Initial Effective Date: May 17, 2024

Last Updated Date: July 23, 2026

Welcome to UGREEN NAS and sign up for a global unified account!

As the personal information controller of your personal information (for users in the Chinese mainland: Ugreen Group Limited; for users outside the Chinese mainland: America Ugreen Limited, hereinafter referred to as "we", "us", or "UGREEN"), protecting the security of your personal information is our duty, and we will provide full protection for your personal information security in accordance with applicable laws and regulations.

For this purpose, we have formulated this UGREEN NAS Privacy Policy (hereinafter referred to as “this Policy”) to help you fully understand how we collect, use, share, store, and protect your personal information when you use our products and services, as well as how you can manage your personal information, so that you can make more informed decisions.

Before using our products and services, please carefully read and understand the content of this Policy (especially the bolded text), and ensure that you fully understand and agree to this Policy.

In addition to this Policy, in specific scenarios, we will also inform you of the corresponding objectives, extent, and use of the collected personal information through just-in-time notifications (including pop-ups and on-page prompts). These real-time notifications and feature updates form an integral part of this Policy and shall have the same legal effect as this Policy. For ease of understanding, we explain the professional terms involved herein in plain and concise language wherever possible. If you have any questions, comments, or suggestions regarding the content of this Policy, you may contact us through the contact details provided at the end of Section 10 hereof.

By agreeing to this Policy, you acknowledge that you have understood the features provided by UGREEN NAS and the necessary personal information required for the operation of such features. When you activate or use UGREEN NAS, we will process relevant information for the features or services you select, or as required by applicable laws and regulations. Except for the information necessary for providing the basic features and services of UGREEN NAS and the information to be processed under applicable laws and regulations, you reserve the right to decline our processing of other information. Please be aware, however, that this may limit access to certain features or services.

This Policy aims to help you understand:

1. Scope of Application

2. How We Collect and Use Your Personal Information

3. Use of Cookies and Other Similar Technologies

4. How We Store and Protect Your Personal Information

5. How We Share, Transfer, and Publicly Disclose Your Personal Information

6. How You can Exercise Your Rights to Manage Your Personal Information

7. How We Process The Personal Information of Minors

8. How Your Personal Information Is Transferred Globally

9. Policy Updates

10. Contact Us

Appendices

11. Appendix for the European Economic Area, UK, and Switzerland

12. Appendix for California

13. Appendix for the Republic of Korea

1. Scope of Application

For the purposes of this Policy, "UGREEN NAS" refers to the UGREEN NAS client, UGREEN NAS website, UGREEN NAS software development kit for third-party websites and applications, application programming interfaces, and mini-programs that are legally owned and operated by UGREEN and branded as "UGREEN NAS", through which you access and use our products and services, as well as any new forms of products and services arising from technological developments that we provide to you (hereinafter collectively referred to as "UGREEN NAS").

Variations in features may exist among different UGREEN NAS versions. We collect and process your personal information in accordance with this Policy unless otherwise specified by separate policies of other UGREEN NAS versions. In cases where other UGREEN NAS versions have separate policies, those policies shall also apply. In the event of any inconsistency between this Policy and the privacy policy of the associated versions, the privacy policy of the associated version shall control. Please be aware that certain search paths and operations may differ across UGREEN NAS versions, and should be considered in the context of the actual usage.

Except for the activities that the information would be collected and used for in this Policy, this Policy does not apply to other services provided to you by third parties, and such services are subject to the rules on personal information collection and use separately notified by such third parties.

2. How We Collect and Use Your Personal Information

Based on the principles of lawfulness, legitimacy, and necessity and for the following purposes described herein, we will collect and use the personal information actively provided by you, generated during your use of UGREEN NAS, or obtained from third parties with your consent, so that we can help you use UGREEN NAS, communicate with you, and improve or optimize our products or services. As our business develops, we may adjust and change the products or services we provide. If we intend to use your personal information for purposes not specified herein, or to use information collected for a specific purpose for any other purposes, we will inform you in a reasonable manner and obtain your consent again in advance, unless there is another lawful basis or legitimate ground for processing your personal information. You may refer to the UGREEN NAS Personal Information Processing List to quickly review the details of the personal information we collect.

2.1 Information Processing Scenarios

(1) Registration and Login

(2) UGREEN Account Management

As a unified identity authentication system for UGREEN's products and services, the UGREEN account applies to the companion apps for UGREEN NAS products (UGREEN private cloud /UGREEN NAS), companion apps for IPC products, and other UGREEN products and services that have been or will be integrated. You may refer to the UGREEN Account Privacy Policy for more details on the rules governing the processing of personal information in connection with unified account management.

