KDDI Shanghai Privacy Policy

KDDI SHANGHAI Corporation (hereinafter referred to as "we" or "KDDI SHANGHAI") attaches great importance to your personal information and privacy protection. KDDI SHANGHAI will provide corresponding security measures for your personal information in accordance with legal requirements. Please read and understand this privacy policy (hereinafter referred to as "this privacy policy") carefully before submitting personal information to KDDI SHANGHAI.

This privacy policy explains How KDDI SHANGHAI processes your personal information, but some projects involving trade secrets or projects that customers and suppliers have special requirements for personal information and privacy protection may be notified or supplemented by KDDI SHANGHAI in the form of a dedicated privacy notice or privacy notice.

You can more easily confirm the details of this privacy policy by indexing

• Personal information: refers to various information related to identified or identifiable natural persons recorded electronically or other means, excluding anonymized information.
• Sensitive personal information refers to personal information that, once leaked or illegally used, can easily cause infringement of the personal dignity of natural persons or harm to personal and property safety, including biometric identification, religious beliefs, specific identities, medical and health care, financial accounts, travel trajectories, and other information, as well as personal information of minors under the age of fourteen. We will bold and underline sensitive personal information in this privacy policy to remind you to pay special attention.
• KDDI SHANGHAI customers refers to natural persons or units that have signed contracts with KDDI SHANGHAI to purchase products or services from KDDI SHANGHAI, hereinafter referred to as "customers".
• Supplier of KDDI SHANGHAI: refers to a natural person or unit that has signed a contract with KDDI SHANGHAI to provide products or services to KDDI SHANGHAI, hereinafter referred to as "supplier".
• Your (or) contact person refers to KDDI SHANGHAI's supplier or customer, or any other third-party employee, related business contact personnel, and other relevant personnel who collect and use their personal information in KDDI SHANGHAI.

This privacy policy applies to KDDI SHANGHAI's collection and use of your personal information in the following scenarios:

（1）Business contact and business negotiation

KDDI SHANGHAI collects personal information such as the names, positions, work units, phone numbers, contact email addresses, and other personal information provided by customers, suppliers, or other units through WeChat, phone calls, and email for business contacts and business negotiations with customers, suppliers, or any other units.

（2）Supplier registration and management

KDDI SHANGHAI collects personal information such as the name, phone number, position, email, and work unit address information of the contact person provided by the supplier through email, phone, and WeChat for supplier registration management. KDDI SHANGHAI will register the personal information of the contact person with the supplier's relevant information in KDDI SHANGHAI's supplier management system for contact with suppliers and annual supplier qualification review.

（3）Data center visit management

KDDI SHANGHAI collects personal information provided by data center visitors through WeChat, phone, email, and on-site names, ID card numbers (passport numbers) in order to ensure the security and order of data centers, confirm the identity of visitors, safeguard their legitimate rights and interests, and conduct visits. KDDI SHANGHAI will provide the personal information of visitors to KDDI's data center maintainer Shanghai YAYANG Data Information Co., Ltd. or KDDI China Corporation Operation and maintenance department for admission registration.

（4）Company visit management

In order to ensure the safety and order of KDDI SHANGHAI's office space, confirm the identity of visitors, safeguard the legitimate rights and interests of visitors, conduct visits and visit management, KDDI SHANGHAI will collect personal information such as name, telephone number, position, e-mail, and work unit address provided by visitors through WeChat, telephone, email and on-site. In general, facial information of visitors is not collected, and if facial information is collected, the visitor's consent will be obtained separately.

（5）Management of corporate activities such as seminars

To invite you to participate in seminars and other events organized by KDDI SHANGHAI, we will send you meeting invitation materials containing a QR code for the“Forms for Microsoft Teams”(an online survey application) via offline means or email. The personal information you provide, such as company name, name, position, phone number, and email address, by responding to an email or scanning a QR code, will be used for registration for events such as seminars, venue arrangement, security at the event site, protection of your rights and interests, access management, and application procedures for entry.

KDDI SHANGHAI will also collect business cards provided by you during events such as seminars. These business cards contain personal information such as the company name, your name, phone number, position, email address, and work location, which will be used for contacting you, communicating with you, and conducting business discussions.

（6）Procurement Management

When KDDI SHANGHAI sells products or services to customers, it collects personal information such as the name, contact phone number, email address, etc. of the customer's contact person provided by email or phone for business contact. KDDI SHANGHAI will provide the personal information of the customer contact person to third parties such as KDDI SHANGHAI's suppliers based on the specific situation of the project but will obtain the consent of the contact person in advance.

