Shine Smart Service Privacy Policy

Who Are We?

Shenzhen Growatt Technology Co., Ltd. has always been committed to becoming a world-class new energy solution provider, striving to create an intelligent and user-friendly photovoltaic monitoring software for users. We will provide you with remote monitoring and management services for photovoltaic power stations through the ShinePhone APP, ShinePhone Beta APP, GroEnergy APP, Ruiguang Box APP, and Shine Server (https://server-cn.growatt.com/login) (hereinafter collectively referred to as "Shine Smart Service").

Shenzhen Growatt Technology Co., Ltd. respects your privacy rights. This Shine Smart Service Privacy Policy (hereinafter referred to as "this Privacy Policy") aims to explain how we collect, share, use, and process your personal information, as well as how you can exercise your personal information rights. If you have any questions or concerns about our use of your personal information, please contact us through the contact information provided at the bottom of this Privacy Policy.

The Company strictly complies with laws and regulations and adheres to the following principles for protecting personal information to provide you with safer and more reliable services:

• 1. Security and Reliability: We make every effort to prevent your information from being leaked, damaged, or lost through reasonable and effective information security technologies and management processes.
• 2. Independent Choice: We provide you with convenient information management options so that you can make appropriate choices and manage your personal information.
• 3. Protection of Communication Privacy: We strictly comply with laws and regulations to protect the privacy of your communications and provide you with secure communication services.
• 4. Reasonable and Necessary: To provide better services to you and other users, we only collect necessary information.
• 5. Clarity and Transparency: We strive to use concise and understandable language to introduce the privacy policy, so you can clearly understand our information processing methods.
• 6. Integrating Personal Information Protection into Product Design: We incorporate the concept of personal information protection into all aspects of product or service development, considering legal, product, design, and other factors comprehensively.

This Privacy Policy mainly explains to you: what personal information we collect; the purposes for which we collect personal information; the rights you have; how we share, transfer, and publicly disclose your personal information; and information about changes to the privacy policy.

We hope you read this Privacy Policy carefully to understand in detail how we collect, use, and process information, so that you can better understand our services and make appropriate choices. Unless otherwise agreed, terms used in this Privacy Policy have the same meanings as in the Shine Smart Service User Agreement. If you have questions, please contact us.

I. Information We Collect

We collect only the information necessary to realize product functions based on the principles of legality, legitimacy, and necessity.

1.1 Information You Actively Provide When Using Our Services

1.1.1 Information you fill in when registering for a Shine Smart Service account.
For example: The username, email address, or mobile phone number you provide when registering for a Shine Smart Service account is only used for login verification. We will encrypt this information to protect your privacy.

1.1.2 Information you upload when using Shine Smart Service.
For example, the avatar you upload when using Shine Smart Service.

1.2 Information We Obtain When You Use Shine Smart Service

1.2.1 WiFi Collector Configuration Logs
When you use the WiFi collector for configuration, we will collect your configuration logs, such as: the configured WiFi name, current configuration steps, country, and the current APP version used, to help us troubleshoot reasons for WiFi collector failure and improve the WiFi collector configuration success rate and network configuration experience.

1.2.2 Photovoltaic Inverter Device Information
When you connect a photovoltaic inverter to Shine Smart Service, we may collect basic software and hardware information and technical parameters of the inverter device, such as unique identifier, device serial number, alias, model, hardware version, machine type, software version, GPS location information of the mobile device, server IP, last update time of the inverter device, number of strings, power on/off information of the inverter device, power information, voltage limits, and other information.

1.2.3 Device Operating Data and Self-Consumption & Electricity Usage Records
When you connect a photovoltaic inverter to Shine Smart Service, we will collect the status of the inverter device, various voltage data, various current data, grid frequency, power data, fault data, temperature data, operating time, etc. The device will upload data related to the meter, such as: battery information, self-consumption information, usually only to show you your power generation and consumption data, but this may involve recording your electricity usage habits.

1.2.4 Location Information
When you use the service, we obtain your IP address and GPS geographic location information (not mandatory) after obtaining your consent upon inquiry.

1.2.5 Other
When you use our APP, we also collect your inverter device's IP address, information about your installation of third-party apps you jump to (such as payment or map apps), etc.

1.2.6 Third-Party Code and Plugins

To ensure the stable operation of our products/services and for you to fully enjoy and use the necessary and additional functions of our products/services, our ShinePhone APP and Ruiguang Box APP may embed SDKs or other similar applications from authorized partners (Shine Server does not involve the use of SDKs or other similar applications). We will strictly test the application programming interfaces (APIs) and software development kits (SDKs) used by authorized partners to obtain information, and will strictly monitor these SDKs, agreeing on strict data protection measures with third-party companies, requiring them to process your personal information in accordance with this Privacy Policy and other relevant confidentiality and security measures to protect your personal information security.