(3) Device Binding and Management

(4) LAN Device Search via find.ugnas.com

(5) Operations and security

(6) Technical Support

(7) Login History and Trusted Device Management

(8) UGREENlink Services

Your UGREENlink or DDNS domain name will be transmitted to a third-party certification authority, Let's Encrypt or ZEROSSL, to generate an SSL certificate in order to ensure the security of the connection with your UGREEN account via HTTPS. For details on how Let's Encrypt and ZEROSSL use your data, please refer to Let's Encrypt Privacy Policy and ZEROSSL Privacy Policy.

(9) App Center

(10) Third-Party Services

Be aware that some third parties may use your OpenID associated with your account for data collection and processing. The third-party service provider shall be responsible for the data collection, storage, use, and transmission. UGREEN is not involved in the processing of such data, nor will it process, access, control, or modify this data. Please choose and use third-party services carefully, as your personal information and data security will be subject to the third-party service provider's terms and policies when you use such services.

(11) Configuration Backup and Restoration

(12) User Experience Survey (for users outside the Chinese mainland)

(13) Device Analysis and Improvement Program (for the Chinese mainland users)

(14) Description of Specific Features

In order to provide you with clearer and more targeted privacy protection guidelines, certain features of UGREEN NAS are subject to separate dedicated data processing statements. When you use or access the following features for the first time, the system will prompt you to read and agree to the corresponding dedicated data processing statements:

2.2 Legal Basis for Processing of Your Personal Information

Subject to applicable laws and regulations, we may process your personal information if:

(1)we have obtained your consent;

(2)it is necessary for the conclusion or performance of a contract at your request;

(3)it is necessary for the fulfillment of legal obligations, such as compliance with anti-money laundering, counter-terrorism financing, anti-telecom fraud, real-name management, and other relevant legal and regulatory requirements;

(4)it is directly related to national security or national defense security;

(5)it is necessary for addressing public health emergencies or protecting the life, health, and property safety of individuals in emergency situations;

(6)it is directly related to criminal investigation, prosecution, trial, judgment enforcement, and other such matters;

(7)the personal information collected is voluntarily disclosed by you;

(8)we collect your personal information from publicly available sources that have been legally disclosed, such as legitimate news reports, government information disclosures, and similar channels;

(9)it is necessary for ensuring the secure and stable operation of the products and services we provide, such as detecting and handling product or service failures; or

(10)other circumstances stipulated by laws and regulations occur.

Please note that when any circumstance described in items (2) through (10) above occurs, we may not be required to obtain your consent again in accordance with applicable laws and regulations.

2.3 Application Permissions

To provide services to you, UGREEN NAS may need to request corresponding permissions from you within the necessary scope. Rest assured that UGREEN NAS will not activate these permissions by default. Only when you proactively confirm to enable them, may UGREEN NAS collect your personal information through these permissions, and it will only be used in the necessary scenarios explained to you.

It should be specifically noted that the granting of a specific permission to UGREEN NAS does not mean that we will necessarily collect your relevant information. Even if you have confirmed to enable the permission for UGREEN NAS, we will only collect your relevant information within a lawful, legitimate and necessary scope. Refusing to grant permissions may lead to the unavailability of specific features reliant on said permissions, but that will not affect you using other UGREEN NAS features. For more information on permissions and their uses, refer to the UGREEN NAS Permission Application and Usage Description.

3. Use of Cookies and Other Similar Technologies

Cookies and device identifiers are commonly utilized across the Internet. We may use such technologies to store cookies or anonymous identifiers on your device when you access UGREEN NAS and related services, so that we can collect and identify data during your use of our product. We use cookies and similar technologies primarily to facilitate your use of our products and services, enhance security and efficiency, improve login and response speed, and provide you with a more seamless access experience. By continuing to use the service, you consent to our use of cookies and similar technologies to collect and process your relevant information in accordance with this Policy.

We undertake that we shall not use cookies for any purposes other than those set forth herein. The cookies and similar identifiers we set will be stored for a period of 180 days from the date of data generation. If you use the web version of UGREEN NAS, most browsers provide you with the option to clear browser cache data, including cookies. You may delete cookie data in your browser settings; however, please note that deleting cookies may render certain features or services provided by us that rely on cookies unavailable.

4. How We Store and Protect Your Personal Information

4.1 Retention Period

During your use of our services, we will retain your personal information for the period necessary to achieve the purposes described herein, unless a longer retention period is required or permitted by law. If you need to delete your personal information, you may contact us through the contact information provided in Section 10 hereof. In addition, unless otherwise expressly provided by applicable laws and regulations, upon the expiration of the retention period described above, we will delete or anonymize your personal information.

