KDDI Beijing Privacy Policy

KDDI CHINA CORPORATION (hereinafter referred to as "we" or "KDDI Beijing") attaches great importance to your personal information and privacy protection. KDDI Beijing will provide corresponding security measures for your personal information in accordance with legal requirements. Please read and understand this privacy policy (hereinafter referred to as "this privacy policy") carefully before submitting personal information to KDDI Beijing.

This privacy policy explains How KDDI Beijing processes your personal information, but some projects involving trade secrets or projects that customers and suppliers have special requirements for personal information and privacy protection may be notified or supplemented by KDDI Beijing in the form of a dedicated privacy notice or privacy notice.

You can more easily confirm the details of this privacy policy by indexing

• Personal information: refers to various information related to identified or identifiable natural persons recorded electronically or other means, excluding anonymized information.
• Sensitive personal information refers to personal information that, once leaked or illegally used, can easily cause infringement of the personal dignity of natural persons or harm to personal and property safety, including biometric identification, religious beliefs, specific identities, medical and health care, financial accounts, travel trajectories, and other information, as well as personal information of minors under the age of fourteen. We will bold and underline sensitive personal information in this privacy policy to remind you to pay special attention.
• KDDI Beijing customers refers to natural persons or units that have signed contracts with KDDI Beijing to purchase products or services from KDDI Beijing, hereinafter referred to as "customers".
• Supplier of KDDI Beijing: refers to a natural person or unit that has signed a contract with KDDI Beijing to provide products or services to KDDI Beijing, hereinafter referred to as "supplier".
• Your (or) contact person refers to KDDI Beijing's supplier or customer, or any other third-party employee, related business contact personnel, and other relevant personnel who collect and use their personal information in KDDI Beijing.

This privacy policy applies to KDDI Beijing's collection and use of your personal information in the following scenarios:

（1）Business contact and business negotiation

KDDI Beijing collects personal information such as the names, positions, work units, phone numbers, contact email addresses, and other personal information provided by customers, suppliers, or other units through WeChat, phone calls, and email for business contacts and business negotiations with customers, suppliers, or any other units.

（2）Supplier registration and management

KDDI Beijing collects personal information such as the name, phone number, email, work unit, and work unit address information of the contact person provided by the supplier through email, phone, and WeChat for supplier registration management. KDDI Beijing will register the personal information of the contact person with the supplier's relevant information in KDDI Beijing's supplier management system for contact with suppliers and annual supplier qualification review.

（3）Data center visit management

KDDI Beijing collects personal information such as name, ID number (passport number), fingerprint information, and vein provided by data center visitors through WeChat, phone, email, and on-site access management to ensure the security and order of data centers, confirm the identity of visitors, safeguard their legitimate rights and interests, and conduct visits. KDDI Beijing will provide the personal information of visitors to KDDI's data center maintainer Beijing Asia-Pacific Zhongli Information Technology Co., Ltd. or VNET Group Limited For admission registration.

（4）Company visit management

In order ensure the safety and order of KDDI Beijing's office space, confirm the identity of visitors, safeguard the legitimate rights and interests of visitors, conduct visits and visit management, KDDI Beijing will collect personal information such as name, telephone number, e-mail, work unit and work unit address provided by visitors through WeChat, telephone, email and on-site. In general, facial information of visitors is not collected, and if facial information is collected, the visitor's consent will be obtained separately.

（5）Management of corporate activities such as seminars

To invite you to participate in seminars and other events organized by KDDI Beijing, we will send you meeting invitation materials containing a QR code for the“SOJUMP”(an online survey application) via offline means or email. The personal information you provide, such as company name, name, position, phone number, and email address, by responding to an email or scanning a QR code, will be used for registration for events such as seminars, venue arrangement, security at the event site, protection of your rights and interests, access management, and application procedures for entry.

KDDI Beijing will also collect business cards provided by you during events such as seminars. These business cards contain personal information such as the company name, your name, phone number, position, email address, and work location, which will be used for contacting you, communicating with you, and conducting business discussions.

