Privacy Policy

XPPen values user privacy and the security of your personal information. This Privacy Policy explains how we collect, use, store, share, transfer, and protect your personal information when providing XPPen Services, as well as how users can exercise their relevant rights. This Privacy Policy applies to the community websites, community mobile applications, and any other products or services provided by XPPen that explicitly reference this Policy (collectively, the "XPPen Services"). By accessing or using the XPPen Services, you acknowledge that you have read and understood this Privacy Policy.

A. COLLECTION OF INFORMATION

Your privacy is important to XPPen, and we have taken steps to ensure that we do not collect more information from you than is necessary to provide our services and protect your account.

We collect the following categories of information:

• Information collected at the time of user registration on the Site, including username, address, phone number, and email address;
• Account name and profile photo from social media platforms (such as Facebook), if you choose to register or log into an XPPen account through such platforms.

When you register for or use an XPPen account, we may process your email address, phone number, verification code, user ID, nickname, profile photo, bio, country or region, language preference, and account settings. The actual data fields collected will be subject to the information displayed on the relevant pages.

When you register or log in through Google, Apple, or other third-party services officially supported by the platform, we may receive information including your authorized third-party account identifier, name, email address, and profile photo, depending on your authorization and the settings of the respective third-party service.

If you choose to complete our supplemental questionnaires for registered members, we may also collect your nationality, gender, date or year of birth, monthly spending, and user preferences. If you prefer not to provide such information, your use of our products and services will not be affected.

If you contact our customer service, we may record your communications with us and collect additional information to verify your identity.

We record details of user activities across XPPen Services. Information relating to such transactions (including, but not limited to, the types and specifications of the goods, pricing and delivery information, dispute records, and any information disclosed in discussion forums) may be collected when transactions are conducted on or facilitated through XPPen Services.

When you use our community features, we may process the artwork, images, videos, tutorials, posts, descriptions, comments, replies, direct messages, drafts, reports, feedback, and other content you submit or generate.

We may also record your browsing, search, view, like, favorite, follow, comment, reply, share, and report histories, as well as your participation in events and interactions with other users within the XPPen Services.

Please note that the nickname, profile photo, artwork, posts, comments, and interaction information you actively and publicly publish may be viewed by other users, and could be screenshotted, reposted, or accessed outside of the XPPen Services.

From time to time, we collect information about our users and prospective users during trade shows, industry events, and other functions. The information we may collect at these events includes, but is not limited to, usernames, addresses, phone numbers, and email addresses.

We record users’ purchasing and browsing activities on our platform, including, but not limited to, IP addresses, browsing patterns, buyer behavioral data, and device information. In addition, we gather statistical information about the XPPen Services and their visitors, including, but not limited to, IP addresses, browser types, operating systems, software and hardware attributes, pages viewed, number of sessions, and unique visitors.

When you use the XPPen Services, we may collect necessary device, network, usage, and diagnostic information based on the specific services and features you utilize, in order to maintain service operations, ensure account security, analyze performance, and troubleshoot technical issues. For our mobile applications, such information may include device model, operating system and application version, network status, operation logs, and crash logs.

For the XPPen Space mobile application, the device and log information we actually collect is as follows:

• Basic device information: device model, hardware configuration, operating system name and version, application version number, system language, screen resolution, and network type;
• Device identifiers: with your explicit consent (opt-in), we obtain device advertising identifiers (IDFA on iOS and AAID on Android) for channel attribution and advertising effect evaluation; a non-resettable application instance identifier generated within the application is used for account security verification and abnormal behavior detection;
• Operation and diagnostic logs: application launch and exit times, page access paths, function click behavior, software crash logs, performance anomaly data, and network request status logs;
• Security-related information: login device identifiers, abnormal login records, and operation risk characteristic information, used for account security protection and fraud identification;

The above information is only used to ensure the normal operation of services, troubleshoot product failures, optimize user experience, and maintain account and platform security, and will not be linked to your real identity in an identifiable manner.

Certain data we collect may be defined as personal data under applicable data protection laws (“Personal Data”). To enable us to provide our services and products to you, you need to provide certain categories of data (which may include Personal Data), such as your username, address, phone number, and email address. If certain data is required, we will let you know at the time of collection. In the event that you do not provide sufficient data marked as necessary, we may not be able to complete the registration process or provide certain products or services.

