1. WHO WE ARE AND HOW TO CONTACT US

MicroTech Medical (Hangzhou) Co., Ltd. ("MicroTech", "we", "us" or "our") is responsible as controller for the personal data described in this Privacy and Cookie Policy, unless a separate notice identifies another controller or states that we process personal data on behalf of another organization.

Controller: MicroTech Medical (Hangzhou) Co., Ltd., No. 108 Liuze Street, Cangqian, Yuhang District, Hangzhou 311121, Zhejiang, People's Republic of China. Email: sales@microtechmd.com (for general business inquiries). Privacy contact: customerservice@microtechmd.eu.

EU representative under Article 27 GDPR: MTM AiDEX Europe GmbH, c/o Sonnenberg Services GmbH, Sternstr 67, 40479 Düsseldorf, Germany. Data Protection Officer: Fei Yu, dpo@microtechmd.com. The MicroTech entity that determines why and how personal data is processed is the controller for that processing. Where a distributor, healthcare professional, clinic or other partner independently determines the purposes and means of processing, that party is a separate controller and its own privacy notice applies.

2. SCOPE

This Policy applies when you visit a MicroTech website that links to it; contact us through website forms or other online contact channels; subscribe to communications; complete a survey; apply for a role through the website; or otherwise interact with the websites, electronic communications and other services that expressly link to this Policy (together, the "Services").

This Policy does not apply where a more specific notice is provided, including notices for employees and applicants, clinical investigations, vigilance and adverse-event reporting, product complaints, or processing performed by a healthcare provider. For the avoidance of doubt, this Policy applies only to the website and related online contact channels. It does not apply to product purchases or registration, mobile applications, connected devices, customer or technical support provided outside the website, medical information enquiries, product complaints, pharmacovigilance activities, or any other processing activity subject to a separate privacy notice. Third-party websites and services are governed by their own notices.

For individuals in the European Economic Area ("EEA"), this Policy applies where the GDPR applies to our processing, including where we offer goods or services to, or monitor the behavior of, individuals in the EEA. Separate local notices may supplement this Policy.

3. PERSONAL DATA WE COLLECT AND ITS SOURCES

The categories collected depend on how you interact with us. We limit collection to data that is adequate, relevant and necessary for the stated purposes.

· Identity and contact data: name, postal address, email address, telephone number.
· Technical and usage data: IP address，browser type, cookie or similar identifiers, pages viewed, links selected, timestamps, referring URL, approximate location derived from IP address and diagnostic logs.

We collect data directly from you, automatically through the Services, from your device where you enable a relevant feature, and from permitted sources such as distributors, service providers, healthcare organizations, event organizers, affiliates, publicly available professional sources and social-media platforms. Where Article 14 GDPR applies, we will provide any additional required information within the applicable period.

If you provide personal data about another person, you must be authorized to do so and provide that person with the information required by applicable law.

4. WHY WE PROCESS PERSONAL DATA AND OUR LEGAL BASES

We do not rely on your general use of the Services as blanket consent. We rely on the legal basis appropriate to each purpose. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out lawfully.

Purpose	Data	GDPR legal basis	Recipients
Respond to inquiries and communications submitted through the website	Identity/contact	Legitimate interests in responding to website inquiries and communications (Art. 6(1)(f)); and, where applicable, steps requested before entering into a business relationship (Art. 6(1)(b))	Website communication and hosting providers
Direct marketing	Identity/contact(email address)	Consent (Art. 6(1)(a)) where required; otherwise legitimate interests (Art. 6(1)(f)), subject to applicable direct-marketing and ePrivacy rules	Email-marketing and communication providers
Comply with law and establish, exercise or defend legal claims	Relevant categories above	Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)); Art. 9(2)(f), (h) or (i) for special-category data where applicable	Courts, regulators, law enforcement, auditors and professional advisers

 Our legitimate interests include operating and securing our business and Services, responding to requests, improving products, preventing fraud, maintaining records and communicating with customers and professionals. We balance those interests against your rights and expectations and provide the right to object where required.

