Data Security Statement — QingdaoFu Property

Data Security Statement — QingdaoFu Property (Shenzhen) Co., Ltd.

Published: June 19, 2026 | Version: V1.0

QingdaoFu Property (Shenzhen) Co., Ltd. (hereinafter referred to as "we" or "the Company") attaches great importance to data security, strictly complies with the Data Security Law of the People's Republic of China, the Personal Information Protection Law of the People's Republic of China, the Cybersecurity Law of the People's Republic of China, the Regulations on Network Data Security Management, and other laws and regulations, and in conjunction with the requirements of the Financial Information Service Data Classification and Grading Guide (Guo Xin Ban Tong Zi [2026] No. 2), has formulated this Data Security Statement to publicly commit to our data security protection responsibilities.

1. Data Security Compliance Commitment

1.1 Legal Compliance

We commit to complying with the following laws, regulations, and standards:

Data Security Law of the People's Republic of China
Personal Information Protection Law of the People's Republic of China
Cybersecurity Law of the People's Republic of China
Regulations on Network Data Security Management
Provisions on the Management of Financial Information Services
Data Security Technology — Data Classification and Grading Rules (GB/T 43697-2024)
Financial Information Service Data Classification and Grading Guide (Guo Xin Ban Tong Zi [2026] No. 2)
Other applicable laws, regulations, and national standards

1.2 Compliance System

We have established the following data security compliance system:

Data Classification and Grading Management System: Managing business data by classification and grading in accordance with the Financial Information Service Data Classification and Grading Guide
Data Security Responsibility System: Clarifying data security responsible persons and management institutions
Data Security Assessment Mechanism: Regularly conducting data security risk assessments
Emergency Response Mechanism: Establishing data security incident emergency plans
Compliance Audit Mechanism: Regularly conducting data security compliance self-inspections

2. Data Classification and Grading Management

2.1 Classification and Grading Principles

In accordance with the requirements of the Financial Information Service Data Classification and Grading Guide, we classify and grade business data following these principles:

Legal Compliance Principle: Classification and grading work complies with national laws and regulations
Scientific Rationality Principle: Grading based on multi-dimensional attributes of data (coverage, precision, sensitivity, etc.)
Strict Application Principle: When there is dispute in level determination, adopting the higher and stricter grading strategy
Dynamic Update Principle: Timely adjusting classification and grading results based on changes in data status

2.2 Data Classification

Data involved in our business mainly includes the following categories:

Data Category	Data Content	Typical Scenario
User Data	Client names, contact information, enterprise information	Consultation registration, business discussion
Business Data	Compliance consulting records, service contract information	Service delivery
Operational Data	Website access logs, system operation data	Website operation and maintenance

2.3 Data Grading

In accordance with the Guide's four-level grading model (Core Data — Important Data — Sensitive General Data — Regular General Data), our current data grading is as follows:

Data Grade	Our Involvement	Protection Measures
Core Data	Not involved	—
Important Data	Not involved (user scale has not reached the threshold of 10 million)	—
Sensitive General Data	Possibly involved (enterprise client business information, carbon emission data, etc.)	Encrypted storage + permission grading + desensitization
Regular General Data	Involved (public information, website logs, etc.)	Basic security protection

Special Note: This statement reflects the current data grading status. If business development leads to changes in data scale or nature, we will timely update the classification and grading results and report to the competent authorities as required by laws and regulations.

3. Data Security Protection Measures

3.1 Technical Measures

Security Area	Specific Measures
Transmission Security	Site-wide HTTPS encryption (SSL/TLS protocol)
Storage Security	Alibaba Cloud ECS enterprise-level security protection, data stored in mainland China
Access Control	Role-based access control (RBAC), principle of least privilege
Audit Logging	Key operations leave traces, supporting security incident traceability
Sensitive Data Protection	Sensitive general data encrypted for storage, desensitized when externally provided

3.2 Management Measures

Management Area	Specific Measures
Organizational Assurance	Designated data security responsible person, established data security management system
Personnel Management	Security training and confidentiality constraints for personnel accessing sensitive data
Vendor Management	Data processing agreements signed with data processing service providers, clarifying security responsibilities
Emergency Management	Data security incident emergency plan established, regular drills conducted
Compliance Self-Inspection	Data security compliance self-inspection conducted at least once annually

3.3 Data Lifecycle Management

Phase	Security Requirements
Data Collection	Lawful, legitimate, necessary, with explicit collection purpose
Data Storage	Classified and graded storage, sensitive data encrypted, stored in China
Data Usage	Used within authorized scope, prohibited from unauthorized processing or analysis
Data Transmission	Encrypted transmission, cross-border transmission subject to security assessment per law
Data Deletion	Timely deletion or anonymization after retention period expires

4. Cross-Border Data Transfer

4.1 Basic Principles

Data Localization: Personal information and business data we collect and generate within China are stored within China.
Prudent Cross-Border Transfer Principle: If business requires providing data overseas, we will strictly comply with the cross-border transfer provisions of the Regulations on Network Data Security Management and the Personal Information Protection Law.

4.2 Cross-Border Transfer Security Assessment

If personal information or important data needs to be provided overseas, we will apply to the national cyberspace administration for a data export security assessment in accordance with the law, and will not conduct cross-border transfers before passing the security assessment.

5. QingdaoFu Academy Data Security

QingdaoFu Academy learning services are hosted and operated by the Coze platform, with the following security measures:

Data Storage: Learning behavior data, practice answers, error records, etc. are stored on Coze platform servers within mainland China, meeting data localization storage requirements
Data Transmission: Academy pages are transmitted via HTTPS encryption, and the Coze site embedded via iframe also uses SSL/TLS encryption
Data Classification: Learning data belongs to general personal information and does not involve important data or core data
Data Retention: Learning data is retained during the user's account existence and deleted within 30 days after account cancellation
Third-Party Hosting: Coze platform, as a data processor, is bound by its data processing agreement and may not use user data for other purposes

6. Data Security Incident Emergency Response

6.1 Emergency Plan

We have established a data security incident emergency plan, clarifying incident grading standards, response procedures, and handling measures.

6.2 Incident Notification

After a data security incident occurs, we will report to the competent authorities in a timely manner in accordance with the requirements of the Regulations on Network Data Security Management, and notify affected users through website announcements, emails, and other means, informing them of the possible impact and remedial measures taken.

7. Statement Updates

We may revise this statement from time to time. The revised statement will be published on this website and shall take effect from the date of publication. Significant changes will be notified to users through reasonable means such as website announcements.

8. Contact Information

If you have any questions about our data security measures, please contact us through the following:

Company Name: QingdaoFu Property (Shenzhen) Co., Ltd.
Unified Social Credit Code: 91440300MADHNCR06F
Registered Address: Room 301-3, Jiayu Building, No. 62 Longjing 2nd Road, Longjing Community, Xin'an Subdistrict, Bao'an District, Shenzhen
Phone: +86-755-23634308
Email: 3676226702@qq.com
Website: qdoff.cn

This statement is formulated and interpreted by QingdaoFu Property (Shenzhen) Co., Ltd.