The XPPen mobile application may request access to system permissions, including your photo library or photos, camera, and notifications, depending on the specific features you use. We will explain the purpose of each permission before requesting it. You may disable these permissions at any time through your device settings; however, doing so may affect your ability to use the corresponding features.

The XPPen Space mobile application only requests system permissions that are directly related to its core functions. The description of each permission is as follows:

• Network Access: Used for all online features, including loading community content, uploading artwork, logging into accounts, synchronizing personal data, and receiving messages. Its purpose is to ensure the normal operation of basic application services. If you disable network access, the application will not be able to load any online content or utilize any Internet-based features.
• Notification Permission: Used for push scenarios such as event notifications, private message reminders, system announcements, and award notifications. Its purpose is to deliver important messages and event information to you in a timely manner. If you decline this authorization, you will not receive application push notifications, but this will not affect the normal use of other in-app features.
• Photo and Video Library Access Permission: Used when publishing artwork, changing avatars, or editing posts to select pictures or videos from the local album. Its purpose is to allow you to upload local media content to the community feature. If you decline this authorization, you will not be able to select pictures or videos from the system album for publication, but other functions will not be affected.
• Camera Permission: Used for taking photos and videos to directly publish artwork and scanning QR codes for logins. Its purpose is to allow you to directly capture content via the camera or complete QR code operations. If you decline this authorization, you will not be able to use the camera to capture content directly, but you can still select existing media files from the album.
• Microphone Permission: Used for publishing video artwork with audio and submitting voice feedback. Its purpose is to allow you to record and publish audio content. If you decline this authorization, you will not be able to record audio, but this will not affect the publication and use of other text-and-image content.

We will explain the purpose and obtain your consent via a pop-up window before invoking the corresponding permission. You can enable or disable these permissions in the device system settings at any time.

B. USE OF PERSONAL DATA

We collect and use your Personal Data for the following purposes:

• verifying your identity;
• verifying your eligibility to register as a user of the Site;
• processing your registration as a user, providing you with a log-in ID for the Site and maintaining and managing your registration;
• providing you with customer service and responding to your queries, feedback, claims or disputes;
• facilitating communication between us on the Site, processing your purchase orders, and providing delivery services;
• communication features: When you use private messages or other communication tools, we process relevant messages and communication data to deliver messages, maintain our services, handle reports or disputes, and protect user and platform security;
• X-Coins services: When you use X-Coins-related services, we may process data regarding the acquisition, expenditure, balance, validity period, redemption, lucky draws, and rewards of X-Coins. This data is used to calculate and distribute points, display records, process redemptions or rewards, and manage anti-cheat and dispute resolutions;
• events and rewards: When you participate in competitions, activities, lucky draws, reward programs, or prize distributions, we may process your entry details, activity footprint, winning status, and fulfillment data (including contact details, shipping address, and mobile number) to facilitate prize delivery;
• assessing the account security and transaction risks of members, detecting and preventing fraud and other security incidents;
• safety and trust: We may also utilize the aforementioned information to conduct content moderation, investigate reports, identify policy violations, counter cheating, enhance account security, prevent fraud, and enforce our Community Guidelines;
• personalizing our communication with you based on your browsing records, device information we collect, and your order history; and performing research or statistical analysis in order to improve the content and layout of the Site, as well as to improve our product offerings and services;
• identifying, developing, and marketing products and services that we believe you will value, including across browsers and devices, in accordance with applicable laws. Cookies or other similar technologies may be used to provide you with advertising based upon your browsing activities and interests (see section E. COOKIES below). Where we are required by applicable law, we will seek your consent prior to sending you communications for marketing purposes;

We may also use your Personal Data for other purposes that are not incompatible with the purposes we have disclosed to you (such as archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes) if and where this is permitted by applicable data protection laws.

C. DISCLOSURE OF PERSONAL DATA

We may disclose and transfer your Personal Data to our partners and service providers engaged by us to facilitate our services to you, or who otherwise process Personal Data for purposes that are described in this Privacy Policy, or as notified to you at the time of collection. Examples of these partners or service providers include:

XPPen services may engage third-party service providers to provide account login, cloud storage, customer service, content moderation, payment, logistics, and other necessary services. Our mobile applications may also integrate third-party SDKs to support third-party login, push notifications, statistical analysis, crash diagnostics, and other mobile features. Such service providers are strictly limited to processing information only for the agreed purposes and within the minimum scope necessary.

The third-party services and SDKs integrated into the XPPen Space mobile application are listed below. All such service providers are restricted to processing your information solely within the agreed purposes and the minimum scope necessary:

We evaluate the data security capabilities of third-party service providers, stipulate their data protection obligations through contracts, and require them to process information strictly in accordance with our entrusted purposes, and not to use the information for their own independent commercial purposes. Examples of these partners or service providers include:

• marketing platforms, such as, but not limited to, Google, X (formerly Twitter), Facebook, and Instagram, and providers of analytics services relating to users’ behavior, in order to tailor the content you see when visiting our Site. These marketing platforms may combine information they collect on our Site with data on their platforms and data they collect from other websites or through other sources in order to conduct targeted advertising. The activities of these third-party marketing platforms are governed by their own privacy policies, not this Privacy Policy;
• payment service providers to assist with payment for transactions. The activities of payment service providers may be governed by their own privacy policies, not this Privacy Policy;
• logistics partners to provide delivery services for buyers, including the return and exchange of products;
• cloud computing service providers to provide cloud storage services;

These service providers must abide by our data privacy and security requirements and are only permitted to use your Personal Data in connection with the purposes specified above, and not for their own purposes. For the purposes specified above, we may share your Personal Data with affiliated companies within the XPPen company group and/or their designated service providers.

The XPPen website, community, mobile applications, official online store, and certain other services may share a unified XPPen account system. To provide unified login, account security, X-Coins, order status tracking, and related functionalities, we may link and process your account identifiers and associated information across these different services within the minimum scope necessary.

When we believe it is necessary to comply with applicable laws or to exercise, establish, or defend our legal rights or protect your vital interests or those of any other person, we may also disclose and transfer your Personal Data to our professional advisers, law enforcement agencies, insurers, government and regulatory bodies, and other organizations, or as otherwise required or permitted by applicable laws.

We may also disclose your Personal Data to any other person with your consent to the disclosure. We may provide aggregated or anonymized data to third parties, but when we do so, the information we share is in a de-identified format that does not personally identify you.

We have established relationships with other parties and websites to offer you the benefit of products and services which we do not offer. We offer you access to these other parties and their websites either through the use of hyperlinks to these sites from our Site or through offering "co-branded" sites in which both we and other parties share the same uniform resource locator (URL), domain name, or pages within a domain name on the Internet. In some cases, you may be required to submit Personal Data to register or apply for products or services provided by such third parties or co-branded partners. This Privacy Policy does not apply to these third-party sites or co-branded sites. The privacy policies of those other parties may differ from ours, and we have no control over the information that you submit to those third parties. You should read the relevant privacy policy for those third-party sites and co-branded sites before responding to any offers, products,or services advertised by those parties.

D. RIGHTS REGARDING PERSONAL DATA

Under the applicable laws, you may have the rights of access to Personal Data held by us and other rights. If you are a Visitor from the European Union, please refer to section I. VISITORS FROM THE EUROPEAN UNION below for more information.

You may exercise certain rights through the account settings within the relevant XPPen services or via the web portal. You may also submit a request through the contact methods specified in this Privacy Policy. To ensure account and data security, we may verify your identity in accordance with applicable laws.

You can submit an account deletion request through your account settings or other designated channels. Upon successful identity verification, the account will enter a 7-day cooling-off period. Logging back into the account during this cooling-off period will automatically cancel the deletion request.

Once the account deletion is complete, the account cannot be recovered, and any unused X-Coins or other virtual benefits will be forfeited and cleared. Private messages and certain non-public account data will be deleted or anonymized. Publicly published works and other public content may continue to be displayed in an anonymous format, but will no longer be linked to the original account identity. The official online store account and other related service accounts associated with this account may be deleted concurrently.

Information required to be retained by law, or necessary to fulfill legal obligations, resolve disputes, and ensure account and transaction security, may be retained in a restricted manner for the necessary duration, and will not be used for any other purposes unrelated to the retention purpose.

If you have any questions regarding this Privacy Policy or if you wish to access or correct your Personal Data as a user of XPPen.com, you may send your request to service@xp-pen.com. If and to the extent permitted by applicable law, we may charge you a reasonable fee for the processing of any request you make regarding your Personal Data.

E. Cookies & Similar Technologies

Cookies

To ensure our website works correctly, we may at times place a small piece of data known as a cookie on your computer or mobile device. A cookie is a text file stored by a web server on a computer or mobile device. The content of a cookie can be retrieved or read only by the server that creates the cookie. The text in a cookie often consists of identifiers, site names, and some numbers and characters. Cookies are unique to the browsers or mobile applications you use, and enable websites to store data such as your preferences or items in your shopping cart.

In addition to website cookies, XPPen services may also use local storage, device identifiers, analytics tools, and other similar technologies based on specific services; mobile applications may also use third-party SDKs, push identifiers, and crash diagnostic tools. In addition to website cookies, similar technologies used by the XPPen Space mobile application are as follows:

Local Storage Technology: Through the in-app local database and cache mechanism, we store your login status identifier, language preferences, browsing cache, and local draft content; its purpose is to improve app loading speed, retain your usage preferences, and reduce repeated login and loading operations; the information processed is anonymized local configuration data and cached content.

Device Identifier Technology: With your active authorization, we obtain system advertising identifiers (such as iOS IDFA and Android AAID); its purpose is to count channel conversion effects, evaluate promotion efficiency, and provide personalized content recommendations based on usage preferences; the information processed is the device advertising unique identifier.

Push Identifier Technology: We obtain the system-generated device push token; its purpose is to accurately identify the device and deliver push notifications to you; the information processed is the device push unique identifier.

Third-Party Analysis and Diagnostic Technology: We collect application performance data and behavior events through integrated third-party SDKs; its purpose is to count application usage, locate crash and performance issues, and optimize product function experience; the information processed is basic device information, anonymized behavior data, and crash logs.

The above technologies will not compulsorily collect your personal identity information. You can turn off advertising identifier authorization through system permission settings, or delete locally stored data by clearing the application cache.

Like many other websites or Internet service providers, XPPen uses cookies to improve user experience. Session cookies are deleted after each visit, while persistent cookies remain in place across multiple visits. Cookies allow websites to remember your settings, such as language, font size on your computer or mobile device, or other browser preferences. This means that a user does not need to reset preferences for every visit. On the contrary, if cookies are not used, websites will treat you as a new visitor every time you load a web page. For example, if you are redirected to another web page from a website you are already logged in to and then return to the original website, it will not recognize you and you must log in again.

XPPen will not use cookies for any purposes not stated in this Policy. You can manage or delete cookies based on your own preferences. For details, visit AboutCookies.org. You can clear all the cookies stored on your computer, and most web browsers provide the option of blocking cookies. However, by doing so, you have to change the user settings every time you visit our website.

Social Media and Single Sign-On

In addition to cookies, we may also use other similar technologies on our websites, such as social media, and single sign-on.

• Social Media

Our websites include social media features, such as the Facebook Like button and widgets, such as the Share This button or interactive mini-programs that run on our site. These features may collect your IP address and which page you are visiting on our site, and they may set a cookie to enable the feature to function properly. Social media features and widgets are either hosted by a third party or hosted directly on our websites. Your interactions with these features are governed by the privacy policy of the company providing them.

• Single Sign-On

Depending on your jurisdiction, you may be able to log in to our website using sign-on services such as Facebook Connect or an Open ID provider. These services will authenticate your identity, provide you the option to share certain personal information (such as your name and email address) with us, and pre-populate our sign up form. Services like Facebook Connect give you the option to post information about your activities on this website to your profile page to share with others within your network.

By using our website, you acknowledge that cookies, social media, and single sign-on features may be used as described above.

F. MINORS

We consider it the responsibility of parents to monitor their children's use of our products and services. Nevertheless, it is our policy not to require Personal Data from minors or offer to send any promotional materials to persons in that category. XPPen does not intentionally seek to receive any Personal Data from minors. Should a parent or guardian have reason to believe that a minor has provided XPPen with Personal Data without their prior consent, please contact us to ensure that the Personal Data is deleted and that the minor is unsubscribed from any of the applicable XPPen services.

G. SECURITY MEASURES

We employ commercially reasonable security methods to prevent unauthorized access to the Site, to maintain data accuracy, and to ensure the correct use of the Personal Data we hold.

We will implement measures such as encrypted transmission, access control, identity verification, security auditing, vulnerability management, and security incident response based on actual circumstances to protect Personal Data within XPPen services.

For registered users of the Site, your information can be viewed and edited through your account, which is protected by a password. We recommend that you do not divulge your password to anyone. Our personnel will never ask you for your password in an unsolicited phone call or in an unsolicited email. If you share a computer with others, you should not choose to save your login information (e.g., user ID and password) on that shared computer. Remember to sign out of your account and close your browser window when you have finished your session.

No data transmission over the Internet or any wireless network can be guaranteed to be perfectly secure. As a result, while we try to protect the Personal Data we hold for you, we cannot guarantee the security of any information you transmit to us, and you do so at your own risk.

H. CHANGES TO THIS PRIVACY POLICY

We keep our Privacy Policy under regular review and may update this Privacy Policy to reflect changes to our information practices. If we make material changes to our Privacy Policy, we will notify you by email (sent to the email address specified in your account) or post the changes on all the XPPen websites, so that you may be aware of the Personal Data we collect and how we use it.

If this Privacy Policy undergoes material changes, we may notify you through website announcements, emails, mobile application pop-ups, in-app messages, push notifications, or other reasonable methods.

Such changes to our Privacy Policy shall apply from the effective date as set out in the notice or on the website. We encourage you to periodically review this page for the latest information on our privacy practices. Your continued use of products and services on the websites, mobile applications, and/or any other device will be taken as acceptance of the updated Privacy Policy. We will seek your fresh consent before we collect more Personal Data from you or when we wish to use or disclose your Personal Data for new purposes.

I. VISITORS FROM THE EUROPEAN UNION

This section of the Privacy Policy applies only if you use our Site or services covered by this Privacy Policy from a country that is a Member State of the European Union, the European Economic Area (EEA), or the United Kingdom (UK), and supplements the information in this Privacy Policy.

Legal Basis for Data Processing

We process Personal Data for the purposes set out in this Privacy Policy, as described above. Our legal basis to process Personal Data will depend on the Personal Data concerned and the specific context in which we collect it. However, we will normally collect and process Personal Data about you only where it is: necessary for the performance of any contract between us (for example, to provide you with the services you request and to identify and authenticate you so you may use the Site); necessary to comply with legal requirements (for example, to comply with applicable accounting rules and to make mandatory disclosures to law enforcement); necessary for our legitimate interests and not overridden by your rights; or where it is based on your consent.

If we collect and use your Personal Data in reliance on our legitimate interests (or those of any third party), this interest will normally be to operate our Site and services, to manage our relationship with you, and to communicate with you as necessary to provide our services to you. These legitimate commercial interests include, for instance, responding to your queries, improving our Site and our services, undertaking marketing, ensuring the security of our Site and services, and detecting or preventing illegal activities such as fraud.

If we ask you to provide Personal Data to comply with a legal requirement or to enter into a contract with you, we will make this clear at the relevant time and advise you whether the provision of your Personal Data is mandatory or not (as well as the possible consequences if you do not provide your Personal Data). In some instances, you may be required to provide us with Personal Data for processing as described above, in order for us to be able to provide you all of our services, and for you to use all of the features of our Site.

We retain your Personal Data as long as we have an ongoing legitimate business need to do so, for example, to provide services or products to you, or as required or permitted by applicable laws, such as tax and accounting laws. When we have no ongoing legitimate business need to process your Personal Data, we will either delete or anonymize it or, if this is not possible (for example, because your Personal Data has been stored in backup archives), we will securely store your Personal Data and isolate it from any further processing until deletion is possible.

We retain Personal Data only for the duration necessary to fulfill the purposes described in this Privacy Policy, maintain relevant accounts or services, comply with legal obligations, resolve disputes, and ensure security.

We retain your Personal Data only for the minimum period necessary to achieve the purposes stated in this Privacy Policy. Our specific retention periods for various types of data are as follows:

Basic Account Information: Retained continuously during the normal existence of the account; deleted or anonymized within 1 working day after the official account cancellation, unless otherwise required by law.

Public Content such as Published Works, Posts, and Comments: Retained continuously during the account existence; after account cancellation, such content will be disassociated from the original account identity and retained on the platform in anonymous form until the content is actively deleted or removed by the platform due to compliance or operational needs.

Non-public Content such as Private Messages and Drafts: Retained continuously during the account existence; deleted or anonymized within 1 working day after the official account cancellation.

Interaction Records (Likes, Favorites, Follows, Reports, etc.): Retained continuously during the account existence; anonymized or deleted together with the account subject information after account cancellation.

X-Coins and Related Benefit Records: Retained continuously during the account existence; unused X-Coins and virtual benefits will be cleared upon account cancellation, and related transaction records will be retained for no more than 1 year from the date of cancellation to handle possible disputes and verifications.

Order, Event and Prize Award Information: Retained for 3 years from the date of transaction completion or event conclusion, for performance, after-sales support, prize distribution, and dispute handling; if relevant laws require a longer retention period, the longer period shall apply.

