Sinar Mas Group Privacy Policy

In order to provide you with better services, we may collect and process your personal information during the provision of services or products. This includes, but is not limited to, your browsing and use of any online services we own and operate, such as our website ("this Website"), online stores, membership systems, business systems, mobile applications (APP), WeChat Official Accounts, and WeChat Mini Programs. Personal information includes, but is not limited to: name, address, ID card number, mobile phone number, WeChat OpenID, profile picture, and nickname. We may also collect information you provide through other means, such as visiting our physical stores, calling our inquiry hotline, or applying for and enjoying services like VIP cards, member sales events, and job applications. We do not knowingly solicit personal or other information from any person under the age of 18. If you are under 18, you must obtain the prior written consent of your parents or legal guardians before using our products or services. Without such written consent, you should not use our services or create a user account. By browsing our website, you confirm that your parents or legal guardians were notified of this Privacy Policy prior to any registration or use of personal information, and that they have approved such actions under these terms. If it is subsequently proven that your parents or legal guardians did not consent to our provision of services or the collection of your personal information, we will, in accordance with applicable laws, cooperate in deleting the information and cease providing the relevant products or services. The personal information you provide is necessary for us to deliver the requested services and fulfill our contractual obligations to you, if any. If you fail to provide such data, we may be unable to provide the requested services, achieve the intended results of those services, or respond to and resolve the issues you encounter. Certain personal information may be deemed sensitive due to its nature, such as fingerprints, race or ethnicity, religious beliefs or philosophical views, and facial recognition data. Such sensitive information receives stricter protection compared to standard personal data. Please be aware that the content you provide, upload, or post while using our services may inadvertently disclose sensitive personal information. You should carefully consider whether to disclose such information during your use of our services. Your personal information will be stored securely within our systems. We take all practicable measures to ensure that personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, including any directly related purposes. Additionally, when you browse this Website or use this Application, we collect basic technical data sent by your browser, such as browser type and language, access times, the referring website address, IP address, device type, and clickstream data (i.e., your activities within the Website or Application). This data is collected via automatic tools, including Cookies and other common technologies, to improve the functionality of our Website and Application. Further information regarding Cookies is provided below.

We may use the personal information you provide to us within and outside the People's Republic of China (PRC) for the following purposes (and any purposes directly related to such purposes) (collectively, the "Relevant Purposes"): (a) Identifying and verifying your identity; (b) Communicating with you regarding your use of our services, products, mobile applications, and/or websites (as applicable); (c) Information and database management; (d) Providing our services to you (including evaluating service applications and managing such services); (e) Matching your personal information with data provided to us by other means; (f) Monitoring and analyzing the usage of our services, products, customer behavior, mobile applications, and/or websites to further develop and improve our offerings; (g) Complying with applicable laws, regulations, or codes of practice within or outside the PRC; (h) Legal proceedings, including the recovery of overdue payments; (i) Preventing or detecting crimes, and ensuring the security of our products or services; (j) Software authentication or managing software upgrades; (k) Other purposes directly related to the above; (l) Conducting direct marketing via fax, email, direct mail, telephone, and/or other communication forms to notify you of activities, services, products, and publications from us (and/or our partners and related institutions). If you choose not to receive such information, you may contact us by calling our customer service at 021-22866678 during the operating hours of The Stage Shanghai Observation Deck (10:00-22:00). We will cease such marketing activities at no charge to you.

We will not rent, sell, or share your collected personal information with third parties except: (i) to provide the information or services you have requested; (ii) with your express consent; or (iii) under the following circumstances: A. We may share your personal information with companies within our group, partners, third-party service providers, contractors, and agents. We may also permit third parties to collect your personal information while providing our services to you. Any such permission is granted solely for the following purposes: • To provide our services to you; • To assist us in achieving the purposes described in the "Use of Data" section; • To fulfill our obligations and exercise our rights under this Privacy Policy; • For our business dealings, including helping us better understand, maintain, and improve our services. The locations of these third parties, as well as the sites where they use and store your personal data, may be outside of your jurisdiction. Where we permit such third parties to collect and use your personal information under the aforementioned requirements, we will take reasonable measures to ensure their compliance with this Privacy Policy and our other relevant requirements, including the implementation of appropriate confidentiality and security measures. B. Under special circumstances, we may disclose and use personal or non-personal information if such disclosure is for the purpose of: • Complying with applicable laws or the mandates of courts, procuratorates, public security organs, and any regulatory agencies or organizations; • Protecting the personal and property safety or legal rights of the Sinar Mas Group, our companies, customers, other users, or employees; • Providing data to our subsidiaries and affiliates for purposes related to business operations or services; • Investigating, preventing, or taking action against illegal or improper activities; • Facilitating mergers, sales, acquisitions, transfers of all or part of our assets, or any similar corporate transactions; • Transferring personal information externally that has undergone de-identification processing.

