Techtronic Industries Company Limited and its subsidiaries and affiliates (“We” or “Us” or “Our”) understand the importance of the personal information of Relevant Individual(s) (as defined below) of Our business partners (“You” or “Your”) and are committed to protecting Relevant Individuals’ personal information and complying with the laws and regulations of PRC on data protection.
This Letter is intended to inform You that We might process the personal information of Relevant Individual(s) (including sensitive personal information) for various purposes, such as pandemic prevention and control, factory access control, bid calling and bidding management, supply chain management, sales management, and foreign judicial proceedings. Please focus on sensitive personal information, which is bold and underlined in the Letter.
Before giving Your assent to the Letter, please carefully read and fully understand the contents of the Letter. The terms used in the Letter have the same meaning as set forth in applicable laws and regulations of PRC on personal information protection. By signing the Letter, You will be deemed as agreeing to be bound by the terms of the Letter. If You do not agree to any of the terms or conditions of the Letter, please do not sign the Letter. However, please note that Your refusal to agree might affect Your business cooperation with Us.
For the purposes of the Letter, “Relevant Individuals” are natural persons relevant to Your business, such as Your legal representative and operational personnel and Your business partners.
Where the personal information of multiple Relevant Individual(s) is to be processed, before signing the Letter, You should confirm that You have forwarded the Letter to all Relevant Individual(s) and ensure that they are aware of and fully understand the contents of the Letter (especially the meaning of the bold texts) and corresponding legal consequences, and that You have obtained their authorizations or consents of Relevant Individual(s) in accordance with the law. Upon Your signatory checks the “Consent” option, Relevant Individual(s) will be deemed to accept the Letter, and We will legally use and protect the personal information of Relevant Individuals in accordance with applicable laws and regulations and this Letter.
1. Collect, use and provide to third parties the personal information of Relevant Individual(s)
We might process the personal information of Relevant Individual(s) for various purposes, such as pandemic prevention and control, factory access control, bid calling and bidding management, supply chain management, sales management, and foreign judicial proceedings. If We are required to process the personal information of Relevant Individual(s) other than that specified in the Letter, We will inform You in a reasonable manner and obtain Your consent before processing. To be specific, We will process the personal information of Relevant Individual(s) for the following purposes:
1) We might collect the name, email, license plate number, ID card/passport number and its validity period, contact number, Your name and address and business relationship with Us, and reason for visit of Relevant Individual(s), for the purpose of access control management.
2) We might collect the name, ID card/passport number, contact number, Your name, time of arrival at Our factory, place of household registration (detailed address indicated on ID card), permanent residence (detailed address), physical health status, and Guangdong health code of Relevant Individual(s), and provide necessary information to the community or the Center for Disease Control and other government authorities as required by local pandemic prevention and control policies, for the purpose of pandemic prevention and control. For more information about the purpose, method and scope of processing personal information in the pandemic prevention and control scenario, please refer to the Supplier’s Commitments on Pandemic Prevention and Control for Entering Our Factory.
3) We might collect the name, mobile phone number, fax number, and email address of Relevant Individual(s), Your name and address, and position of Relevant Individual(s) in You, and share necessary personal information of Relevant Individual(s) with third-party platforms contracting with Us, for the purpose of reviewing supplier qualification before You are registered as our supplier, carrying out supplier management or implementing sales management.
4) We might collect the name, mobile phone number, email address of Relevant Individual(s), Your name and address, and position of Relevant Individual(s) in You, for the purpose of developing Our new supplier or helping You sign up to bid for Our new projects.
5) We might provide necessary personal information of Relevant Individual(s) to Our overseas affiliates and overseas third-party platforms contracting with Us, for the purpose of carrying out a unified management to business partners to adapt to the requirement of Us and/or Our overseas affiliates. According to the Personal Information Protection Law, before cross-border transmission of the personal information of Relevant Individual(s), We will enter into a contract with the overseas recipient by using the standard contract prepared by the Cyberspace Administration of China, setting out the rights and obligations of both parties. We will take necessary measures to ensure that the processing by overseas recipient of the personal information transmitted meet the same standards on personal information protection.
