Unionfab Privacy Policy

Version date: 10 September 2026

This Privacy Policy explains how Unionfab ("we," "us," or "our") collects, uses, stores, shares, transfers, and protects personal information when you visit the Unionfab website, create or use an account, request a quotation, place an order, contact our team, use our customer support channels (including LiveChat), use the Unionfab DTC quotation and ordering platform, or interact with Material AI and the AI Material Advisor. It also outlines your privacy rights under applicable data protection laws and explains how you can exercise them.

1. Scope and Controller

This Privacy Policy applies to personal information that Unionfab processes as a controller or business for its own purposes in connection with the website and related services. It does not govern information that Unionfab processes solely on documented instructions from a customer where Unionfab acts as a processor or service provider; the applicable customer agreement governs that processing.

Unless a service-specific notice identifies another entity, Unionfab is responsible for the personal information described in this Policy. References to Unionfab, we, us and our mean the Unionfab entity that provides the relevant service and determines why and how the personal information is processed.

The data controller responsible for the personal information collected through this website and related Services is Unionfab AM Technology (Shanghai) CO., Ltd., located at No. 518 Xinzhuan Road, Building 40, Songjiang High Science and Technology Park, Shanghai, China. You may contact our privacy team at hello@unionfab.com. Where our affiliated companies jointly determine the purposes and means of processing with us, we determine our respective compliance responsibilities in accordance with applicable law and provide a central contact point through hello@unionfab.com for you to exercise your rights.

This Policy covers unionfab.com and its localized pages, the account registration, the Unionfab DTC quotation and ordering front end, Contact Us forms, LiveChat and 24/7 Help, Material AI and the AI Material Advisor, customer service, payments, order fulfilment, and marketing communications that link to this Policy.

2. Key Definitions

3. Personal Information We Process

Depending on how you interact with Unionfab, we process the following categories of personal information:

• Identity and account information, including name, username, nickname, avatar, customer type, company name, account identifier, password in protected form, verification code, invitation code, registration source, device identifier, language and account preferences.

• Contact and professional information, including email address, telephone or mobile number, WhatsApp number, country or region, company, job title, industry, customer requirements, assigned sales representative and communication preferences.

• Quotation project and manufacturing information, including CAD or 3D models, drawings, bills of materials, photographs, specifications, dimensions, tolerances, quantities, materials, finishes, intended application, engineering notes, project messages, file metadata, DFM results, quotation history and related technical content.

• Order and commercial information, including quotation and order numbers, selected services, products, quantities, prices, discounts, coupons, purchase history, production status, delivery status, returns, refunds, complaints and after-sales records.

• Billing shipping and tax information, including invoice type and title, company or personal name, tax number, recipient name, email, telephone number, company, country, province or state, city, district, street, detailed address and postal code.

• Payment information, including payment method, transaction amount, currency, transaction status, payment processor transaction identifiers and billing IP address. Payment card or financial account details are generally collected directly by payment processors where their interface is used.

• Communications, including emails, SMS or WhatsApp messages, LiveChat conversations, Material AI prompts and responses, customer support messages, survey responses, testimonials, call or meeting notes, and files or media you choose to provide.

• Device usage and network information, including IP address, approximate location inferred from IP, browser type, operating system, device and analytics identifiers, referral URL, pages viewed, search and click activity, access times, session identifiers, cookie and pixel data, , website interaction and session-replay information, such as click locations, page response and abnormal interaction events, where enabled and with sensitive content masked where applicable, performance and error logs, and security events.

• Profile and preference information, including language, material or process preferences, saved selections, interests inferred from Service activity, marketing preferences, customer tags, loyalty or potential-customer indicators, gender and date of birth if voluntarily provided.

• Identity verification and compliance information, including copies of identification documents, tax identifiers, sanctions or fraud-screening results, and information required to comply with export control, tax, accounting or other legal obligations, but only when necessary.

Please do not provide sensitive personal information or personal information about another individual unless it is necessary for the requested Service and you are authorized to provide it. Technical files may contain names, metadata or other personal information; review files before uploading them.

Models, drawings and production data are not necessarily personal information on their own. We treat them as personal information when they are linked to an identifiable account, contact, author or other individual, or when their contents or metadata include personal information. Where sensitive personal information is processed, we explain the necessity and possible impact and obtain separate consent when required by applicable law.

