Data Processing & Cross-border Transfer Statement

Data Processing and Cross-Border Transfer Statement

1. Scope of Statement

This page describes how FilamentLab transfers personal information across different jurisdictions when you apply for cross-border services, including overseas DDU/DDP shipments, inquiries to overseas subsidiaries and overseas technical support. This statement supplements our Privacy Policy.

2. Categories of Transferred Personal Information

Only the minimum necessary dataset required by customs and import laws of the destination country will be transferred: consignee name, address, phone number, company name, tax ID / customs number, together with commercial invoice line items (product SKU, quantity, value, HS code).

3. Cross-Border Transfer Mechanisms

EU / EEA: Standard Contractual Clauses (SCCs) version 2021 adopted under Commission Decision (EU) 2021/914. You may request a copy of the executed SCCs from our DPO.

• United States: SCCs, or processing by our US subsidiary FilamentLab Materials US Inc. as a local independent controller depending on scenarios.

• Asia-Pacific (Australia, New Zealand, Japan, South Korea): SCCs for Australia and Japan, plus customs data sharing required by local legislation.

• Data inbound to Mainland China: Processing is necessary for performance of the contract you entered into, pursuant to Article 38 of the Personal Information Protection Law of the People’s Republic of China.

4. Data Recipients

Recipients include:

• (a) Overseas subsidiaries and affiliates of FilamentLab;

• (b) Contracted logistics partners (DHL, UPS, Maersk, COSCO, SF Express);

• (c) Licensed customs brokers and freight forwarders.

5. PIPL Cross-Border Assessment

For cross-border transfer requirements under Articles 38–42 of the Personal Information Protection Law (PIPL), FilamentLab has completed a Personal Information Protection Impact Assessment (PIA) covering data categories, overseas recipients, jurisdictions, technical and organisational security safeguards, and retention periods. A summary of the assessment can be requested via email: [email protected]

6. How to Exercise Your Rights

You may submit requests for access, rectification, erasure, data portability or withdrawal of consent relating to cross-border transfers by emailing [email protected]. Responses will be provided within 15 working days.

7. Cross-Border Data Protection Contacts

DPO (Global): [email protected]

PIPL Lead (Xuzhou HQ): [email protected]

Supporting documentation is under preparation. Please contact us for further information.