Privacy Policy on the Official Mall of Chery International

Version update date: June 18, 2023
Version effective date: July 1, 2023

Our Commitment to Your Privacy

Chery Automobile Co., Ltd. ("Chery" or "we") attaches importance to and is committed to protecting your privacy. To ensure the security of your personal data, we have conveyed Chery's privacy and security guidelines to all employees, with strict implementation of privacy protection measures within our company.

The privacy policy on the official mall of Chery International (the "Policy") applies only to the website and related services of the official mall of Chery International. The privacy policy explains how we collect, use and protect your personal data. Please read this Privacy Policy (which can be accessed from the following headings) carefully before agreeing to and using the relevant services, especially the bold terms therein. If you have any questions, please contact us via the information provided in "Contact Us" below.

What Is Personal Data

We always respect the basic rights of privacy, and believe that these basic rights should not be different depending on the countries/regions where you live. Therefore, we consider any identified or identifiable individual-related data as "Personal Data", no matter where the individual lives. This means that the data that can be directly used to identify your identity (such as your name and cell phone number) belongs to personal data; and the data that can not be directly used to identify your identity, but can be used to identify your identity indirectly through reasonable inferences, also belongs to personal data. The data that cannot be used to identify or associate a specific natural person after technical processing is referred to as Anonymized Data, which is not regarded as personal data.

Personal Data Collected by Us

Personal data collected by us from you

In order to provide you with an excellent service experience while providing good privacy protection, we will only collect personal data that is necessary for the service. The types of personal data collected by us will depend on how you interact with us (functional service). In following scenarios (functional service), we will collect your personal data for different purposes. We will not collect your personal data through ways such as fraud, deception, and misdirection.

Please note that for specific scenarios and purposes, the data we collect may contain your personal sensitive information, which will be marked in bold. You have the right not to provide us with the authorization or consent for this sensitive information. We promise that your unauthorized choice will not affect our provision of basic services, but will only affect some personalized services. We will mark them in the following scenarios.

When you use the following functions and services, we will collect your personal data and other information related to you.

Types of personal data	Purpose of use	Mode of use	Scope of use	Period of data storage
Login account	For logging in	Use the specified account number and password to log in	Login account: After logging in, you can use the complete functions of the official mall. During the login process, you need to provide us with the following personal data: [account, password]. Login log: For customer experience and service needs, we will record your login and logout behavior data on the official mall.	When exit the Chery agent system or initiate deletion, the background will be deleted processing
Shopping Mall	For online shopping	Use personal transaction fulfillment information to purchase products	Mall: You can make online purchases within the mall to achieve order transactions and purchase products. We will collect the recipient, recipient phone number, detailed recipient address, destination port, contact person, contact person phone number, purchase records, and relevant payment information. And we will provide relevant order inquiries. If you do not provide relevant information, you may not be able to achieve the purchase function.	When exit the Chery agent system or initiate deletion, the background will be deleted processing
Shopping Cart	For adding products	Select the products you are interested in and add them to your shopping cart	Shopping Cart: During the process of browsing products, you can choose to add the products you are interested in to the shopping cart. When you use this function, we will also store your purchase records.	When exit the Chery agent system or initiate deletion, the background will be deleted processing
Personal Information	For order address management and transaction order management	Use custom delivery address to place an order; shopping cart to place an order; product detail page to place an order; contact the consignee using a contact number;	Personal Information: You can click on the avatar to enter the personal center, where you can check your account, your address (add and edit content for delivery address, including recipient, recipient phone number, detailed delivery address, destination port, contact person, and contact person phone number), and transaction order records.	When exit the Chery agent system or initiate deletion, the background will be deleted processing
Orders	For order inquiry	Enter the order inquiry page through "Personal Center-My Orders".	Orders: You can enter the order query page through "Personal Center - My Orders" to view your mall order data. At the same time, we will store the buyer, shipping address, phone number, name, and other information retained in the order.	3+ years
Customer Service Inquiry	For customer service inquiries	Use the customer service consultation function (email to contact official customer service)	Customer service consultation: In response to your inquiries and requests, and to provide service follow-up to you, you can choose to use the customer service consultation function. If you use the customer service consultation function, we need to collect communication information between you and us (such as consultation email, photos, videos, voice, and location sent during communication), and consultation records. In addition, in order to inquire about your purchase intention, we will also collect your phone number;	5

