Legal

QNAP SYSTEMS, INC. PRIVACY POLICY
(Version 3.0)

Revised on Oct. 1st, 2026

Protecting the personal privacy of every customer, vendor, and employee is a crucial part of gaining and keeping your trust in QNAP Systems, Inc. (the “Company”, “we”, “us”). As a global organization, we strive to deploy consistent, rigorous policies and procedures to provide a high level of privacy protection across all of our businesses and services.

This privacy policy (the “Policy”), effective May 25, 2018 and last revised on the date stated above, serves as our commitment to you to protect the security and privacy of your personal data, and covers the following areas of privacy concerns:

The types of data we collect from you
When we collect your data
How we use and process your data
Our legal basis for processing your data
When and to whom we share your data
For how long we retain your data
When and to whom we transfer your data across country borders
The security measures we take to protect your data
Your rights over your data
The choices you have over how your data is collected and used by us
Who to contact and what to do if you wish to discuss with us about your data and your rights
How our AI features handle the content of your conversations

This Policy does not apply to third-party applications, products, services, websites or social media features that may be accessed through links that we provide on our websites and interfaces. Accessing those links may result in the collection of information about you by a third party. We do not control or endorse those third-party websites or their privacy practices. We encourage you to review the privacy policies of such third parties before interacting with them.

Your privacy is of utmost importance to us. We render our products and services to you on the basis of your understanding of your data privacy rights.

This Policy will be made multi-language, and all language versions shall be valid. In case of any discrepancy between the English version and other language versions, the English version shall prevail.

Please read this Policy carefully. When visiting our website and using our services that link to or reference this Policy, you agree to be bound by the terms and conditions of this Policy.

What is your personal data?

Personal data is any information that relates to an identifiable living individual. Any piece of data—whether by itself or used in conjunction with other pieces of data in a data controller’s possession—that can be used to identify you is considered your personal data. The processing of your personal data is governed by applicable privacy laws.

What role do we play in processing your personal data?

In most cases we are the data controller with respect to processing your data. This means that we decide how your personal data is processed and for what purposes. We know that you care about how your personal data is used and shared, and we appreciate your trust that we will do so carefully and sensibly. For more information, you can contact us using the channels set forth in the “Whom should I contact?” section of this Policy.

There is an important exception. Where our products run on hardware that you or your organization owns and administers — for example a QNAP NAS — the data held on that device, including the files stored on it, its activity and system logs, and the content of conversations with the AI features installed on it, is under the control of the person or organization that owns and administers the device. It is not under ours. For that data, the owner or administrator of the device is the data controller and is responsible for informing the individuals concerned and for responding to their requests. We are the controller only for the data that actually reaches us, which is described in the "Our collection of personal data" and "AI features and conversation data" sections of this Policy.

When do we collect your personal data?

We can collect some of your data:

whenever you become our customer;
whenever you register or log in to use our online services;
whenever you use our products and services;
whenever you fill in forms and contracts that we send you;
whenever you opt into our online or offline marketing activities, including but not limited to: newsletters, online and live event registrations, and other promotional information and materials;
whenever you interact with our AI features, and, if you choose to submit feedback on an AI response, the conversation in which that response appears;
whenever you contact us through our various channels.

Our collection of personal data

The personal data we collect includes any and all data you provide us with when you: enter into contract with us, register an account with us, update or add your account information, enter our website, fill out our web forms, or give us data in any other way.

You may choose not to provide us with any of your data, but that may hinder us from fully administering services to you if such services require your personal data. We use your personal data whenever we communicate with you, respond to your requests, manage your account, customize your service experience, improve our products and services, and personalize marketing activities. We may communicate with you through mail, email, or telephone. We will send you strictly service-related announcements or information on rare occasions, when it is necessary to do so.

Personal data we collect

When you register or log in to use our services, we may collect and store data including your name, phone number, address, email address, Internet Protocol (IP) address, login credentials, account name, and account activity.