4. Collection Scenarios Purposes and Processing Methods

The table below describes the main collection points, the information processed, and the purpose and method of processing. Fields marked as required in an interface are needed to provide the requested function. Other fields are optional. If required information is not provided, we may be unable to create an account, issue a quotation, process an order, deliver parts, respond to a request or provide the relevant function.

5. Material AI and Automated Recommendations

Material AI and the AI Material Advisor use the technical requirements and selections you provide to generate material or process recommendations. These outputs are informational and may be incomplete or unsuitable for a particular regulated or safety-critical application. Review the recommendation and consult a Unionfab engineer before relying on it for final design or production decisions.

The recommendation feature may use automated rules or machine-learning models to analyze prompts, material properties, process constraints and available database information. The feature does not make decisions that produce legal effects or similarly significant effects about individuals. You may request human assistance, provide corrected information, or choose materials and processes without relying on the recommendation where the Service permits.

Do not enter passwords, payment card details, government identifiers, health information or other unnecessary sensitive personal information into Material AI. We may use anonymized or aggregated interaction information to evaluate reliability, safety and Service performance when applicable law permits and the information can no longer reasonably identify you.

When you use Material AI and the AI Material Advisor, your technical inputs, prompts, and relevant file parameters are processed solely to evaluate manufacturability and generate material recommendations. Where third-party AI or cloud infrastructure providers are engaged, your data is processed within secure enterprise environments subject to strict confidentiality and data-protection terms. Furthermore, Unionfab does not permit provider-side model training using your confidential designs, CAD files, or technical prompts, and you may request human engineering assistance at any time.

6. Cookies Analytics and Advertising

Unionfab uses cookies, pixels, local storage and similar technologies. Some are necessary for sign-in, security, shopping and quotation functions. Others support preferences, performance measurement, analytics and advertising. Where required by law, non-essential technologies are used only after consent.

You can manage non-essential cookies through the Cookie Preference Settings where available and through your browser. Blocking cookies may affect account, quotation or ordering functions. We do not respond to legacy Do Not Track signals because no uniform standard applies. Where legally required, we treat a recognized Global Privacy Control signal as a request to opt out of sale or sharing for the browser that sends the signal.

7. Legal Bases

The legal basis depends on the Service, information, purpose and jurisdiction. We rely on one or more of the following where applicable:

For individuals in China, we process personal information on a basis permitted by the Personal Information Protection Law, including consent, necessity to conclude or perform a contract requested by you, compliance with legal duties, and other statutory grounds. We obtain separate consent where the law requires it, including for certain sensitive personal information, disclosures to another controller and cross-border transfers.

8. How We Share Personal Information

We disclose only the information reasonably necessary for the relevant purpose to the following recipients:

8.1 Entrusted Processing

We engage service providers to perform certain functions on our behalf, such as customer relationship management, communications and customer support, analytics, security, document processing and other technical or operational services.

Where a service provider processes personal information on our behalf, we will require it, through appropriate contractual arrangements, to process personal information only for the agreed purposes, period and methods and within the agreed categories of personal information, and to implement appropriate security measures. We will also supervise its processing activities as required by applicable law.

For example, where we use a third-party online chat or customer-support service, the relevant service provider may process information such as your contact details, conversation content and related technical information on our behalf.

8.2 Disclosure to Other Personal Information Processors

To provide certain Services that are independently performed by third parties, we may provide the personal information reasonably necessary for the relevant purpose to other personal information processors. These may include payment processors and financial institutions, logistics and customs service providers, manufacturing partners and other recipients described in this Policy.

Where required by applicable law, we will inform you of the recipient's name or identity, contact details, processing purpose and method, and the categories of personal information involved, and obtain your separate consent before providing the information.

Further information about relevant recipients is available in our 20.Third Party Personal Information Sharing Schedule.

8.3 Joint Processing

Where Unionfab and one or more affiliated companies jointly determine the purposes and methods of processing certain personal information, we will agree on the respective responsibilities of the parties in accordance with applicable law and process personal information only within the purposes, methods and categories described to you.

Where applicable, we will provide you with an appropriate contact point through which you may exercise your personal information rights.

8.4 Corporate Transactions

If personal information needs to be transferred as a result of a merger, reorganization, division, dissolution, insolvency, sale of assets or similar corporate transaction, we will inform you of the name or identity and contact details of the recipient as required by applicable law.

We will require the recipient to continue to protect the personal information in accordance with this Policy and applicable law. If the recipient changes the original purposes or methods of processing, it must establish an appropriate legal basis and obtain consent again where required by applicable law.