When purchasing products or services from suppliers, KDDI SHANGHAI collects personal information such as the name, phone number, email address, etc. of the supplier's contact person provided by the supplier through email or phone for business contact. After the procurement is completed, KDDI SHANGHAI will also collect personal information such as the name, contact phone number, email address, etc. of the technical after-sales contact provided by the supplier through email or telephone from the supplier for after-sales service contact.

（7）Signing contract business communication

When KDDI SHANGHAI signs a contract with a customer, it collects personal information such as the name, position, phone number, email, etc. of the customer contact person provided by the customer through email, phone, and WeChat, for communication related to signing the contract.

When KDDI SHANGHAI signs a contract with a supplier, it will collect personal information such as the name, phone number, position, email address, and work unit address of the contact person provided by the supplier through email, phone, and WeChat, for relevant communication in signing the contract.

When KDDI SHANGHAI signs contracts with other third parties, it collects personal information such as the name, position, phone number, email address, and work unit of the contact person provided by the third party through email, phone, and WeChat, for relevant communication in signing contracts.

（8）Performance of the contract

When KDDI SHANGHAI provides products or services to customers in accordance with the contract, it collects personal information such as the name, position, phone number, email, etc. of the project, business, and after-sales contact provided by the customer through email, phone, and WeChat for business contact. KDDI SHANGHAI will provide personal information of customer projects, business, and after-sales contacts to product manufacturers or suppliers from KDDI SHANGHAI and other third parties according to project needs but will obtain the consent of the customer contact in advance.

When KDDI SHANGHAI provides products or services to customers, it will collect personal information such as the names, positions, phone numbers, email addresses, and work unit addresses of contact persons or service personnel (referred to as "relevant personnel") who provide product delivery, installation services, after-sales, service provision, maintenance, after-sales, etc. provided by KDDI suppliers or product manufacturers through email, phone, WeChat, etc. for business contact. KDDI SHANGHAI will provide personal information of relevant personnel to customers according to project needs but will obtain the consent of relevant personnel in advance.

（9）Software and system development services

In order to provide customers with related services such as system or software development, operation, maintenance, upgrade, and management in accordance with the contract, KDDI SHANGHAI collects personal information such as the names, positions, phone numbers, and email addresses of service personnel provided by suppliers through email and telephone, for business communication related to fault upgrading and quality improvement to suppliers after circuit opening.

In order to provide customers with related services such as system or software development, operation, maintenance, upgrade, and management in accordance with the contract, KDDI SHANGHAI collects personal information such as the names, phone numbers, positions, email addresses, work unit addresses, office computer ID, IP address of customer employees provided by customers through email, phone, customer system, or through public channels; Collect personal information such as the name, position, phone number, email address, etc. of the service personnel of the software information service provider for upgrading office computer software; Software maintenance; Remote operation and maintenance contact, etc.

（10）Financial and tax treatment

In its business dealings with customers, suppliers, or any other third party, KDDI SHANGHAI collects personal information such as the names and email addresses of financial personnel provided by customers, suppliers, or other third parties through email and contracts for payment and invoicing communication in accordance with contract and legal provisions.

（11）Acceptance of services

When receiving system development services, security, cleaning, transportation, banking, finance and taxation, auditing, legal services, and other services, KDDI SHANGHAI collects personal information such as the name, work unit address, phone number, email address, etc. of the service personnel for business contact.

（12）Recruitment information

In order to recruit employees, KDDI SHANGHAI obtains personal information such as the name, gender, age, date of birth, nationality, household registration, contact telephone number, e-mail address, address, educational background, professional background, marriage status, foreign language ability and certificate information of the applicant from headhunting companies such as RGF Human Resource Consulting Shanghai Co.,Ltd. YINGCHUANG Talent Services (Shanghai) Co., Ltd. Shanghai Guying Human Resources Service Co., Ltd. QIAN JIN Network Information Technology (Shanghai) Co., Ltd. for contacting you; Understand your basic situation, educational background, and professional background; Evaluate your compliance with the position.

（13）Customer satisfaction survey

KDDI SHANGHAI will collect personal information such as the name, unit name, and email address of customer contacts from customers who agree to participate in customer satisfaction surveys for customer satisfaction surveys.

Cookies are data files composed of text and numbers stored on computers or mobile devices. When you visit KDDI China's website (referred to as "website" or "our website" and "KDDI China website"), we collect relevant data about your visit and access to the website through cookies to improve your user experience and improve our website. We use the following types of cookies:

• The first type of essential cookies

These cookies are used to store session information and perform the activities required to run the website (e.g., NW traffic balancing). These cookies are temporary and disappear when you close your browser.