We also receive and store certain types of data whenever you interact with us. For example, we use "cookies", which are unique identifiers that we transfer to your device to enable our systems to provide service features such as personalized advertisements on other websites, provide remote access for you, allow you to visit our website without re-entering your username and/or password, verify that you have the authorization needed for the services to process your requests, personalize and improve your experience, record your preferences, customize functionalities for your devices, and to improve the functionality and user-friendliness of our services. It also helps us to better understand how you interact with our services and to monitor aggregate usage and web traffic routing on our website. Most of the cookies we use are so-called "session cookies". Cookies do not cause any damage to your computer and do not contain any viruses. Most browsers automatically accept cookies as the default setting. You can modify your browser settings to reject our cookies or to prompt you before accepting a cookie. However, if a browser does not accept our cookies or if you reject a cookie, some portions of our services may not function properly.

We obtain certain types of data whenever your web browser accesses our website or advertisements and other content served by us or on our behalf on other websites. This data may include the IP address used to connect your computer to the internet, device ID or token, unique identifier, device type, ID for advertising, referral URL, computer and connection data such as the type of operating system you use, your device information, your software information, browser type, browser language and version, ad data, access times, your browsing history, and your web log information. Our server automatically receives and records the IP address your browser sends to our server when you login to our website. We will store your IP address in our user registration databases. We will use your IP address to provide the most appropriate contents based on your geographic area or information derived from your IP address.

Our server keeps your account information active in our user registration databases in order to provide immediate access to your personal data each time you visit our website, as noted above.

Non-personal data we collect

We also collect data in a form that does not, on its own, permit direct association with any specific individual. We may collect your activities on our website, cloud services, software, and hardware. The information is anonymized before being stored in our servers. We aggregate and use this data to help us provide more useful information to our customers and to understand which parts of our website, products, and services are of most interest.

Use of Google Analytics

Our website uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses cookies or IP addresses to help us monitor and analyze how users use our website site and our services. The information generated by cookies or IP addresses about your use of the website will be transmitted to and stored by Google on servers. Google will use this information on our behalf for the purpose of evaluating your use of the website, compiling reports on website activity, and providing us other services relating to website activity and internet usage. The IP address that your browser conveys within the scope of Google Analytics will not be associated with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also opt out from being tracked by Google Analytics by downloading and installing: https://tools.google.com/dlpage/gaoptout?hl=en.

Where required by applicable law, we set analytics cookies only after you have given consent through our cookie banner, and you can withdraw that consent at any time through the same banner.

Use of Fabric

We use Fabric tools provided by Fabric. We use the information we get from Fabric tools to administer, develop, and improve our services and applications. Fabric’s ability to use and share information collected by Fabric about your use of our apps are governed by the Google Privacy Policy (available at http://www.google.com/policies/privacy/). You may learn more about how Google collects and processes data specifically in connection with Fabric at http://www.google.com/policies/privacy/partners/. By default, multiple Fabric kits are activated in our applications. Fabric kits like “Crashlytics” will always be activated to keep us informed about any problems appearing in our applications.

Use of opt-in/subscription

You have a choice of whether or not you want to receive marketing communication materials from us, and how you want to receive these notifications. These materials detail marketing activities from us related to product solutions, services, and other helpful business content.

You can manage your preferences by:

opting into a newsletter subscription on a web form;
opting into marketing activities on a web form; or
unsubscribing from a newsletter or opting out of marketing activities, by clicking a link at the bottom of newsletter or emails regarding marketing activities.

If you no longer wish to receive these communications from us, please follow the opting out or “unsubscribe” instructions provided in the link at the bottom of our marketing communications emails, or update your account settings.

AI features and conversation data

We offer more than one AI feature, and they do not collect data in the same way. This section explains what we do with the data involved. It applies in addition to the rest of this Policy.

The feature	What reaches us
AI features in QNAP devices	We may collect feedback you choose to provide regarding your experience with our services or responses.
AI Genius, on our website	The conversation itself

What we process

Feedback — the rating you submit on a particular response (for example thumbs up, thumbs down or a problem report) .
Conversation content — the conversation in which the response you rated appears, including the text you typed and the responses generated for you.
Technical information — the name and version of the AI model used, timestamps, the serial number of the QNAP device on which the AI feature runs, product model and firmware version, and error codes .