 5. HEALTH DATA AND OTHER SPECIAL-CATEGORY DATA

We do not collect health data or other special-category data through ordinary website browsing or general website contact forms. Please do not include health-related information in your inquiries or other communications with us. If you nevertheless provide such information, we will use it only to respond to your request or, where appropriate, redirect your request to a more appropriate channel, and delete it ly afterwards unless retention is required by law.

 6. DISCLOSURES AND RECIPIENTS

We may disclose personal data only as necessary for the purposes described above to:

· MicroTech affiliates that provide shared business, technical, compliance or support functions;
· processors such as hosting, cloud, cybersecurity, analytics, CRM, communications, survey, event and professional-service providers, bound by appropriate contractual and confidentiality obligations;
· distributors and other business partners where necessary to respond to a website inquiry or request, or where each party has an independent lawful basis;
· competent regulators, courts, law-enforcement bodies or other authorities where required or permitted by law; and
· a buyer, investor or successor in connection with a proposed or completed merger, acquisition, financing, restructuring or transfer of assets, subject to appropriate safeguards.

We do not sell personal data. We do not disclose personal data for third-party behavioral advertising. We require processors to act only on documented instructions, maintain confidentiality and implement appropriate security measures.

 7. INTERNATIONAL DATA TRANSFERS

MicroTech is established in China and some recipients may be located outside the EEA, including in countries that may not provide a level of protection equivalent to EEA law. Where the GDPR applies, we transfer personal data only under a lawful mechanism, such as an adequacy decision, the European Commission's Standard Contractual Clauses ("SCCs"), binding corporate rules where applicable, or a permitted derogation for a specific situation. We use supplementary contractual, organizational and technical measures where required by a transfer risk assessment.

You may request information about the applicable transfer mechanism and, subject to necessary redactions, a copy of relevant safeguards by contacting us.Consent is not used as the default mechanism for routine or repeated international transfers.

8. RETENTION

We retain personal data only for as long as needed for the relevant purpose, including to provide website-related services, comply with applicable legal obligations, resolve disputes and enforce agreements. We then delete or irreversibly anonymize it unless continued retention is required or permitted by law.

Category	Retention rule
Website inquiries and website contact records	Personal information will be retained for 6 months after closure, subject to legal-hold requirements.
Marketing records	Until consent is withdrawn or an objection is made, plus a limited suppression record to respect the request
Cookie/analytics data	As stated in the cookie table or consent-management platform.

 Retention decisions consider the amount, nature and sensitivity of the data, risk of harm, purpose, available alternatives, legal requirements and limitation periods.

9. SECURITY

We maintain appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. Depending on risk, measures may include encryption or pseudonymization, access controls, logging, secure development and testing, vulnerability management, backups, supplier assessments, staff training and incident-response procedures. No system is completely secure; you should protect credentials and notify us ly of suspected unauthorized use.

Where a personal-data breach occurs, we will assess and notify the competent supervisory authority and affected individuals when required by applicable law.

10. YOUR GDPR RIGHTS

Subject to the conditions and exceptions in applicable law, you may:

· request access to your personal data and information about its processing;
· request correction of inaccurate data and completion of incomplete data;
· request erasure of personal data;
· request restriction of processing;
· object at any time to direct marketing and object, on grounds relating to your situation, to processing based on legitimate interests;
· receive personal data you provided in a structured, commonly used and machine-readable format and transmit it to another controller where the portability right applies;
· withdraw consent at any time, without affecting the lawfulness of prior processing; and
· lodge a complaint with a supervisory authority, particularly in the EEA country of your habitual residence, place of work or alleged infringement. A list is available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

To exercise a right, contact customerservice@microtechmd.eu or write to the address in Section 1. We may request proportionate information to verify identity. We will normally respond within one month, subject to any lawful extension, and will explain if a request cannot be fulfilled. Rights are generally free of charge, except where the GDPR permits a reasonable fee or refusal for manifestly unfounded or excessive requests.

11. AUTOMATED DECISION-MAKING

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you, unless we provide a specific notice describing the decision, logic involved, significance, consequences, lawful basis and available safeguards, including the right to obtain human intervention where applicable.