Exceptions of obtaining authorization/consent: within the scope of laws and regulations, we may collect and use your personal data in accordance with the law under the following circumstances, without obtaining your authorization and consent:

Directly related to national security and national defense security;
Directly related to public safety, public health, or major public interests;
Directly related to criminal investigation, prosecution, trial, and enforcement of judgments;
For protecting the life, property, and other major legal rights and interests of you or other individuals but difficult to get your consent;
The personal data involved is disclosed to the public by you;
Necessary for the signing and performance of the contract in accordance with your requirements;
Collecting personal data from legally publicly disclosed information, such as legitimate news reports, government information disclosure, and other channels;
Necessary for maintaining the safe and stable operation of the provided services, such as detecting and handling malfunctions in the services.

Personal data collected by us from other sources

We may collect your relevant personal data from other individuals, businesses or third parties acting in accordance with your instructions, partners assisting us in providing products and services and providing assistance in security and fraud prevention, and other legitimate sources.

Individuals:

We may collect data about you from other individuals, for example, if this individual has sent you a product through our store, or invited you to join or enjoy a service we provide.

According to your instructions:

You may instruct other individuals or third parties to share data with us. For example, you may instruct your mobile operator to share data related to your phone number with us so that you can register an account or enjoy other services and features we provide that require phone number information.

Cookies and Other Technologies

We may collect your information through cookies or similar technologies and use it for the following purposes:

·Remember your identity. For example, cookies or similar technologies can help us identify your identity as our registered user, or save your order information or other information;

We will only use cookies or similar technologies for the above purposes, and will not provide summary of non-personally identifiable information collected through cookies or similar technologies to advertisers and other partners for the purpose of analyzing the use of our services by you and other users.

You may reject or manage cookies or similar technologies through a browser or user selection mechanism. But please note that if you disable cookies or similar technologies, we may not be able to provide you with the best service experience, and you may not be able to use certain services normally.

Use of Personal Data

We will use your personal data based on the following data usage rules:

In accordance with the terms of this policy, and for the purpose of achieving functions of our products or services, we will use the personal data collected;
In order to ensure the stability and safety of service, we will use your personal data for identity verification, safety protection, fraud detection, prevention or prohibition of illegal activities, risk reduction, filing, and backup;
We will report to relevant departments in accordance with laws and regulations or regulatory requirements;
After collecting your personal data, we will desensitize and de-identify the data through technical means, and the de-identified information will no longer identify the subject. Please understand and agree that in this case, we can conduct comprehensive statistics, analysis and processing of your personal data, so as to provide you with more accurate, personalized, smooth and convenient service, or help us evaluate and improve involved service and operation activities;
Please note that all personal data you provide when using our services will continuously authorize us to use during your use of our services, unless you delete them or refuse us to collect them through system settings;
We will conduct statistics on the use of our services and may share the statistical information with the public or third parties to showcase the overall usage trends of our services. However, the statistical information does not include any identifying information about you;
When we use your personal data for other purposes not specified in this policy, or if the information collected for a specific purpose is used for other purposes, we will seek your consent again in the form of confirmation agreements and copywriting confirmation actions in specific scenarios in accordance with the requirements of laws and regulations and national standards.

We may not use datasets for research and development purposes, such as datasets containing images, voice or other data that may be associated with an identifiable individual. When obtaining such datasets, we will comply with applicable laws, including those of the jurisdictions in which the datasets are stored. When using such datasets for research and development purposes, we will not attempt to re-identify the identity information of individuals involved.

We retain personal data only for the period necessary for the purpose of collection, and we comply with the relevant provisions of this policy or our specific service privacy statement or applicable legal requirements. We will, in accordance with this policy, retain your personal data for the period necessary to achieve the purposes stated therein. During the retaining period for evaluation, we will firstly carefully ascertain whether it is necessary to retain the personal data collected; if it is necessary to retain, we will strive to retain personal data for the shortest period as permitted by law.