In particular, We will provide the name, contact number and email address of Relevant Individual(s) to an overseas third-party platform operated by Source 44 LLC, d.b.a. Source Intelligence, for the purpose of creating an account for the Relevant Individual(s) to access the platform to complete compliance surveys for Us and/or Our overseas affiliates to verify Your supply chain and product compliance. According to the Personal Information Protection Law, before cross-border transmission of the personal information of Relevant Individual(s), We will enter into a contract with Source 44 LLC, d.b.a. Source Intelligence, by using the standard contract prepared by the Cyberspace Administration of China, setting out the rights and obligations of both parties. We will take necessary measures to ensure that the processing by Source 44 LLC, d.b.a. Source Intelligence, of the personal information transmitted meet the same standards on personal information protection. Relevant Individual(s) have the right to request access to, and correction of, their personal information held by Source 44 LLC, d.b.a. Source Intelligence. Any such request should be made to [name], [job title], of Source 44 LLC, d.b.a. Source Intelligence, at [email address].
6) We might provide necessary personal information of Relevant Individual(s) abroad, for the purpose of cooperating with foreign agencies on judicial proceedings. According to the Personal Information Protection Law, before cross-border transmission of the personal information of Relevant Individual(s), We will enter into a contract with the overseas recipient by using the standard contract prepared by the Cyberspace Administration of China, setting out the rights and obligations of both parties, and will take necessary measures to ensure that the processing by overseas recipient of the personal information transmitted meet the same standards on personal information protection, and only after approval by the competent authority of PRC, will we provide foreign judicial or law enforcement agencies with the personal information of Relevant Individual(s) stored within the territory of PRC.
7) Please understand that as required by applicable laws and regulations, We might process the personal information of Relevant Individual(s) without Your consent: (a) where it is necessary for the conclusion and performance of a contract to which You are a party; (b) where it is necessary for the performance of Our statutory obligations; (c) where it is necessary for the response to public health emergencies, or for the protection of the life, health and property safety of natural person in emergencies; (d) where the personal information is processed to a reasonable extent for the purpose of news reporting, public opinion supervision or the like for the public interest; (e) where the personal information is disclosed by Relevant Individual(s) or otherwise disclosed legally and processed to a reasonable extent in accordance with applicable laws and regulations; (f) other circumstances stipulated by applicable laws and administrative regulations.
2. How to store the personal information of Relevant Individual(s)
1) Storage location
In principle, the personal information We collect and generate within the territory of PRC will be stored within the territory of PRC. However, as We provide products or services through resources and servers around the world, the personal information of Relevant Individual(s) might be provided to or accessed to by Our authorized partners and service partners located in jurisdictions outside the territory of PRC upon getting Your separate consent.
In addition, We might provide the personal information of Relevant Individual(s) to judicial or law enforcement agencies outside the territory of PRC, if it is necessary: (a) to perform Our legal and/or regulatory obligations under the law of PRC or any other jurisdiction; or (b) according to the agreements entered into by and between Us and relevant governmental authorities, regulatory authorities or other persons. Such jurisdictions might formulate different data protection laws, in which case We will ensure that the personal information of Relevant Individual(s) would be protected as adequately as within PRC. For example, We will seek a separate consent of Relevant Individual(s) to cross-border transfer of personal information, or implement security measures such as data de-identification before cross-border data transfer.
We will conduct a personal information protection impact assessment in accordance with applicable laws, regulations and relevant regulatory requirements, and undergo and pass the cross-border transmission security assessment organized by the Cyberspace Administration of China and the personal information protection certification, or enter into contracts with overseas recipients by using the standardized contract drafted by the Cyberspace Administration of China to set out Our and the overseas recipient’s rights and obligations. Before providing the personal information of Relevant Individual(s) to a foreign judicial or law enforcement agency, We will obtain the consent of the competent authority of PRC as required by applicable laws and regulations.
2) Storage period
We will only retain the personal information of Relevant Individual(s) for the shortest period necessary to achieve the purpose of collecting, unless a longer period of information retention is necessary to comply with applicable laws and regulations. We determine the information storage period mainly based on: whether there is a contractual relationship between Us and You; the legal obligations We need to perform, and the need to protect Our legal position, for example, to apply statutes of limitations, and to undergo audits or regulatory investigations. After the storage period has expired, We will erase or anonymize the personal information of Relevant Individual(s) by laws. If erasure is technically infeasible, We will cease processing other than storage and taking necessary security measures.
