COMPANY PRIVACY POLICY

We pay full attention to your privacy. Please read over the Privacy Policy because it contains who we are and the methods by which and reasons why we collect, store, use and share your personal information. It also explains your rights for personal information and how to contact us or the supervisory authority when you complain.

I. Core Terms

We, Yutong Bus Co., Ltd. and its global affiliates (hereinafter referred to as “Yutong” or “we”) collect, use and are responsible for your personal information. Our behaviors are governed by the Chinese laws and other applicable laws. In accordance the specific condition and the provisions of relevant laws, as the “controller” or “processor” of information, we are responsible for and protect these personal information.

We will use your personal information according to needs so that we can provide you services, contact with you and conduct research and investigation to improve our services, and use it for compliance, supervision and law as well as other purposes stated in Section III.

For the purposes stated in the Privacy Policy, we will share your personal information with our affiliates and authorized partners, and share the information with other parties including government organs and/or enforcement officials according to the requirements of applicable laws. Please refer to Section IV for details.

If we can act only with your consent, for example, for the purpose of marketing or providing the right of access to your personal information for a third party, you may withdraw the consent at any time.

Our Privacy Policy stipulates more details about such processing method, including the details of your personal information protection right, and the right to refuse some processing activities implemented by Yutong. For more information on your rights and how to exercise these rights, please refer to “Your Rights” in Section IX.

II. Personal Information Collected by us and How do we Collect

Personal information refers to all kinds of information which is recorded in electronic or other methods or related to the identified or identifiable natural persons, but excluding anonymized information. In the process of purchasing our products or services, we may collect your personal information. You have no obligation to provide us with any personal information. Whether to provide us with personal information is up to you. However, please note that we may not be able to bear some or all of the obligations to you, or provide all our services for you or respond to or resolve the problems that you encounter without some of your information.

1. Yutong APP or Yutong website

While you register an account or log in the website, you need to provide us with your personal information: company name (required), company address (required), name (required), sex (required), position, tel./ mobile phone (required), e-mail (required), passport number/ ID card number (only involving customs clearance in the customer’s personal name), date of birth.

2. Sale of products/ services

While you conduct commercial communication, exchange business cards, sign sales contracts, distribution contracts, KD contracts, MoU and other agreements with us, to better perform the contracts and provide you with better services, we may collect your following personal information: company name, company address, name, sex, position, tel., mobile phone and E-mail.

3. Handling the Invitation Letter for you

When you are invited to visit Yutong, in order to help you handle the Invitation Letter with the Henan Provincial Department of Business, we will collect your personal information as follows: name, sex, passport number/ ID card number, date of birth, nationality and past visa information.

4. Using Yutong Bus products or services

When using vehicle maintenance services and after-sale services, we will collect your personal information below: vehicle owner name, vehicle owner phone number, vehicle owner E-mail; repair man’s name and repair man’s phone number.

Collect vehicle parameter related information through V+ system (including components such as vehicle sensing equipment, vehicle application platform, vehicle SIM card service, etc.): including vehicle VIN and vehicle number data, vehicle mileage parameters, vehicle dynamics parameters, vehicle operation process parameters, vehicle battery status parameters, vehicle AC system operation status parameters and other data. The aforesaid data is only used for vehicle operation status monitoring and quality analysis and cannot be associated with your personal information.

5. Job wanted

When applying for our jobs through Yutong website, APP or a third-party recruiting website, we will collect your personal information below as the reference information for recruitment or conduct background investigation, including name, sex, date of birth, E-mail address, mobile phone number and work experience.

When you sign the Labor Contract with us, we will collect your personal information below as the reference information for recruitment, including name, phone number, nationality, local country, sex, ID card number (or passport number), family address, work experience, qualification certificate, emergency contact’s name, emergency contact’s phone number and salary.

6. Supplier/ Service provider provides services

When you register the supplier’s qualification or sign the Service Procurement Contract with us through the Yutong website, we will collect your personal information below to perform the Contract or conduct background investigation, including name, sex, date of birth, ID card number (or passport number), contact address, practicing qualification, E-mail address and mobile phone number.

