Effective date: November 1^st, 2023

Please read this Privacy Policy (“Privacy Policy”) carefully before you use products and services provided by GM (as defined below) via the Platform (as defined below) and/or in the Offline Scenario (as defined below). You will be deemed to have read, understood, and agreed to this Privacy Policy (as amended and updated from time to time) and the documents related to it in the course of registering and/or using products and services on the Platform or in the Offline Scenario. Any individual without full civil capacity according to laws and regulations or without expressing consent to the entire content of this Privacy Policy and the documents related to it, shall, in principle, not use or shall immediately cease to use the relevant products and services. If you use our products and services on behalf of legal persons, unincorporated organizations or other entities, you shall, in principle, not use or shall immediately cease to use the relevant products and services without obtaining legal and valid authorization from or without the aforementioned entities having fully consented to this Privacy Policy. If you purchase GM's products and services, you have the responsibility to inform other actual users agreed by you of this Privacy Policy and the documents related to it and ensure that they fully understand and agree to this Privacy Policy before using our products and services.

Please also read carefully the Checklist for Implementing Separate Consents of General Motors (China) Privacy Policy ("Checklist”)and General Motors (China) Guidelines for Protection of Minors’ Personal Information ("Guidelines”), which are aforementioned as “the documents related to the Privacy Policy” and form important parts of the Privacy Policy.

General Motors (China) Investment Co., Ltd. [通用汽车（中国）投资有限公司] (“GM”, “We”, “Our”) is the developer of the following platforms built via the internet and mobile internet:

GM is also the user of the following platforms built via the internet and mobile internet (together with the platforms listed in the table above, each a "Platform" and collectively, the "Platforms"):

This Privacy Policy:

1. provides the basic rule for protecting the Personal Information (PI) (as defined below) collected from the following channels：(1) the Platforms; (2) the authorized partners or vendors of GM; (3) Offline Scenarios including, but not limited to the following scenarios: a) Call GM via phone; b) Visit GM's offline experience centers for test drive, test rides and vehicle purchase; c) Visit GM's offline maintenance centers to accept after-sales and repair services; d) Participate in events such as exhibitions and car fancier clubs held by GM or its authorized event organizers.
2. explains how the Platforms and the Offline Scenarios collect, process, use and disclose PI;
3. states our commitment to protecting PI;
4. applies to the products and services provided by the Platforms and the Offline Scenarios. If some special functions in the products and services provided by the Platforms and the Offline Scenarios that apply to their specific personal information processing rules, such specific rules will more explicitly indicate how your personal information will be collected, processed, used and disclosed in the associated products and services. In case of any inconsistency between this Privacy Policy and the specific personal information policy, the specific personal information policy shall prevail;
5. we will continue to enrich and extend the products and services available to users of the Platforms and the Offline Scenarios based on user needs. This Privacy Policy shall apply to all new functions, new products and new services provided through the Platforms and the Offline Scenarios, unless otherwise stated. This Privacy Policy shall also apply to our Affiliates as well as our delegated agencies, authorized partners and vendors involved in the provision of the products and services of the Platforms and the Offline Scenarios if such Affiliates, delegated agencies, authorized partners or vendors do not have separate personal information statements or perform on our behalf.

We hereby draw your attention that the Platforms may include links and directions to other websites or applications that are not developed or provided by GM. Since we do not control these third-party websites or applications, this Privacy Policy will not apply to products and / or services provided to you by other third parties under any circumstances. It is recommended that you carefully read the relevant privacy policies and user agreements of such third parties before using such products and / or services.

For the purpose of this Privacy Policy:

