Personal Data Processing Policy

1. General Provisions

This Personal Data Processing Policy is formulated in accordance with the requirements of the Personal Information Protection Law of the People's Republic of China, Civil Code of the People's Republic of China, Cybersecurity Law of the People's Republic of China, and Data Security Law of the People's Republic of China, and stipulates the personal data processing procedures and measures to ensure personal data security adopted by Enthalpy-Optimizing Energy Science and Technology Co., Ltd (hereinafter referred to as the "Operator").

1.1

The most important goal and condition for the Operator's activities is to respect and safeguard the rights and freedoms of individuals and citizens when processing personal data, including the right to privacy, personal and family secrets.

1.2

This policy on personal data processing of the Operator (hereinafter referred to as the "Policy") applies to all information that the Operator may obtain about visitors to the website chinapche.com.

2. Basic Concepts Used in This Policy

2.1

Automated processing of personal data – processing of personal data using computer technology.

2.2

Blocking of personal data – temporary suspension of personal data processing (except when processing is necessary to clarify personal data).

2.3

Website – a collection of graphics and materials, computer programs and databases that ensure their accessibility on the Internet at the network address chinapche.com.

2.4

Personal data information system – a collection of personal data contained in a database and the information technology and technical means that ensure their processing.

2.5

De-identification of personal data – an action that makes it impossible to determine that personal data belongs to a specific user or other personal data subject without the use of additional information.

2.6

Processing of personal data – any action (operation) or set of actions (operations) performed on personal data by automated means or non-automated means, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transmission (distribution, provision, access), de-identification, blocking, deletion and destruction of personal data.

2.7

Operator – a state organ, municipal organ, legal person or natural person who independently or jointly with others organizes and/or processes personal data, and determines the purposes of personal data processing, the content of personal data to be processed, and the operations (actions) performed on personal data.

2.8

Personal data – any information related directly or indirectly to a specific or identifiable user of the website chinapche.com.

2.9

Personal data subject to distribution with consent – personal data to which the personal data subject grants access to an unlimited circle of persons by consenting to the processing of their personal data allowed for distribution in accordance with the procedures prescribed by the Personal Information Protection Law of the People's Republic of China (hereinafter referred to as "personal data allowed for distribution").

2.10

User – any visitor to the website chinapche.com.

2.11

Provision of personal data – an action aimed at disclosing personal data to a specific person or specific group of persons.

2.12

Distribution of personal data – any action aimed at disclosing personal data to an unlimited circle of persons (transmission of personal data) or making personal data known to an unlimited circle of persons, including publishing personal data in the media, posting in information and telecommunication networks or providing access to personal data in any other way.

2.13

Cross-border transmission of personal data – transmission of personal data to the territory of a foreign state to a foreign government agency, foreign natural person or foreign legal person.

2.14

Destruction of personal data – any action that leads to the irreversible destruction of personal data and the inability to further restore its content in the personal data information system, and/or destruction of the material carrier of personal data.

3. Basic Rights and Obligations of the Operator

3.1 The Operator has the right to:

  1. Obtain true information and/or documents containing personal data from the personal data subject;
  2. If the personal data subject withdraws consent to the processing of personal data and submits a request to stop processing personal data, the Operator has the right to continue processing personal data without the subject's consent if there are grounds prescribed by the Personal Information Protection Law of the People's Republic of China;
  3. Independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations prescribed by the Personal Information Protection Law of the People's Republic of China and normative legal documents adopted thereunder, unless otherwise provided by the Personal Information Protection Law of the People's Republic of China or other laws and administrative regulations.

3.2 The Operator is obliged to:

  1. Provide information about the processing of their personal data at the request of the personal data subject;
  2. Organize the processing of personal data in accordance with the procedures prescribed by the current laws of the People's Republic of China;
  3. Respond to inquiries and requests from personal data subjects and their legal representatives in accordance with the requirements of the Personal Information Protection Law of the People's Republic of China;
  4. Provide necessary information to the departments performing personal information protection duties within 10 days from the date of receipt of such requests;
  5. Publish or otherwise ensure unrestricted access to this Personal Data Processing Policy;
  6. Adopt legal, organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution and other illegal acts;
  7. Stop the transmission (distribution, provision, access) of personal data, stop processing and destroy personal data in the circumstances and procedures prescribed by the Personal Information Protection Law of the People's Republic of China;
  8. Fulfill other obligations prescribed by the Personal Information Protection Law of the People's Republic of China.