Entrusted Processing of Personal Data

In the above functions and services, some specific functions or services are provided by our hired service providers of customer support, such as providers of shipping logistics services. We will only entrust the service providers to process necessary personal data as required under this function for the purpose of providing you with this function.

As for the service providers we entrust to process personal data, we will sign strict confidentiality agreements with them, and require them to process personal data in accordance with our requirements, this policy, and any other relevant confidentiality and security measures.

We will not share your personal data with any third parties, unless your explicit consent is obtained, except in the following cases:

·Requirements by laws and regulations, or supervision. We will provide your personal data to courts or supervision authorities in accordance with laws and regulations, courts’ orders or other legal procedures, or at the request and advocacy of supervision authorities.

·Sharing with our affiliated companies: Your personal data may be shared with our affiliated companies. We will only share personal data that is necessary and subject to the purposes stated in this Privacy Policy. If any changes to the purposes for which personal data is processed are required, we will seek your authorized consent again.

Transfer of Personal Data

We will not transfer your personal data to any company, organization or individual, except in the following cases:

·Transfer at your direction or with your explicit consent: In accordance with your instructions or with your explicit consent, we will transfer your personal data to other parties;

·When involving mergers, acquisitions, asset transfers, or similar transactions, if it involves the transfer of your personal data, we will provide you with appropriate notice before the transfer and ensure that your personal data is equally protected in accordance with this policy after the transfer. We will require the new company or organization that holds your information to continue to be bound by this policy, otherwise, we will require the company or organization to seek authorization from you again.

In the following situations, we do not need to obtain your authorized consent in advance to share, transfer, or publicly disclose your personal data:

Related to the performance of the personal data controller’s obligations under laws and regulations;
Directly related to national security and national defense security;
Directly related to public safety, public health, or major public interests;
Directly related to criminal investigation, prosecution, trial, and enforcement of judgments;
For protecting the life, property, and other major legal rights and interests of you or other individuals but difficult to get your authorized consent;
Personal data that you disclose to the public on your own;
Collecting your personal data from legally publicly disclosed information, such as legitimate news reports, government information disclosure, and other channels.

About Your Rights

We respect your rights to obtain, access, correct, transfer, revoke, and delete your personal data. In accordance with applicable data privacy laws, we will take appropriate steps to provide these rights to our customers worldwide. If you choose to exercise these privacy rights, you will have the right to be treated fairly, and also have the right to enjoy the same service when you do not exercise these privacy rights. We promise that we will not sell your data to any party for earning profits.

When you exercise your rights, we will require you to provide the proof of identification information for verification, so as to ensure the protection of our customers’ confidential information. We will reply with processing comments or results within fifteen (15) days upon receiving your application and verifying your identity. In some cases, we may not be able to approve your request, for example, if there is a conflict between your request and a legal obligation we need to comply with. In addition, we may deny your privacy request if it affects the privacy rights of others after evaluating your request. For your reasonable request, we will not charge fees in principle; but for your request that is repeated and beyond reasonable limits, we will charge a certain of cost, as the case may be.

You can exercise your rights as provided below:

Right of access

If you want to access your personal data, including but not limited to account information, order information, vehicle usage data, and information about the receiver of your personal data shared by us, you may access your personal data in the following ways.

You can access your relevant personal data through the following functions by logging into your dealer account:

Check your personal account data including your nickname and account number in "Personal Center".
Check your product orders including order type, order status, order time, transaction and consumption record (order amount, order number, address and phone number) in “Personal Center → My Orders”;
Check the delivery address including consignee, consignee's phone number, detailed address, destination port, contact person, and phone number for the contact in "Personal Center → My Address";

Right of correction

When you find errors in your personal data processed by us, you have the right to make corrections or updates to the incorrect or incomplete information after your identity is verified, provided that the corrections will not affect the objectivity and accuracy of the information.

