Effective Date: [13/10/2026]

Keboda Technology Co., Ltd. (hereinafter referred to as "Keboda", "we" or "us") attaches great importance to the protection of your personal data and privacy. This Privacy Policy (hereinafter referred to as "this Policy") is intended to explain, in a clear and transparent manner, how we collect, use, store, share and protect your personal data when you visit our official website, as well as the rights you have with regard to your personal data.
1. Scope of Application
1.1 Applicable Website
This Privacy Policy applies to the collection, use, storage, sharing and protection of your personal data when you access the official website of Keboda Technology Co., Ltd. at https://www.keboda.com/ (hereinafter referred to as "this Website"), when you use the various services and functions provided on this Website, and during your interactions with us.
1.2 Processing Entities
Depending on how you use the Website and, where applicable, the country or region of a position advertised on this Website for which you apply using the recruitment contact details provided on this Website, the KEBODA entity responsible for processing your personal data may differ.
1.2.1 Website Operation and Cookies
The Website is operated by KEBODA Technology Co., Ltd. When you visit the Website, personal data processed in connection with the operation and security of the Website and the provision of necessary technical functions is processed by the following entity:
Entity Name：KEBODA Technology Co., Ltd.
Registered Address：No. 2388 Zuchongzhi Road, China (Shanghai) Pilot Free Trade Zone, Shanghai, China
Postal Code：201203
Contact Information：+86 21 6097 8999
1.2.2 Recruitment and Talent Management
The Website is used solely to display job vacancies and the relevant recruitment contact email addresses. We do not directly collect or receive your résumé, job application or other recruitment-related personal data through the Website.

If you apply for a position advertised on this Website using the recruitment email address provided on the relevant recruitment page, your recruitment-related personal data will, in principle, be processed by the KEBODA entity identified below for the country or region where that advertised position is based, acting as the data controller.

The relevant data controllers are as follows:

2. Personal Data We Collect
We follow the principle of "data minimization" and only collect the personal data necessary for the relevant purposes in the specific scenarios in which we interact with you. The following sets out, by processing purpose, the categories of data collected and the corresponding legal basis.
2.1 Website Operation and Cookies
When you visit this Website, we use only strictly necessary cookies and similar technologies that are required to ensure the secure and proper operation of the Website and to provide essential technical functions. We do not currently use analytics, advertising or other non-essential cookies. Where applicable law permits, strictly necessary cookies do not require your consent. You may manage cookies through your browser settings; however, disabling strictly necessary cookies may affect the functionality of the Website.
For detailed information on our use of cookies, please refer to our Cookie Statement .
2.2 Recruitment and Talent Management
When you apply for a position within the KEBODA Group using a recruitment email address provided on the Website, we may collect the following personal data:

The specific data controller responsible for processing your recruitment-related personal data is set out in Section 1.2, “Data Processing Entities”.
3. How We Process Your Personal Data
We collect and use your personal data based on the purposes set out in Chapter 2 of this Policy.

If we intend to process your personal data for a purpose other than the purpose for which it was originally collected, we will assess whether the further processing is compatible with the original purpose in accordance with applicable data protection law. Where required, we will provide you with additional information and obtain your consent or rely on another applicable legal basis before carrying out such further processing.
3.1 How We Share and Disclose Your Personal Data
3.1.1 How We Share and Disclose Your Personal Data
We may share or disclose your personal data where necessary for the purposes described in this Policy and in accordance with applicable data protection laws.
3.1.2 Service Providers and Other Processors
We may engage third-party service providers to process personal data on our behalf for purposes such as IT system operation and maintenance, data hosting and storage, and other services necessary for our business operations.

Where a service provider processes personal data on our behalf, we will select service providers that provide sufficient guarantees to implement appropriate technical and organisational measures to protect personal data. We will enter into appropriate data processing arrangements with such service providers and require them to process personal data only on our documented instructions, maintain appropriate confidentiality and security measures, and comply with applicable data protection requirements.
3.1.3 Sharing with Other Recipients
Where necessary for the purposes described in this Policy and where permitted by applicable law, we may disclose your personal data to the following categories of recipients:
    other Keboda entities, where necessary for internal administration, recruitment, supplier management or other legitimate business purposes;
    professional advisers, such as legal advisers, auditors and consultants, where necessary for the provision of their professional services; and
    other third parties where disclosure is necessary for the establishment, exercise or defence of legal claims or for the protection of our legitimate rights and interests.

