1.Introduction

TIANGEN Biotech (Beijing) Co., Ltd. (“TIANGEN,” “we,” “us”) a wholly owned subsidiary of QIAGEN N.V., is committed to protecting personal data in accordance with applicable laws, including, but not limited to, the Personal Information Protection Law of the People’s Republic of China (PIPL) and, where applicable, the EU General Data Protection Regulation (GDPR). This Privacy Policy (the “Policy”) explains how TIANGEN Biotech (Beijing) Co., Ltd. collects, stores, uses, shares, transfers, discloses, deletes, and otherwise processes information collected from or about you (the “Personal Data”).

2.General information on data processing

2.1.Scope of processing of personal data

Generally, we collect and use personal data of our users only to the extent necessary for the provision of a functional website and our content and services. The collection and use of personal data of our users takes place regularly only with the consent of the user. An exception applies to cases in which prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law.

“Personal Data” is any information―as electronically or otherwise recorded―that can be used to identify a person or that we can link directly to an individual, such as name, address, email address, telephone number, or credit card number, as applicable. Personal Data in some jurisdictions can include information that indirectly identifies a person, even absent other identifying information.

“Sensitive Personal Data” refers to personal data that, once leaked or unlawfully used, may easily result in an infringement of an individual's dignity or harm to their personal or property safety. This includes biometric data, religious beliefs, specific identity information, health and medical information, financial account information, location and tracking information, as well as the personal data of minors under the age of fourteen (14). We will process your sensitive personal data only where it is necessary for a specific purpose and supported by a sufficient legal basis. Where required by applicable laws, we will obtain your separate consent before processing such data. We will implement appropriate technical and organizational measures to protect the security of your sensitive personal data.

We will process any Personal Data we collect in accordance with applicable law and as described in this Privacy Policy (unless a separate policy governs). In some circumstances, if you do not provide us with your Personal Data, certain Products and Services may be unavailable to you.

2.2.Legal Basis on data processing

The legal bases for processing:

· for the purposes of our legitimate interests
· in preparation for or to perform a contract
· to protect vital interests
· to comply with a legal obligation
· in circumstances where we have requested and received consent and for other purposes that may be required or allowed by law

2.3.Sub-processing

We may engage third party service providers to assist with the data processing activities. When we work with these service providers in our capacity as a data processor, the third-party service provider is a sub-processor.

Before engaging any processor and sub-processor, we perform due diligence, including security and legal analysis. Our processor and sub-processors are all subject to contract terms that enforce compliance with applicable data protection laws.

2.4.Data deletion and storage duration

The personal data of the data subject will be deleted or blocked as soon as the purpose of the storage is fulfilled. In some cases, we may be required to retain Personal Data for a longer period of time by law or for other necessary business purposes.

3.Provision of the website and creation of log files

3.1.Scope of data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the calling computer.

In this process, the following data is collected:

(1).Information sent in user-agent header by the browser

(2).The IP address of the user

(3).Date and time of access

(4).Information sent in referrer header by the browser

The data is also stored in the log files of our system. A storage of this data together with other personal data of the user does not take place.

3.2.Purpose of the data processing

The temporary storage of the IP address by the system is necessary to allow delivery of the website to the computer of the user. To do this, the user's IP address must be kept for the duration of the session.

Storage in log files is done to ensure the functionality of the website. In addition, the data is used to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.

4.Use of cookies

Our website uses cookies. Cookies are text files that are stored in the internet browser or the internet browser on the user's computer system. These cookies are primarily used to make the functions of the online offer usable.

We also use cookies to make our website more user-friendly. In addition, we use cookies on our website, which enable an analysis of the surfing behavior and a precise alignment to the interests of the user.

When accessing our website, users are informed by an information banner about the use of cookies for analysis purposes and referred to this privacy policy.

5.Inquiry

5.1.Scope of data processing

On our website, users may inquire by providing personal data. Inquiry is subject to the acceptance of the provisions of this Privacy Policy,.