A. Non-personal Information: Even if you do not provide any personal information, we will collect data based on your use of this Website (referred to as "non-personal information"). Non-personal information cannot be used to verify your identity. Like many other websites, we obtain non-personal information such as IP addresses, browser types, the name of your ISP (Internet Service Provider), the address of the website you visited prior to this Website, the specific pages you visit, the sequence of your visit, and the time spent on each page. Our contractors assist us in collecting and compiling this information by using cookies to provide us with relevant reports. Through non-personal information, we can personalize the content you see, improve our services, conduct research, and provide anonymous aggregate reports for internal audits and third parties. B. Cookies: Cookies are small data files that typically include an anonymous unique identifier sent by a website's server to be stored on your computer's hard drive. Their use is standard practice across the Internet. With your browser's permission, a website can send its own cookies to your browser. However, to protect your privacy, your browser only allows a website to access the cookies it has sent, rather than those sent by other sites. You can configure your browser to accept or reject all cookies, or to notify you when a cookie is being sent (as browser settings vary, please consult your browser's "Help" menu to modify your cookie preferences). You may also reset your browser to refuse all cookies. Please note that if you refuse cookies, certain functions of this Website may be affected. We may be unable to provide the specific services or information you require, and your overall service experience may be impacted as some features may not function normally. Furthermore, while you will still receive the same volume of advertisements, they will be less relevant to your interests. In addition, advertisers or other partners may place cookies on our products and services. These cookies may collect non-personally identifiable information to analyze how users interact with such services, deliver advertisements of interest to you, or evaluate the effectiveness of advertising campaigns. The collection and use of information by these third-party cookies are not governed by this Privacy Policy, but are instead subject to the privacy policies of the respective third parties. We assume no responsibility for third-party cookies.

Ensuring the security, integrity, and confidentiality of your information is crucial to us. We have implemented technical, administrative, and physical security measures specifically designed to protect visitor information from unauthorized access, disclosure, use, or modification. We periodically review our security procedures and consider the adoption of appropriate new technologies and methods. Please note that while we do our utmost to protect relevant information, no security measure is perfect or impenetrable. It is important to understand that the systems and communication networks you use to access our services may experience issues due to factors beyond our control. We will retain your personal information for the duration necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

For your convenience, this Website or other online services may, from time to time, contain links to external websites operated by third parties. We have no control over and assume no responsibility for such third-party websites or their content. Once you leave this Website, we are no longer responsible for the protection and privacy of any information you provide to these external sites. You should exercise caution and review the privacy statements of any website you visit.

We periodically review this Privacy Policy and may revise its provisions from time to time by updating this webpage. Such revisions constitute an integral part of this Privacy Policy. Your continued use of our services following the modification of this Privacy Policy indicates that you have fully read, understood, and agreed to be bound by the revised version. Therefore, we encourage you to visit this webpage regularly to stay informed of the latest information regarding our Privacy Policy.

We generally store your data on our servers located within the People's Republic of China (PRC). However, we may also transfer this data to our offices outside the PRC for inclusion in our databases. If you are located in the European Economic Area (EEA), your personal information may be transferred to countries outside the EEA that may not provide a level of protection equivalent to or adequate as that provided within the EEA. Such transfers will only be conducted in accordance with applicable laws, including transfers necessary to fulfill our contractual obligations to you. We will take all reasonably necessary steps to ensure that your personal information is securely protected and handled in accordance with this statement.