We determine the retention period of your personal information according to the following criteria:

(1) the term during which we maintain an ongoing relationship with you and provide UGREEN NAS products and services to you (e.g., for as long as you hold a UGREEN cloud account or continuously use our products);

(2) whether the information is modified by the account owner, or deleted by users through their accounts;

(3) whether we are subject to legal obligations to retain data (e.g., we may be required to retain your transaction records for a specified period in accordance with applicable laws and regulations); or

(4) whether retention is advisable from our legal position (e.g., in connection with the enforcement of our agreements, resolution of disputes, applicable statutes of limitations, litigation, or regulatory investigations).

The retention periods for personal information are as follows:

4.2 Retention Location

Generally, personal information collected and generated within the People's Republic of China is stored in the People's Republic of China, but as UGREEN NAS offers global services, we may transfer your personal information to our affiliates outside China. For more information, refer to "Section 8. How Your Personal Information is Transmitted Globally".

4.3 Procedures and Method for Destruction of Personal Information

When personal data reaches the end of its retention period, we will use technical methods to destroy personal information stored in electronic file formats, including physical deletion from databases and logical deletion through code. We will destroy personal data stored in paper documents through shredding or incineration.

4.4 Security Measures

We attach great importance to the security of your information and are committed not only to meeting information security standards currently in force but also to striving to take industry-leading security measures. To ensure the security of your personal information, we have adopted a range of advanced security technologies, including but not limited to encrypted transmission, secure storage, firewall protection, and regular security vulnerability scanning.

In addition to the above technical measures, we have developed a management system to enhance the security of personal information. We also ensure that our employees receive data protection training and that all data processing and storage procedures are subject to strict review and continuous improvement.

We fully recognize that no system is completely impenetrable. Therefore, we continuously strive to identify and manage potential risks and take appropriate preventive measures to reduce the risk of your information being leaked, damaged, misused, subject to unauthorized access, unauthorized disclosure, or altered. If a security incident occurs, we will follow established procedures and response mechanisms to take actions, including but not limited to promptly notifying affected users, remediating security vulnerabilities, and taking measures to prevent similar incidents.

Although we have implemented reasonable and effective measures described above and have complied with applicable laws and regulations, we cannot guarantee the security of your personal information when it is transmitted through insecure channels. Accordingly, you shall take proactive measures to ensure the security of your personal information. For instance, you may set a strong password for your account and updating it regularly, refraining from sharing your account credentials with others, and assisting us in protecting the security of your account and personal information.

5. How We Share, Transfer, and Publicly Disclose Your Personal Information

5.1. Application Programming Interfaces and Software Development Kits

To guarantee the secure and stable operation of our products and services, UGREEN NAS incorporates software development kits (SDKs) and Application Programming Interfaces (APIs). When you use products and services supported by these SDKs/APIs, third-party SDKs/APIs may collect and process your personal information. We perform security checks and assessments of third-party SDKs/APIs and adhere strictly to legal and regulatory requirements to safeguard data security. To maximize the protection of your personal information, we urge you to thoroughly understand the privacy policies of these third-party SDKs/APIs before use, as these entities are solely liable for your data under their respective privacy and data protection policies. This policy does not cover third-party products or services that you may access or initiate. We are not liable for the collection, use, and processing of your personal information by these third parties when you use their products or services. If you are concerned about the risks associated with these SDKs or APIs, we advise discontinuing their use and contacting us promptly. For details about UGREEN NAS's use of third-party SDKs/APIs for personal information processing, please refer to the List of Third Parties Sharing Personal Information with UGREEN NAS.

5.2. Personal Information Sharing

We do not share your personal information with any companies, organizations or individuals other than UGREEN or its affiliates unless:

(1) we have obtained explicit authorization or consent from you or your guardian;

(2) competent judicial or administrative authorities require us to disclose your personal information in accordance with statutory procedures;

(3) we disclose your personal information in order to initiate litigation or arbitration against users to protect our legitimate rights and interests;

(4) we disclose your personal information in accordance with the relevant service agreements, terms of use, or other agreements between you and UGREEN;

(5) we disclose your personal information to the extent permitted by applicable laws and regulations and for the purpose of protecting the interest of UGREEN, its affiliates, UGREEN NAS users, and the public; or

(6) we disclose your personal information in accordance with any relevant agreement between you and a third party; or

(7) we use your personal information for academic research purposes.

