Yealink User Data Access and Sharing Policy

Effective Date: September12，2025
Last Updated: September12，2025
Applies to: All EU users of Yealink devices and services

This Policy is formulated by Yealink Network Technology Co., Ltd. (hereinafter referred to as Yealink, we, or our) to regulate the access and use of data generated by or related to the user(i.e.,you) during the use of Yealink devices and services. This Policy is designed to comply with applicable laws such as the EU Data Act(EDA) and the General Data Protection Regulation (GDPR).

1. Data Access

1.1 Pursuant to its obligations as a data holder under the EDA, Yealink shall make product data and related service data available to the user under fair, reasonable, and non-discriminatory (FRAND) conditions.

1.2 In the event that the data disclosed contains trade secrets or is protected by intellectual property rights, Yealink shall have the right to require the user and any designated third-party data recipient to enter into a Confidentiality Agreement as a condition for disclosure.

1.3 Yealink products may integrate third-party services. If you wish to obtain product data or related service data generated by such third-party services, please follow the instructions provided by the respective third party.

2. Scope of Accessible Data

2.1 Subject to applicable legal and contractual obligations, users may request access to the following categories of data:

• "Product data" means data generated by the use of a connected product that the manufacturer designed to be retrievable, via an electronic communications service, physical connection or on-device access, by a user, data holder or a third party, including, where relevant, the manufacturer;

• "Related service data" means data representing the digitisation of user actions or of events related to the connected product, recorded intentionally by the user or generated as a by-product of the user's action during the provision of a related service by the provider.

2.2 Certain data may be anonymized or aggregated for operational or analytical purposes and may not be individually accessible. The specific data that can be accessed may vary depending on the features of different products and the way users use them. For details on the data category of each product line, please refer to the following

• IP Phone: Network and Connectivity Status Data; Fault and Event Log Data; Audio Information; SIP Registration Information; Device Configuration Files; Bluetooth Information.

• Dect Phone: Handset Device Identity and Registration Information; Network and Connection Status Data; Fault and Event Log Data; SIP Registration Information; Device Configuration Files.

• MTR-A: Accessory Information; Other Hardware Information; Network and Connectivity Status Data; Bluetooth Information; Application List; Audio Information; Video Information; USB Drive Information; Fault and Event Log Data.

• MTR-W: Accessory Information; Network and Connection Status Data; Audio Settings; Fault and Event Log Data.

• ProAV: Accessory Information; Device Status Information; Network and Connection Status Data; Audio Settings; Fault and Event Log Data.

• YMCS (Yealink Management Cloud Service): Device Reporting Data; User Account Data; Integrated Service Data; Operation Log Event.

• YDT (Yealink Deployment Tool): MCore Device Info on LAN; Operation logs.

• YUC (Yealink USB Connect): Device Reporting Data; Integrated Service Data; User-generated Data; Fault and Event Log Data.

2.3 The definition of "data" mentioned in this Policy refers to the data scope listed in Clause 2.1.

2.4 If you require further details regarding the aforementioned data (including but not limited to its format, volume, whether it is generated in real-time, retention period, and storage), please contact us through the channels specified in Clause 4.1. Upon request, Yealink will provide you with the relevant Data Disclosure Sheet. You acknowledge and agree that such Data Disclosure Sheet is prepared solely for the purpose of fulfilling Yealink's disclosure obligations under the EU Data Act, and you are entitled to review and understand its contents prior to purchasing the relevant products or services. Without Yealink's prior written consent, you shall not copy, modify, distribute, disclose, or otherwise use the Data Disclosure Sheet for any purpose beyond the expressly authorized scope of this Agreement. Yealink shall not be liable for any unauthorized use of the Data Disclosure Sheet, and you shall indemnify and hold Yealink harmless against any losses arising therefrom.

3. Personal Data

3.1The EDA does not affect the rights and obligations conferred by the GDPR and other applicable data protection laws, nor does it create any new legal basis for processing personal data. If the requested data involves personal data and the requesting party is not the data subject, a basis for processing as required under the GDPR must exist; otherwise, we may refuse to provide it.

