Effective from: 2024/9/5
Published at: 2024/9/5

This Privacy Policy (“Policy”) provides information on the personal data processing by SAIC MAXUS, a company with limited liability established under the law of People’s Republic of China, having its statutory seat in No.2500 Jungong Rd., Yang Pu District, Shanghai, P.R.China SAIC MAXUS can be reached via the following contact details:

Telephone number: +86 18601771912
Email address: maxusglobal@saicmotor.com

This Policy applies for all personal data processed by SAIC MAXUS and/or on behalf of SAIC MAXUS, which identify or may identify a person (“Personal Data”). These persons involved are hereinafter collectively referred to as data subjects (“Data Subjects”).

SAIC MAXUS reserves the right to review and/or alter the Policy periodically, in order to comply with local legislation, and for any other purpose deemed reasonably necessary by SAIC MAXUS.

For queries and inquiries about this Policy, please contact the Privacy contact person of: Harvey Tao

This Policy sets out the elements necessary for SAIC MAXUS’s compliance with applicable privacy legislation, principles and practice.

The Policy is an external policy, and is directed towards Data Subjects who’s Personal Data are being processed by SAIC MAXUS for the purpose of producing and delivering products and services. This Policy applies to the processing of Personal Data, in which SAIC MAXUS acts as the data controller within the meaning of the Applicable Laws. This is the case when SAIC MAXUS determines the purpose for and the means for the processing of Personal Data of Data Subjects within the purposes of this policy.

For business purposes, Data Subjects may be asked to provide their Personal Data. If this is the case, SAIC MAXUS, its affiliates and partners shall be required to keep such information confidential.

Personal Data mentioned herein and defined by SAIC MAXUS refers to information of all kinds related to each Data Subject -- their name, email address, telephone number, and so on -- that are transmitted to SAIC MAXUS by Data Subjects.

The categories of Personal Data SAIC MAXUS processes are:

        - first name;
        - last name;
        - e-mail address;
        - telephone number (business and private);
        - contact purpose
        - region
        - IP address;
        - log in history;
        - visitor information (date and time);

The purposes of the processing of Personal Data by SAIC MAXUS are:

        - marketing and PR activities;
        - relationship management;
        - maintaining contact with potential business partners;

For more information on the purposes of the processing of Personal Data by SAIC MAXUS please refer to Annex 1 to this Policy, which includes a table with the purposes, legal grounds and retention periods for the processing of Personal Data.

Legal grounds

SAIC MAXUS is obligated to process the Personal Data in accordance with these purposes and in compliance with the Applicable Laws. The data processing by SAIC MAXUS is necessary for the operation of activities , for which the Data Subject has given its explicit consent, or for the performance of a contract between SAIC MAXUS and the third party, or for the performance of a legal obligation, or is necessary for the purposes of a legitimate interest pursued by SAIC MAXUS. The Data Subjects has the right to withdraw consent at any time. Also, when the processing is necessary for the performance of the contract between SAIC MAXUS and the Data Subject, the Personal Data processed is necessary to enter into a contract. The legitimate interests for which SAIC MAXUS processes Personal Data are: relationship management, marketing and PR activities contact form for offers and orders, and safeguarding the security of customers and visitors.

Retention period

SAIC MAXUS will not use and store Personal Data longer than necessary to fulfil the abovementioned purposes, and shall remove the collected Personal Data after the necessary period to achieve the purposes described in this Policy has passed, or to comply with contractual obligations or as permitted or required by the Applicable Laws. Annex 1 of this Policy refers to the retention periods for each purpose of processing of Personal Data.

The Personal Data may only be processed to the extent necessary for the described purposes. Personal Data may in principle not be processed for other purposes other than that for which the Personal Data were collected. If there is a necessity or need to process Personal Data for other purposes, it shall be investigated by SAIC MAXUS whether the purposes of the intended data processing is compatible with the original purposes. SAIC MAXUS shall provide the Data Subject prior to that further processing with information on that other purpose.

SAIC MAXUS handles Personal Data carefully and confidentially, and uses all suitable physical, managerial, and technical safeguards to preserve the integrity and security of your Personal Data.

Personal Data is being accessed or transferred by SAIC MAXUS and other third parties such as SAIC MAXUS’s affiliates, creditors, embassies, governments.