• The second type of analytical cookies

These cookies collect data about How you use the website (for example, the number of users and How users visit the website), helping to improve the operation of the website. For example, we can analyze whether users can easily find the content they are looking for and collect error information that users may encounter.

• The third type of functional class

If you return to our website from other sites in the same browser, these cookies can identify you. These cookies collect information about your preferences,（such as the region and language of your choice）and are used to improve your website browsing experience. It can also record the content of KDDI related policies and declarations you view to prevent duplicate pop-up.

Third party or third-party websites that work with KDDI China websites may use cookies from KDDI China websites. Our ad publishers may use cookies from our website, access data, our identifiers, and your interests and preferences to push you ads you may be interested in.

You can click on the "Cookie settings" icon on our website in the browser to set refusal to use cookies or to refuse to use cookies other than necessary cookies. The website will stop using cookies or certain types of cookies according to your settings, stop providing cookies to third parties, pushing advertisements, etc. If you stop using cookies, you may not be able to use all or part of the functions of KDDI China website.

For more detailed Policy content on cookies on KDDI China website, please confirm Cookie Policy.

（1）Entrusted processing

Within the scope of the purposes described in part II of this privacy policy, we may entrust a third party (hereinafter referred to as the "trustee") to assist us in providing you with the services and scenarios described in part II of this privacy policy. We will sign a personal information protection agreement with the trustee, and the confidentiality agreement clarifies the protection obligations of us and the trustee for your personal information. We will agree with the trustee in relevant agreements on the purpose, deadline, processing method, type of personal information, protective measures, rights and obligations of both parties, and supervise the trustee's personal information processing activities. We will also require the trustee to take necessary technical and management measures for personal information protection in strict accordance with applicable laws and regulations, industry norms, this privacy policy, and our requirements.

（2）Provision

We will not provide your personal information to any third party unless you have your separate consent. If it is necessary to provide your personal information to a third party (referred to as "recipient" in this item), we will inform you of the recipient's name or name, contact information, processing purpose, processing method, and type of personal information, and obtain your separate consent. At the same time, we will sign a personal information protection agreement with the recipient, which clarifies our and the recipient's obligation to protect personal information. We will also require the recipient to take necessary technical and management measures for personal information protection in strict accordance with applicable laws and regulations, industry norms, this privacy policy, and our requirements.

（3）Transfer

In principle, we will not transfer your personal information. If KDDI SHANGHAI needs to transfer your personal information due to mergers, division, dissolution, bankruptcy, and other reasons, it will inform you of the recipient's name, name, and contact information. We will require the recipient to continue fulfilling its obligations as a personal information processor.

（4）Public disclosure

We will not publicly disclose your personal information unless you have your prior consent.

（5）Providing, transferring, or publicly disclosing personal information without obtaining your separate consent

In the following situations, we do not need to obtain your authorization and consent in advance to entrust the processing, provision, or public disclosure of your personal information:

1) related to KDDI SHANGHAI's performance of its obligations under laws and regulations.
2) directly related to national security and national defense security.
3) directly related to public safety, public health, and major public interests.
4) directly related to criminal investigation, prosecution, trial, and judgment execution.
5) In order to safeguard the significant legitimate rights and interests of your or other individuals, such as life and property, it is difficult to obtain your authorization and consent.
6) personal information you disclose to the public on your own.
7) collecting your personal information from legally publicly disclosed information, such as legal news reports, government information disclosure, and other channels.

（1）KDDI SHANGHAI has a dedicated data security management Committee responsible for the company's network security, data security, and personal information security protection management work; At the same time, we have built a complete data security management system; We properly manage the entire cycle stage of the processing of personal information you provide.

（2）We regularly provide safety education and training to personal information related practitioners; We have formulated and implemented emergency plans for personal information security incidents; We regularly conduct compliance audits on personal information processing activities.

（3）We have used security measures that comply with industry standards to protect the personal information you provide, preventing unauthorized access, public disclosure, use, modification, damage, or loss of data. The security measures we have taken, and our data security capabilities include but are not limited to:

1) Multiple data encryption protection measures have been taken, such as file storage server encryption system and email attachment encryption system.
2) In accordance with the requirements of relevant national laws and regulations, the obligation of information system level protection has been implemented. All systems that need to handle level protection filing have already processed relevant filing.
3) Using antivirus software with terminal detection (EDR) function, firewalls are deployed to key nodes to prevent network intrusion.
4) Personal information processing related systems are limited to login permissions for AD connections within the company, and ID password authentication and terminal restrictions are implemented. only authorized terminals and authorized users can log in.
5) Personal information processing related systems are guaranteed through institutional mechanisms in accordance with the three levels of information system security level protection; https protocol and SSL encryption protocol are used for data transmission.