When we collect conversations

We do not collect your conversations with the AI features on your QNAP device on an ongoing basis. We collect a conversation only when you actively submit feedback on a particular response. When you do, the conversation in which that response appears is transmitted to us and stored together with your feedback. Our internal review tools display the response you rated and up to 3 turns regarding it.

Feedback is optional

You can use the AI features on your QNAP device without ever submitting feedback. We do not make access to those features conditional on your agreeing to feedback collection, and nothing is collected unless you actively click a rating. Clicking the rating is how you give your consent for that particular conversation. You can withdraw that consent at any time by asking us to delete the feedback, and withdrawal does not affect the lawfulness of what we did with it before you withdrew.

What we use it for

This is what we use feedback from the AI features on your QNAP device for:

detecting and repairing product defects, and improving stability and performance;
analyzing why a response was incorrect or inappropriate;
evaluating and improving the quality of AI responses, including building internal test datasets that we use to measure that quality;
maintaining the security of the service and detecting misuse;
understanding, in aggregate, how the AI features are being used so that we can decide what to improve next (product analytics);
complying with legal obligations.

We do not use your feedback, or the conversation content stored with it for advertising, marketing or profiling, and we do not sell it. If we ever intend to change this, we will tell you before we do so and, where consent is required, ask for it separately.

Human review

Feedback you submit, and the conversation content in it, is reviewed by designated personnel. This is necessary to identify, address and report the issues raised, and in some cases is required for safety or legal reasons. Please do not enter confidential information into a conversation if you do not want it reviewed. Access is restricted and access is granted only to the product management and engineering staff who need it in order to investigate the issue reported. Everyone with access is bound by confidentiality obligations.

How long we keep it

We keep feedback, and the conversation content stored with it, only for as long as it is needed for the purposes set out above. We review stored feedback periodically and delete records that are no longer needed for those purposes. You can ask us to delete your feedback at any time; see “Your rights and your personal data” below.

Personal and sensitive content

Conversation content is what you freely type, and we cannot know it in advance. Current technical limitations mean we cannot automatically de-identify it. A conversation may contain your own personal data, the personal data of other people, special categories of personal data such as health information, or confidential technical information such as passwords, keys, network configuration, internal paths or hostnames. Please read a conversation through before you submit feedback on it, and remove anything you would not want us to receive. If the conversation contains another person’s personal data, please make sure you have an appropriate basis for providing it to us.

Where processing takes place

Some of these AI features support models that run locally on your device (on-device models). When you select an on-device model, your conversation content is in principle processed on your device. Actions that the AI feature performs on your device — for example listing folders, reading logs or changing a setting — are carried out locally, under the permissions your account already has, and we do not upload the files stored on your device to us.

Please note: even when you have selected an on-device model, certain types of request still need to be sent to our cloud services to be processed. These currently include product FAQ lookups. The content of such requests may include personal data or environment information you have entered.

Devices administered by another person

Our AI features run on a QNAP device and use the account you log in with. If that device was set up for you by someone else — for example your employer, your organisation's IT team, or another member of your household — the person who administers that device holds administrative privileges over what is stored on it. Depending on how the device and the AI features are configured, this may allow the administrator to see the files you place on the device, its activity and system logs, the results of any scheduled tasks you create, and the content of your conversations with the AI features, including anything you typed into them.

Processing on the device therefore does not mean that the content is private from the administrator of that device. It means only that the content is not sent to us. What the administrator is able to see, and what they do with it, is determined by them and not by us, and is outside the scope of this Policy. If you are not sure who administers the device you are using, or you want to know what they can see, please ask them. We are not able to answer that on their behalf.

AI Genius on our website

AI Genius is an assistant on our website that answers questions about our products. It differs from the AI features built into a QNAP device in one respect that matters to you: we receive and keep a record of the conversation itself, whether or not you give feedback on it.

What we process

When you use AI Genius, we process the questions you type and the responses generated for you; a session identifier, which is a random string held in a browser cookie and used to keep the context of a single conversation; your language preference; and any rating or comment you choose to submit.