5.3. Transfer

We will not transfer your personal information to any other company, organization, or individual except UGREEN's affiliates unless:

(1) we have obtained your explicit authorization or consent in advance;

(2) we transfer your personal information to others in accordance with applicable laws and regulations, legal procedures, or mandatory government requirements or judicial rulings.

(3) If we or our affiliates undergo a merger, demerger, or liquidation, acquire or sell assets or businesses, or enter into other transactions, your personal information may be transferred to another party as part of such transaction. In such cases, we will ensure the confidentiality of your personal information during the transfer and make our best efforts to ensure that the company or organization receiving your personal information continues to be bound by this Policy; otherwise, we will require such company or organization to seek your authorization and consent again.

5.4. Disclosure

We will publicly disclose your personal information only if:

(1) we have obtained your explicit consent; or

(2) we disclose your personal information in accordance with mandatory requirements of applicable laws and regulations, legal procedures, litigation or competent government authorities.

5.5. Exceptions to Prior Authorization and Consent for the Sharing, Transfer, and Disclosure of Personal Information

We may share, transfer, or disclose personal information without obtaining prior authorization and consent from the personal information subject if:

(1) it is directly related to national security or national defense security;

(2) it is directly related to public security, public health, or major public interests;

(3) it is directly related to criminal investigation, prosecution, trial, judgment enforcement, and other such matters;

(4) it is made for the purpose of safeguarding the major legitimate rights and interests (such as life and property) of the personal information subject or other individuals, where it is difficult to obtain the said individual’s consent;

(5) the personal information subject voluntarily discloses his/her personal information to the public; or

(6) we collect personal information from publicly available sources that have been legally disclosed, such as legitimate news reports, government information disclosures, and similar channels.

6. How You can Exercise Your Rights to Manage Your Personal Information

6.1 When you register or log in using a local account, all data is stored on your UGREEN NAS device and your mobile phone (or computer). We do not collect any of your personal data. To facilitate the management of your information, you may perform relevant operations via the following paths:

(1) Query path: Avatar > Personal Profile (you may view your avatar and email address) or Control Panel > User Management (you may view your avatar, username, role, email address, etc.)

(2) Correction path: Avatar > Personal Profile (you may edit your avatar and email address) or Control Panel > User Management (you may edit your avatar, username, role, email address, etc.)

(3) Changing the Scope of Your Consent or Withdrawing Your Consent

①Path to change the authorization scope for permission application and usage: Avatar > Privacy Management > System Permission Management

②Path to withdraw privacy policy authorization on mobile devices: Avatar > Privacy Management > Privacy Statement > Withdraw Consent Please be advised that withdrawing your consent will clear all app data, restore the app to its initial state, and revoke all application permissions. This action will not clear the local data stored on your NAS device. When you use the app again, you will need to re-agree to the User Agreement and the Privacy Policy.

(4) Deletion path: Log in to the administrator account, choose Control Panel > User Management to delete users, or choose Control Panel > Update & Restore to restore the device to factory settings (local accounts are stored on the device, so the device administrator may manage and delete local accounts, and may even restore the device to factory settings to delete all user accounts).

6.2 When you register and use a UGREEN account, regardless of your location, we safeguard your rights to exercise control over your personal information in accordance with the following standards as well as all applicable laws and regulations. Regardless of whether you exercise any of the rights set forth in this Section, we will not discriminate against you, including by denying goods or services, charging different prices, or providing services of different quality. Subject to applicable laws and regulations and your jurisdiction, you may be entitled to some or all of the following rights regarding your personal information.

(1) Right to query

You have the right to confirm with us whether we are processing your personal information, and to request detailed information about such processing, such as processing purposes, information categories, and recipients.

You may exercise your rights pursuant to Item 6.3 of this Section ("How to Exercise Your Rights"). You may also conduct self-service queries via the following path: Log in to your UGREEN account at https://web.ugnas.com/account/login/#/login and choose Personal Profile > Account & Security (you may view your avatar, username, password, mobile phone number and email address).

(2) Right to correction

If you find that your personal information held by us is inaccurate or incomplete, you have the right to request correction.

You may exercise your rights pursuant to Item 6.3 of this Section ("How to Exercise Your Rights"). You may also conduct self-service corrections via the following path: Log in to your UGREEN account at https://web.ugnas.com/account/login/#/login and choose Personal Profile > Account & Security (you may edit your avatar, username, password, mobile phone number and email address).