When you sign the Service Authorization Contract and After-sale Agreement with us, in order to better perform the Contract, we will collect your personal information below: company name, company address, contact name, position, telephone, E-mail, service station personnel’s name, and service station personnel’s salary.

7. Customer return visit

Personnel information collected in the customer’s return visit business process, including: name, phone number, whatsApp, customer needs and return visit result; personal information collected in the process of accepting the customer’s active consultation, including name, phone number, E-mail and customer needs.

8. Financing service

When applying for the financing service, you may need to provide us your personal information below: bank statements, housing information, vehicle information, credit information, detailed property condition and debt condition.

9. Third-party source information and public information

Permitted by law, we will acquire relevant information from public and commercial third parties or public sources, for example, acquiring the information of Yutong’s customers from suppliers, deals and service providers, including customer name, company address, contact name, position, phone number and E-mail.

To find an international supplier, Yutong Bus will obtain the contact information (name, phone number and E-mail) of the business party through the supplier’s official website for negotiations on daily purchase price, contract signing, quality issue settlement, marketing and other business cooperation.

III. Purpose for which we Use Personal Information

1. Communicating and interacting with you

(1) Informing you of important safety related information of vehicles or new energy products;

(2) Informing service personnel where the vehicle has a fault or an accident;

(3) Sending information of products, services, terms and policies and changes to you;

(4) Informing you of our marketing activities;

(5) For internal management and backstage support, share your contact information with branches of companies around the world.

2. Providing products and services for you

(1) Realizing our order: processing payment, delivery and evaluating your financing needs;

(2) Monitoring vehicle performance;

(3) Road rescue, care and maintenance and other after-sale services.

3. Verifying the reasons for accidents

When a vehicle has an accident, position the vehicle and verify the reasons for the accident and the status of the vehicle.

4. Legal requirements and legal procedures

For purposes required in laws and regulations, court orders or other legal procedures, or competent government organs, including the government collection/monitoring platform monitors the relevant data of the vehicles in order to access to new energy vehicle data.

5. Improving and strengthening the development of our products and services

(1) Product system upgrade;

(2) Satisfaction degree investigation;

(3) Analyzing and improving product performance, R&D and new technology related to the products.

6. Information flow analysis

When you access to Yutong relevant website or use the services provided by Yutong, we may identify your identity through small-scale data documents. These data documents could be Cookies, Flash Cookies or your browser or other local storage provided by associated applications (collectively referred to as “Cookies”). We use Cookies to analyze the information flow, customize services, contents and ads, evaluate the promotion effect and promote trust and security. Please refer to the Cookie policy for details.

IV. Our Sharing of Personal Information

We will strictly keep confidential your personal information. We will not share relevant information with a third party without your consent except for the following scenarios:

•In order to facilitate us to provide you with services on the basis of Yutong’s OCRM system and manage your personal information and transaction behaviors, your personal information may be shared between Yutong’s affiliates;

•Third parties which help provide products and/or services to you, such as deals, service providers;

•Other third parties which help us carry on business and conduct market investigations, for example, marketing institutions, satisfaction degree investigation institutions;

•Credit reference institutions;

•Banks we cooperate.

In addition to the aforesaid relevant authorized partners, if required, we may share your personal information with government competent departments and/or executive institutions at request to abide by mandatory requirements of laws and regulations, court orders or requirements of government authorities and safeguard the public interest of society, or use it for other purposes reasonably necessary to protect the personal and property safety or legal rights and interests of our customers, Yutong or Yutong’s employees. When a merger, acquisition or bankruptcy liquidation results in the sale of one of our businesses or integration with other businesses, your information will be disclosed to our counselor or the counselor of any potential buyer and delivered to the new owner of business.

We will only share the personal information necessary to provide you with services and be constrained by the purposes stated in the Privacy Policy. If the authorized partner intends to change the processing purpose of personal information, your authorized consent will be solicited again. You may withdraw your consent at any time. Your personal information will no longer be shared with these authorized partners.