1.2.7 Information on Third-Party Data Collection

1.3 Self-Start Explanation

To ensure that this application can normally receive broadcast information pushed by the client when it is closed or running in the background, this application must use the (self-start) capability. There will be a certain frequency of broadcasting sent through the system to wake up the application for self-start or associated start, which is necessary for realizing functions and services; when you open a content-type push message, it will jump to open the relevant content after obtaining your explicit consent. Without your consent, there will be no associated start.

II. Purposes of Collecting Your Personal Data

We strictly comply with laws, regulations, and agreements with users, using the collected information for the following purposes. If we use your information beyond these purposes, we will explain it to you again and obtain your consent.

• • To provide you with equipment maintenance, debugging, and monitoring services.
• • Product development and service optimization. For example, when our system fails, we record and analyze the information generated during the failure to optimize our services.
• • Security assurance.
• • Software management. For example, software authentication, software upgrades, etc.

To provide you with a better experience, improve our services, or for other purposes with your consent, and in compliance with relevant laws and regulations, we may use information collected through certain services for our other services.

To ensure service security and help us better understand the operation of our applications, we may record relevant information, such as your usage information of the application (e.g., number and time of logins), fault information, and the source of the application. When analyzing, we will de-identify your personal information or only analyze statistical data.

III. Your Personal Information Rights

3.1 Right of Access and Right to Update/Correct

While using our services, you can access, modify, and update the registration information and other personal information you provided, or contact us following the notification guidelines. The scope and method of accessing, modifying, and updating personal information depend on the specific services you use. If you need to access or correct other personal information generated during your use of our products/services, please feel free to contact us. We will respond to your request in the manner and within the timeframe stated in this Privacy Policy. However, please note that due to technical limitations or security considerations, we may not be able to provide access, update, or correction services for some of your personal information.

3.2 Right of Copy

You have the right to obtain a copy of your personal information. If you need a copy of your personal information we have collected, you can contact us through the contact information listed in this Privacy Policy. Subject to compliance with relevant laws and technical feasibility, we will provide you with a copy of your personal information upon your request.

3.3 Right of Deletion

You have the right to request deletion if (a) we collected or used your personal information in violation of laws or regulations; (b) we had no legal basis for collecting your personal information, or you withdrew your consent; (c) we collected or used your personal information in violation of our agreement with you; (d) you cancel your account; or (e) we no longer provide products or services to you.

3.4 Right of Withdrawal

You can withdraw part or all of your authorization by modifying personal data, closing some functions, canceling your account, etc., to limit/refuse our processing of your personal information. For example, if you are using location-related services and wish to stop sharing your geographic location information, you can stop sharing by turning off the phone's location function, or through methods provided by software/hardware service providers and communication service providers. When you withdraw consent or cancel your account, we cannot continue to provide the services corresponding to the withdrawal or cancellation and will no longer process your corresponding personal information. However, your decision to withdraw consent or authorization does not affect the processing of personal information carried out based on your prior consent or authorization before the withdrawal. After account cancellation, we will stop providing products or services to you and delete your personal information based on your request and applicable legal requirements. If we must collect, use, or share your information according to applicable laws and regulations, we may refuse your request to the extent permitted by applicable laws and regulations. We have the right to adjust your above rights according to applicable laws and regulations.

3.5 Right to Obtain an Explanation

You have the right to request an explanation of the personal information processing rules. You can contact us through the contact information listed in this policy.

3.6 Right to Transfer Personal Information

You have the right to request that we transfer your personal information to the personal information processor you designate, subject to the conditions stipulated by the national cyberspace administration. Where technical conditions permit, we will provide a means of transfer to the personal information processor you designate.

3.7 How We Respond to Your Above Requests

When you exercise your personal information rights mentioned above, we may require you to verify your identity to ensure account security. Please understand that due to technical limitations, legal or regulatory requirements, we may not be able to satisfy all your requests. We will respond to your request within 15 working days. For your reasonable requests, we generally do not charge a fee, but for requests that are repetitive beyond a reasonable limit, we may charge a certain cost fee depending on the situation. We may reject requests that are unreasonably repetitive, require excessive technical means (for example, developing a new system or fundamentally changing current practices), pose a risk to the legal rights of others, or are highly impractical.

IV. How We Share, Transfer, and Publicly Disclose Your Personal Information

(1) Sharing

1. Sharing with Third-Party Partners
We share your personal information with installers, distributors, and third-party service providers (e.g., map service providers offering location services) based on the purpose of achieving operational and maintenance services. We strictly limit the sharing of information in accordance with laws and regulations. Regarding the sharing of your personal information with third-party service providers, please refer to the information about SDK service providers above; regarding the sharing of your personal information with installers and distributors, please contact us as described in this Privacy Policy.