(3) Right to modify or withdraw consent

You may exercise your rights pursuant to Item 6.3 of this Section ("How to Exercise Your Rights"). You may also modify the scope of your authorization or withdraw your consent to our processing of your personal information on your own via the following paths:

• Modify the scope of system permission authorization: Avatar > Privacy Management > System Permission Management

• Withdraw privacy policy authorization on mobile devices: Avatar > Privacy Management > Privacy Statement > Withdraw Consent

• Reject or withdraw marketing emails: Follow the unsubscription instructions in the marketing emails (not applicable to users in the Chinese mainland)

• Opt out of the Device Analysis and Improvement Program: Control Panel > About This Device > Device Analytics, and uncheck the corresponding option

After you withdraw your consent, we will no longer process the corresponding personal information. However, your decision to withdraw your consent does not affect the processing of your personal information we carried out with your authorization prior to the withdrawal.

(4) Right to delete

You have the right to request that we delete your personal information if:

• we have processed your personal information in violation of laws or regulations;

• we collect or use your personal information without your consent; or

• you have closed your account or no longer use our products or services.

You may exercise your rights pursuant to Item 6.3 of this Section ("How to Exercise Your Rights"). You may also delete device information on your own via the following path: Log in to your UGREEN account at https://web.ugnas.com/account/login/#/login and choose UGREEN NAS Device > Unbind Device.

However, please understand that in order to comply with applicable laws and regulations, meet regulatory requirements, or ensure data integrity, we may retain your personal information, and will delete your personal information upon expiration of the retention period.

(5) Right to restriction of processing

You have the right to request us to suspend the processing of your personal information so that you may verify or preserve the relevant information if:

• you consider the personal information held by us about you to be inaccurate and request us to suspend the processing until the personal information is corrected;

• our processing of your personal information is unlawful, but you wish to restrict the processing rather than have your personal information deleted;

• we no longer need such personal information, but you need it for the establishment, exercise or defense of legal claims; or

• you have objected to the processing, and we are verifying whether we have overriding legitimate interests that prevail over your interests.

You may exercise your rights pursuant to Item 6.3 of this Section ("How to Exercise Your Rights").

During the period of restriction, we will only process your personal information with your consent, when necessary for the establishment or exercise of legal claims, or for the protection of the rights and interests of others.

(6) Right to refuse processing

You have the right to refuse our processing of your personal information if:

- we process your personal information on the legal basis of legitimate interests, public interests, or other legal bases for which applicable laws grant personal information subjects the right to refuse processing;

- we process your personal information for direct marketing purposes; or

- we process your personal information for scientific research, historical research or statistical purposes.

You may exercise your rights pursuant to Item 6.3 of this Section ("How to Exercise Your Rights").

(7) Right to data portability

You have the right to obtain a copy of the personal information you have provided to us. You may use such information for other services, or request us to directly transfer it to other personal information controllers designated by you.

You may exercise your rights pursuant to Item 6.3 of this Section ("How to Exercise Your Rights").

(8) Right to restrict automated decision-making

In certain business functions, we may make automated decisions through information systems or algorithms based on applicable lawful grounds.

Prior to deploying automated decision-making technologies, we will inform you of the principles of such automated decision-making, the personal information used, and the impact on you.

If such decision has a material impact on your legitimate rights and interests (the definition of "material impact" shall be subject to the laws of the country or region applicable to you), you have the right to request us to provide an explanation of such decision, conduct a human review of such decision, or choose to refuse automated decision-making.

You may exercise your rights pursuant to Item 6.3 of this Section ("How to Exercise Your Rights").

(9) Account Cancellation

You have the right to close your UGREEN account. You may exercise your rights pursuant to Item 6.3 of this Section ("How to Exercise Your Rights"). You may also perform self-service operations via the following path: Log in to your UGREEN account at https://web.ugnas.com/account/login/#/login and choose Personal Profile > Account & Security > Cancel Account.

We will respond to your cancellation request by deleting the personal information under the account associated with your registered mobile phone number.

(10) Right to Lodge a Complaint with Regulatory Authorities

If you believe that our processing of your personal information infringes upon your rights under applicable laws and regulations, you have the right to lodge a complaint with the competent regulatory authorities.

6.3 How to Exercise Your Rights

Except for circumstances where self-service operations are specified under each right, you may exercise your rights by sending an email to nascss@ugreen.com.

To protect the security of your information, we will verify your identity (or the authority of your authorized agent) prior to processing your request. You may be required to provide your name, address, telephone number and email address. We will cross-check such information against the information we hold, and may require you to provide identity verification documents. Any information you provide for verification purposes shall be used solely for identity verification.