8.5 Public Disclosure

We do not ordinarily publicly disclose your personal information. If public disclosure is necessary, we will inform you of the purpose of the disclosure and the categories of personal information involved and obtain your separate consent where required by applicable law, unless otherwise permitted or required by law.

We require processors and service providers to protect personal information and process it only for authorized purposes. Where a recipient independently determines its own purposes and means, its privacy notice also applies. We do not disclose personal information to another independent recipient for a new purpose without providing any notice or consent required by law.

9. International Transfers

Unionfab serves customers in multiple countries. Personal information may be transferred to, accessed from or stored in China and other countries where Unionfab affiliates, manufacturing partners or service providers operate. Those countries may have data-protection rules different from those in your location.

When applicable law restricts international transfers, we use a recognized transfer mechanism and supplementary safeguards as appropriate, such as an adequacy decision, standard contractual clauses, certification, contractual commitments, security measures, separate consent or a required government procedure. You may contact us for information about the safeguards relevant to your information, subject to lawful confidentiality limits.

For personal information collected in Mainland China, we store such data on secure servers located within Mainland China in accordance with applicable laws. Any cross-border transfer complies with statutory assessment, filing, or contractual mechanisms.

10. Retention and Deletion

We retain personal information only for the shortest period reasonably necessary for the purpose described in this Policy, unless a longer retention period is required by applicable law. In determining the applicable retention period, we consider the categories of personal information involved, the purposes of processing, the period necessary to complete quotations, transactions and related Services, and the reasonable time needed to maintain security, handle complaints or disputes, fulfil warranty and quality obligations, establish or defend legal claims, and comply with tax, accounting, export-control and other legal obligations.

When the applicable retention period expires, or when the processing purpose has been achieved, cannot be achieved or the personal information is no longer necessary for that purpose, we will delete or anonymize the relevant personal information as required by applicable law.

Where continued retention is reasonably necessary to handle a complaint or dispute, comply with a legal obligation or cooperate with a competent authority, we will retain the relevant information only for the period and within the scope necessary for that purpose and restrict other processing where appropriate.

Where immediate deletion is technically difficult, including information temporarily retained in protected backups, we will securely isolate the information and cease other processing except for storage and necessary security measures until deletion becomes possible.

11. Security

We use administrative, technical and physical safeguards designed for the nature of the information and the risks involved. These measures may include access controls, least-privilege permissions, authentication, encryption in transit and where appropriate at rest, network and application security, logging, backups, vendor review, confidentiality duties, employee training, vulnerability management and incident-response procedures.

No transmission or storage system is completely secure. Protect your password, use a unique password, sign out of shared devices and contact us promptly if you suspect unauthorized account access. If a personal-information incident occurs, we will contain and assess it, take remedial measures, and notify affected individuals and authorities where required by law.

Classified Protection and Security Governance

We align our cybersecurity governance, system architecture, and data protection practices with relevant national and international security standards to ensure confidentiality, integrity, and availability.

12. Your Privacy Rights

Subject to applicable law and exceptions, you may have the following rights in relation to your personal information:

Right to know and make decisions about processing. You may ask us to explain whether and how we process your personal information, and you may restrict or refuse certain processing of your personal information where permitted by applicable law. You may exercise this right by contacting us using the methods described in Section 13, How to Exercise Your Rights.

Right to access and obtain a copy. You may request access to, or a copy of, the personal information that we hold about you. Where relevant information is available through your UnionFab account, you may view it directly through your account. For other information, or if you wish to obtain a copy of your personal information, you may contact us using the methods described in Section 13, How to Exercise Your Rights.

Right to data portability. Where the conditions prescribed by applicable law are satisfied, you may request that we transfer your personal information to a personal information processor designated by you, and we will provide an appropriate means for such transfer. To submit a data portability request, please contact us using the methods described in Section 13, How to Exercise Your Rights.

Right to correction and completion. If you believe that personal information we hold about you is inaccurate or incomplete, you may request that we correct or complete it. Where UnionFab provides an account setting or other function that allows you to update relevant information, you may make the change directly. If the relevant information cannot be updated through the Platform, you may contact us using the methods described in Section 13, How to Exercise Your Rights.