Where another recipient processes your personal data as an independent controller, that recipient will be responsible for processing the personal data in accordance with applicable data protection laws.

Where we and another party jointly determine the purposes and means of processing personal data, we will determine our respective responsibilities for compliance with applicable data protection requirements in accordance with Article 26 GDPR.
3.1.4 Public Disclosure
We do not publicly disclose your personal data unless such disclosure is required or permitted by applicable law or you have otherwise expressly requested or authorised the disclosure.

Where personal data is required to be publicly disclosed pursuant to applicable law, we will limit the disclosure to what is necessary for the relevant purpose and take appropriate measures to protect your personal data.
3.2 Cross-Border Transfer of Personal Data
We collect and use your personal data based on the purposes set out in Chapter 2 of this Policy.

If we intend to further process your personal data for a purpose other than that for which it was originally collected, we will assess whether the further processing is compatible with the original purpose in accordance with applicable data protection law. Where required, we will provide you with additional information before such further processing and will obtain your consent or rely on another applicable legal basis, as appropriate.
3.2.1 Cross-Border Transfer of Personal Data Collected in the EU/EEA
Personal data collected in the European Union / European Economic Area ("EU/EEA") may, depending on the relevant processing activity and service provider arrangements, be stored in or accessed from the EU/EEA or transferred to countries outside the EU/EEA. Any transfer of personal data outside the EU/EEA will be carried out in accordance with Chapter V GDPR where the GDPR applies.

In connection with our international operations, your personal data may be transferred to, or accessed from, countries outside the EU/EEA. Where the destination country has not been recognised by the European Commission as providing an adequate level of data protection, we will ensure that an appropriate transfer mechanism or safeguard under Chapter V GDPR applies before the transfer takes place.

International transfers will be carried out in accordance with applicable data protection law, including Chapter V GDPR. Depending on the circumstances, transfers may be based on the following mechanisms or safeguards:
−    The European Commission has decided that the recipient's country or region ensures an adequate level of data protection;
−    Entering into Standard Contractual Clauses (SCCs) approved by the European Commission with the overseas recipient to ensure that personal data receives appropriate protection during cross-border transfer;
−    For intra-group transfers of personal data, on the basis of approved Binding Corporate Rules (BCRs), Standard Contractual Clauses, or other intra-group transfer arrangements that meet the requirements of the GDPR.
You may contact us using the details in the “Contacting Us” section to obtain further information about the transfer mechanism or safeguards applicable to transfers of your personal data, including information on how to obtain a copy where available.
3.3 Legal Bases for Processing
We process personal data only where an appropriate legal basis under applicable data protection law is available. The applicable legal basis depends on the relevant processing activity. Where the GDPR applies, recruitment-related processing is based on the legal basis described in Section 2.1. Processing necessary for the secure and proper operation of the Website may be based on our legitimate interests in maintaining the security, availability and functionality of the Website (Article 6(1)(f) GDPR), to the extent applicable. Other processing activities may rely on consent, contractual necessity, compliance with a legal obligation, vital interests, public interest, or another legal basis permitted by applicable law, as appropriate.

Please note that, under applicable law, where we apply technical measures to personal data so that the information can no longer be used to identify a specific individual and cannot be restored, such information no longer constitutes personal data. Such use does not require separate notification to, or consent from, you.
4. How We Use Cookies and Similar Technologies
We currently use only strictly necessary cookies and similar technologies required for the secure and proper operation of the Website and the provision of essential technical functions. We do not currently use analytics, advertising or other non-essential cookies. Where applicable law permits, strictly necessary cookies do not require your consent. You may manage cookies through your browser settings; however, disabling strictly necessary cookies may affect the functionality of the Website.