3.2 If you need to access or share information involving personal data, you must strictly comply with the GDPR and other applicable data protection laws, ensuring that such processing is based on a lawful legal basis. You shall bear sole responsibility for any legal liabilities arising from the improper sharing or processing of personal data.

4. How to Request Access

4.1 Users can request their data by:

• Submitting a request through privacy@yealink.com or Yealink sales, mark the subject as Data Access Request;

• Including relevant identifiers (e.g., product name, related service name, device ID, Registered company email address/company ID, MAC address, data category);
  Please note that this process may involve the limited processing of personal data. Such processing is carried out solely for fulfilling user requests, in strict compliance with applicable data protection laws, and entailing no retention or storage of personal data beyond what is strictly necessary for that purpose.

• Verifying their identity for security purposes;

If you wish to share data with a third party, please contact us for further processing. To verify that the third party has obtained your valid authorization, we will require the third party to provide an authorization letter duly signed by you. You may obtain the authorization letter template via this link.

We aim to respond to all verified requests within 30 days of receipt.

4.2 Based on the following circumstances, we may restrict your access:

• Security: If sharing would violate product safety requirements under EU or Member State law, and access to the data could cause serious adverse effects on human health, safety, or security.

• Trade Secrets: We will only disclose trade secrets to you after you have entered into a Confidentiality Agreement with us. At the same time, we reserve the right to suspend or refuse to share trade secrets under the following circumstances:

  – You have not reached Confidentiality Agreement with us on necessary confidentiality measures;

  –You have failed to perform the Confidentiality Agreement , or you have compromised the confidentiality of trade secrets;

  – In exceptional cases, we, as the data holder, are still highly likely to suffer serious economic loss due to the disclosure of trade secrets, even if you have taken measures;

If we refuse to share data for the above reasons, we will notify the competent authority in accordance with the EDA.

5. Data Sharing with Third Parties

5.1 We do not share your individual data with third parties without your consent, unless:

• Required by law or regulatory obligation;

• You explicitly instruct us to share data (e.g., with a third-party platform);

• For emergency response purposes (under public interest exceptions).

5.2 When you request that data be provided to a third party, we may restrict the third party's access to the data under the following circumstances:

• Not yet on the market: Your right to request that we share data with a third party does not apply to data obtained in the course of testing other new products, substances, or processes that have not yet been placed on the market, unless our contract with you permits third-party use.

• No data sharing with gatekeepers: Your right to request that we share data with a third party does not apply to data platforms operated by the largest providers of core platform services in Europe, namely the so-called "gatekeepers" as defined under the Digital Markets Act.

• Trade secrets: See Clause 4.
  If we refuse to share data for the above reasons, we will notify the competent authority in accordance with the EDA.

6. Data Usage Restrictions

6.1 As Data Holder:

• We will only use the data in accordance with the contract signed with you;

• We will not use the data to gain insights into your financial situation, assets, production methods, or usage patterns in a way that could harm your commercial position in active markets;

• We will not provide non-personal product data to any third party without your consent for purposes other than fulfilling our contractual obligations to you;

• Other cases as required by applicable laws or contractual Agreements.

6.2 As User:

• You shall not use data obtained through a data access request to gain insights about the manufacturer or data holder;

• You shall not use the obtained data to develop connected products that compete with the source connected products, nor share such data with third parties for that purpose;

• Other cases as required by applicable laws or contractual agreements.

6.3 As Third Party:

• Third parties shall not use the data received from the data holder for analytical purposes except as necessary to provide the services requested by the user. "Analysis" includes any form of automated processing of personal data intended to evaluate personal aspects of the user (e.g., analyzing or predicting work performance or financial situation) that may have legal effects or similarly significant impacts;

• Third parties shall not provide the received data to any other third party unless a contract is in place with the user and all measures are taken to protect trade secrets;

• Third parties shall not use the received data in ways that could adversely affect the security of the products or related services;

• Third parties shall not use the obtained data to develop connected products that compete with the source connected products, nor share such data with third parties for that purpose;

• Other cases as required by applicable laws or contractual agreements.