We do not ask you for personal data through AI Genius. It does not request your name, email address, account details or payment information, and we do not seek to identify you from what you type. In practice, the only personal data about you or about anyone else in a conversation is what you have chosen to enter — so please enter only what is needed to get an answer.

How responses are generated

To generate a response, we transmit your question, and the conversation it belongs to, over an encrypted connection to an AI service operated for us by a third party.

The provider operates an abuse monitoring function under which content may be retained by it for a limited period and reviewed by its authorised personnel in order to detect misuse of the service.

How long we keep it

The conversation window you see on screen is cleared once the session has been idle for more than 30 minutes. The underlying record — the question text, the responses, and any comment you submitted — is held in our system logs and is deleted automatically 6 months after it is created. The 30-minute period applies only to the window on screen; it does not mean that the content has been deleted at that point.

What we use it for

Answering your question, investigating faults, keeping the service secure and detecting misuse, and understanding in aggregate which topics people ask about so that we can improve our documentation and our products. We do not use AI Genius content to train or fine-tune any AI model, we do not use it for advertising, marketing or profiling, and we do not sell it.

How do we process your personal data?

We comply with our obligations under applicable privacy laws by: keeping personal data up to date; storing and destroying it securely; collecting and retaining only the necessary data that we need to provide you with service; protecting personal data from loss, misuse, unauthorized access, and disclosure; ensuring that appropriate technical measures are in place to protect personal data.

The processing operations we perform on your data cover automated and non-automated means of collecting, recording, organizing, structuring, storing, altering, retrieving, using, transmitting, disseminating or otherwise making available, aligning or combining, restricting, and/or erasing your data.

We use your personal data for the following purposes:

To design and deliver our services and activities to you
To provide you access to and use of our services.
To inform you of online and offline offers, products, services, and updates
To customize, measure, and improve our services and our marketing communication activities
To provide the products and services you requested, as described when we collect the information
To contact you to conduct research about your opinions of current services and products or of potential new services and products that we may offer
To send you communications regarding marketing activities or conduct webinars informing you of our news, events, new products, business tools and information, and activities
To share your contact details with our affiliate offices around the world within our group companies, for the purposes of internal administration and back-office support, to ensure our network security, and to prevent fraud
To maintain the integrity and safety of our data technology systems which store and process your personal data
To enforce or defend our policies or contract with you
To detect and investigate data breaches, illegal activities, and fraud
To analyse feedback in order to correct defects and improve the quality of our AI features, as described in the “AI features and conversation data” section

What is our lawful basis for processing your personal data?

In general, the lawful bases for us to process your personal data—for the various types of processing performed on your data—are, as applicable: processing as necessary for us to enter into and to perform our contract with you, or processing as necessary to pursue the legitimate interest of our Company or of the third parties. To know what types of processing your data undergoes, you can refer to “How do we process your personal data?” section of this Policy.

The following sets out which basis applies to which purpose:

Creating and administering your account, and providing the products and services you requested — contract.
Detecting and repairing product defects, and maintaining stability and performance — legitimate interests, namely keeping our services working and correcting problems promptly.
Collecting the conversation content contained in feedback you submit, and analysing it in order to correct defects, evaluate and improve the quality of our AI features and understand how those features are used — consent, which you give by submitting the feedback and may withdraw at any time.
Marketing communications — consent, or legitimate interests where permitted by applicable law.
Security, fraud prevention, and protecting our rights and those of our users — legitimate interests; legal obligation.
Complying with legal obligations and responding to lawful requests from authorities — legal obligation.

We will collect, process, and use the personal data supplied by you only for the purposes communicated to you and will not disclose your data to third parties except under the circumstances of data disclosure described in the “Sharing your personal data” section below.

Where we talk about our legitimate interest or that of third parties, such legitimate interest can include:

Implementation and operation of a group-wide organizational structure and group-wide information sharing;
Right to freedom of expression or information, including in the media and the arts;
Prevention of fraud, misuse of company IT systems, or money laundering;
Operation of a whistleblowing scheme;
Physical security, IT, and network security;
Internal investigations; and
Proposed mergers and acquisitions

Processing of special categories of personal data

In accordance with the applicable privacy laws, we currently do not collect or process the following categories of data relating to you: your racial or ethnic origin, political opinions, religious beliefs, trade union membership, health data, genetic data, biometric data. If we had to process this type of data, we would request your prior explicit consent in principle.