（6）Procurement Management

When KDDI Beijing sells products or services to customers, it collects personal information such as the name, contact phone number, email address, etc. of the customer's contact person provided by email or phone for business contact. KDDI Beijing will provide the personal information of the customer contact person to third parties such as KDDI Beijing's suppliers based on the specific situation of the project but will obtain the consent of the contact person in advance.

When purchasing products or services from suppliers, KDDI Beijing collects personal information such as the name, phone number, email address, etc. of the supplier's contact person provided by the supplier through email or phone for business contact. After the procurement is completed, KDDI Beijing will also collect personal information such as the name, contact phone number, email address, etc. of the technical after-sales contact provided by the supplier through email or telephone from the supplier for after-sales service contact.

（7）Signing contract business communication

When KDDI Beijing signs a contract with a customer, it collects personal information such as the name, position, phone number, email, etc. of the customer contact person provided by the customer through email, phone, and WeChat, for communication related to signing the contract.

When KDDI Beijing signs a contract with a supplier, it will collect personal information such as the name, phone number, position, email address, and work unit address of the contact person provided by the supplier through email, phone, and WeChat, for relevant communication in signing the contract.

When KDDI Beijing signs contracts with other third parties, it collects personal information such as the name, position, phone number, email address, and work unit of the contact person provided by the third party through email, phone, and WeChat, for relevant communication in signing contracts.

（8）Performance of the contract

When KDDI Beijing provides products or services to customers in accordance with the contract, it collects personal information such as the name, position, phone number, email, etc. of the project, business, and after-sales contact provided by the customer through email, phone, and WeChat for business contact. KDDI Beijing will provide personal information of customer projects, business, and after-sales contacts to product manufacturers or suppliers from KDDI Beijing and other third parties according to project needs but will obtain the consent of the customer contact in advance.

When KDDI Beijing provides products or services to customers, it will collect personal information such as the names, positions, phone numbers, email addresses, and work unit addresses of contact persons or service personnel (referred to as "relevant personnel") who provide product delivery, installation services, after-sales, service provision, maintenance, after-sales, etc. provided by KDDI suppliers or product manufacturers through email, phone, WeChat, etc. for business contact. KDDI Beijing will provide personal information of relevant personnel to customers according to project needs but will obtain the consent of relevant personnel in advance.

（9）Software and system development services

In order to provide customers with related services such as system or software development, operation, maintenance, upgrade, and management in accordance with the contract, KDDI Beijing collects personal information such as the names, positions, phone numbers, and email addresses of service personnel provided by suppliers through email and telephone, for business communication related to fault upgrading and quality improvement to suppliers after circuit opening.

In order to provide customers with related services such as system or software development, operation, maintenance, upgrade, and management in accordance with the contract, KDDI Beijing collects personal information such as the names, phone numbers, positions, email addresses, and work unit addresses of customer employees provided by customers through email, phone, customer system, or through public channels; Collect personal information such as the name, position, phone number, email address, etc. of the service personnel of the software information service provider for upgrading office computer software; Software maintenance; Remote operation and maintenance contact, etc.

（10）400 hotline service

In order to accurately grasp the repair or consultation content of customer system faults, KDDI Beijing uses "TIANRUN RONGTONG customer contact cloud system" (hereinafter referred to as "CTI system") provided by Beijing TIANRUN RONGTONG technology co., ltd. to provide customers with 400 hotline services, count incoming calls and record call contents, so as to trace problems and improve service experience. KDDI Beijing will collect fault report registration phone numbers (including mobile phone numbers) provided by customers. When you use our after-sales service 400 hotline service, with your consent, our company will activate the recording function to record your call content. At the same time, we will collect your name, affiliate, phone number, hotline records, and call recording through the CTI system to reply to incoming calls, question backtracking, etc. If you do not agree to the recording, we will not be able to provide you with 400 hotline service, you can contact our company by email and other means of after-sales service. please confirm the personal information protection policy of Beijing TIANRUN RONGTONG technology co., ltd. regarding the CTI system: website.

（11）Financial and tax treatment

In its business dealings with customers, suppliers, or any other third party, KDDI Beijing collects personal information such as the names and email addresses of financial personnel provided by customers, suppliers, or other third parties through email and contracts for payment and invoicing communication in accordance with contract and legal provisions.