By using our services, submitting applications, or browsing this Website and utilizing other online services, you confirm your acceptance of our collection and use of your personal information as outlined in this statement. You have the right to: • Verify whether we hold your data, access such data, and request the correction of any inaccuracies or the withdrawal of your authorization. (Upon the modification or withdrawal of your authorization for the collection and use of personal information, we will cease to collect, process, or use your data beyond the scope of the revised authorization or withdrawal. However, such modification or withdrawal does not affect any data processing previously carried out based on your prior consent. Please note that modifying or withdrawing authorization for certain information may result in our inability to provide products or services normally.) • Ascertain our policies and practices regarding personal information and the specific categories of data we hold.

You can access and manage your information through the following ways: (a) Querying, correcting, and supplementing your information You have the right to query, correct, or supplement your information. You can perform these actions yourself through: • Logging in to the WeChat Official Account or Mini Program client to query, correct, or supplement information such as your personal profile, account security settings, and delivery addresses; • Contacting our customer service for assistance in querying, correcting, or supplementing your information. (b) Deleting your information You may delete portions of your information using the methods specified in "(a) Querying, correcting, and supplementing your information". You may submit a request to us to delete your personal information under the following circumstances: • If our processing of personal information violates applicable laws and regulations; • If we collect or use your personal information without obtaining your explicit consent; • If our processing of personal information constitutes a serious breach of our agreement with you; • If we permanently cease to provide products or services to you. If we decide to fulfill your deletion request, we will also simultaneously notify the entities that obtained your personal information from us and request that they delete it promptly (unless otherwise stipulated by laws and regulations, or if these entities have independently obtained your authorization). After you have deleted, or we have assisted you in deleting, the relevant information, we may not be able to immediately remove the corresponding data from our backup systems due to applicable laws and security technical constraints. In such cases, we will securely store your personal information and isolate it from any further processing until the backup can be cleared or anonymity is achieved. (c) Responding to your above requests To ensure security, you may be required to provide a written request or otherwise prove your identity. We may ask you to verify your identity before processing your request. We will provide a response within 15 days. If you are not satisfied, you may also file a complaint through our customer service. In principle, we do not charge a fee for reasonable requests; however, for requests that are repeated multiple times or exceed reasonable limits, we may charge a fee as appropriate. We may reject requests that are not directly related to your identity, involve ungrounded repetitive information, or require excessive technical means (for example, requiring the development of a new system or fundamental changes to existing practices). We may also decline requests that pose a risk to the legitimate rights and interests of others or are deemed impractical. In the following situations, in accordance with the requirements of laws and regulations, we will be unable to respond to your request: • Related to national security and national defense security; • Related to public safety, public health, and major public interests; • Related to crime investigation, prosecution, trial, and execution of judgments, etc.; • Where there is sufficient evidence showing that the personal information subject has subjective malice or is abusing their rights; • Where responding to your request would result in serious damage to the legitimate rights and interests of you or other individuals and organizations; • Where the request involves trade secrets. If you wish to exercise any of the aforementioned rights, opt out of marketing communications, and/or raise questions or complaints, please contact our customer service at 021-22866678 during the operating hours of The Stage Shanghai Observation Deck (10:00-22:00, subject to actual daily business hours). Where permitted by law, we may charge a reasonable fee for processing requests to access data.

Except for the exemptions regarding personal information and privacy specified in the "Disclosure" section above, we shall not assume any responsibility in the following situations: (a) Any leakage of personal information resulting from you disclosing your user password to others or sharing your registered account with third parties; (b) Any leakage, loss, theft, or alteration of personal information caused by force majeure events affecting normal network operations, such as hacker attacks, computer virus intrusions or outbreaks, temporary closures due to government regulation, or other unforeseen technical disruptions; (c) Personal information leakage caused by external websites linked to this Website and any subsequent legal disputes or consequences arising therefrom; (d) Our compliance with the requirements of relevant government authorities, applicable laws and regulations, court orders, or the provisions of other legal procedures; (e) Uses reasonably necessary for us to comply with applicable laws and regulations, safeguard public interests, or protect the personal and property safety or legitimate rights and interests of our customers, our group, other users, or employees.

The interpretation and dispute resolution of this Privacy Policy shall be governed by the laws of the Mainland of the People's Republic of China. Any dispute arising from this Privacy Policy or our handling of your personal information shall be submitted by both parties to the Shanghai Arbitration Commission (SHAC) for arbitration in accordance with the arbitration rules of the SHAC in effect at the time of the application. The language of arbitration shall be Chinese. The arbitral award shall be final and binding upon both parties. (Last Updated Date: [March 2, 2026])