There is one exception you should be aware of. Where you use our AI features, the content you type is yours to compose and we cannot know it in advance. If you choose to submit feedback on an AI response, the conversation we receive may contain special categories of personal data that you have entered — for example a description of a health condition. We are not able to remove such content automatically before we receive it. Where the conversation you submit contains special categories of personal data, we rely on your explicit consent under Article 9(2)(a) GDPR, which you give by choosing to submit that feedback, and on no other basis.

We do not use special categories of personal data for advertising, profiling, or any decision affecting you. If you do not wish to provide this consent, do not submit feedback on that conversation; declining does not affect any product feature.

AI Genius works differently, because we receive the conversation whether or not you submit anything. We therefore cannot obtain your explicit consent before the content reaches us, and we ask you not to enter special categories of personal data into AI Genius at all. We do not seek such data, we do not use it as a special category of data, and AI Genius records are deleted automatically at the end of the retention period.

Necessity to provide us data

You are not under any obligation to provide us any personal data. As noted below, the choice is yours. However, please note that without certain data from you, we may not be able to undertake some or all of our obligations to you under our service contract with you, or adequately provide you with our full range of services. If you would like to obtain more details about this, you can contact us using the channels set forth in the “Whom should I contact?” section of this Policy.

Sharing your personal data

Your personal data will be treated as strictly confidential, and will be shared only with the categories of data recipients listed below. We will only share your data with third parties outside of the Company with your consent, and you will have an opportunity to choose for us not to share your data.

We may disclose your personal data to:

our affiliated entities within our global group of companies worldwide to provide you services such as detecting and dealing with data breaches, illegal activities, and fraud, maintaining the integrity of our information technology systems, as well as other internal administration purposes.
third-party service providers whom we subcontract to work on our behalf or for us and therefore may have access to your data only for purposes of performing these tasks on our behalf and under obligations similar to those described in this Policy, who perform functions such as data processing, managing and enhancing customer data, providing customer service, conducting customer research or satisfaction surveys, marketing support, informational systems technical support, to help us provide, analyze, and improve our services such as data storage, maintenance services, database management, web analytics, improvement of our service features, and to assist us in detecting and dealing with data breaches, illegal activities, and fraud.
governments and/or government-affiliated institutions, courts, or law enforcement agencies to comply with our obligations under relevant laws and regulations, enforce or defend our policies or contract with you, respond to claims, or in response to a verified request relating to a government or criminal investigation or suspected fraud or illegal activity that may expose us, you, or any other of our customers to legal liability; provided that, if any law enforcement agency requests your data, we will attempt to redirect the law enforcement agency to request that data directly from you, and in such event, we may provide your basic contact information to the law enforcement agency.
third parties involved in a legal proceeding, if they provide us with a court order or substantially similar legal procedure requiring us to do so.

We may provide you with opportunities to connect with third-party applications or services. If you choose to use any such third-party applications or services, we may facilitate sharing of your information with your consent. However, we do not control the applications or services of those third parties or how they use your information, and your use of such applications and services is not governed by our Privacy Policy. Please review the terms and the privacy policies of those third parties before using their applications or services.

This includes third-party AI model providers. Some of our AI features let you choose which model provider to connect to. Where you select a third-party provider, your inputs are sent to that provider to generate a response, and that provider handles them under its own privacy policy and terms. The provider may be located outside your country or region. Please make sure you have the right to provide the content in question — including any personal data of other people contained in it — to that provider.

Where you connect using your own account or API key, you have a direct relationship with that provider and the transfer takes place according to your own settings and choices; we provide only the connection.

We will display your personal data and account activity in your profile page and elsewhere on our service portals according to the preferences you set in your account. You can review and revise your profile information at any time. Please consider carefully what information you disclose in your profile page and your desired level of anonymity. In your profile page, we will also display your device information as well as provide the network connection information for the devices to the applications that connect to your devices.