4. Basic Rights and Obligations of Personal Data Subjects

4.1 The personal data subject has the right to:

  1. Obtain information about the processing of their personal data, except as provided by laws and administrative regulations. The information shall be provided to the subject by the Operator in an accessible form and shall not contain personal data related to other personal data subjects unless there are legitimate grounds for disclosing such personal data. The list of information and the procedure for obtaining it are prescribed by the Personal Information Protection Law of the People's Republic of China;
  2. Require the Operator to clarify, block or destroy their personal data if it is incomplete, outdated, inaccurate, illegally obtained or not necessary for the declared processing purposes, and take measures prescribed by law to protect their rights;
  3. Set conditions for prior consent when personal data is processed for the purpose of marketing goods, works and services;
  4. Withdraw consent to the processing of personal data and submit a request to stop processing personal data;
  5. Appeal to the departments performing personal information protection duties or the court against illegal acts or omissions of the Operator in processing their personal data;
  6. Exercise other rights prescribed by the laws of the People's Republic of China.

4.2 The personal data subject is obliged to:

  1. Provide true data about themselves to the Operator;
  2. Notify the Operator of the clarification (updating, change) of their personal data.

4.3

Persons who provide false information about themselves to the Operator or provide information about other personal data subjects without the latter's consent shall be liable in accordance with the laws of the People's Republic of China.

5. Principles of Personal Data Processing

  1. Personal data processing shall be conducted on a legal and fair basis.
  2. Personal data processing shall be limited to the achievement of specific, predetermined and legitimate purposes. Processing of personal data incompatible with the purposes for which personal data is collected is not allowed.
  3. Merging of databases containing personal data processed for incompatible purposes is not allowed.
  4. Only personal data that meets the purposes of their processing shall be processed.
  5. The content and scope of processed personal data shall be consistent with the declared processing purposes. Processing of personal data that is excessive in relation to their declared processing purposes is not allowed.
  6. When processing personal data, ensure the accuracy, sufficiency and, if necessary, timeliness of personal data in relation to the processing purposes. The Operator shall take necessary measures and/or ensure that such measures are taken to delete or clarify incomplete or inaccurate data.
  7. Personal data shall be stored in a form that allows identification of the personal data subject for no longer than is necessary for the purposes of personal data processing, unless the storage period is prescribed by laws, administrative regulations or contracts (to which the personal data subject is a party, beneficiary or guarantor). Processed personal data shall be destroyed or de-identified when the processing purposes are achieved or when the necessity to achieve these purposes ceases to exist, unless otherwise provided by laws and administrative regulations.

6. Purposes of Personal Data Processing

Processing purpose: To inform users by sending emails.

Personal data: Surname, given name, patronymic; email address; telephone number.

Legal basis: The articles of association (incorporation documents) of the Operator.

Types of personal data processing: Collection, recording, systematization, accumulation, storage, destruction and de-identification of personal data; sending information emails to email addresses.

7. Conditions for Personal Data Processing

  1. Personal data processing is carried out with the consent of the personal data subject to the processing of their personal data.
  2. Personal data processing is necessary to achieve the purposes prescribed by international treaties or laws of the People's Republic of China, or to perform the functions, powers and obligations conferred on the Operator by the laws of the People's Republic of China.
  3. Personal data processing is necessary for the exercise of judicial power, the execution of judicial documents, and other documents that must be executed by institutions or officials in accordance with the enforcement procedure laws of the People's Republic of China.
  4. Personal data processing is necessary for the performance of a contract to which the personal data subject is a party, beneficiary or guarantor, as well as for the conclusion of a contract at the initiative of the personal data subject or a contract under which the personal data subject will be a beneficiary or guarantor.
  5. Personal data processing is necessary to realize the rights and legitimate interests of the Operator or third parties, or to achieve socially important purposes, provided that the rights and freedoms of the personal data subject are not infringed.
  6. Processing of personal data that the personal data subject or at their request (hereinafter referred to as "public personal data") makes accessible to an unlimited circle of persons.
  7. Processing of personal data that must be published or compulsorily disclosed in accordance with laws and administrative regulations.