6.4 Remedies for Unauthorized Use:

If a user or third party unlawfully obtains or misuses the product or related service data as described above, we have the right to require them to:

• Immediately delete the data and all copies thereof;

• Cease using, selling, producing, importing, or exporting any products or services based on the relevant data;

• Destroy any infringing products or materials;

• Notify the end users or relevant parties of the unauthorized use and the remedial actions taken;

• Compensate us and/or the affected parties for any resulting damages or losses.

6.5 Users and third parties, after obtaining Yealink product or related service data, shall use such data only within the scope permitted by law and in compliance with applicable regulations. Any risks, liabilities, or losses arising from the use of such data shall be borne solely by the users or third parties, and Yealink shall assume no responsibility in this regard.

7. Data Portability and Service Migration

7.1 YMCS (Yealink Management Cloud Service) platform currently supports interoperability and portability with other third-party platforms via users manually exporting the relevant data packages (can be imported and read by third-party platforms) through the platform, ensuring the integrity, consistency, and security of exported data. Where additional assessments for specific third-party switching or the development of functional modules are required, reasonable technical support fees may be charged, and a separate service Agreement will be executed with the user.

7.2 If data involves cross-border transfer, we will adopt the necessary safeguards in accordance with applicable laws to ensure compliance, including requiring the user to sign appropriate contracts, Standard Contractual Clauses, or relying on other lawful bases as required under data protection laws.

7.3 During the data migration process, the user's rights to access, rectification, and erasure shall remain unaffected. Once the data has been fully and securely migrated to the new service environment, we will, based on the user's explicit instructions and in accordance with this Policy and our Privacy Policy, delete or anonymize the data in the original service, except for data required to be retained under applicable law.

7.4 The new service provider designated by the user shall undertake to comply with applicable data protection laws and to adopt appropriate technical and organizational measures to ensure the security and confidentiality of the data. The user shall ensure that its designated service provider does not violate any data protection laws or contractual obligations.

7.5 As data migration involves multi-party collaboration, although we will use commercially reasonable efforts to assist the user, we shall, to the maximum extent permitted by law, not be liable for any service interruptions, delays, or temporary unavailability of data caused by technical issues or the environment of the user's designated service provider. The user shall conduct sufficient testing and fully understand the risks before initiating a full migration.

8. Dispute Resolution

8.1 The parties shall, in good faith, use all reasonable efforts to resolve any disputes arising from or in connection with this Policy, including disputes related to data access, use, or sharing (hereinafter referred to as Data Dispute), through amicable consultation and negotiation.

8.2 If the parties are unable to resolve a Data Dispute through consultation within a reasonable period, the Data Dispute shall be submitted to an EU-recognized dispute resolution body designated by YEALINK, in accordance with clause 10 of the EDA. The Parties agree to comply with the decisions or recommendations issued by such dispute resolution body to the extent permitted by applicable law.

8.3 During the pendency of any Data Dispute, each party shall continue to comply with its obligations under this Policy, including those relating to confidentiality, data protection, and lawful processing of personal and non-personal data.

8.4 For disputes not relating to data, the resolution shall follow the dispute resolution procedures outlined in the parties' underlying contract.

9. Miscellaneous

9.1 Yealink is entitled to reasonable compensation for providing the data, which shall be based on the actual costs incurred and investments made in data generation. The specific terms of compensation will be agreed upon with you during the data request process.

9.2 You acknowledge and agree that, pursuant to the EDA and other applicable laws, we may be required to provide data related to your use of the products or services (including, where applicable, personal data) to public sector bodies or EU institutions upon their lawful request. Such disclosure will be carried out in compliance with the principles of lawfulness, necessity, and proportionality, and we will implement appropriate technical and organizational measures to safeguard the security of the data.
Where not prohibited by applicable laws or confidentiality obligations imposed by public authorities, we will use reasonable efforts to inform you of such disclosure promptly.

9.3 If you have any questions or concerns regarding your data access rights, please contact:

Data Protection Officer

PAN, Jianbiao (Jim)

privacy@yealink.com

Yealink Network Technology Co., Ltd.