（12）Acceptance of services

When receiving system development services, security, cleaning, transportation, banking, finance and taxation, auditing, legal services, and other services, KDDI Beijing collects personal information such as the name, work unit address, phone number, email address, etc. of the service personnel for business contact.

（13）Recruitment information

In order to recruit employees, KDDI Beijing obtains personal information such as the name, gender, age, date of birth, nationality, household registration, contact telephone number, e-mail address, address, educational background, professional background, marriage status, foreign language ability and certificate information of the applicant from headhunting companies such as Beijing progress consulting services co., ltd., Beijing Guying Technology Consulting Services Co., Ltd. RGF Human Resource Consulting Shanghai Co.,Ltd. and ZHIAN WANGPIN Information Technology Co., Ltd. Beijing Branch for contacting you; Understand your basic situation, educational background, and professional background; Evaluate your compliance with the position.

（14）Customer satisfaction survey

KDDI Beijing will collect personal information such as the name, unit name, and email address of customer contacts from customers who agree to participate in customer satisfaction surveys for customer satisfaction surveys.

Cookies are data files composed of text and numbers stored on computers or mobile devices. When you visit KDDI China 's website (referred to as "website" or "our website" and "KDDI China website"), we collect relevant data about your visit and access to the website through cookies to improve your user experience and improve our website. We use the following types of cookies:

• The first type of essential cookies

These cookies are used to store session information and perform the activities required to run the website (e.g., NW traffic balancing). These cookies are temporary and disappear when you close your browser.

• The second type of analytical cookies

These cookies collect data about How you use the website (for example, the number of users and How users visit the website), helping to improve the operation of the website. For example, we can analyze whether users can easily find the content they are looking for and collect error information that users may encounter.

• The third type of functional class

If you return to our website from other sites in the same browser, these cookies can identify you. These cookies collect information about your preferences,（such as the region and language of your choice）and are used to improve your website browsing experience. It can also record the content of KDDI related policies and declarations you view to prevent duplicate pop-up.

Third party or third-party websites that work with KDDI China websites may use cookies from KDDI China websites. Our ad publishers may use cookies from our website, access data, our identifiers, and your interests and preferences to push your ads you may be interested in.

You can click on the "Cookie settings" icon on our website in the browser to set refusal to use cookies or to refuse to use cookies other than necessary cookies. The website will stop using cookies or certain types of cookies according to your settings, stop providing cookies to third parties, pushing advertisements, etc. If you stop using cookies, you may not be able to use all or part of the functions of KDDI China website.

For more detailed Policy content on cookies on KDDI China website, please confirm Cookie Policy.

（1）Entrusted processing

Within the scope of the purposes described in part II of this privacy policy, we may entrust a third party (hereinafter referred to as the "trustee") to assist us in providing you with the services and scenarios described in part II of this privacy policy. We will sign a personal information protection agreement with the trustee, and the confidentiality agreement clarifies the protection obligations of us and the trustee for your personal information. We will agree with the trustee in relevant agreements on the purpose, deadline, processing method, type of personal information, protective measures, rights and obligations of both parties, and supervise the trustee's personal information processing activities. We will also require the trustee to take necessary technical and management measures for personal information protection in strict accordance with applicable laws and regulations, industry norms, this privacy policy, and our requirements.

In the 400 hotline service scenario, our company collects your personal information through a third-party CTI system. We need to share your name, affiliate, phone number, hotline records, call recording and other personal information with the system supplier "Beijing TIANRUN RONGTONG technology co., ltd." and entrust it to process your personal information within the scope of 400 hotline services. In order to ensure your data security and privacy, our company has signed a data processing agreement with Beijing TIANRUN RONGTONG technology co., ltd., clarifying the supplier's responsibility, obligations, and requirements for protecting your data. Regarding how the supplier processes your personal information, you can visit the supplier's official website for privacy statement review. If you have any questions, call the supplier for consultation at 1010-9099.