Under the circumstance where we have evaluated the protective measures taken by the authorized partners for personal information and consider that their data protection measures are enough to guarantee information security, we allow them to process your personal information. When you access the service of the authorized partners, they will also display their privacy policy in view of collecting and using your personal information and obtain your consent in advance. We are unable to obtain any of your personal information which they may directly process. We also impose contractual obligations and confidentiality obligations on authorized partners to ensure that they can only use your personal information which we provide them to serve you and us. Once any partner is discovered to violate the contractual provisions, we will take effective measures till the cooperation is terminated.

V. Storage of Personal Information

We store the vehicle end information of domestic vehicles and overseas non-EU region vehicle end data in the IDC machine room (private cloud)/ Alibaba public cloud operated by our company. Personal information collected and generated within China is stored in China; the vehicle end information in overseas EU region will be stored in our server in Frankfurt, Germany. Customer information and employee information will be stored in the system of Yutong headquarters and the system of the aforesaid authorized partner.

No matter where our server is located, we will take proper organization and safety measures to protect your rights and the security of your personal information according to the Privacy Policy. For example, we will use encryption techniques and protection mechanism to prevent information disclosure; ensure that only a few authorized personnel can access the personal information; and we will hold privacy protection training courses to strengthen employees’ understanding of the importance of protecting personal information. We will try to protect your personal information. However, please note that any security measures cannot be impeccable.

VI. Retention Time of your Personal Information

When you have the account of our website or we provide products and/or services, we will reserve your personal information. Hereafter, we will reserve your personal information when necessary:

•Responding to any questions, complaints or claims to you;

•Recommending marketing information and materials to you;

•Improving product performance and satisfaction degree investigations;

•Keeping records required by law;

•Solving vehicle operation faults and maintenance information.

For the purpose stipulated in the Policy, we will not keep your personal information longer than necessary unless the retention period needs to be extended or we are permitted by law. Different retention durations are applicable to different types of personal information. When the retention period expires, we will completely delete or anonymize your relevant data in the system to ensure that the data cannot be restored or traced to you.

Despite of this provision, we may reserve your personal information to assist in any government and judicial investigation and use it to file legal claims or civil, criminal or administrative litigation or provide support for that.

VII. Transfer your Personal Information abroad

In order to provide services to you, we sometimes need to share your personal information outside your country, for example:

•Our offices, branches and subsidiaries and affiliates all over the world;

•Service providers outside your local country;

Note: The cross-border transfer of personal data in the European Economic Area (EEA) is subject to the special provisions of the EU Regulation No. 679/679/EU dated April 27, 2016 on the protection of personal data and the free movement of such data. Yutong promises, where applicable, at the time of processing outside the original collection or hosting area, to ensure that the transfer of all personal data is constrained by relevant guarantee measures to keep full protection of personal data (in particular, standard contract clauses, binding company rules, and, where appropriate, to analyze the influence and ability of third country legislation to ensure the validity of the rights of data subjects), and to obtain any relevant consent, authorization or permission (if applicable) of the data subjects or competent regulatory institutions.

VIII. Data Processing Records

Yutong’s system maintains necessary data sharing, transfer and processing records. The content includes third party information, disclosed information, disclosure time, etc. The aforesaid content is generated by our software during data processing. Records are generally made in electronic form. Based on the requirements of the regulatory institutions, as the controller or processor and when necessary, we may provide data processing records that are available.

IX. Your Rights

You may enjoy the following rights free of charge:

Data access right	If you want to access your website or account information, order information, vehicle use data and other information, you may contact us according to the methods listed in the "Contact Us" section below to access your personal information.
Correction right	When you find that your personal information we processed is wrong, after verification of your identity and with correction not affecting the objectiveness and accuracy of information, you have the right to correct or update the wrong or incomplete information. You may contact us according to the methods listed in the "Contact Us" section below.
Right to be forgotten	If we collect, use or share your personal information with others in violation of laws and regulations or your agreements, you have the right to require us to delete. You may contact us according to the methods listed in the "Contact Us" section below.
Limited processing right	In some cases, you may limit us from processing your personal information. If you object to the marking of stored personal information to limit the processing behavior of the information, please contact us according to the methods listed in the "Contact Us" section below.
Data portability	In some cases, you have the right to receive the personal information you provide us and/or transfer the information to a third party in a structured, commonly used and machine-readable form. If you have such request, please contact us according to the methods listed in the "Contact Us" section below.
Right to oppose	You have the right to refuse: —To process (including analyzing) your personal information at any time for the purpose of marketing; —In other cases, we will continue analyzing your personal information for our legal interests.
Self-determination (independent personal decision-making)	You have the right to be not subject to a decision to rely solely on (including analysis) automated processing. If you object to automatic decision-making of your personal information, you may give us feedback through “Contact Us” below.

