other individuals, we will share your relevant information when necessary.

- Sharing with Affiliates: If we merge or reorganize with other companies, or if we have affiliations, we may share your personal information among affiliates. However, affiliates must comply with the privacy protection obligations stipulated in this agreement. If an affiliate uses the information for purposes exceeding the original authorized scope, it must obtain your separate consent.

6.2 Disclosure

Except as otherwise stipulated in this agreement or as required by laws and regulations, we will not publicly disclose your personal information. If public disclosure is necessary due to legal procedures, public interest, or other reasons, we will adopt industry-standard security protection measures and inform you in advance of the purpose, type of information, and possible impact of the disclosure (except where notification is not required by laws and regulations), and obtain your explicit consent.

6.3 Transfer

We will not transfer your personal information to any third party unless we obtain your explicit consent, or if the transfer of personal information is necessary due to reasons such as merger, division, dissolution, or bankruptcy of the company. In such cases, we will ensure that the receiving party continues to fulfill its privacy protection obligations and will notify you promptly. If the receiving party is unable to fulfill its corresponding obligations, we will take measures to protect the security of your personal information.

VII. Your Personal Information Rights

According to relevant laws and regulations, you are entitled to the following personal information rights, and we will provide you with convenient ways to exercise them:

- Right to Know: You have the right to know the purpose, method, scope, storage period, and sharing targets of our processing of your personal information. You can inquire through this Privacy Policy, website customer service, etc.

- Right to Access: You have the right to inquire about the storage status and content of your personal information. You can apply for access through the 'Personal Center' on this website or by contacting customer service.

- Right to Correction: If you find that your personal information is inaccurate or incomplete, you have the right to request us to correct it. You can correct it yourself through the 'Personal Center' or contact customer service to apply for correction. We will process your application within a reasonable period after receiving it.

- Right to Deletion (Right to Be Forgotten): In the following circumstances, you have the right to request us to delete your personal information, and we will delete it promptly upon receiving your application: (1) The purpose of collection has been achieved and is no longer necessary; (2) You withdraw your consent; (3) We cease to provide related services; (4) You cancel your account; (5) Other circumstances stipulated by laws and regulations. - Right to limit or refuse processing: Under certain circumstances (such as when the purpose of information processing has been achieved, or when you do not consent to processing), you have the right to request us to limit or refuse to process your personal information. We will adjust the processing method according to your request.

- Right to withdraw consent: You may withdraw your previous consent to the processing of your personal information at any time. Withdrawal of consent will not affect the legality of the information processing actions based on consent prior to withdrawal. You can withdraw consent through website settings, customer service, etc.

- Right to portability: Under certain conditions, you have the right to request us to transfer a copy of your personal information to a third-party service provider you designate. We will do so in accordance with laws and regulations.