（2）Provision

We will not provide your personal information to any third party unless you have your separate consent. If it is necessary to provide your personal information to a third party (referred to as "recipient" in this item), we will inform you of the recipient's name or name, contact information, processing purpose, processing method, and type of personal information, and obtain your separate consent. At the same time, we will sign a personal information protection agreement with the recipient, which clarifies our and the recipient's obligation to protect personal information. We will also require the recipient to take necessary technical and management measures for personal information protection in strict accordance with applicable laws and regulations, industry norms, this privacy policy, and our requirements.

（3）Transfer

In principle, we will not transfer your personal information. If KDDI Beijing needs to transfer your personal information due to merger, division, dissolution, bankruptcy, and other reasons, it will inform you of the recipient's name, name, and contact information. We will require the recipient to continue fulfilling its obligations as a personal information processor.

（4）Public disclosure

1) We will not publicly disclose your personal information unless you have your prior consent.
2) public disclosure based on law or reasonable basis: if required by laws, legal procedures, litigation, or public and government authorities, our company may publicly disclose your information.

（5）Providing, transferring, or publicly disclosing personal information without obtaining your separate consent

In the following situations, we do not need to obtain your authorization and consent in advance to entrust the processing, provision, or public disclosure of your personal information:

1) Related to KDDI Beijing's performance of its obligations under laws and regulations.
2) Directly related to national security and national defense security.
3) Directly related to public safety, public health, and major public interests.
4) Directly related to criminal investigation, prosecution, trial, and judgment execution.
5) In order to safeguard the significant legitimate rights and interests of your or other individuals, such as life and property, it is difficult to obtain your authorization and consent.
6) Personal information you disclose to the public on your own.
7) Collecting your personal information from legally publicly disclosed information, such as legal news reports, government information disclosure, and other channels. 

（1）KDDI Beijing has a dedicated data security management Committee responsible for the company's network security, data security, and personal information security protection management work; At the same time, we have built a complete data security management system; We properly manage the entire cycle stage of the processing of personal information you provide.

（2）We regularly provide safety education and training to personal information related practitioners; We have formulated and implemented emergency plans for personal information security incidents; We regularly conduct compliance audits on personal information processing activities.

（3）We have used security measures that comply with industry standards to protect the personal information you provide, preventing unauthorized access, public disclosure, use, modification, damage, or loss of data. The security measures we have taken, and our data security capabilities include but are not limited to:

1) Multiple data encryption protection measures have been taken, such as file storage server encryption system and email attachment encryption system.
2) In accordance with the requirements of relevant national laws and regulations, the obligation of information system level protection has been implemented. All systems that need to handle level protection filing have already processed relevant filing.
3) Using antivirus software with terminal detection (EDR) function, firewalls are deployed to key nodes to prevent network intrusion.
4) Personal information processing related systems are limited to login permissions for AD connections within the company, and ID password authentication and terminal restrictions are implemented. only authorized terminals and authorized users can log in.
5) Personal information processing related systems are guaranteed through institutional mechanisms in accordance with the three levels of information system security level protection; https protocol and SSL encryption protocol are used for data transmission.

（4）We will take all reasonable and feasible measures to ensure that unrelated personal information is not collected. We will only retain your personal information for the period required to achieve the purposes stated in this privacy policy, unless an extension of the retention period is required or is permitted by law.

In the 400 hotline service scenario, your name, affiliate, and phone number will be encrypted and stored in our company and Beijing TIANRUN RONGTONG technology co., ltd.'s servers. If our company or Beijing TIANRUN RONGTONG technology co., ltd. are not allowed to use your personal information mentioned above, please request the deletion of personal information by calling our fixed line at + 86-10-85325800 or sending an email to 400-user@kddi.com.cn. Your hotline records and call recordings will be encrypted and stored in the server of Beijing TIANRUN RONGTONG technology co., ltd., and will be kept for 24 months from the date of your last contact with our company.

（5）The internet environment is not 100% secure, and we will try our best to protect the security of your personal information. If our physical, technical, or management protection facilities are damaged, resulting in unauthorized access, public disclosure, tampering, or destruction of information, resulting in damage to your legitimate rights and interests, we will bear corresponding legal responsibilities.