If you want to exercise any of these rights, please conduct through the following means:

•Sending E-mail, making phone calls or writing letters – see below “How to contact us”;

•Telling us the rights you would like to exercise and the personal information involved in the request.

X. Responding to Your Requirements Aforesaid

To guarantee your information security, we will first require you to verify your identity and then process your request. Generally, we will accept your request fed back via E-mail within 7 working days and your request fed back via telephone within 5 working days. We will process your legitimate request within 15 working days after accepting and may give you feedback on the results of the processing via telephone, E-mail and other channels.

For your reasonable request, we do not charge fees in principle. However, in view of repeated requests exceeding the reasonable limit, we will charge a certain cost as appropriate. In terms of those unreasonably repeated requests that require too many technical means (for example, the need to develop new systems or fundamentally change existing practices), bring risks to the legitimate rights and interests of others, or are very unrealistic requests (for example, involving information stored on backup tapes), we may refuse.

In the following cases, we are unable to respond to your request:

1. Related to personal information controllers fulfilling obligations stipulated by laws and regulations;

2. Directly related to national security and national defense security;

3. Directly related to public safety, public health, and major public interests;

4. Directly related to criminal investigation, prosecution, trial and execution of judgments;

5. The personal information controller has sufficient evidence to show that the personal information subject has subjective malice or abuses of rights;

6. It is for the purpose of protecting the life, property and other major legitimate rights and interests of the personal information subject or other individuals, but it is difficult to obtain the consent of the person;

7. The response to the request of the personal information subject will cause serious damage to the lawful rights and interests of the personal information subject or other individuals or organizations;

8. Involving business secrets.

XI. Guaranteeing the Security of Personal Information

We will take all proper organization, management and technical measures to protect your personal information security in the links of collection, transmission, storage, use, sharing and disclosure, destruction, etc. We have established an information security management organization to build and improve the information security management system and privacy security management system, and take necessary technical measures to effectively protect the life cycle security of your personal information. We also have formulated the procedures for processing any suspicious data security holes. We will inform you and the corresponding regulatory institutions of the suspicious situations of data security holes.

XII. Processing Minors’ Personal Information

Except applicable legal requirements, we will not knowingly collect minors’ (according to legal provisions of each country) personal information. Minors are not allowed to provide us with their personal information without the consent of their guardian.

If we discover that we have collected minors’ personal information without a verifiable parent or guardian’s prior consent, we will manage to delete relevant data as soon as possible. If the parent or guardian has a reason to believe that minors provide their personal information to Yutong without their prior consent, please contact us to ensure to delete such personal information and guarantee that minors cancel ordering any applicable Yutong products and services.

XIII. Jurisdiction

If the relevant provisions of the Privacy Policy conflict with the laws and regulations in the specific jurisdiction, the latter shall prevail.

XIV. Changes in Privacy Policy

The privacy statement was issued on May 30, 2019 and finally updated on November 28, 2021.

We may modify the Privacy Policy from time to time- we will publish it on the website https://en.yutong.com/privacy/ at that time. We may also send a change notice via different channels, for example, sending a separate notice to you via E-mail.

XV. Exceptions

Information collected by third party services (including any third party websites) accessed through our services is inapplicable to the Privacy Policy. Please refer to the privacy policies of third parties before submitting personal information to them.

XVI. How to Contact us

If you have any doubt about the Privacy Policy or the information on you we hold, or claim your above-mentioned legal rights and interests, please contact us via mailing letters, E-mail or making phone calls.

Our contact information

Address: Yutong Industrial Park, Shibalihe, Zhengzhou City, Henan Province, China E-mail: dataprotection@yutong.com TEL: 0086-371-66718999