How long do we keep your personal data?

We keep your personal data for no longer than reasonably necessary for the given purpose for which your data is processed. If you will provide us, or have provided us, consent for us to process your data, we will process your data for no longer than your consent is effective. Notwithstanding the above, we may retain your personal data as required by applicable laws and regulations, as necessary to assist with any government and judicial investigations, to initiate or defend legal claims or for the purpose of civil, criminal, or administrative proceedings. If none of the above grounds for us to keep your data apply, we will delete and dispose of your data in a secure manner according to our Privacy Policy.

Privacy of data subjects who are minors

Our products and services are not targeted to persons who are minors in the jurisdiction in which they reside (generally under the age of 18). We do not knowingly collect or process personal data from persons who are minors. If you are a minor, you should not buy or use our products or services. If we become aware that we hold personal data of a minor, we will delete it.

Your rights and your personal data

Unless subject to an exemption under applicable privacy laws, you have the following rights with respect to your personal data:

The right to request a copy of your personal data which we hold about you.
The right to request that we correct any personal data that is found to be inaccurate or out of date.
The right to request that we erase your personal data where it is no longer necessary for us to retain such data, except we are not obliged to do so if we need to retain such data in order to comply with a legal obligation or to establish, exercise, or defend legal claims.
The right to withdraw your consent to the processing at any time, where we rely on your consent to process your data. This includes cases where you wish to opt out of marketing communications that you receive from us.
The right to request that we provide you with your data and, where possible, to transmit that data directly to another data controller, where the processing is based on your consent or is necessary for the performance of a contract with you, and, in either case, we process the data by automated means.
The right to restrict our processing of your personal data where you believe such data to be inaccurate, or our processing is unlawful; or that we no longer need to process such data for a particular purpose unless we are not able to delete the data due to a legal or other obligation or because you do not wish for us to delete it.
The right to object to us using your personal data, where the legal justification for our processing of your personal data is our legitimate interest. We will abide by your request unless we have compelling legitimate grounds for the processing which override your interests and rights, or if we need to continue to process the data for the establishment, exercise or defense of legal claims.
The right to lodge a complaint regarding our processing of your data, with the competent authority where you reside or in which your data is processed.

If you would like to exercise any of the above rights, please do so through this webpage: www.qnap.com/sarf.

After receiving your request, we will evaluate your request and inform you how we intend to proceed with your request. Under certain circumstances, in accordance with applicable privacy laws and regulations, we may withhold access to your data, or decline to modify, erase, port, or restrict the processing of your data.

Please be advised that if you exercise the rights to erase data, restrict or object to our processing, or to withdraw your consent, we may not be able to continue providing our services to you if the necessary data is missing for processing.

Transfer, storage, and processing of data abroad

As noted in the “Sharing your personal data” section of this Policy, as a globally operating company, we may share your information with our affiliate companies or third parties. Please refer to the “Sharing your personal data” section of this Policy for the recipients of your data and the reasons for our provision of your data to them. Where such entities are located in other countries and jurisdictions, we will therefore be transferring your personal data outside of the European Economic Area. In making such data transfers, we make sure to protect your personal data by applying the level of security required by applicable privacy laws. Where we transfer your data to a country or jurisdiction that cannot guarantee the required level of protection as required by applicable privacy laws, we have enhanced our IT security measures and have entered into Standard Contractual Clauses (SCCs) with the transferee to require security obligations on the transferee, both of which are intended to increase the protection of your personal data. SCCs are one of a number of "appropriate safeguards" under the applicable privacy laws that enable the transfer of personal data concerning data subjects within the European Economic Area to jurisdictions that have not been designated by the European Commission as possessing an adequate level of data protection. You may request a copy of such SCCs from us, or inquire about transfers of your information, by providing your request to the contact window set forth in the “Whom should I contact?” section of this Policy. In particular, feedback submitted on our AI features, and the conversation content stored with it, is stored in the United States with Amazon Web Services. For that transfer we rely on the Standard Contractual Clauses adopted by the European Commission, together with the supplementary technical and organisational measures described in the “Security” section of this Policy.