Right to deletion. You may request deletion of your personal information where:

(i) the purpose of processing has been achieved, cannot be achieved or the information is no longer necessary for that purpose;

(ii) we cease providing the relevant products or services, or the applicable retention period has expired;

(iii) you withdraw your consent where processing is based on consent;

(iv) our processing violates applicable law or an agreement with you; or

(v) deletion is otherwise required by applicable law.

Where deletion is required but is technically difficult to implement, we will cease processing other than storage and the implementation of necessary security measures, as required by applicable law.

Where UnionFab provides a function that allows you to delete certain information directly, you may use that function. For other deletion requests, including requests relating to information that cannot be deleted directly through the Platform, please contact us using the methods described in Section 13, How to Exercise Your Rights.

Right to withdraw consent. Where we process your personal information on the basis of your consent, you may withdraw that consent. Withdrawal of consent will not affect processing lawfully carried out before the withdrawal. Where we provide a specific mechanism for withdrawing consent, you may use that mechanism. Otherwise, you may contact us using the methods described in Section 13, How to Exercise Your Rights.

Right to request an explanation of our processing rules. You may ask us to explain the rules governing our processing of your personal information. To exercise this right, please contact us using the methods described in Section 13, How to Exercise Your Rights.

Other rights under applicable law. Depending on where you reside, applicable law may provide additional rights, including the right to object to or restrict certain processing, opt out of the sale or sharing of personal information, targeted advertising or certain profiling, authorize an agent to submit a request on your behalf, appeal certain decisions relating to a privacy request, or lodge a complaint with a competent data protection or consumer protection authority.

Deletion and Account Closure

You may request deletion where processing violates applicable law or an agreement, consent has been withdrawn and no other lawful basis applies, the purpose has been achieved or is no longer necessary, the retention period has expired, or Unionfab has stopped providing the relevant Service. Where we approve a deletion request, we also direct processors and, where required, notify recipients to delete the information unless retention is legally required or another exception applies. Information in protected backups may remain isolated until the backup is overwritten or deletion is technically possible.

Where account closure is available, you may use the account settings or contact us. After completing identity verification and any necessary order, payment, warranty, dispute or legal-retention steps, we close the account and delete or anonymize information that is no longer required. Closing an account does not erase records that law requires us to retain.

13. How to Exercise Your Rights

To submit a privacy request, use one of the following methods:

State that the request concerns privacy and describe the right you wish to exercise. Include enough information to locate the relevant account or record, but do not send a password or full payment-card number. If you make a request through an authorized agent, we may ask for evidence of authorization and may verify your identity directly where permitted.

1.We acknowledge the request and assess the applicable law and scope.

2.We may ask for information reasonably necessary to verify identity, authority and the records involved. Verification information is used only for that purpose and related security needs.

3.We search relevant systems, consult service providers where needed and apply lawful exceptions, such as protecting another person's rights or retaining records required by law.

4.We respond within the period required by applicable law. For requests from individuals in mainland China, we generally respond within 15 working days; For EEA or United Kingdom requests this is generally one month; for verified California requests it is generally 45 days. Lawful extensions may apply, and we will explain an extension when required.

5.If we deny all or part of a request, we explain the basis and any available appeal or complaint route where required.

Requests are generally free. We may charge a reasonable fee or refuse a manifestly unfounded, repetitive or excessive request when applicable law permits. We do not discriminate against an individual for exercising a privacy right.

14. Children

The Services are intended for business and professional users and are not directed to children. A child under 14 may not use the Services without the consent and guidance of a parent or other guardian; elsewhere, the applicable local age threshold applies. We do not knowingly collect a child's personal information without legally valid guardian authorization. If you believe a child has provided personal information to us, contact us so we can investigate and delete or otherwise handle it as required.

For users in Mainland China, an individual under 18 should use the Services with the consent and guidance of a parent or other guardian. Personal information of a child under 14 is sensitive personal information; if Unionfab learns that it has processed such information without valid guardian consent, it will delete or otherwise handle it as required by law.

15. California Privacy Notice

This section applies to California residents to the extent Unionfab is subject to the California Consumer Privacy Act as amended. The categories below describe personal information collected during the preceding 12 months, the business or commercial purposes, and the categories of recipients. Examples do not mean that we collect every listed item about every individual.

California Purposes

We collect, use and disclose the categories above to provide and improve Services; create and secure accounts; communicate; quote, manufacture, inspect and deliver parts; process payments and refunds; provide support; prevent fraud and security incidents; comply with law; conduct permitted analytics and advertising; and establish or defend legal claims.