All or part of the following data is collected during the inquiry process:

(1).Area

(2).Country

(3).City

(4).E-mail address

(5).Name

(6).Company

(7).Telephone number

(8).Address

(9).Product-related Requirements

5.2.Purpose of the data processing

The data provided through your inquiry is processed for the purpose of providing you with information about our latest products, services, promotional offers, and marketing activities, communicating with you regarding potential business or collaboration opportunities, and carrying out other related business and marketing activities.

6.Web chat

6.1.Description and scope of data processing

We offer a web chat on the website, which you can use to get in touch with our support staff quickly. The chat helps you to find the right contact person for your query and to process your request efficiently. All or part of the following data may be collected during the chat:

· Name
· Email address
· Any other information voluntarily shared during the chat.

6.2.Purpose of the data processing

We may process the above data for the following purposes, including but not limited to:

· To respond to your inquiries or requests;
· To provide product information, quotations, sample requests, and other customer support services;
· To handle technical support requests, after-sales services, and product-related matters;
· To identify and connect you with the appropriate sales, customer service, technical support, or other business personnel regarding your inquiry.

7.Business and Operational Activities

7.1.Description and scope of data processing

In the course of conducting business with us, participating in events, requesting product information, or using related services, we may collect personal data that you voluntarily provide, including but not limited to:

· requesting samples, product information, or other materials;
· participating in surveys, market research activities, or customer feedback programs;
· registering for and participating in online or offline events organized, co-organized, or sponsored by TIANGEN;
· participating in contests, lotteries, or other promotional activities;
· requesting product information, technical support, or business collaboration opportunities;
· establishing or maintaining business relationships with us; and

· other activities related to our business, operational, or marketing activities.

Where permitted by applicable laws or with your consent, we may also use your personal data to communicate with you regarding our products, services, events, business opportunities, and other related information.

7.2.Purpose of the data processing

The purposes of processing personal data include analyzing survey results, providing requested content (such as sample kits, product information, or other materials), completing event registration and related communications, organizing and managing events, rewarding and notifying contest or lottery winners, and communicating with you regarding business matters and customer support.

Where permitted by applicable laws or with your consent, we may also use the personal data to improve and develop TIANGEN's business, products, and services, better understand customer needs and preferences, and provide information regarding our products, services, events, or potential business opportunities.

8.Transfer of personal data across national borders

As a member of the QIAGEN group operating globally, TIANGEN may collect personal information from individuals located in different countries and regions. Such personal information may be accessed, stored, processed, or transferred across jurisdictions for group management, customer support, technical operations, information system maintenance, compliance purposes, and other legitimate business needs.

For personal information collected within the People's Republic of China, we will process and transfer such information in accordance with the Personal Information Protection Law of the People's Republic of China and other applicable laws. Where cross-border transfers are required, we will comply with applicable legal requirements, including conducting personal information protection impact assessments, implementing appropriate safeguards, and obtaining separate consent where required by law.

For personal information collected in other jurisdictions, we will process such information in accordance with applicable data protection laws and this Privacy Policy, and will implement appropriate technical, organizational, and administrative measures to protect such information.

Regardless of where personal information is stored or processed, we will take reasonable and necessary measures to ensure an appropriate level of protection consistent with applicable legal requirements.

9.Security in the processing of your data

We adopt all security, technical and administrative measures to protect your data from unauthorized access and from accidental or unlawful situations of destruction, loss, alteration, communication or any manner of improper or unlawful processing of your personal data. However, it is important that you understand that no system is totally secure or insusceptible to invasions and failures.

10.With whom do we share your data

10.1.QIAGEN Group Affiliates

As a member of the QIAGEN group, TIANGEN may share your personal information with other QIAGEN affiliates for group management, internal administration, customer relationship management, technical support, financial administration, legal and compliance purposes, risk management, and other legitimate business needs. QIIAGEN affiliates will process your personal information only for the purposes described in this Privacy Policy and in accordance with applicable laws and regulations. Where such sharing involves cross-border transfers, we will comply with applicable legal requirements.