1. Personal Information (“PI”) means any information recorded in electronic or other means that relates to a natural person who has been or can be identified, excluding information that has been anonymized
2. Affiliate means any enterprise, limited liability company, joint stock company, joint venture, partnership, institution, unincorporated organization, association, group, unit, trust or any other entity or organization (“Controlled Entity”) which directly or indirectly, Controls, is Controlled by, or is under common Control with GM. For the purpose of this definition, “Control” means the power to direct the management or policies of such Controlled Entity, directly or indirectly, whether through ownership of more than 40% voting securities, by contract, or otherwise.
3. Sensitive Personal Information (“SPI”) means PI that, once leaked or illegally used, can easily lead to the infringement of the personal dignity of natural persons or the harm of personal and property safety, including information of biometrics, religious beliefs, specific identities, medical health, financial accounts, whereabouts, etc., as well as PI of minors under the age of fourteen (14)
4. Minor refers to a natural person under the age of eighteen (18), excluding a Minor who shall be deemed as a person with full civil capacity in accordance with the law.
5. Device Information refers to the following information of a mobile phone, including the name, device model, operating system and application versions, device manufacturer, screen resolution, device MAC address and unique device identification number (such as IMEI/Android ID/IDFA/OPENUDID/GUID/SIM IMSI).
6. Detailed Vehicle Information refers to the following information of a car, including the type of such vehicle, vehicle system, engine, transmission, airbag system, vehicle identification code/VIN, purpose of the vehicle, amount of electricity of the battery, state of charge, brake pads, electric range, total range, remaining range, comprehensive range, amount of electricity, fuel consumption, energy consumption, charging, oil life, tire pressure, air-conditioning, WiFi information, air filter, the service life of the vehicle, information on vehicle body stability control system, information on brake and anti-lock system, operating information of Onstar system, the operating information of other parts and components, the functions of the vehicle.

GM understands the importance of your PI to you and will do our best to ensure the security and reliability of them. We are committed to maintaining your trust in us and sticking to the following principles to protect your PI: (1) principle of consistency between rights and responsibilities, (2) principle of explicit purpose, (3) principle of optional consent, (4) principle of least necessity, (5) principle of security assurance, (6) principle of PI subject’s participation, (7) principle of openness and transparency, and (8) principle of good faith.

This Privacy Policy will help you better understand the following:

• PERSONAL INFORMATION WE COLLECT
• HOW WE COLLECT AND USE YOUR PERSONAL INFORMATION
• HOW WE USE COOKIES AND SIMILAR TECHNOLOGIES
• HOW WE PROVIDE, TRANSFER AND PUBLICLY DISCLOSE THE PERSONAL INFORMATION WE COLLECT
• HOW WE PROTECT AND STORE PERSONAL INFORMATION
• YOUR RIGHTS AND OPTIONS
• PROTECTION OF MINORS' PERSONAL INFORMATION
• UPDATES AND SCOPE OF USE OF THIS PRIVACY POLICY
• HOW TO CONTACT US
• SPECIAL ACKNOWLEDGE TO SHARING YOUR PI WITH US

1. Personal Information We Collect

In order to better provide you with the products and services available on the Platform and in the Offline Scenarios, we may need to collect your personal information through the Platform and in the Offline Scenarios and/or access information stored on the devices you use.

The business functions that we provide through the Platform and in the Offline Scenarios are divided into basic business functions and expanded business functions. Based on categorization of the business functions, the personal information that we collect from you is categorized into (1) the personal information that we need to collect in order to provide the basic business functions of the services ("Required Personal Information"), and (2) the personal information that you may choose to consent to our collection from you in order to provide expanded business functions of the services ("Expanded Personal Information"). With respect to the Required Personal Information, we may not be able to provide you with the basic business functions of the services without your provision of such information; with respect to the Expanded Personal Information, we may not be able to provide you with expanded business functions without your provision of such information, but this will not affect your use of the basic business functions of the services. Sensitive personal information that we collect from you is indicated in bold. The sensitive personal information that we collect is necessary for providing certain services to you. Your refusal to provide such sensitive personal information may affect your normal use of certain services and will not affect your normal use of other services which can be provided without your provision of sensitive personal information. Please refer to Sections 2.2 and 4.1.4 for further details on our handling of sensitive personal information. You may withdraw your consent to our collection of sensitive personal information in your sole discretion in accordance with Sections 6 and 9 of this Privacy Policy. If you withdraw your consent, you will not be able to use that particular service requiring such sensitive personal information, but you may continue to use other services that we provide.

Please note that the personal information that we may collect in the scenarios and by the Services listed in this Privacy Policy (including Required Personal Information and Extended Personal Information) is the scope of the information that we may collect. But it does not mean that we will collect all such personal information in the corresponding services or scenarios, nor does it mean that all the listed personal information will be collected at one time. Instead, we may collect your personal information as appropriate, on a case-by-case basis, when you use specific business functions.

This Section 1 will disclose to you the purposes for and the scope to which we may collect or have access to your personal information in different business functions, in the context of specific functional scenarios.