You can correct your relevant personal data through the following functions by logging into your dealer account:

Correct personal data: correct your address (delivery address) in “Personal Center→ My Address”.

Right of deletion

If you find that we violate laws and regulations or violate our agreement with you to collect your personal data, you have the right to ask us to delete it.

You can contact the official customer service email of Chery International Mall at： chery@mychery.com to request the deletion of your relevant information.

Right of revocation

For the processing of personal data collected by us, you have the right to change or withdraw your authorized consent at any time. You may submit the relevant request to change your prior authorization of the scope of personal data collected by us through the official customer service email of Chery International Mall at chery@mychery.com.

You need to understand that each function can be completed with some basic personal data. When you revoke the consent or authorization of the personal data under the function, we will no longer process the corresponding personal data at your request, but will also be unable to continue to provide you with the corresponding services. However, your revocation of consent or authorization will not influence the processing of personal data previously carried out on the basis of your authorization.

Right to obtain a copy of personal data

You have the right to a copy of your personal data, which you can obtain via the official customer service email of Chery International Mall at chery@mychery.com; under feasible technologies, such as data interface matching, we can directly transmit the copy of your personal information to your designated third party in accordance with your requirement.

Exceptions in response to your request

We will not be able to respond to your request in the following circumstances:

Related to the fulfillment of our obligations under laws and regulations;
Directly related to national security and national defense security;
Directly related to public safety, public health, or major public interests;
Directly related to criminal investigation, prosecution, trial, and enforcement of judgments;
Your subjective malice or abuse of power with sufficient evidence;
For protecting the life, property, and other major legal rights and interests of you or other individuals but difficult to get your consent;
Leading to serious damages of legal rights and interests of you or other individuals and organizations when responding to your request;
Involving trade secrets.

If you fail to exercise your rights through above ways, you can contact us at any time via the contact information listed in “Contact Us” below, and we will reply you with processing comments or results within seven (7) days.

Protection of Personal Data

We believe that good privacy relies on a high level of security. We will protect your personal data by taking administrative, technical, and physical protection measures, while taking into account the nature of personal data, data processing, and threats faced. We have been continuously improving such protection measures to ensure that your personal data is protected at any time, which specifically includes, but is not limited to:

In terms of systems, we have formulated relevant information security systems to regulate the requirements for the protection of personal data.
In terms of internal management, we have established dedicated information security personnel responsible for the construction of the information security system, with duties covering network security, vulnerability management, threat discovery, and security incident handling processes.
In terms of technologies, we use security tools such as intrusion detection/protection systems, network firewalls, anti-virus tools, and anti-spam tools (such as IDS/IPS, WAF, and DLP) in practice, and conduct network boundary monitoring and protection measures for the systems. Our system is subject to encrypted connections by HTTPS to ensure the security of your data during transmission.
In terms of security audit, we will conduct the regular security audit, which means that we must conduct security test and audit for each version we develop before it can be launched for release.
In terms of compliance audits, we conduct regular internal audits as well as entrust data security audit professionals to conduct regular compliance audits on activities that process personal data.

The Internet environment is not 100% secure, so we cannot guarantee that the system and information are 100% secure. If you believe that our system has any security risks or vulnerabilities, please feel free to contact us based on the method listed in the "Contact Us" part below. We will develop an emergency plan for network security incidents to deal with security risks such as system vulnerabilities, computer virus, network attacks, and network intrusions in a timely manner. In the event of an incident endangering network security, we will immediately launch the emergency plan, take corresponding remedial measures, and report to the relevant competent authorities in accordance with applicable laws and regulations. After the occurrence of a security incident, we will promptly inform you of the basic situation and potential impact of the incident, the measures we have taken or will take to address it, suggestions for you to independently prevent and reduce risks, and remedial measures for you in accordance with the requirements of laws and regulations. We will promptly inform you of the relevant situation of the incident through SMS, email, and other contact information you have reserved. If it is difficult to inform you one by one, we will take reasonable and effective measures to publish an announcement.

Storage of Personal Data

We currently store all data in Mexico. We will obtain your individual consent prior to data collection and storage as required to comply with laws and regulations regarding data protection.