8. Procedures for Collection, Storage, Transmission and Other Types of Personal Data Processing

The security of personal data processed by the Operator is ensured by the implementation of legal, organizational and technical measures to fully comply with the requirements of current legislation in the field of personal data protection.

8.1

The Operator ensures the security of personal data and takes all possible measures to exclude access to personal data by unauthorized persons.

8.2

The personal data of users shall in no case be transmitted to third parties, except in cases related to the enforcement of current laws of the People's Republic of China, or if the personal data subject has consented to the Operator's transmission of data to third parties to fulfill civil law contractual obligations.

8.3

If personal data is found to be inaccurate, the user may update it independently by sending a notification marked "Personal Data Update" to the Operator's email address sales@chinapche.cn.

8.4

The processing period of personal data is determined by the achievement of the purpose for which the personal data was collected, unless another period is prescribed by the contract or current laws.

The user may withdraw their consent to the processing of personal data at any time by sending a notification marked "Withdrawal of Consent to Personal Data Processing" to the Operator's email address sales@chinapche.cn.

8.5

All information collected by third-party services (including payment systems, communication means and other service providers) is stored and processed by the aforementioned persons in accordance with their user agreements and privacy policies. The personal data subject is obliged to review these documents. The Operator shall not be liable for the actions of third parties, including the service providers specified in this clause.

8.6

The prohibition set by the personal data subject on the transmission (except for provision of access) and processing or processing conditions (except for obtaining access) of personal data allowed for distribution shall not apply to the processing of personal data in cases of national, public and other public interests prescribed by the laws of the People's Republic of China.

8.7

The Operator ensures the confidentiality of personal data when processing it.

8.8

The Operator stores personal data in a form that allows identification of the personal data subject for no longer than is necessary for the purposes of personal data processing, unless the storage period is prescribed by laws, administrative regulations or contracts (to which the personal data subject is a party, beneficiary or guarantor).

8.9

The conditions for terminating personal data processing may be the achievement of the purpose of personal data processing, the expiration of the validity period of the personal data subject's consent, the subject's withdrawal of consent or request to stop processing personal data, and the discovery of illegal processing of personal data.

9. List of Operations Performed by the Operator on Obtained Personal Data

9.1

The Operator performs collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transmission (distribution, provision, access), de-identification, blocking, deletion and destruction of personal data.

9.2

The Operator performs automated processing of personal data by receiving and/or transmitting the obtained information through information and telecommunication networks or without using networks.

10. Cross-border Transmission of Personal Data

10.1

Where the Operator provides personal data abroad, it shall comply with the provisions of the Personal Information Protection Law of the People's Republic of China and relevant laws and regulations, and meet one of the following conditions:(1) Passing a security assessment in accordance with the provisions of the Cyberspace Administration of China;(2) Undergoing personal information protection certification by a professional institution in accordance with the provisions of the Cyberspace Administration of China;(3) Concluding a contract with the overseas recipient in accordance with the standard contract formulated by the Cyberspace Administration of China, agreeing on the rights and obligations of both parties;(4) Other conditions prescribed by laws, administrative regulations or the Cyberspace Administration of China.

10.2

Where the Operator provides personal data abroad, it shall inform the personal data subject of the name or title, contact information, processing purpose, processing method, types of personal data of the overseas recipient, as well as the ways and procedures for the personal data subject to exercise the rights prescribed by this Law against the overseas recipient, and obtain the separate consent of the personal data subject. Where laws and administrative regulations provide otherwise, such provisions shall prevail.

11. Confidentiality of Personal Data

The Operator and other persons who have access to personal data must not disclose or distribute personal data to third parties without the consent of the personal data subject, unless otherwise provided by laws and administrative regulations.

12. Final Provisions

12.1

Users may contact the Operator by email at sales@chinapche.cn to obtain any explanations on issues of interest regarding the processing of their personal data.

12.2

This document will reflect any changes to the Operator's personal data processing policy. The policy shall remain in effect for a long time until it is replaced by a new version.

12.3

The current version of the policy is freely available on the Internet at: chinapche.com/privacy-cn.php.