• 1.1

  User registration

  You can register as a user through the The Durant Guild App, Durant Guild Wechat Applet, Durant Guild Car-mounted Terminal and Offline Scenarios. If you are registered as our user, you will have access to all of our Platforms through which we provide user services. If you do not agree to provide the information below, you will not be able to complete platform user registration or use services that require a user account, but you will still be able to use basic services of the Platform such as browsing and searching.

  Where applicable, we will invite you to activate your account through a mobile communication operator SMS verification code (additional communication costs may be borne by you in accordance with mobile communication operator tariffs).

  The following table shows the scope and manner of collection of Required Personal Information in scenarios where we provide user registration services. The personal information in the table below is collected for the purpose of creating user names and recording passwords.

  Channels Involved	Scope of Collection of Required Personal Information	Manner of Collection
  The Durant Guild App	Your mobile phone number, mobile device information, SMS verification code. If you sign in with a WeChat authorization, we will also collect your WeChat Union ID If you use an iPhone, we may also collect your Apple ID when you sign in with such Apple ID as your account authorization	In-app collection or user input
  The Durant Guild WeChat Applet	Your WeChat ID, WeChat user unique ID (Union ID and Open ID), WeChat nickname, WeChat profile picture, mobile phone number, mobile device information	In-app collection or user input
  The Durant Guild Car-mounted Terminal	Your mobile phone number, Vehicle ID/VIN, SMS verification code	Car-mounted terminal collection or user input
  Offline Scenarios	Your mobile phone number, SMS verification code	Offline collection

• 1.2

  Account Management

  After you register as our user, you can manage your user account through The Durant Guild App, Durant Guild WeChat Applet and Durant Guild Car-mounted Terminal. Specifically, you can: (1) in The Durant Guild App: update your account information (user ID, name, region, mailing address, birthday, gender), change your profile picture and personalized signature, and deregister your account; (2) in Durant Guild WeChat Applet: update your account information or deregister your account; (3) in Durant Guild Car-mounted Terminal: change your account profile picture and nickname, and deregister your account through the blue key.

  After your user account is registered successfully, your user account will be bound to a unique mobile phone number. If you need to change your bound mobile phone number, you will need to apply through The Durant Guild App. If you use The Durant Guild App to purchase a vehicle, we will share your mobile phone number with SAIC General Motors and Shanghai OnStar Information Service Co., Ltd. and create an SAIC General Motors account for you with your consent. If you later use the account management services to unbundle or replace the mobile phone number corresponding to your SAIC General Motors user account, the mobile phone number corresponding to your SAIC General Motors account may be unbundled or replaced together. The following table shows the scope, manner and purpose of the Required Personal Information collection for scenarios in which we provide account management services.

  Channels Involved	Scope of Required Personal Information Collection	Manner of Collection	Purpose of Collection
  The Durant Guild App	Your user ID, SMS verification code, mobile phone number	In-app collection or user input	Unbundling your mobile phone number, deregister your account
  	Your user ID, name, region, mailing address, birthday, gender	In-app collection or user input	For updating your account information, changing your profile picture and personalized signature
  The Durant Guild WeChat Applet	Your user ID, SMS verification code	In-app collection or user input	For deregistration of your account
  	Your user ID, name, region, mailing address, birthday, gender		For updating your account information
  The Durant Guild Car-Mounted Terminal	Your user ID	Car-mounted Terminal collection or user input	Change your account profile picture and nickname
  	When you make a direct call to customer service through the blue key of Durant Guild Car-mounted Terminal to deregister your user account, we collect your Vehicle Identification Number (VIN) and voice recording	Collection by Car-mounted Terminal	Deregister your user account (Note: Please refer to other sections of this privacy policy regarding the purpose of collecting personal information for the other services provided through the blue key.)

• 1.3

  Information Display and Search Services

  You can browse information (including overview of best-selling models, vehicle configuration information, etc.) on our The Durant Guild App, The Durant Guild WeChat Applet, GM China official website, The Durant Guild website and TDG Fashion Life WeChat Applet, and conduct searching on the same.

  When you use The Durant Guild App to use information display and search services, we collect your device information by way of in-app collection, which is used to ensure the proper operation of information presentation, search services provided by The Durant Guild App.

  We do not collect your personal information when you use The Durant Guild WeChat Applet, GM China official website, The Durant Guild website and TDG Fashion Life WeChat Applet to use information display and search services.

