Privacy Notices

Last update: May 15, 2024

Keeping personal data safe and secure is among our priorities at Kehua Tech. We are committed to complying with Data Privacy regulations worldwide, and we want to make it easy for all individuals to understand what data we collect, why we collect it, and the options available to manage personal data.

This privacy notice explains how Kehua Data Co., Ltd. and its subsidiaries and/or affiliates (“Kehua Tech”, “our,” “us” or “we”), as Data Controller, processes the personal data concerning you that are provided by you or third parties and/or collected during Kehua Tech’s business activities in relation to you as our customer or supplier.

Personal data processed

We collect, store, and use the personal data, which includes personal details (name, date, and place of birth), contact details, former or current roles and jobs (also public positions such as government official, political party official, and candidate for public office), background checks (if allowed in your jurisdiction and in accordance with applicable laws and regulations) of contacts, representatives (directors, officers, and employees) and/or shareholders of your company.

Data likely to disclose the existence of criminal convictions and ongoing criminal proceedings may also be processed, e.g., to comply with anti-mafia, money laundering and counter-terrorism legislation.

Kehua Tech may also carry out criminal record checks on contacts, representatives, and/or shareholders of your company, to comply with anti-mafia, money laundering, and counter-terrorism legislation.

Purposes of the processing

Personal data of contacts, representatives, and/or shareholders of your company may be processed for the following purposes:

(a) to assess whether Kehua Tech can enter into and/or continue a contractual relationship with your company

(b) to manage contractual relationships with your company, including the relevant administrative and accounting obligations

(c) to ensure Kehua Tech’s and its affiliates’ continuing compliance with applicable anti-money laundering and anti-corruption laws and other laws applicable to Kehua Tech and its affiliates regarding the arrangements to be entered into with your company

(d) to develop Kehua Tech’s business prior (before consumption), upon and/or following a merger and/or acquisition activity (including without limitation, any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, brands, affiliates, subsidiaries, or other assets). Customer and Supplier information may be a transferred business asset in such a transaction.

The legal bases for processing personal data are:

• for purposes (a) and (b) above: either (i) legitimate interest pursued by Kehua Tech (if you are legal entity) or (ii) performance of a contract or taking steps at your request prior to entering into a contract with you (if you are a natural person)
• for purpose (c) above: to fulfil legal obligations (e.g., to comply with anti-mafia, money laundering and counter-terrorism legislation)
• for purpose (g): we have legitimate interest pursued by Kehua Tech to process your personal information to develop Kehua Tech’s business prior (before consumption), upon and/or following a merger and/or acquisition activity.

The legal bases might be other depending on the data privacy laws of the country that you are residing in. In any case, Kehua Tech shall only process your personal information based on lawful and valid legal basis.

Also, if required by the data privacy laws of the country that you are residing in, Kehua Tech shall additionally obtain your consent for certain processing of your personal data (e.g., processing of sensitive data; cross border transfer).

Methods and place of processing and place of storage of personal data</strong >

Your personal data will be processed in accordance with the key principles of processing prescribed under applicable data protection laws.

Rest assured that we maintain appropriate security, technical, and organizational measures that ensure a level of security appropriate to the risk of unauthorized access to, and accidental or unlawful destruction, loss, alteration, and unauthorized disclosure of, personal data transmitted, stored, or otherwise processed.

Your personal data will be processed manually or electronically using automated tools that ensure the security and confidentiality of the data.

Processed data are stored at our registered office or at the office of any external providers we entrust to store personal data. If you wish to know the list of our external providers, please contact us.

We will process only personal data necessary for the above purposes. The people authorized to the data processing will immediately delete or make anonymous personal data unnecessary for the above purposes.

Data retention period

We will process your personal data only for the period necessary to fulfil the purposes outlined in this privacy notice unless a longer period for the processing of such personal data is required or permitted by applicable law. Any storage of data beyond the deletion deadlines will encompass only non-personal data (aggregated or anonymized data).

Data dissemination, sharing and communication

Your personal data will be primarily processed by our employees authorized to the data processing for the above purposes.

We may also engage processors to facilitate us in the processing of your personal data. Before engaging a processor, we perform security and privacy assessments of the processor, and we ensure that the processing of personal data is always regulated with written data processing agreements or appropriate contractual safeguards according to applicable the data privacy laws. The list of our external providers is kept up-to-date, and you can access it on request.

Since we are a global company, we may share your personal data with our subsidiaries and affiliates to complete internal procedures within our offices, to perform certain processing activities on a global scale or to support you in your requests.

Kehua Tech might sell or buy brands, stores, subsidiaries, or business units. Kehua Tech may share and/or transfer your Personal Information with a third-party in merger and/or acquisition activity (including without limitation, any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, brands, affiliates, subsidiaries, or other assets). Kehua Tech may share and/or transfer your Personal Information with a third-party prior (before consumption), upon or following a merger and/or acquisition activity.

Your data may also be shared with government agencies, insurance companies, banks, pension funds and welfare assistance funds, to fulfil specific legal, regulatory, and contractual obligations, The above entities/individuals will act as autonomous data controllers or data processors (as applicable).

Cross border transfer. Please consider that your personal data may be transferred outside of your country and/or region. In such cases, Kehua Tech will take appropriate measures to ensure that safeguards are in place to ensure data protection.

EU-based individual. If you are an EU-based individual, for transfers outside European Economic Area (EEA), we will ensure that Binding Corporate Rules approved by the supervisory authority or Standard Contractual Clauses adopted by the European Commission, are in place before processing is conducted. Where it is required in accordance with the circumstances, we may apply supplementary measures to ensure adequate protection of your personal data.

Your Guaranteed Rights

Right to access, update, correct, and supplement your data, to object to the processing, and to submit complaints

You have the right to obtain confirmation of the existence or non-existence of personal data relating to you.

You also have the right to be informed of the following:

• ·the origin of the personal data.
• ·the purpose and methods of data processing.
• ·the logic applied to the data processed electronically.
• ·the identity of the data controller and the data processors; and
• ·the identity of the individuals or categories of individuals to whom your personal data may be sent to or who may acquire your data as appointed representatives of our company in your country of residence or as individuals authorized to process your data.

You also have the right to:

(a) have your data updated, corrected, supplemented, or deleted.

(b) have the processing restricted to the scope of the consent you gave by accepting this notice.

(c) have any unlawfully processed data erased, made anonymous, or blocked.

(d) require a declaration attesting that the people/companies we communicate or disseminate your data to have been notified and given full details of any of the operations under points (a) and (b) above having been carried out, unless this proves impossible or implies an effort that is clearly disproportionate to the right to be protected.

(e) withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (when processing is based on such legal basis) and

(f) obtain, in a structured format commonly used and readable by electronic devices, the personal data you give us, and to have the data transmitted, directly or through Kehua Tech, to another data controller (known as data portability).

You also have the right to object, in whole or in part, to:

·the processing, on legitimate grounds, of your personal data, including data relevant for the purposes they were collected.

Updates

This Privacy Notice will be updated as required and new versions will be made available in a timely manner.

When we interact with you, we may also provide you with additional privacy notices about specific processing activities about how Kehua Tech processes your personal information at that particular point in time.