6.4 How We Will Respond to Your Requests to Exercise Your Rights

(1) Response timeframe

We will respond to your request within all applicable statutory time limits after receiving your request and verifying your identity. Where no specific statutory time limit applies, we will respond within 15 working days.

(2) Limitations and exceptions to requests

We will not charge any fees for reasonable rights requests in principle. We reserve the right to reject any requests that are manifestly unfounded or excessive, exceed reasonable limits, require excessive technical resources (such as developing a new system or fundamentally altering current practices), may infringe upon the legitimate rights and interests of others, or are objectively impracticable.

We may be unable to respond to the following requests made by you:

• requests related to our fulfillment of obligations prescribed by laws and regulations;

• requests directly related to national security or national defense security;

• requests directly related to public security, public health, or major public interests;

• requests directly related to criminal investigation, prosecution, trial, judgment enforcement, and other such matters;

• requests made by you with subjective malice or by abusing your rights as confirmed by sufficient evidence;

• requests made for the purpose of safeguarding the major legitimate rights and interests (such as life and property) of you or other individuals, where it is difficult to obtain the said individual's consent;

• requests responding to which would cause serious harm to the legitimate rights and interests of you, other individuals, or organizations; or

• requests involving trade secrets.

7. How We Process the Personal Information Of Minors

We do not proactively provide products and services to minors. "Minors" refers to natural persons under 18 years of age (subject to the laws of the country or region applicable to you).

We will only process the personal information of a minor based on the consent of his/her parents or guardians when, and only when the parents or other guardians purchase a NAS device and grant a non-administrator account to the minor, or when adult users store personal information of minors in the NAS device.

If you are a minor under the laws of your country or region, please ensure that your parents or guardians review this Policy thoroughly. We require that you use our services or share information with us only with the explicit consent of your parents or guardians.

If you are a parent or guardian, please ensure that any child under your care uses our services with your consent.

If you have any questions regarding the processing of minors' personal information, please contact our dedicated department in charge of personal information protection. If we collect personal information from minors who use our products or services with the consent of their guardians, we will use or disclose such personal information only to the extent permitted by applicable laws and regulations, with the explicit consent of the minors' guardians, or as necessary to protect the minors. If a guardian has reason to believe that we have collected personal information of a minor without the guardian’s consent, please contact us at nascss@ugreen.com, and we will delete the minor’s personal information as requested as soon as possible.

8. How Your Personal Information Is Transferred Globally

8.1. UGREEN operates globally. As of now, we have deployed servers in Singapore, Germany, the United States, Japan, the Republic of Korea, Hong Kong(China),and the Chinese mainland. When you use your UGREEN NAS device, the system will automatically transfer you to the nearest server based on your country/region.

8.2. Meanwhile, to determine the uniqueness of your UGREEN account and help you locate the home region of your UGREEN NAS device, we will transfer the hashed value of your UGREEN account (the hashed phone number for users in the Chinese mainland or the hashed email address for users in other countries or regions) and the location information of your UGREEN NAS device to the Hong Kong(China) server for the purpose of verifying the global uniqueness of your UGREEN account.

8.3. When you enable the UGREENlink feature while traveling globally, the hashed value of your UGREENlink ID (a nickname you define for your UGREEN NAS device) and your UGREEN NAS device serial number will be transmitted between the server nearest to where you initiate the access request and the Hong Kong(China) server. The Hong Kong(China) server then determines your UGREEN account's home country/region in order to transfer you to the server in your account's original home country/region, ensuring that you can efficiently access your UGREEN NAS device from anywhere in the world. In addition, to enable specific features, we may use third-party SDKs or technical services. In this process, your personal information may be transferred across borders to the location of third-party servers.

8.4. With respect to the cross-border transfer of personal information described above, we will take necessary compliance measures to ensure that your personal information receives adequate protection, including but not limited to adopting security technologies such as encrypted transmission and de-identification and binding overseas recipients with standard contracts or other methods permitted by applicable laws and regulations to govern their processing of personal information, so as to guarantee that your data enjoys an equivalent level of protection after being transferred overseas.

8.5. File transfers that you initiate between UGREEN NAS and Cloud Drives may involve cross-border data transfer. These activities are entirely under your control, and we have no means to access or be aware of them. You are responsible for ensuring that any such cross-border data transfers comply with applicable laws and regulations.

9. Policy Updates

9.1 We may update this Policy from time to time. Without your explicit consent, we will not reduce your rights hereunder. We will post any updates to this Policy on this page. We will notify you of material changes in an appropriate manner (e.g., push notifications, pop-ups, emails), and seek your consent again.