10.2.Service Providers and Vendors

To support our business operations, we may engage third-party service providers to assist us with activities including:

· Website hosting and maintenance;

· Cloud computing and data storage services;
· Customer relationship management (CRM) systems;
· Information technology support;
· Email and communication services;
· Event management and marketing services;
· Online meeting and customer support services;

· Audit, legal, accounting, and consulting services.

Such service providers may only process personal information on our instructions and are required to implement appropriate safeguards.

10.3.Sub-processors

We engage personal data sub-processors to provide infrastructure services and to help us provide email notifications. Prior to engaging any third-party sub-processor, we perform a diligence review to evaluate their privacy, security and confidentiality practices, and executes an agreement implementing its applicable obligations. The following is an up-to-date list of the names of our key sub-processors and the purposes for which they process personal data.

10.4.Commercial partners

Our products are available in much of the world. However, we are not present everywhere. To enable wider access to our portfolio, we cooperate with commercial partners with whom we share your personal data so that they can provide you with access to our products and all necessary information. We perform a diligence review to evaluate our commercial partners’ privacy, security and confidentiality practices, and executes an agreement implementing its applicable obligations.

10.5.Legal and Regulatory Disclosures

We may disclose personal information where required or permitted by applicable laws, including:

· responding to requests from courts, regulators, law enforcement authorities, or government agencies;
· protecting our legal rights and interests;
· investigating, preventing, or addressing unlawful activities;
· protecting the safety of individuals and property;
· other circumstances required or permitted by applicable laws.

11.Rights of the data subject

Please note that in many circumstances, we cannot effectively do business with you without processing some Personal Data about you (e.g., your contact information). If you are unable to provide this information, we may be unable to process your request.

You may have a right under your area’s data protection law to the following rights with respect to some or all of your personal data:

11.1.Information

To request access to and a copy or representative summary of your Personal Data (including under GDPR Article 15).

11.2.Correction and Deletion

To request that we rectify or erase your personal data (including under GDPR Articles 16 and 17).

11.3.Restriction of processing

To request that we restrict or block the processing of your Personal Data (including under GDPR Articles 18, 21 and 22 and to object to the sale or sharing of your Personal Data under other relevant laws).

11.4.Data portability

To provide your Personal Data directly to another organization, i.e., a right to data portability (including under GDPR Article 20).

11.5.Objection

You have the right to object at any time to the processing of personal data relating to you which is "only" based on legitimate interests of us or third parties (Article 6 (1) (f) GDPR). In the event of an objection, we will no longer process personal data unless we can demonstrate compelling legitimate reasons for processing that outweigh your interests, rights and freedoms, or the processing is for the purpose of asserting, exercising or defending legal claims.

11.6.Revocation of consent

You have the right to revoke your consent to the processing activities, if previously collected, at any time. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until the revocation.

11.7.Right to Complaint and Remedies

You have the right to lodge a complaint with applicable regulatory authorities responsible for personal information protection or seek judicial remedies in accordance with applicable laws.

If you wish to exercise any of your rights described in this Privacy Policy, please contact us atdataprotectioncn@qiagen.com.

Upon receiving your request, we may require additional information to verify your identity and process your request. Subject to applicable laws and regulations, we will respond within the time period required by law after completing the necessary verification procedures.

In certain circumstances permitted by applicable laws and regulations, we may be unable to fulfill part or all of your request, including where:

· the request relates to our compliance with legal obligations;
· the request concerns national security or public security;
· the request relates to criminal investigations, prosecutions, trials, or enforcement of judgments;
· there is sufficient evidence that the request is made in bad faith or constitutes an abuse of rights;
· fulfilling the request would seriously impair the legitimate rights and interests of you, other individuals, or organizations; or
· other circumstances provided by applicable laws and regulations.

12.Amendments to this Policy

This Policy may, if necessary, be amended. Amendments made to this Policy will always be prominently communicated to you.

13.Contact

Any questions about this Privacy Policy may be directed to dataprotectioncn@qiagen.com.