In all cases, SAIC MAXUS will expressly state why such information is necessary, so that Data Subjects may provide the information at their own discretion. SAIC MAXUS will not disclose Personal Data provided by Data Subjects to any party, other than SAIC MAXUS itself, without prior permission from the Data Subjects.

SAIC MAXUS discloses Personal Data in case such disclosure is mandatory under Applicable Laws or is reasonably judged to be essential in order to protect and safeguard the rights, property and safety of other parties, SAIC MAXUS itself, and/or SAIC MAXUS's affiliates.

SAIC MAXUS may use the IP addresses of Data Subjects recorded in the system, in order to explore the cause of or solution to any problem arising in its servers, or to administer its Website.

Circumstances may arise where, whether for strategic or other business reasons, SAIC MAXUS decides to sell, buy, merge or otherwise reorganize businesses. Such a transaction may involve the disclosure of Personal Data to prospective or actual purchasers, or receiving it from sellers. It is SAIC MAXUS 's practice to seek appropriate protection for information in these types of transactions.

SAIC MAXUS may transfer Personal Data to China, which shall take place only in compliance with the Applicable Laws, and where appropriate safeguards are in place that ensure the level of protection of Data Subjects as required by the Applicable Laws.

In certain circumstances, it is possible that Personal Data may be subject to disclosure pursuant to judicial or other government subpoenas, warrants, or orders.

Data Subjects have the right of information, access, rectification, addition and erasure of Personal Data, and the right to object against or restrict the processing of Personal Data (or withdraw an earlier given consent), as well as the right to data portability. The procedure of SAIC MAXUS that enable Data Subjects to exercise these rights, is described below.

Data Subjects may file a request for access with SAIC MAXUS, and SAIC MAXUS shall respond as soon as possible, and in any event within one (1) month, about:

a) whether SAIC MAXUS holds any Personal Data relating to the respective Data Subject; and, if so, information is provided on the purposes of the processing, the categories, the recipients (if applicable) the envisaged period for which the Personal Data will be stored, or the criteria used, the a) whether SAIC MAXUS holds any Personal Data relating to the respective Data Subject; and,

b) if so, information is provided on the purposes of the processing, the categories, the recipients (if applicable) the envisaged period for which the Personal Data will be stored, or the criteria used, the existence of the right to request rectification, erasure, restriction or to object to such processing, the right to lodge a complaint with a supervisory authority, the existence of automated decision-making, where the data is transferred to a third country, the appropriate safeguards and the source(s) of the Personal Data.

After a Data Subject has accessed the Personal Data, he/she may request SAIC MAXUS to correct, restrict, amend, add, erase and/or transport the Personal Data. SAIC MAXUS informs the Data Subject within one (1) month after receiving the request whether the request shall be complied with (in time), and if not, accompanied with the reasons for the delay or rejection.

Information provided shall be free of charge. Data Subjects can exercise these rights at reasonable intervals. Data Subjects can exercise their rights by contacting the Privacy contact person in writing (see address above) or per e-mail at: maxusglobal@saicmotor.com

SAIC MAXUS will comply with a legitimate request of a Data Subject for correction, restriction or erasure, if the Personal Data are factually incorrect, incomplete, or irrelevant for the purpose(s) of the data processing, or otherwise processed in violation with the Applicable Laws.

With regard to a request to erase Personal Data, it should be taken into account that SAIC MAXUS shall not comply with such request, if it is incompatible with any legal obligations of SAIC MAXUS.

If a request is allowed, SAIC MAXUS shall execute the decision to correct, amend, erase and/or transport the Personal Data as soon as possible.

In the event of concerns about the handling of Personal Data, Data Subjects also have the right to lodge a complaint with a local supervisory authority.

For queries and inquiries about this Policy of SAIC MAXUS, please contact the Privacy contact person at: Harvey Tao

We may update this Privacy Policy according to changes in our business functions and measures concerning the protection of personal information. If we make changes to this Privacy Policy, we will notify you through our website. Where changes to this Privacy Policy will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will give you sufficient advance notice so that you have the opportunity to exercise any rights you have.

Annex 1: purposes of processing, legal grounds and retention periods.
Purpose of processing Legal ground Retention period.

Marketing and PR activities Legitimate interest (marketing and PR) 1 year after the person leaves the position.

Relationship management Consent and necessary for performance of a contract 7 years, or 2 years after end of the relationship with the customer.

Maintaining contact with potential business partners Consent 1 year.

Visitor registration Legitimate interest (security) 30 days.