We will only retain your personal information for as long as necessary to achieve the purposes described in this Privacy Policy, unless otherwise required by law or regulation or unless the subject of the personal information has otherwise authorized consent. The period of storage of your personal information may vary depending on the product/service you use. We judge the duration of storage of personal information based on the following criteria

To fulfill the purpose of the products and services related to you and to maintain the corresponding product and business records to respond to your possible inquiries or complaints.
To ensure the safety and quality of the services we provide to you.
whether you agree to a longer retention period.
the relevant requirements of the statute of limitations.
whether there are any other special agreements or legal regulations regarding the storage period.

After the storage period has expired, we will delete or anonymize your personal information.

Except for the following cases.

To comply with the requirements of laws and regulations regarding the retention of information.
When the period needs to be reasonably extended for financial, auditing, dispute resolution purposes, etc.

Transmission of Personal Data between Countries/Regions

As we provide our services through our servers in Mexico, which means that your personal data will be transferred to Mexico and may be accessed by logistics service providers in your country for processing activities including those described in this policy and related to your use of our services. We will comply with applicable laws regarding the transmission of personal data between countries/regions to ensure that your data is protected everywhere.

We will transmit your personal data outside of China after clearly informing you of the name and contact information of the overseas recipient, purpose and method of data processing, type of personal information, as well as the methods and procedures for exercising the rights stipulated in this policy to the overseas recipient, and obtaining your separate consent.

Personal Data of Minors

Our websites and services are primarily aimed at adults. Unless otherwise required by applicable laws, we will not collect the personal data of minors (in accordance with applicable local laws). If we are aware that we have unknowingly collected personal data of minors, we will try to delete the relevant data as soon as we receive your notification.

Requirement of Jurisdictions

In case of any conflict between the relevant provisions of this policy and the laws and regulations of specific jurisdictions, the latter shall prevail.

Applicable Provision for Residents in the European Economic Area

If you are an resident in the European Economic Area, you should be aware that other jurisdictions may not necessarily provide the same protection as the EU GDPR, however, we will comply with our direct obligations under EU GDPR while processing the personal data of residents in the European Economic Area based on applicable laws. Under this circumstance, you will enjoy the following additional rights: (i) to question our data processing based on legitimate interests; (ii) to request data migration for the personal data with your consent to automate processing; and (iii) to file a complaint to your local data protection authority.

Provision for Residents of California, the United States

If you are a resident of California, the United States, you can request a list of certain third parties to whom we have provided your identifiable personal data for their direct marketing purposes per calendar year. You need to confirm in your request your identity as a resident of California, the United States, and provide your address in California at the time. You can make a written request based on the method listed in the "Contact Us" part below. We will make a reply within fifteen (15) days.

Update Privacy Policy

If we decide to update our privacy policy, we will publish the updated one by a notice before it takes effect, so that you can be informed of any changes. Without your explicit consent, we will not impair your rights under this policy. For material changes, we will notify you of the specific changes through a pop-up window or by sending an email. Material changes as referred to in this policy include, but are not limited to:

A material change in our service model;
A change in the primary recipients of personal data sharing, transfer or public disclosure;
A material change in your rights to participate in the processing of personal data and how they are exercised;
Changes in our contact information and complaint channels;
When the Report on Assessment of Personal Data Security Impact indicates that there is a high risk;
When other circumstances arise that are material or may seriously affect your personal rights.

We will also keep an older version of this policy on file for your review.

Contact Us

We have established a dedicated team for personal data protection. For any complaints or reports about network information security, or any doubts, opinions or suggestions regarding this policy, please feel free to contact our customer service department at the following methods:

E-mail address: chery@mychery.com

Generally, we will reply to you with the handling results within fifteen (15) days. If you are not satisfied with our reply, especially if our processing of personal data causes damages to your legitimate rights and interests, and we still refuse to improve after receiving your feedback, you can file a complaint or report to the local regulatory authorities, or file a lawsuit with a court of competent jurisdiction in the defendant's location for solution.