Data Protection Statement of Guangzhou Xuejiayan Biotechnology Co., Ltd.

Thank you for visiting our website at https://xuejayan.com/ and for your interest in our company, products, and services. Xuejiayan is a brand under Guangzhou Xuejiayan Biotechnology Co., Ltd. We take your privacy very seriously and strictly adhere to relevant laws and regulations. This statement explains how we collect, store, and process your personal data when you interact with our website, as well as your rights regarding access, correction, deletion, and other matters.

Personal data refers to any information relating to you personally—such as your name, address, email address, or user behavior.

Whenever we process personal data, engage third-party vendors to perform specific functions, or use your data for advertising purposes, we will detail these processes below—including the specific data involved, the legal basis for processing, and the data retention periods.

Name and Address of the Data Controller

The Data Controller complies with the General Data Protection Regulation (GDPR), Malaysia's Personal Data Protection Act 2010 (as amended in 2024), Singapore's Personal Data Protection Act 2012, Thailand's Personal Data Protection Act B.E. 2565 (2022), as well as the Personal Information Protection and Electronic Documents Act (PIPEDA) and the Personal Information Protection Law (PIPL). All personal data collected via TikTok Lead Generation Forms will be processed in strict accordance with local data protection laws applicable in Southeast Asia.

Xicheng Village, Renhe Town, Baiyun District, Guangzhou City
Guangzhou Xuejiayan Biotechnology Co., Ltd.
Guangzhou City, Guangdong Province, China
Tel: +86 13556533136
WhatsApp: +86 13556533136
Email: ljl19840520@gmail.com

Contact Details for the Data Protection Officer

You may contact our Data Protection Officer via the following methods:

Xicheng Village, Renhe Town, Baiyun District, Guangzhou City
Guangzhou Xuejiayan Biotechnology Co., Ltd.
Email: ljl19840520@gmail.com

Collection and Storage of Personal Data: Types, Purposes, Legal Basis, and Retention Periods

Website Access

When you use our website solely for informational browsing purposes (without registering or submitting any information), we collect access data that your browser transmits to our server log files. This data includes:

• IP address (anonymized);
• Date and time of the request;
• Time zone difference relative to Greenwich Mean Time (GMT);
• Content of the request (specific page);
• Access status/HTTP status code;
• Volume of data transferred;
• Referring website;
• Browser type, version, and language;
• Operating system.

This data is used to ensure the stability, security, and optimization of the website, and is subsequently deleted. The legal basis for this processing is Article 6, Paragraph 1(f) of the GDPR; our legitimate interest lies in ensuring the secure and efficient operation of the website. This data is stored separately from other personal data within log files and is deleted once the session has ended or when it is no longer required.

Use of Other Services, Features, and Offers

Our website offers various services—such as contact forms and an online store—to facilitate your purchase or customization of cosmetic products. The use of these services requires you to provide additional personal data, which we will process in the following manner:

Contact via Email, Contact Form, or WhatsApp

When you submit information (including your name, email address, and phone number) via the website's contact form, WhatsApp, or the official TikTok Instant Lead Generation Form, we will process such data only after obtaining your explicit and separate consent.

Under the Personal Data Protection Acts (PDPA) of Malaysia, Singapore, and Thailand, phone numbers are classified as sensitive personal data. We retain the personal data you submit for a maximum of 90 days solely for the purposes of quotation arrangements and business follow-up. Upon the expiration of this period, all relevant data will be permanently deleted. You may withdraw your consent to be contacted at any time without incurring any liability.

Data Transfer to Third Parties

Except in the following circumstances, your personal data will not be shared with third parties:

• You have provided explicit consent pursuant to Article 6, Paragraph 1(a) of the General Data Protection Regulation (GDPR) or applicable laws (e.g., Canada's Personal Information Protection and Electronic Documents Act [PIPEDA], China's Personal Information Protection Law [PIPL]);
• The transfer is necessary to fulfill a legal obligation pursuant to Article 6, Paragraph 1(f) of the GDPR, provided that there are no overriding interests preventing such disclosure;
• The transfer is required by law pursuant to Article 6, Paragraph 1(c) of the GDPR or applicable regulations;
• The transfer is necessary for the performance of a contract concluded with you pursuant to Article 6, Paragraph 1(b) of the GDPR.