（6）After a personal information security incident occurs, we will promptly inform you by email, letter, phone, push notification, and other means: the basic situation and possible impact of the security incident, the disposal measures we have taken or will take, suggestions that you can independently prevent and reduce risks, and remedial measures for you. When it is difficult to inform in the above way, we will issue an announcement in a reasonable and effective way. At the same time, we will also proactively report the disposal of personal information security incidents in accordance with regulatory requirements.

In accordance with relevant national laws, regulations, and standards, we guarantee that you exercise the following rights over your personal information:

(1) you have the right to access and copy your personal information provided to us.

(2) If you believe that your personal information, our process is inaccurate or incomplete, you have the right to request us to correct or supplement your personal information.

(3) request us to delete your personal information.

(4) require us to explain the rules for personal information processing.

(5) you may revoke your consent.

(6) refuse or restrict our use of your personal information.

If you exercise your above rights, please contact us at our contact window at + 86-10-85325800. To ensure security, you need to provide a written request or otherwise prove your identity. We will ask you to verify your identity before processing your request. In the following situations, we will not be able to respond:

1) Related to KDDI Beijing's performance of its obligations under laws and regulations.
2) Directly related to national security and national defense security.
3) Directly related to public safety, public health, and major public interests.
4) Directly related to criminal investigation, prosecution, trial, and judgment execution.
5) In order to safeguard the significant legitimate rights and interests of your or other individuals, such as life and property, it is difficult to obtain your authorization and consent.
6) Personal information you disclose to the public on your own.
7) Collecting your personal information from legally publicly disclosed information, such as legal news reports, government information disclosure, and other channels.

KDDI Beijing's products and services may be connected to other third-party software, equipment, systems, etc. (collectively referred to as "third parties" in this paragraph). KDDI Beijing has no control over such third parties. KDDI Beijing cannot control the personal information and privacy protection policies of third parties, which are not subject to this privacy policy. We recommend that you read and learn about their personal information protection policies before using third-party services.

KDDI Beijing's products and services will not proactively collect personal information of minors under the age of 14. If individual projects require the processing of personal information of minors under the age of fourteen, we will formulate specialized personal information processing rules in accordance with relevant national laws and regulations and obtain the consent of the parents or other guardians of minors.

If parents or guardians need to access, modify, or delete personal information related to the ward at any time, please contact our contact window at + 86-10-85325800. If we find that children's personal information has been collected without the prior consent of verifiable parents or other guardians, we will try to delete the relevant personal information as soon as possible.

In principle, the personal information collected by KDDI Beijing within the territory of the people's Republic of China will be stored within the territory of the people's Republic of China. Due to our provision of products or services through resources and servers worldwide, this means that after obtaining your authorization and consent, your personal information may be transferred to overseas jurisdictions in the country/region where you use the products or services or accessed from these jurisdictions. If your personal information is provided across borders, KDDI Beijing will take relevant measures stipulated by national laws and regulations, including but not limited to informing you of the name or name, contact information, processing purpose, processing method, type of personal information, and the way and procedures for you to exercise the rights stipulated in the personal information protection law of the people's Republic of China to overseas recipients, and obtain your separate consent; Conclude a contract with overseas recipients in accordance with the standard contract formulated by the national cyberspace administration, stipulating the rights and obligations of both parties; Conduct personal exit safety assessment or filing in accordance with legal provisions.

This privacy policy may change. If this privacy policy changes, we will publish the latest version of the privacy policy here (our official website). If we make significant changes to our privacy policy, we may also send you change notifications through different channels, such as sending you separate notifications.

If you have any questions, opinions or suggestions about this privacy policy, or have any questions about our personal information processing work and claim your rights from us, you can contact us through the following methods:

+ 86-10-85325800 (working hours: 8: 30 to 17: 30 on weekdays, except Saturday, Sunday and statutory holidays).

If you are not satisfied with our response, especially if our personal information processing behavior has damaged your legitimate rights and interests, you can also complain or report to relevant regulatory authorities such as cyberspace, public security, and market supervision administration.