9.2 After we update this Policy, your consent and continued use of our services shall constitute your agreement to the content of this Policy (including the updated version), and your consent to our collection, use, storage, disclosure, and transfer of your personal information in accordance with this Policy.

9.3 The UGREEN NAS device can be connected and used by multiple users at the same time, but only the administrator account has the full control over the device. The administrator controls the purpose, scope, privacy policy, and updates of the device information, and its decisions directly affect all non-administrator accounts under the same device. Please note that we are not liable for any issues or potential impacts that may arise for non-administrator users as a result of any update decided by the administrator.

10. Contact Us

10.1 If you have any questions, comments, or suggestions regarding this Policy or our services, you may contact us through the following channels:

(1) Choose Help Center > Contact Us on your UGREEN NAS device.

(2) Contact our Data Protection Officer via email at nascss@ugreen.com.

(3) Contact us by mail at the following registered address:

1/F to 6/F, Office Building 7; 4/F, Factory Building 6, Longcheng Gongmao Yu'an Industrial Park, Gaofeng Community, Dalang Subdistrict, Longhua District, Shenzhen, Guangdong, 518000 PRC

(4) Contact number and working hours:

(Global/US) +1 (888) 820-8830 Mon-Sun 9:00-17:00 PST  

(DE) +49 800 989 8988 Mon-Fri 8:00-17:00 CET

(UK) +44 808 501 3926 Mon-Fri 7:00-16:00 GMT

(MY) +60 18 008 19150 Mon-Fri  15:00-24:00 MYT

(JP) +81 800 170 8375 Mon-Sun 9:00- 18:00 JST

(KR) +82 2 2158 8397 Mon-Fri 10:00-17:00 KST

(The Chinese mainland) 0755-21044617 Mon-Fri 9:00-17:00 CST

10.2 To help us efficiently respond to your request and provide you with timely feedback, please submit your identity verification materials, valid contact information, a written request, and relevant supporting evidence. We will respond to your request within fifteen (15) working days upon verification of your identity.

Appendices

11. Appendix for the European Economic Area, UK, and Switzerland

This Section shall apply solely to residents of the European Economic Area, the United Kingdom and Switzerland ("you"). This Appendix supplements the information contained in the main body of this Policy. In the event of any conflict or inconsistency between this Appendix and the main body of this Policy, this Appendix shall prevail.

11.1 Legal Basis

We process your personal information on the following lawful bases in different scenarios:

- Necessary for the performance of contractual obligations: management of local accounts, management of UGREEN accounts, device binding, LAN device discovery, technical support, use of UGREENlink services, operations and security, configuration backup and restoration, login history, trusted device management (when you log in with a UGREEN account)

- Your consent: user experience surveys, biometric unlock for UGREEN NAS login and Vault, third-party services, trusted device management (when you log in with a local account)

11.2 Right to Lodge a Complaint Under the Data Act

In accordance with the EU Data Act (Regulation (EU) 2023/2854), you, as a user, have the right to lodge a complaint if you consider that your rights under this Regulation have been infringed.

This complaint can be lodged, individually or collectively, with the competent authority designated pursuant to Article 37 of the Data Act in the Member State of your habitual residence, place of work, or place of business. This right is without prejudice to any other administrative or judicial remedy available to you.

The competent authority with which the complaint has been lodged will inform you of the progress of the proceedings and the final decision rendered in accordance with national laws.

12. Appendix for California

This Section shall apply solely to residents of the State of California ("California") ("you"). This Appendix supplements the information contained in the main body of this Policy. In the event of any conflict or inconsistency between this Appendix and the main body of this Policy, this Appendix shall prevail.

12.1 Your Personal Information Rights

(1) Right to know

As stated in Section 6 "How You can Exercise Your Rights to Manage Your Personal Information", you have the right to know about the collection, disclosure, and sale of your personal information over the past twelve months. For details, please refer to the UGREEN NAS Third-Party Personal Information Processing List the List of Third Parties Sharing Personal Information with UGREEN NAS.

(2) Right to opt-out of the sale or sharing of personal information

We do not sell or share, and have not in the past 12 months sold or shared any personal information. For the purposes of this Section, “sell” refers to the disclosure of personal information to a third party for monetary or other valuable consideration, and “share” refers to the disclosure of personal information to a third party for cross-context behavioral advertising, whether or not for monetary consideration.

(3) Right to limit use of sensitive personal information

We do not use, and have not in the past 12 months used your sensitive personal information for any purposes other than those authorized by applicable laws and regulations, including the provision of goods or services to you and the protection of security and integrity for your account.