For details about our use of cookies, please refer to the Cookie Statement.
5. How We Protect Your Personal Data
5.1 Security Measures
We attach great importance to the security of your personal data and have implemented security measures in line with industry standards to prevent unauthorised access, misuse, alteration or destruction of personal data, and we continuously improve our safeguards.
5.2 Data Retention Period
We retain personal data only for as long as necessary for the purposes for which it was collected and processed, taking into account the duration of the relevant relationship or recruitment process, applicable statutory retention obligations, limitation periods, and the need to establish, exercise or defend legal claims. Once personal data is no longer required, we will delete or anonymise it unless continued retention is required or permitted by applicable law.
5.3 Data Security Incident Response
In the event of a security incident such as a personal data breach, we will take the following actions in accordance with applicable law (including Articles 33 and 34 of the GDPR) and our internal emergency response plan:

−    take appropriate measures to contain, investigate and remediate the personal data breach and mitigate its potential adverse effects;
−    where a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach, in accordance with Article 33 GDPR;
−    where the breach is likely to result in a high risk to your rights and freedoms, notify you without undue delay, informing you of the nature of the incident, its possible impact and the protective measures you may take; and
−    where we have implemented measures that effectively prevent the high risk to your rights and freedoms, we may be exempt from the obligation to notify you in accordance with the law.
6. Your Data Subject Rights
Keboda respects and supports your rights regarding your personal data under applicable data protection law. The following sets out the specific rights you enjoy under the GDPR and our commitment in responding to them:
6.1 Right to be Informed
You have the right to be provided with transparent, clear and easily‑understandable information about our processing of your personal data at the time of collection, or where your data is obtained from another source, before or within a reasonable period after collection (Right to be Informed, Articles 13 and 14 GDPR).
6.2 Right of Access and Right to Rectification
You have the right to obtain from us confirmation as to whether personal data concerning you is being processed and, where it is, access to the personal data and a copy of it (Right of Access, Article 15 GDPR).

You have the right to obtain the rectification of inaccurate personal data concerning you without undue delay, and to have incomplete personal data completed (Right to Rectification, Article 16 GDPR).
6.3 Right to Erasure ("Right to be Forgotten")
You have the right to obtain the erasure of personal data concerning you without undue delay (Article 17 GDPR). You may submit a request for erasure in the following circumstances:

−    the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
−    you withdraw your consent on which the processing is based and there is no other legal ground for the processing;
−    you object to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing;
−    the personal data has been unlawfully processed; or
−    the personal data must be erased for compliance with a legal obligation to which we are subject.
6.4 Right to Restriction of Processing
You have the right to obtain the restriction of the processing of your personal data (Article 18 GDPR) where one of the following applies: you contest the accuracy of the personal data, for a period enabling us to verify its accuracy; the processing is unlawful and you oppose the erasure and request the restriction instead; we no longer need the personal data but you require it for the establishment, exercise or defence of legal claims; or you have objected to the processing pending the verification of whether our legitimate grounds override yours.
6.5 Right to Data Portability
Where the processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format, and to transmit that data to another controller (Article 20 GDPR).
6.6 Right to Withdraw Consent
Where we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Withdrawing consent shall be as easy as giving it (Article 7(3) GDPR).
6.7 Right to Object
You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data which is based on our legitimate interests or the performance of a task carried out in the public interest (Article 21(1) GDPR). Where you object to processing for direct marketing purposes, we will stop processing your personal data for such purposes without further qualification (Article 21(2) GDPR).
6.8 Rights in relation to Automated Decision-Making and Profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR). We currently do not use fully automated decision-making systems that produce such effects. Should we introduce such systems in the future, we will provide you with prior notice and ensure appropriate safeguards, including human intervention.
6.9 Right to Lodge a Complaint
You have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Article 77 GDPR).

6.10 Response to Your Requests
You may contact us via the channels set out in the “Contacting Us” section. After taking reasonable steps to verify your identity where necessary, we will respond to your request without undue delay. 

We will generally process valid requests free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the requested action, or refuse to act on the request, as permitted by Article 12(5) GDPR. If we refuse to act on a request, we will inform you of the reasons and of your right to lodge a complaint with a supervisory authority and to seek a judicial remedy
7. Contacting Us
If you have any questions, comments or suggestions regarding this Privacy Policy, please contact us using the details below:

Company Name: Keboda Technology Co., Ltd.
Address: Zuchongzhi-Road 2388, Building 1-2, 201203 Shanghai, China
Postal Code: 201203 

Keboda Information Security Team
Email: cybersecurity@keboda.com