• 1.4

  Services Provided to You Regarding Your Vehicle Purchase

  The following materials cover the services that we provide to you in connection with vehicle purchase, which currently include (1) pre-purchase assistance services; (2) test-drive appointment services; (3) execution of letter of intent; (4) purchase of vehicle; (5) assist to provide automobile finance and insurance support services; (6) internet of vehicle card access services; and (7) charging station installation services. GM may adjust the scope of the above services with the development of its business and actual needs.

  Please note: User registration is required before you can use this business function on our online platform.

  • 1.4.1

    Pre-Purchase Assistance Services

    You may contact us through Offline Scenarios, The Durant Guild enterprise WeChat and The Durant Guild App. We will provide you with the pre-purchase assistance service, i.e., we get to know your purchase intention based on the information you provide so that we are able to recommend you your preferred models and products. The table below demonstrates the scope and method of collection of the Required Personal Information under this scenario.

    Channels Involved	Scope of Collection of Required Personal Information	Method of Collection
    Offline Scenarios, The Durant Guild Enterprise WeChat and The Durant Guild App	Your user ID (not applicable to Offline Scenarios), gender, age group, industry, country, city of residence, family size, vehicle model and vehicle series sourcing channel, market activity preferences, source store, store arrival time, current vehicle model, whether you have self-owned charging stations, whether you have parking lots, points of attention, points of concern, degree of brand familiarity, city of the car license plate, vehicle purchase city, vehicle purchase store, vehicle purchase time, vehicle purchase budget, purchase purpose, purchase method, intended brand, intended vehicle series and intended vehicle model	Offline Scenarios: offline collection. The Durant Guild enterprise WeChat, The Durant Guild App: relevant information shall be provided by users to customer service staff in such apps.

  • 1.4.2

    Test Ride and Test Drive Appointment

    You may contact us through The Durant Guild App, The Durant Guild WeChat Applet, The Durant Guild Enterprise WeChat and Offline Scenarios, and we will provide you with test ride and test drive service of your intended vehicle model(s).

    Please note: if you wish to participate in our test ride and test drive activity, we will separately enter into a test ride and test drive agreement with you.

    Further, due to the nature of our test ride and test drive activity, we need to safeguard the legitimate rights of you and your accompanying persons (if any) to the fullest extent possible, and therefore we may need to verify your authentic identity. In particular,where applicable, we will verify your identity through your mobile communication operator's SMS verification (additional communication costs will be borne by you in accordance with your mobile communication operator's tariff standards, which may incur additional communication costs); where applicable, we (or our suppliers) may need to verify the authenticity of these identity documents and verify the information provided by the applicants, using technical measures such as personal identification verification devices, facial image comparison techniques and etc.; where applicable, we (or our suppliers) will also verify your identity by facial recognition verification and other similar means. When facial recognition verification is turned on in this service scenario, GM will not collect your face image; instead, your facial recognition characteristics will be collected independently by our suppliers. We will again inform you of the necessity of the collection and processing of your facial recognition characteristics and other rules such as impact on your personal legitimate right by means of pop-up window or other proper methods.

    The table below demonstrates the scope and manner in which we collect the Required Personal Information in this scenario. The Required personal information collected by us is necessary for the execution and performance of the test ride and test drive agreement.

    Channels Involved	Scope of Collection of Required Personal Information	Collection Method
    The Durant Guild App, The Durant Guild WeChat Applet and Offline Scenarios	Your name, gender, mobile phone number, ID card number, driver's license image, SMS verification code, medical information for first aid, emergency contact name and telephone number of the emergency contact, source channel of the test ride and test drive activities, intended test ride and test drive location, user ID (not applicable to Offline Scenarios)	In-app Collection, User input or offline collection

  • 1.4.3

    Letter of Intention

    You can contact us through The Durant Guild WeChat Applet and Offline Scenarios for execution of the letter of intention. The table below demonstrates the scope and manner in which we collect the Required Personal Information in this scenario. The purpose for collecting the information below is to confirm your intention towards the vehicle. The required personal information collected by us in this scenario is necessary for the execution and performance of such letter of intention.

    If the purchaser of the vehicle is an enterprise, we will also collect the enterprise name and the unified social credit code of the enterprise.

    Please note: If you are not the actual purchaser of the vehicle or the legally authorized agent of the purchasing enterprise (“contact person of the enterprise”), please ensure that you obtain the informed consent of such person (s) (where applicable) before you provide their personal information to us.