Sale Sharing and Targeted Advertising

We do not sell personal information for money. Our use of certain advertising or analytics cookies may involve disclosing identifiers, internet activity or inferences to advertising or analytics partners in a way California law defines as sharing for cross-context behavioral advertising. California residents may opt out through the Do Not Sell or Share My Personal Information link or Cookie Preference Settings where available, or by using a recognized Global Privacy Control signal. We do not knowingly sell or share personal information of individuals under 16.

California Rights

California residents may request to know, access, correct or delete personal information; opt out of sale or sharing; limit use and disclosure of sensitive personal information when the statutory right applies; and receive equal service and pricing when exercising these rights. Requests may be submitted using Section 13. An authorized agent may submit a request with appropriate authorization. We verify requests as required and use verification information only for that purpose.

We use sensitive personal information only for purposes permitted without a right to limit, such as providing requested goods and services, processing payment, preventing security incidents, resisting malicious or illegal activity, ensuring physical safety, short-term transient use, and maintaining Service quality. If our practices change so that the limitation right applies, we will provide the required notice and method.

16. EEA United Kingdom and Switzerland

If you are in the European Economic Area, United Kingdom or Switzerland, the controller, purposes, categories, recipients, transfers and retention criteria are described above. Depending on the processing, our legal bases are contract, consent, legal obligation and legitimate interests. Where we rely on legitimate interests, those interests include securing and improving the Services, responding to business inquiries, administering customer relationships, preventing fraud and protecting legal rights.

You may have rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent. You may object at any time to direct marketing. You also have the right to lodge a complaint with the data-protection authority in the country where you live or work or where you believe an infringement occurred. International transfers are handled as described in Section 9, including standard contractual clauses or another lawful mechanism where required.

17. Other Regional Rights

China

Individuals in China may request to know about and decide on processing, restrict or refuse processing, access and copy personal information, correct or supplement information, request deletion, withdraw consent, request an explanation of processing rules and exercise other rights provided by the Personal Information Protection Law. Close relatives may exercise lawful rights concerning a deceased person unless the person made other arrangements. We provide separate notice and obtain separate consent where required for sensitive personal information, disclosures to another personal-information processor and cross-border transfers.

Australia and New Zealand

Individuals in Australia and New Zealand may request access to and correction of personal information and may complain about our handling of it. If a complaint is not resolved, you may contact the Office of the Australian Information Commissioner or the Office of the New Zealand Privacy Commissioner, as applicable.

Republic of South Africa

Individuals in South Africa may request access to or correction or deletion of personal information, object to certain processing and complain to the Information Regulator of South Africa. Contact details for the Information Regulator are available at https://inforegulator.org.za.

Other Jurisdictions

Other national or state laws may provide additional rights, including rights to access, correct, delete or obtain a copy of information, opt out of targeted advertising, sale or certain profiling, and appeal a refusal. Submit a request under Section 13 and identify your jurisdiction so we can apply the appropriate law.

18. Changes and Contact Details

We may update this Policy from time to time to reflect changes in applicable laws and regulations, our Services, technologies or business practices. We will publish the updated version on our website and indicate the date on which the updated Policy takes effect.

If an update involves a material change to the purposes or methods of processing personal information or the categories of personal information we process, we will provide additional notice through a prominent website notice, pop-up, email or other appropriate means and obtain your consent again where required by applicable law.

We will also provide appropriate notice where there is a material change to matters such as the entity responsible for processing your personal information, major recipients of personal information, the methods through which you may exercise your privacy rights, or our complaint and contact channels.

Questions complaints and privacy requests may be sent to hello@unionfab.com or submitted through the methods in Section 13. We will investigate privacy complaints and respond within the period required by applicable law. If you are not satisfied, you may contact the competent supervisory or consumer-protection authority in your jurisdiction.

19. Personal Information Collection Schedule

This schedule must remain consistent with the policy text and the actual interfaces. It describes current or reasonably evidenced Unionfab website and DTC scenarios; any row that is not active in production should be removed before publication.

Personal Information Collection Schedule Continued

Personal Information Collection Schedule Continued

Required fields should be marked at the point of collection and limited to what is necessary for the requested function. Optional fields should remain clearly optional. Technical files may be confidential business information even where they are not personal information, and should receive equivalent access and project-isolation controls.

20. Third Party Personal Information Sharing Schedule

To provide our services, we share necessary personal information with the following third-party partners and service providers: