PRIVACY POLICY

VictoryStar Machinery Co., Ltd.

Effective Date: November 1, 2025

TABLE OF CONTENTS

1. Introduction and Contact Information 2. Information We Collect 3. How We Use Your Information 4. Legal Basis for Processing (GDPR) 5. Sharing Your Information 6. International Data Transfers 7. Data Retention 8. Your Privacy Rights 9. Security Measures 10. Cookies and Tracking Technologies 11. Google Analytics and Consent Mode 12. Third-Party Services 13. Business-to-Business (B2B) Data 14. Changes to This Policy 15. Compliance with Privacy Laws 16. Contact Information for Privacy Matters

1. INTRODUCTION AND CONTACT INFORMATION

VictoryStar Machinery Co., Ltd. (“VictoryStar,” “we,” “us,” or “our”) is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website https://shvictorystar.com (the “Website”), use our services, or interact with us in any capacity.

As a manufacturer of fruit juice making machines, bottle filling machines, and beverage processing equipment, we primarily serve business customers. This policy applies to all personal information we process, including information from website visitors, business contacts, customers, and prospects.

Company Information:

• Company: VictoryStar Machinery Co., Ltd. • Website: https://shvictorystar.com • Industry: Manufacturing – Beverage Processing Equipment • Primary Markets: Global B2B customers • Data Controller: VictoryStar Machinery Co., Ltd.

2. INFORMATION WE COLLECT

We collect personal information in several ways:

2.1 Information You Provide Directly

• Contact Information: Name, job title, company name, work email address, phone number, business address • Inquiry Information: Details about your equipment needs, production requirements, budget information • Communication Records: Messages, emails, call logs, meeting notes • Account Information: Login credentials, user preferences, service selections • Business Information: Company size, industry type, production capacity, existing equipment • Financial Information: Payment details, billing information, credit terms (for customers)

2.2 Information Collected Automatically

• Technical Information: IP address, browser type, device information, operating system • Website Usage Data: Pages viewed, time spent on site, click patterns, referral sources • Cookies and Similar Technologies: Session identifiers, preference settings, analytics data • Location Information: General geographic location based on IP address • Performance Data: Website loading times, error reports, user interface interactions

2.3 Information from Third Parties

• Business Contact Data: Information from trade directories, industry databases, professional networks • Social Media Information: Public business profile information from LinkedIn, industry forums • Partner Information: Data shared by distributors, sales agents, or business partners • Marketing Data: Information from trade shows, industry events, marketing campaigns • Verification Data: Business registration information, credit check results (where legally permitted)

3. HOW WE USE YOUR INFORMATION

We use your personal information for the following business purposes:

3.1 Sales and Customer Service

• Respond to inquiries about our machinery and equipment • Provide product demonstrations, technical specifications, and quotations • Process orders, manage contracts, and fulfill purchase agreements • Deliver customer support, technical assistance, and after-sales service • Maintain customer relationship management (CRM) records

3.2 Marketing and Business Development

• Send relevant product information, industry updates, and technical newsletters • Invite you to trade shows, webinars, and industry events • Conduct market research and analyze industry trends • Develop new products and improve existing offerings • Build and maintain business relationships with prospects and customers

3.3 Website Operations and Analytics

• Operate and maintain our website functionality • Analyze website performance and user experience • Prevent fraud, security breaches, and technical issues • Customize content based on user preferences and location • Improve website design, navigation, and content relevance

3.4 Legal and Compliance

• Comply with applicable laws, regulations, and industry standards • Respond to legal requests, court orders, and regulatory inquiries • Protect our rights, property, and business interests • Ensure export control compliance and trade regulation adherence • Maintain records for business, legal, and tax purposes

4. LEGAL BASIS FOR PROCESSING (GDPR)

For users in the European Union (EU), European Economic Area (EEA), and United Kingdom (UK), we process your personal information based on the following legal grounds under the General Data Protection Regulation (GDPR):

• Legitimate Interest (Article 6(1)(f)): B2B marketing, website analytics, security measures, and business relationship management • Contract Performance (Article 6(1)(b)): Processing orders, delivering services, customer support • Consent (Article 6(1)(a)): Newsletter subscriptions, optional marketing communications, non-essential cookies • Legal Obligation (Article 6(1)(c)): Compliance with export controls, tax regulations, data retention requirements • Vital Interests (Article 6(1)(d)): Emergency situations affecting health and safety

Legitimate Interest Assessment: We have conducted legitimate interest assessments for our B2B processing activities, balancing our business needs against individual privacy rights. Business contact information used for relevant industry communications is considered within reasonable expectations for B2B relationships.

5. SHARING YOUR INFORMATION

We may share your personal information with the following categories of recipients:

5.1 Service Providers and Business Partners

• Cloud hosting and IT infrastructure providers • Customer relationship management (CRM) systems • Email marketing and communication platforms • Website analytics and tracking services (Google Analytics) • Payment processors and financial service providers • Shipping and logistics companies • Technical support and maintenance contractors

5.2 Distributors and Sales Agents

• Authorized distributors in your geographic region • Local sales representatives and agents • Installation and service partners • Training and technical support providers

5.3 Legal and Regulatory Requirements

• Government agencies and regulatory authorities • Law enforcement agencies (when legally required) • Courts and legal proceedings • Tax authorities and auditors • Export control and trade compliance agencies

5.4 Business Transactions

In the event of a merger, acquisition, sale of assets, or similar business transaction, personal information may be transferred to the acquiring entity. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

6. INTERNATIONAL DATA TRANSFERS

As a global manufacturer serving international markets, we may transfer your personal information across borders. We implement appropriate safeguards for international transfers:

• Standard Contractual Clauses (SCCs): EU-approved contractual terms for data protection • Adequacy Decisions: Transfers to countries with adequate data protection levels • Binding Corporate Rules: Internal policies ensuring consistent protection standards • Data Processing Agreements: Contractual safeguards with service providers • Technical and Organizational Measures: Encryption, access controls, security monitoring

Primary Transfer Destinations: United States (under Data Privacy Framework), China (manufacturing operations), European Union (sales and support), and other countries where we have customers or service providers.

7. DATA RETENTION

We retain personal information for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law:

• Customer Records: 7 years after last transaction (for business, tax, and warranty purposes) • Marketing Communications: Until opt-out or 3 years of inactivity • Website Analytics: 26 months (Google Analytics default setting) • Support Communications: 3 years after issue resolution • Legal and Compliance Records: As required by applicable law (typically 7-10 years) • Security Logs: 12 months for security monitoring and incident response

Data Deletion Process: When retention periods expire, we securely delete or anonymize personal information using industry-standard methods. Backup systems are included in deletion processes, though technical constraints may cause brief delays in complete removal.

8. YOUR PRIVACY RIGHTS

Depending on your location and applicable privacy laws, you may have the following rights:

8.1 Universal Rights (Available to All Users)

• Access: Request information about personal data we hold about you • Correction: Request correction of inaccurate or incomplete information • Deletion: Request deletion of your personal information (subject to legal obligations) • Opt-out: Unsubscribe from marketing communications at any time • Data Portability: Receive your data in a structured, machine-readable format

8.2 Enhanced Rights (EU/EEA/UK – GDPR)

• Restriction of Processing: Limit how we use your information • Object to Processing: Object to processing based on legitimate interest • Withdraw Consent: Withdraw consent for consent-based processing • Supervisory Authority Complaints: File complaints with data protection authorities • Automated Decision-Making: Protection against purely automated decisions

8.3 Exercising Your Rights

To exercise your privacy rights, please contact us using the information provided in Section 16. We will respond to valid requests within 30 days (or as required by applicable law). We may request additional information to verify your identity before processing requests.

9. SECURITY MEASURES

We implement comprehensive security measures to protect your personal information:

9.1 Technical Safeguards

• SSL/TLS Encryption: All data transmission protected with industry-standard encryption • Access Controls: Multi-factor authentication and role-based access permissions • Firewalls and Network Security: Advanced intrusion detection and prevention systems • Regular Security Updates: Timely application of security patches and updates • Data Encryption: Encryption of sensitive data both in transit and at rest

9.2 Organizational Measures

• Employee Training: Regular privacy and security awareness training • Data Minimization: Collection and processing limited to necessary information • Vendor Due Diligence: Security assessments of third-party service providers • Incident Response Plan: Procedures for detecting and responding to security breaches • Regular Audits: Periodic security assessments and compliance reviews

Security Breach Notification: In the unlikely event of a security breach affecting personal information, we will notify affected individuals and relevant authorities as required by applicable law, typically within 72 hours of discovery.

10. COOKIES AND TRACKING TECHNOLOGIES

Our website uses cookies and similar tracking technologies to enhance user experience and analyze website performance:

10.1 Types of Cookies We Use

• Essential Cookies: Required for website functionality, security, and user authentication • Analytics Cookies: Google Analytics for website performance and user behavior analysis • Functional Cookies: Remember user preferences, language settings, and form data • Marketing Cookies: Track user interests for relevant content and advertising (with consent) • Social Media Cookies: Enable social media sharing and integration features

10.2 Cookie Management

You can control cookies through: • Browser Settings: Most browsers allow you to block or delete cookies • Cookie Consent Banner: Manage preferences through our website consent tool • Opt-out Tools: Use industry opt-out mechanisms for advertising cookies • Google Analytics Opt-out: Install Google’s browser add-on to disable tracking

Note: Disabling essential cookies may affect website functionality. Analytics and marketing cookies require explicit consent in EU/EEA regions and are implemented through our consent management system.

11. GOOGLE ANALYTICS AND CONSENT MODE

We use Google Analytics 4 to understand how visitors interact with our website. Our implementation includes privacy-compliant features:

11.1 Google Consent Mode v2 Implementation

• Consent-Based Data Collection: Analytics data collected only with user consent • Cookieless Measurement: Uses modeling when cookies are declined • IP Anonymization: Automatically anonymizes IP addresses • Data Retention Controls: Limited to 26 months maximum retention • Enhanced Privacy Features: No cross-device tracking without consent

11.2 Data Processing Agreement

We have executed Google’s Data Processing Amendment to ensure GDPR compliance for analytics data processing. Google acts as a data processor under our instructions, with appropriate technical and organizational measures in place.

Google Analytics Opt-out: You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on available at: https://tools.google.com/dlpage/gaoptout

12. THIRD-PARTY SERVICES

Our website and business operations integrate with various third-party services. Each service has its own privacy policy:

12.1 Google Services

• Google Analytics: Website analytics and performance measurement • Google Tag Manager: Tag and tracking code management • Google Workspace: Email, cloud storage, and business productivity tools • Google Maps: Location services and mapping functionality Google Privacy Policy: https://policies.google.com/privacy

12.2 Business and Communication Tools

• Customer Relationship Management (CRM) systems • Email marketing platforms • Video conferencing and communication tools • Cloud hosting and content delivery networks • Payment processing and financial services

12.3 Social Media Integration

Our website may include social media sharing buttons and embedded content from platforms like LinkedIn, YouTube, and industry forums. These integrations may collect information about your interaction with our content.

13. BUSINESS-TO-BUSINESS (B2B) DATA

As a B2B manufacturer, most of our data processing involves business contacts and professional relationships:

13.1 Business Contact Processing

• Professional contact information is processed under legitimate interest for B2B communications • Business email addresses (name@company.com) are used for industry-relevant communications • Trade show and industry event contacts receive follow-up communications • Business relationship data is maintained for ongoing commercial purposes • Generic business emails (info@company.com) may not constitute personal data processing

13.2 B2B Marketing Communications

• Product updates and technical bulletins relevant to your industry • Invitations to trade shows, webinars, and technical training sessions • New product announcements and equipment availability • Industry news and regulatory updates affecting beverage manufacturing • Case studies and success stories from similar operations

Business contacts always have the right to opt out of marketing communications and can request removal from our business databases while maintaining necessary service and support relationships.

14. CHANGES TO THIS POLICY

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or business operations. When we make material changes:

• We will post the updated policy on our website with a new effective date • We will notify affected individuals by email for significant changes • We will provide prominent website notice for 30 days after material updates • We will maintain archived versions of previous policies for reference • We will honor the privacy policy that was in effect when information was collected

We encourage you to review this policy periodically to stay informed about how we protect your information. Continued use of our website and services after policy updates constitutes acceptance of the revised terms.

15. COMPLIANCE WITH PRIVACY LAWS

We comply with applicable privacy laws in the jurisdictions where we operate and serve customers:

15.1 International Compliance

• GDPR (European Union): Full compliance with data protection requirements • CCPA/CPRA (California): Consumer privacy rights and disclosure obligations • PIPEDA (Canada): Personal information protection and electronic documents • LGPD (Brazil): Data protection law compliance for Brazilian operations • Privacy Act (Australia): Australian privacy principles adherence • Local Privacy Laws: Compliance with applicable regional and national requirements

15.2 Industry-Specific Compliance

• Export Control Regulations: Compliance with international trade and export laws • Manufacturing Standards: Adherence to industry data protection requirements • Financial Regulations: Compliance with financial data protection laws • Employment Law: Protection of employee and contractor personal information

Regulatory Cooperation: We cooperate with privacy regulators and data protection authorities. If you have concerns about our privacy practices that we cannot resolve directly, you may contact your local data protection authority.

16. CONTACT INFORMATION FOR PRIVACY MATTERS

For questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us:

Privacy Contact Information:

VictoryStar Machinery Co., Ltd. Privacy Officer / Data Protection Team Email: privacy@shvictorystar.com Website: https://shvictorystar.com General Inquiry: Contact form available on website

Response Timeframe:

• General Privacy Questions: 5 business days • Data Subject Rights Requests: 30 days (as required by law) • Security Incident Reports: 24 hours for acknowledgment • Urgent Privacy Matters: 1 business day for initial response

Supervisory Authority Information:

EU/EEA residents have the right to lodge complaints with their local data protection supervisory authority. A list of EU data protection authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

—

This Privacy Policy is effective as of November 1, 2025, and supersedes all previous versions. VictoryStar Machinery Co., Ltd. is committed to protecting your privacy and maintaining the security of your personal information.

Document Version: 2025.1 | Last Updated: November 1, 2025