Privacy Policy

CNLITE Africa (Pty) Ltd ("we", "us", or "our") is committed to protecting your personal information and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at cnliteafrica.com or contact us for our products and services. This policy is designed to comply with: • The General Data Protection Regulation (GDPR) — applicable to users in the European Economic Area • The Protection of Personal Information Act, 2013 (POPIA) — applicable to users in South Africa • The Data Protection Act (Chapter 11:12) — applicable to users in Zimbabwe By using our website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with its terms, please discontinue use of our website.

For the purposes of GDPR and POPIA, the data controller / responsible party is: CNLITE Africa (Pty) Ltd 38 Hiller Road, Harare, Zimbabwe Email: contact@cnliteafrica.com WhatsApp: +263 776 232 333 Our Information Officer (as required under POPIA) can be contacted at the email address above.

We collect the following categories of personal information: 3.1 Information You Provide Directly • Contact details: name, email address, phone number, company name, country • Enquiry and quote request content submitted via our contact forms • Technical support requests and troubleshooting information • Newsletter subscription preferences 3.2 Information Collected Automatically • IP address and approximate geographic location (country/city level) • Browser type, version, and operating system • Pages visited, time spent on pages, and navigation paths • Referring website or search query that brought you to our site • Device type (desktop, mobile, tablet) 3.3 Cookies and Tracking Technologies We use cookies and similar technologies as described in Section 8 of this policy. You can manage your cookie preferences at any time using our Cookie Preferences tool.

Under GDPR, we process your personal data on the following legal bases: • Legitimate Interests (Article 6(1)(f)): To respond to enquiries, provide product information, and improve our website. We have conducted a Legitimate Interests Assessment (LIA) and determined that our interests do not override your rights. • Consent (Article 6(1)(a)): For newsletter subscriptions and non-essential cookies. You may withdraw consent at any time. • Contract Performance (Article 6(1)(b)): When processing is necessary to fulfil a quote request or supply agreement. • Legal Obligation (Article 6(1)(c)): Where required by applicable law. Under POPIA, processing is justified on the grounds of: consent of the data subject; legitimate interests of the responsible party; compliance with a legal obligation; or performance of a contract.

We use the information we collect to: • Respond to your product enquiries, quote requests, and technical support questions • Send you product documentation, safety data sheets, and technical resources you have requested • Send newsletters and industry updates (only with your explicit consent) • Improve our website content, navigation, and user experience • Analyse website traffic and usage patterns (using anonymised/aggregated data) • Comply with legal and regulatory obligations • Detect and prevent fraud or misuse of our services • Communicate important updates about our products or services We will never sell, rent, or trade your personal information to third parties for their own marketing purposes.

We may share your personal information with: 6.1 Service Providers Trusted third-party service providers who assist us in operating our website and conducting our business, including: • Website hosting and infrastructure providers • Email delivery services • Analytics providers (e.g. Google Analytics — data is anonymised) • Customer relationship management (CRM) tools All service providers are contractually bound to process data only on our instructions and in accordance with applicable data protection law. 6.2 CNLITE Global (China) As the authorised African distributor of CNLITE reagents, we may share relevant enquiry information with CNLITE Reagent Co., Ltd in China for the purpose of fulfilling product orders and technical support. Appropriate data transfer safeguards are in place. 6.3 Legal Requirements We may disclose your information if required to do so by law, court order, or governmental authority, or to protect the rights, property, or safety of CNLITE Africa, our customers, or others. 6.4 Business Transfers In the event of a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.

Your personal information may be transferred to and processed in countries outside your country of residence, including Zimbabwe, South Africa, and China. Where such transfers occur, we ensure appropriate safeguards are in place, including: • Standard Contractual Clauses (SCCs) approved by the European Commission (for GDPR transfers) • Binding Corporate Rules or equivalent mechanisms • Adequacy decisions where applicable By submitting your information to us, you consent to these transfers where required.

Our website uses the following categories of cookies: Strictly Necessary Cookies Essential for the website to function correctly. These cannot be disabled. They include session management, security tokens, and load balancing cookies. Functional Cookies Remember your preferences (e.g. language, region) to provide a more personalised experience. These are only set with your consent. Analytics & Performance Cookies Help us understand how visitors interact with our website by collecting anonymous, aggregated data. We use Google Analytics with IP anonymisation enabled. These are only set with your consent. Marketing & Targeting Cookies Used to deliver relevant content and measure the effectiveness of our communications. These are only set with your explicit consent. Managing Cookies You can manage your cookie preferences at any time by clicking the "Cookie Preferences" link in the footer of our website. You can also control cookies through your browser settings, though this may affect website functionality. Cookie Retention Session cookies expire when you close your browser. Persistent cookies are retained for up to 12 months unless you clear them earlier.

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law: • Enquiry and contact form data: 3 years from last contact • Newsletter subscriber data: Until you unsubscribe or withdraw consent • Website analytics data: 26 months (Google Analytics default, anonymised) • Cookie consent records: 12 months • Legal and compliance records: 7 years (as required by Zimbabwean and South African law) When data is no longer required, it is securely deleted or anonymised.

Depending on your location, you have the following rights regarding your personal information: Under GDPR (EEA residents): • Right of Access: Request a copy of the personal data we hold about you • Right to Rectification: Request correction of inaccurate or incomplete data • Right to Erasure ("Right to be Forgotten"): Request deletion of your data in certain circumstances • Right to Restrict Processing: Request that we limit how we use your data • Right to Data Portability: Receive your data in a structured, machine-readable format • Right to Object: Object to processing based on legitimate interests or for direct marketing • Right to Withdraw Consent: Withdraw consent at any time without affecting prior processing • Right to Lodge a Complaint: With your local supervisory authority (e.g. ICO in the UK, or your national DPA) Under POPIA (South African residents): • Right to be notified of collection of personal information • Right of access to personal information • Right to request correction or deletion of personal information • Right to object to processing of personal information • Right to submit a complaint to the Information Regulator of South Africa To exercise any of these rights, please contact us at contact@cnliteafrica.com. We will respond within 30 days (GDPR) or a reasonable period (POPIA). We may need to verify your identity before processing your request.

Our website and services are not directed at children under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately at contact@cnliteafrica.com and we will take steps to delete such information.

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include: • SSL/TLS encryption for all data transmitted to and from our website • Access controls limiting who can access personal data within our organisation • Regular security assessments and updates • Secure data storage with reputable cloud providers However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

Our website may contain links to third-party websites, including our parent company CNLITE Reagent Co., Ltd (cnlitereagent.com), industry associations, and regulatory bodies. We are not responsible for the privacy practices of these external sites and encourage you to review their privacy policies before providing any personal information.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will: • Update the "Last Updated" date at the top of this page • Display a notice on our website for a reasonable period • Where required by law, notify you directly by email We encourage you to review this policy periodically. Your continued use of our website after changes are posted constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: CNLITE Africa (Pty) Ltd Information Officer / Data Protection Contact 38 Hiller Road, Harare, Zimbabwe Email: contact@cnliteafrica.com WhatsApp: +263 776 232 333 Website: cnliteafrica.com For GDPR-related complaints, you also have the right to lodge a complaint with your local data protection supervisory authority. For POPIA-related complaints, you may contact the Information Regulator of South Africa: Website: www.justice.gov.za/inforeg Email: inforeg@justice.gov.za