13. Appendix for the Republic of Korea

This Section shall apply solely to residents of the Republic of Korea ("you"). This Appendix supplements the information contained in the main body of this Policy. In the event of any conflict or inconsistency between this Appendix and the main body of this Policy, this Appendix shall prevail.

13.1 Retention Periods for Personal Information Stored Pursuant to Legal Obligations

In accordance with the Act on the Consumer Protection in Electronic Commerce, Article 15(1)(3) of the Personal Information Protection Act (performance of its duties under its jurisdiction as prescribed by statutes), and other applicable laws and regulations, we will retain your personal information for the duration specified by such laws. In such cases, we will use your personal data solely for the purpose of storing such data, with the retention periods as follows:

Pursuant to the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce:

● We will store the records related to trademarks and advertisements for 6 months.

● We will store the records concerning the cancellation of contracts or unsubscription from services for 5 years.

● We will store the records concerning payment and supply of goods and services for 5 years.

● We will store the records concerning customer services or dispute resolution for 3 years.

Pursuant to the Framework Act on National Taxes:

● We will store the accounting records for 5 years, including corporate ledgers, vouchers, invoices (including electronic tax invoices), receipts, contracts, records of sales and purchases, and other accounting documentation related to tax filings and business transactions.

13.2 Transfer of Personal Data to Overseas Third Parties

13.3 Domestic Representative

Entity name in Korea: Ugreen Korea Co., Ltd.; legal representative: Nie Xingxing

Business address: Room 601-189, 6/F, 47, Sejong-daero 23-gil, Jongno-gu, Seoul, Seoul (Dangju-dong)

Contact number and business hours: +82 2 2158 8397 (Mon-Fri 10:00-17:00 KST)

E-mail: service.nas.kr@ugreen.com  

13.4 Data Protection Officer

We have designated a Data Protection Officer to handle complaints and provide redress for damages related to the processing of personal information from personal information subjects.

Contact person: Reddar

Email: nascss@ugreen.com

13.5 AI Services

This device provides Uliya AI services and third-party agent services.

For detailed information on Uliya AI services, please refer to the Uliya Privacy Policy

The description of third-party agent services is as follows:

(1) Overview of Third-Party Agent Features

Third-party agent frameworks are disabled by default and need to be actively enabled by the user before use.

(2) Intended Use of Third-Party Agents

The use of third-party agents is determined by you. UGREEN strictly prohibits you from using third-party agent features in scenarios that may have significant consequences, such as medical diagnosis, legal advice, financial investment decisions, or safety-related judgments. If you choose to use third-party agents in such scenarios, you shall independently assess the risks and bear the corresponding consequences.

(3) Personal Information Processed by Third-Party Agents

1) Data Processed Directly by the NAS Device

Based on your consent (when you actively download and use third-party agent frameworks), the NAS device processes only the minimum configuration information necessary for the operation of third-party agents (agent framework name, download status) and operational logs (running logs within the NAS Docker environment, excluding third-party AI agent framework logs).

Conversations between you and the agent may be stored on your NAS device, and we have no access to or process such content. Operational logs of the agent within the NAS device are stored on the NAS device, and we likewise have no access to or process such logs.

Conversations (which you may choose to retain manually; if not manually selected for retention, they will be completely deleted) and logs (automatically deleted upon uninstallation) will be cleared by default when you uninstall OpenClaw. Files generated by OpenClaw at your command are saved in the workspace you select on the NAS device and will not be deleted by default; you may delete them manually in the file management.

2) Data Processed by Third-Party Model Providers

With respect to the operation of third-party agent features, the content you input into the agent and the conversation context will be independently processed by the third-party model provider you have configured, in accordance with its own service rules and privacy policies. We are not involved in the processing of such data.

Supplementary notes on data processed by third-party cloud-based AI service providers are as follows:

· You may configure and access other third-party AI services at your discretion. In any case, we shall not be held liable for any direct or indirect liability arising from third-party AI services.

· You are responsible for registering an account with and/or paying for the services of the third-party cloud-based AI service provider.

· The third-party cloud-based AI service provider is located outside the Republic of Korea. By actively enabling the third-party agent framework features, you consent to the transfer of your personal information to countries or regions outside the Republic of Korea.

(4) Whether User Data Is Used for AI Model Training

We do not use data generated by you in connection with third-party agent features for model training.

(5) Your Rights and How to Exercise Them

Third-party agent features shall be actively enabled before use. Once enabled, you may uninstall them in App Management.

For details on your rights regarding the processing of personal information in connection with third-party agent features, please refer to Section 6 "How You can Exercise Your Rights to Manage Your Personal Information" of this Policy.