（4）We will take all reasonable and feasible measures to ensure that unrelated personal information is not collected. We will only retain your personal information for the period required to achieve the purposes stated in this privacy policy, unless an extension of the retention period is required or is permitted by law. 

（5）The internet environment is not 100% secure, and we will try our best to protect the security of your personal information. If our physical, technical, or management protection facilities are damaged, resulting in unauthorized access, public disclosure, tampering, or destruction of information, resulting in damage to your legitimate rights and interests, we will bear corresponding legal responsibilities.

（6）After a personal information security incident occurs, we will promptly inform you by email, letter, phone, push notification, and other means: the basic situation and possible impact of the security incident, the disposal measures we have taken or will take, suggestions that you can independently prevent and reduce risks, and remedial measures for you. When it is difficult to inform in the above way, we will issue an announcement in a reasonable and effective way. At the same time, we will also proactively report the disposal of personal information security incidents in accordance with regulatory requirements.

In accordance with relevant national laws, regulations, and standards, we guarantee that you exercise the following rights over your personal information:
（1） you have the right to access and copy your personal information provided to us.

（2）If you believe that your personal information, our process is inaccurate or incomplete, you have the right to request us to correct or supplement your personal information.

（3）request us to delete your personal information.

（4）require us to explain the rules for personal information processing.

（5）you may revoke your consent.

（6）refuse or restrict our use of your personal information.

If you exercise your above rights, please contact us at our contact window at + 86-21-63917777. To ensure security, you need to provide a written request or otherwise prove your identity. We will ask you to verify your identity before processing your request. In the following situations, we will not be able to respond:

1) Related to KDDI SHANGHAI's performance of its obligations under laws and Regulations.
2) Directly related to national security and national defense security.
3) Directly related to public safety, public health, and major public Interests.
4) directly related to criminal investigation, prosecution, trial, and judgment Execution.
5) In order to safeguard the significant legitimate rights and interests of your or other individuals, such as life and property, it is difficult to obtain your authorization and consent.
6) Personal information you disclose to the public on your own.
7) collecting your personal information from legally publicly disclosed information, such as legal news reports, government information disclosure, and other channels.

KDDI SHANGHAI's products and services may be connected to other third-party software, equipment, systems, etc. (collectively referred to as "third parties" in this paragraph). KDDI SHANGHAI has no control over such third parties. KDDI SHANGHAI cannot control the personal information and privacy protection policies of third parties, which are not subject to this privacy policy. We recommend that you read and learn about their personal information protection policies before using third-party services.

KDDI SHANGHAI's products and services will not proactively collect personal information of minors under the age of 14. If individual projects require the processing of personal information of minors under the age of fourteen, we will formulate specialized personal information processing rules in accordance with relevant national laws and regulations and obtain the consent of the parents or other guardians of minors.

If parents or guardians need to access, modify, or delete personal information related to the ward at any time, please contact our contact window at + 86-21-63917777. If we find that children's personal information has been collected without the prior consent of verifiable parents or other guardians, we will try to delete the relevant personal information as soon as possible.

In principle, the personal information collected by KDDI SHANGHAI within the territory of the people's Republic of China will be stored within the territory of the people's Republic of China. Due to our provision of products or services through resources and servers worldwide, this means that after obtaining your authorization and consent, your personal information may be transferred to overseas jurisdictions in the country/region where you use the products or services or accessed from these jurisdictions. If your personal information is provided across borders, KDDI SHANGHAI will take relevant measures stipulated by national laws and regulations, including but not limited to informing you of the name or name, contact information, processing purpose, processing method, type of personal information, and the way and procedures for you to exercise the rights stipulated in the personal information protection law of the people's Republic of China to overseas recipients, and obtain your separate consent; Conclude a contract with overseas recipients in accordance with the standard contract formulated by the national cyberspace administration, stipulating the rights and obligations of both parties; Conduct personal exit safety assessment or filing in accordance with legal provisions.

This privacy policy may change. If this privacy policy changes, we will publish the latest version of the privacy policy here (our official website). If we make significant changes to our privacy policy, we may also send you change notifications through different channels, such as sending you separate notifications.

If you have any questions, opinions or suggestions about this privacy policy, or have any questions about our personal information processing work and claim your rights from us, you can contact us through the following methods:

+ 86-21-63917777 (working hours: 8: 30 ~ 17: 30 on weekdays, except Saturday, Sunday and statutory holidays).

If you are not satisfied with our response, especially if our personal information processing behavior has damaged your legitimate rights and interests, you can also complain or report to relevant regulatory authorities such as cyberspace, public security, and market supervision administration.