3. How to manage the personal information of Relevant Individual(s)
We fully respect the rights of Relevant Individual(s) to his/her personal information and guarantee that Relevant Individual(s) can manage his/her personal information in the following ways:
1) Access, correction or supplement
If Relevant Individual(s) wishes to access, correct or make a supplement to his/her personal information generated in the course of cooperation between You and Us, Relevant Individual(s) may exercise his/her rights by the methods disclosed in the “Contact Information”.
2) Reproduction and transfer
Relevant Individual(s) has the right to reproduce his/her personal information kept by Us, or upon satisfaction of conditions under laws and regulations, to request Us to transfer his/her personal information to the personal information processor designated by him/her. Relevant Individual(s) may exercise his/her rights by the methods disclosed in the “Contact Information”.
3) Change to scope of consent
Relevant Individual(s) has the right to change the scope of or withdraw his/her consent to personal information collection and processing carried out by Us. Relevant Individual(s) may exercise his/her rights by the methods disclosed in the “Contact Information”. After Relevant Individual(s) withdraw his/her consent, We will be unable to continue the cooperation or business involving the personal information collection and processing to which his/her consent has been withdrawn (for example, We will be unable to grant Relevant Individual(s) an access to Our factory), nor will We process corresponding personal information of Relevant Individual(s). However, the decision made by Relevant Individual(s) to withdraw his/her consent will not affect the personal information processing previously carried out based on his/her consent.
4) Erasure
Relevant Individual(s) can request Us to erase his/her personal information by the methods disclosed in the “Contact Information”: (a) if Our purpose of processing has been achieved or is unable to be achieved, or the processing is no longer necessary for the achievement of the purpose of processing; (b) if We has ceased providing corresponding products or services, or the retention period has expired; (c) if Relevant Individual(s) withdraw his/her consent; (d) if We processes personal information in violation of laws, administrative regulations, or agreements; or (e) in other circumstances stipulated by laws and administrative regulations. Please note that the exercise of the right to erase is not absolute, and Relevant Individual(s) has the right to request Us to erase his/her personal information only under the foregoing statutory circumstances. In addition, statutory retention period requirements or technical limitations might make it difficult for Us to erase the personal information of Relevant Individual(s), but We will cease processing activities other than storage and taking necessary security measures.
5) How We respond to the requests of Relevant Individual(s)
Under general circumstances, We will reply within fifteen working days. As for reasonable request of Relevant Individual(s), We will not charge any fee in principle. In addition to contacting Us, Relevant Individual(s) has the right to report his/her concerns to the competent authority of personal information protection. According to laws and regulations, We will be unable to respond to the request of Relevant Individual(s) in the following circumstances: (a) if it is relevant to the performance of Our obligations under laws and regulations; (b) if it is directly relevant to national security and national defense security; (c) if it is directly relevant to public security, public health, or major public interests; (d) if it is directly relevant to criminal investigation, prosecution, trial and enforcement of judgement; (e) if there is sufficient evidence of subjective malice of or abuse of rights by Relevant Individual(s); (f) response to the request of Relevant Individual(s) will cause serious damage to legitimate rights and interests of Relevant Individual(s) or other individual or organization; (g) if it involves trade secrets.
4. Contact information
If Relevant Individual(s) has any questions, comments or suggestions on the Letter or related matters, please send an email to Our email address for personal information protection (privacy@ttigroup.com), and We will promptly deal therewith and give a reply within 15 working days or within the period stipulated by laws and regulations. For the sake of security, We might need to authenticate Relevant Individual(s)’ identity before giving a formal reply. Under normal circumstances, We will reply within fifteen working days.
5. Application of and revision to the Letter
We might make changes, supplements and/or revisions to the Letter from time to time, in which case Relevant Individual(s) will be notified by email and/or other means permitted by law. According to the Personal Information Protection Law, We might give Relevant Individual(s) a prior notice of any changes to the Letter and provide Relevant Individual(s) with the opportunity to refuse to agree to such changes. If Relevant Individual(s) exercise his/her right to refuse, such changes will not take effect, but might affect the business cooperation between You and Us. We will clearly inform Relevant Individual(s) of the possible consequences of refusal to agree to such changes to the extent and in the manner required by law.