12. DIRECT MARKETING

Where required, we send promotional communications only with your prior consent. You may withdraw consent or object to direct marketing at any time by selecting the unsubscribe link, changing available preference settings or contacting us. We may retain a minimal suppression record so that we continue to respect your choice. Service, safety, recall, account and transactional communications are not marketing and may still be sent where lawful and necessary.

13. CHILDREN

The general website is not directed to children. We do not knowingly collect personal data directly from a child who cannot validly consent under applicable law without authorization from the holder of parental responsibility. If you believe a child provided data unlawfully through the website, contact us so we can investigate and take appropriate action.

14. THIRD-PARTY LINKS AND INTEGRATIONS

The Services may link to or integrate with third-party websites, platforms, app stores or services. Their privacy practices are governed by their own notices. A link does not mean that we control or endorse the third party. Review the relevant notice before providing data or enabling an integration.

15. COOKIE POLICY

Cookies are small files stored on or accessed from your device. Similar technologies include pixels, tags, local storage, software development kits and device identifiers. Cookies may be first-party (set by MicroTech) or third-party, and session-based or persistent.

Except for strictly necessary cookies, we will not store or access cookies on an EEA user's device until the user has received clear information and given valid consent where required. Rejecting optional cookies must be as easy as accepting them. You may change or withdraw consent at any time through the Cookie Settings link or cookie icon available on the website. Withdrawing consent does not affect prior lawful processing.

We collect and use the following cookies:

Name	Service	Purpose	Cookie Type & Duration
c_WBKFRo	Website Security Protection Tool	Stores a client identification or security verification identifier to detect abnormal requests, prevent automated attacks, and maintain security verification status.	First-party persistent cookie, 7 months
_ga	Website Analytics Tool	Assigns an anonymous identifier to the browser to distinguish visitors and measure visits and user behavior.	First-party persistent cookie, 2 years
_ga_8DYSH2VP6E	Website Analytics Tool	Maintains the session state of the relevant GA4 data stream for measuring page views, sessions, and user behavior.	First-party persistent cookie, 2 years
cna	Website Analytics Tool	Automatically generates a device or browser identifier to recognize the same device and support traffic, referral source, and behavioral analysis.	First-party persistent cookie, 5 months
Hm_lpvt_d58301b5b987dbb59ae9c661eb549c2d	Website Analytics Tool	Records the visitor's current or most recent visit time to help calculate sessions, visit duration, and activity.	First-party session cookie, deleted when you close your browser
Hm_lvt_d58301b5b987dbb59ae9c661eb549c2d	Website Analytics Tool	Records the visitor's previous visit times to distinguish new and returning visitors and measure visit frequency.	First-party persistent cookie, 1 year
HMACCOUNT	Website Analytics Tool	Assigns an identifier to visitors to support traffic source attribution, audience segmentation, and statistical analysis.	Session cookie, deleted when you close your browser
showcookie	Cookie Consent Tool	Records whether the Cookie banner has been displayed or whether you have interacted with it, so that the banner does not appear repeatedly.	First-party persistent cookie, 1 day
user_lang_preference	Website Language Preference Tool	Stores your preferred website language so that your selected language can be used on subsequent visits.	First-party persistent cookie, 21 days

 16. CHANGES TO THIS POLICY

We may update this Policy to reflect changes in law, technology or our practices. The effective date appears at the top. Where changes materially affect individuals or where law requires, we will provide an appropriate additional notice and obtain consent if required. Archived versions may be requested through the privacy contact.

17. CONTACT AND COMPLAINTS

Questions, complaints and rights requests may be submitted to customerservice@microtechmd.eu, or by post to: MicroTech Medical (Hangzhou) Co., Ltd., No. 108 Liuze Street, Cangqian, Yuhang District, Hangzhou 311121, Zhejiang, People's Republic of China. General business inquiries may be submitted to sales@microtechmd.com. EEA users may also contact our EU representative identified in Section 1 and lodge a complaint with a competent supervisory authority.