Use of Cookies

We use cookies, pixels, and similar technologies to enhance your website experience and enable features such as our online store. Cookies are small text files stored on your device that serve to identify users and provide convenience. Session cookies are deleted once your browser session ends, whereas persistent cookies remain on your device for your next visit. You may configure your browser to refuse cookies; however, doing so may limit the functionality available to you.

We use the following types of cookies:

• CookiePro (OneTrust): Manages cookie consent preferences (https://www.cookiepro.com/products/cookie-consent/).
• Functional Cookies: Enhance functionality and personalize your experience; set by us or third-party providers (e.g., linkedin.com: bcookie).
• Strictly Necessary Cookies: Essential for the operation of the website (e.g., privacy preference settings such as OptanonConsent, OptanonAlertBoxClosed).
• Performance Cookies: Anonymously track visit counts and traffic sources to improve website performance (e.g., _ga, _uetvid).
• Targeting Cookies: Used by advertising partners to deliver relevant advertisements; do not directly store personal information (e.g., doubleclick.net: IDE, youtube.com: YSC).

The legal basis for the use of Functional and Necessary Cookies is Article 6, Paragraph 1(f) of the GDPR (legitimate interests regarding website functionality). Performance Cookies and Targeting Cookies require your consent pursuant to Article 6(1)(a) of the GDPR; such consent is obtained via the Cookie consent banner. For Cookies involving the transfer of data to the United States, the legal basis is Article 49(1)(a) of the GDPR; however, please note that data protection standards in the United States may differ from those in the EU, Canada, or China. You may revoke your consent at any time via the Cookie Settings.

Website Analytics and Tracking

We use Google Analytics to analyze user behavior and improve our website, processing data such as visit times, duration of visits, page views, and anonymized IP addresses. The legal basis for this processing is the consent you provide via the Cookie banner, pursuant to Article 6(1)(a) of the GDPR. You may opt out of this tracking by using a browser add-on: https://tools.google.com/dlpage/gaoptout?hl=en. Google's Privacy Policy is available at: https://policies.google.com/?hl=en.

We also use Google Tag Manager to integrate analytics and advertising tools; this service is subject to Google's policies: https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/.

Your Rights

As a data subject, you are entitled to the following rights under the GDPR and applicable laws (e.g., Canada's PIPEDA, China's PIPL):

• Right of Access (GDPR Article 15): Confirm whether we are processing your data and request detailed information regarding the purposes, categories, recipients, retention periods, etc.
• Right to Rectification (GDPR Article 16): Correct inaccurate or incomplete data.
• Right to Erasure (GDPR Article 17): Request the deletion of data if it is no longer necessary, if consent has been withdrawn, or if the processing is unlawful; exceptions apply (e.g., legal obligations).
• Right to Restriction of Processing (GDPR Article 18): Restrict the processing of data if its accuracy is contested, the processing is unlawful, or the data is required for the establishment, exercise, or defense of legal claims.
• Notification Obligation (GDPR Article 19): Unless impossible or disproportionate, we will notify recipients of any rectification, erasure, or restriction of processing.
• Right to Data Portability (GDPR Article 20): Receive your data in a structured, machine-readable format or transmit it to another controller.
• Right to Object (GDPR Article 21): Object to processing based on legitimate interests or for advertising purposes.
• Right to Withdraw Consent: Withdraw consent at any time; such withdrawal is effective for future processing.
• Right to Object to Automated Decision-Making (GDPR Article 22): Avoid decisions based solely on automated processing (including profiling), unless necessary for a contract or consent has been obtained.
• Right to Lodge a Complaint (GDPR Article 77): You may lodge a complaint with a supervisory authority—for example, the Office of the Privacy Commissioner of Canada, the Cyberspace Administration of China, or a supervisory authority within an EU Member State.

To exercise these rights, please contact us via email at ljl19840520@gmail.com, by phone at +86 13556533136, or via WhatsApp (+86 13556533136).

You may submit a request at any time via our official email address to have your phone number—along with any other personal information collected via TikTok advertising forms—deleted.

Data Security

We implement technical and organizational measures to protect your data against unauthorized access. Our website utilizes TLS encryption (indicated by "https://" and a padlock icon in your browser) to ensure the security of data transmission. For sensitive information, we recommend using postal mail or WhatsApp, as email carries inherent security risks.