Further processing

If we wish to use your personal data for a new purpose not covered by this Policy, then we will provide you with a new policy explaining this new use prior to commencing such further processing for a new purpose. This new policy sets out the relevant new purpose and processing conditions. In such a case, we will find a lawful basis for further processing, and whenever necessary, we will seek your prior written consent to such further processing.

Security

We protect your data using technical measures to minimize the risks of misuse, unauthorized access, unauthorized disclosure, loss or theft, and loss of access. Some of the safeguards we use are data pseudonymization, data encryption, firewalls, and data access authorization controls. We take our data security very seriously. Therefore the security mechanisms used to protect your data are checked and updated regularly to provide effective protection against abuse.

The servers through which we collect your information are usually encoded using the encryption module of your browser, and are certified by renowned institutions for international encryption technique. If necessary, we use Secure Sockets Layer (SSL) encryption to protect your personal information. Moreover, we have put in place additional and comprehensive state-of-the-art security measures every time your data are accessed through the internet. Firewalls prevent unauthorized access. Diverse encryption and identification layers protect your data from intrusion or disclosure to third parties during data transfer. Furthermore, we internally use sophisticated encoding methods in order to prevent decoding by unauthorized persons. Moreover, an electronic identifier is generated during data transfer to safeguard your information.

For your confidentiality and security, we use IDs and passwords to secure your personal information. It is important for you to protect your ID, password, or any personal information. Do not disclose your personal information, especially your password, to anyone. When you are finished using our services, please do not forget to log out from your account. If you share a computer, whether in a public or private setting, be sure to sign off and close your browsers when finished using a shared computer.

If you believe that the security of your data has been compromised, or if you would like more information on the measures we use to protect your data, you can contact us using the channels set forth in the “Whom should I contact?” section of this Policy.

What are your choices?

You have the choice to allow us to collect and process your data. The collection and processing of your personal data is neither a statutory nor a contractual requirement, although as noted above, we will be unable to provide you with certain services without the necessary data.

If you are dealing with us online, note that most browsers will inform you how to prevent your browser from accepting new cookies, how to receive notifications whenever you receive a new cookie, and how to disable cookies. Additionally, you can disable or delete the data used by browser add-ons, such as Flash cookies, on your browser or on the website of its manufacturer.

You can always choose not to provide us with your data. In case we may need such data to process your requests, we will inform you of our constraints.

To the extent that you have consented to our processing of your data, you can choose to discontinue our processing at any time.

You can choose to request a copy of the personal data we store and process regarding you.

You can choose to add or update data that you have provided us with.

You can choose to erase your data, or choose to restrict our processing of your data instead.

You can choose to port your data to a third party under the conditions stated above.

You can choose to object to our processing of your data.

You can inform us of your choices or request on any data processing aspect listed above using the channels set forth in the “Whom should I contact?” section of this Policy.

In summary, what we are allowed to do with your data—with limited exceptions under applicable privacy laws—is up to you. However, in the event that you choose not to let us further process your data, your choice may affect the delivery of our obligations or services to you. In this case, we will inform you of our constraints.

Whom should I contact?

If you have any questions about this Privacy Policy, or if you would like to exercise any of your rights, or if you have any complaints that you would like to discuss with us, please send us a signed and dated request. State your request clearly and accurately within the first sentence of your query. You may contact us through the following methods:

by post to QNAP Systems, Inc., Data Protection Officer, 3F, No. 22, Zhongxing Rd., Xizhi Dist., New Taipei City 221, Taiwan (R.O.C.)

or by logging on to www.qnap.com/sarf

If your question concerns data held on a QNAP device that is administered by your employer, your organisation or another person, please raise it with that administrator in the first instance. We do not have access to the contents of your device and cannot tell you what its administrator is able to see or what they do with it.

In case of disagreements relating to our processing of your personal data, you can submit a request for mediation or other administrative actions to the data protection supervisory authority with the competent authority where you reside or in which your data is processed. Please click here for a list of local data protection authorities in EEA countries: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.

QNAP SYSTEMS, INC. PRIVACY POLICY (Version 3.0)