Operation Logs, Crash Logs and Diagnostic Data: General operation and diagnostic logs are retained for no more than 180 days; special logs for security auditing and anti-fraud purposes are retained for no more than 3 years.

Backup Data: Data stored in the offline backup system is retained for no more than 6 months, and will be automatically overwritten or destroyed upon expiration, except when extended retention is required by law.

Processing Rules After Account Cancellation: You can submit a cancellation request through the account settings entry in the App. After completing the identity verification, the account enters a 7-day cooling-off period; logging back into the account during the cooling-off period will automatically cancel the cancellation request. If there is no login operation during the cooling-off period, the account will be officially canceled upon expiration.

After cancellation: The account cannot be recovered, and unused X-Coins and all virtual benefits will be forfeited and cleared.

Non-public personal account information, private messages, and local drafts will be deleted or anonymized within 1 working day.

Your historically published works, posts, comments, and other content will be retained in anonymous form and will no longer be associated with the original account identity.

Data that must be retained by law, such as financial, tax, and security auditing data, will be retained in a restricted manner within the statutory retention period, will not be used for any other purposes unrelated to the retention purpose, and will be deleted promptly upon expiration.

If you have questions about or need further information concerning the legal basis on which we collect and use your Personal Data, please contact us using the contact details provided in section J. HOW TO CONTACT US below.

International Transfers of Personal Data

Our business may require us to transfer your Personal Data to countries outside of the European Economic Area ("EEA"), including to countries that may not provide the same level of data protection as your home country, such as the United States and China. We take appropriate steps to ensure that recipients of your Personal Data are bound to duties of confidentiality, and we implement appropriate measures to ensure your Personal Data will remain protected in accordance with this Privacy Policy.

If Personal Data needs to be transferred cross-border or processed outside of the user's home country or region, we will take necessary protective measures in accordance with applicable laws.Primary Storage Locations: Your Personal Data is primarily stored in cloud data centers in the People's Republic of China, and the United States.

Overseas Recipients and Receiving Regions: To provide global services, we may transfer your Personal Data to recipients outside your jurisdiction, including XPPen affiliated companies located in Hong Kong, China, and the United States, as well as the third-party SDK service providers listed in the previous section (Google LLC, Apple Inc., etc.). The corresponding receiving countries/regions include China and the United States.

Types of Data Transferred: Basic account identification information, works and content data you publish, device and log diagnostic data, push identification information, and necessary information for events and prize awards.

Purpose of Transfer: To ensure that users in all regions around the world can uniformly access community services, realize cross-regional account synchronization, obtain third-party technical support, and carry out globally unified product optimization and security protection.

Protection Measures: We will carry out cross-border transfers of Personal Data in strict compliance with applicable data protection laws and regulations. The protection measures adopted include but are not limited to: signing data processing agreements that meet legal requirements (including the European Union's Standard Contractual Clauses, or "SCCs") with recipients; conducting data security impact assessments for data exports; requiring recipients to adopt equivalent technical and security measures; encrypting cross-border data transmissions; and strictly limiting the scope of data use by recipients.

Your Rights

You have the following data protection rights, which you can exercise at any time by contacting us using the contact details provided in section J. HOW TO CONTACT US below.

The right to access, correct, update, or request deletion of your Personal Data.

The right to object to processing of your Personal Data when it is based on our legitimate interests, and, separately, the right to object to direct marketing.

The right to ask us, in certain situations, to restrict processing of your Personal Data or request portability of your Personal Data.

The right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the "unsubscribe" or "opt-out" link in the marketing emails we send you. To opt-out of other forms of marketing (such as postal marketing or telemarketing), please contact us using the contact details provided in section J. HOW TO CONTACT US below.

If we have collected and process your Personal Data with your consent, you have the right to withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the processing of your Personal Data conducted in reliance on lawful processing grounds other than consent.

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

If you are aware of changes or inaccuracies in your information, you should inform us of such changes so that our records may be updated or corrected.

J. HOW TO CONTACT US

If you have any requests, questions or concerns about our use of your Personal Data and this Privacy Policy, please contact us：

Hanvon Ugee (HK)Technology Co., Ltd.

ADD: FLAT/RM 185 G/F HANG WAI IND CENTRE NO.6 KIN TAI ST TUEN MUN N.T HK

E-mail: service@xp-pen.com

Effective Date: August 12, 2026

Last Updated: August 12, 2026

Version: 1.0