Our sharing of your personal information with third-party partners is mainly for the following purposes:

• • To provide you with our services;
• • Distributors/installers provide you with remote, offline, and other operational and maintenance services through the platform;
• • To achieve the purposes described in the "How We Use the Information We Collect" section;
• • To fulfill our obligations and exercise our rights under the Shine Smart Service User Agreement or this Privacy Policy;
• • To maintain and improve our services. If we share your information with third parties, we will use encryption, de-identification, and other means to ensure your information security.
• • Distributors and installers request access to device data purchased from them via API to develop independent platforms and maintain them independently. We will protect your data as much as possible, requiring all distributors and installers obtaining data from the platform to use it only for operational and maintenance purposes and strictly comply with Chinese data security and personal information protection laws and regulations.

(2) Entrusted Processing
We may entrust third-party service providers to help us provide related operational and support services, and transfer or authorize access to your personal information (including cloud service providers) to them for technical or other reasons.

(3) Transfer
We will not transfer your personal information to any company, organization, or individual, except in the following circumstances:

• 1. Transfer with explicit consent: With your explicit consent, we will transfer your personal information to other parties;
• 2. In the event of merger, division, dissolution, or bankruptcy liquidation, if the transfer of personal information is involved, we will require the new company or organization holding your personal information to continue to be bound by this policy; otherwise, we will require that company/organization to seek your authorization and consent again. We will fulfill corresponding notification and other obligations in accordance with legal requirements.

(4) Public Disclosure
We will only publicly disclose your personal information in the following circumstances:

• 1. After obtaining your separate consent;
• 2. Public disclosure based on law or reasonable grounds: Your information may be publicly disclosed when required by law, legal procedures, litigation, or public and government authorities.

V. Information We May Send to You

5.1 Emails Related to Customer Service Evaluation

When you use our services, we may send you emails to obtain your evaluation and feedback on our services.

5.2 Service-Related Announcements

We may send you service-related announcements when necessary (e.g., suspending a service due to system maintenance). You may not be able to cancel these service-related announcements that are not advertising.

VI. Location and Duration of Information Storage

6.1 Location of Information Storage

We comply with laws and regulations by storing user personal information collected within China domestically.

6.2 Duration of Information Storage

Generally, we retain your personal information for the shortest period necessary to achieve the purposes. At the same time, we will legally retain your personal information in accordance with mandatory provisions on personal information retention periods in laws and regulations. After the retention period expires, we will delete your personal information in accordance with applicable legal requirements. In the event of cessation of operation of our products or services, we will notify you through methods such as push notifications, announcements, etc., and delete your personal information within a reasonable period.

VII. Information Security

We provide corresponding security safeguards for your information to prevent loss, misuse, unauthorized access, or disclosure.

7.1 We strictly comply with laws and regulations to protect user information.

7.2 We will use various security protection measures within a reasonable level of security to ensure information security. For example, we use encryption techniques (such as TLS, SSL, MD5), anonymization, and other means to protect your personal information.

7.3 We establish specialized management systems, processes, and organizations to ensure information security. For example, we strictly limit the scope of personnel accessing information, require them to comply with confidentiality obligations, and conduct audits.

7.4 In the event of a security incident such as personal information leakage, we will activate emergency plans to prevent the incident from expanding and inform you via push notifications, announcements, etc.

VIII. Scope of Application

Please note that this Privacy Policy does not apply to services provided by other companies or individuals.

Your use of such third-party services is subject to their privacy policies (not this Privacy Policy), and you need to carefully read their policy content.

IX. How We Handle Minors' Personal Information

We attach great importance to the protection of minors' personal information. We do not actively provide services to children under the age of 14. If you are a minor under the age of 14, you should obtain the consent of your guardian before using our products/services. We protect the personal information of minors in accordance with relevant national laws and regulations.

We do not actively collect personal information directly from minors. In the case of collecting minors' personal information with guardian consent, we will only use, share, transfer, or disclose this information when permitted by law, with guardian consent, or as necessary to protect the minor.

If there is proof that a minor registered and used our products/services without guardian consent, we will negotiate with the relevant guardian and attempt to delete the relevant personal information as soon as possible.

X. How to Contact Us

Agreeing to this Privacy Policy constitutes your permission for us to process your personal data for the specified purposes. Growatt processes your personal data only with your consent. If we ask you to provide sensitive data, we will tell you why and how the information will be used. If you have any questions about this Privacy Policy, please contact us via: Registered Address: Rooms 4-13, Building A401, Sino-German Europe Industrial Demonstration Park, Hangcheng Avenue, Guxing Community, Xixiang Street, Bao'an District, Shenzhen. Email of the Information Protection Officer: service@ginverter.com. We will review the issues as soon as possible and respond after verifying your user identity.

XI. Regarding Changes to the Privacy Policy

We may revise the content of this Privacy Policy from time to time. If such changes result in a substantial reduction of your rights under this Privacy Policy, we will notify you through prominent page prompts before the changes take effect. For significant changes, including changes in the purpose of processing personal information, processing methods, and the types of personal information processed, we will re-obtain your personal consent. We will also provide more prominent notice (including, for certain services, notifying you through announcements on our website, explaining the specific changes to the privacy policy).

---

Shine Smart Service – Privacy Policy v1.1 (EN)