    Channels Involved	Scope of Collection of Necessary Personal Information	Collection Method
    The Durant Guild WeChat Applet and Offline Scenarios	Your name, mobile phone number, type of identification, ID card number or passport number, intended vehicle model, vehicle purchasing store and city of the car plate We will also collect your user ID if you sign the vehicle purchase letter of intention with us through digital platforms	In-App collection, User input or offline collection

  • 1.4.4

    Vehicle Purchasing

    Actual purchasers may purchase vehicles by signing purchase contracts through the The Durant Guild App. As required by laws and regulations, and in order to protect the legitimate right of the actual purchasers to the maximum extent, actual purchasers shall agree to our (or our suppliers') use of appropriate equipment or facilities to verify the true identity of the actual purchasers, in particular: where applicable, we will verify your identity through your mobile operator's SMS verification (additional communication charges may be borne by you in accordance with your mobile operator's tariff standard.) Where applicable, we (or our suppliers) may need to verify the authenticity of identity documents by using personal identification verification devices, facial image comparison techniques and other technical measures. Where applicable, we (or our suppliers) will also verify your identity by, for example, facial recognition verification. When facial recognition verification is turned on in this service scenario, GM will not collect your face image; instead, your facial recognition characteristics will be collected independently by our suppliers. We will again inform you of the necessity of the collection and processing of your facial characteristics and the impact on your personal legitimate right by means of pop-up window or other similar means.

    The following table shows the scope, manner and purpose of collection of the Required Personal Information in this scenario. The personal information of the actual purchaser and the actual payer that we collect in this scenario is necessary for the execution and performance of a purchase contract.

    When the purchaser is an enterprise, we also collect the enterprise's name and tax identification number.

    Please note: if you are not the actual purchaser, the actual payer or the contact person of the enterprise purchasing the vehicle, please ensure that you obtain the informed consent of these persons (where applicable) before you provide us with their personal information.

    Scope of Collection of Required Personal Information	Manner of Collection	Purpose of Collection
    Your user ID, name of the actual purchaser, type of identification, identity card number or passport number, mobile phone number, location, car model and series. When the purchaser is an enterprise, we also collect the name of the enterprise's legal representative, type of identification of the legal representative, identification number of the legal representative, mobile phone number of the legal representative and work email of the legal representative; and the name, work email and work telephone of the enterprise's contact person	In-app collection, user input	For generating purchase orders and signing purchase contracts
    Name of the actual payer, bank name, bank account, transaction record information (i.e., payment time, payment amount, payment channel, which are also applicable to below), invoice information, SMS verification code	In-app collection, user input	Completion of payment or refund

  • 1.4.5

    Assistance on providing automotive finance and insurance ancillary services

    When you purchase a vehicle through our The Durant Guild App and Offline Scenarios, based on your needs, we may recommend you qualified automotive finance service providers from which you can purchase automotive finance and insurance ancillary products and obtain corresponding services. The following table shows the scope, manner and purpose of collection of the Required Personal Information in the context of these service scenarios.

    Channel involved	Scope of Collection of Required Personal Information	Manner of Collection	Purpose of Collection
    The Durant Guild App and Offline Scenarios	Your name, ID number, contact number, purchased or interested car model, purchased or interested financial product	In-app collection, user input or offline collection	Verify the specific information about the automotive finance and insurance service products and services you have received for the vehicle purchased through The Durant Guild;; With your consent, get to know your degree of satisfaction for automotive finance and insurance ancillary service products for reference to qualified automotive financial service product suppliers in cooperation with us, so that such automotive finance and insurance service providers can better provide customized automotive finance and insurance ancillary services and products for you.

    If the existing financial products do not meet your needs, you may also provide us with the Expanded Personal Information, and we will assist in analyzing and designing automotive finance and insurance products that meet your needs for the reference of automotive finance and insurance service providers. Customized financial products are one of our extended services. The following table shows the scope, manner and purpose of collection of the Expanded Personal Information in this scenario.

    Channel involved	Scope of Collection of Expanded Personal Information	Manner of Collection	Purpose of Collection
    The Durant Guild App Offline Scenarios	The following information of the car license plate holder and borrower: Name, gender, nationality, ethnicity, ID number, front and back photo of ID card, occupation, contact number, marital status, family status, address, employer, income status, real estate ownership status, tax payment status, bank account opening status, payment information, credit information, insurance policies, vehicle purchase contracts, loans contracts, registration certificate information, vehicle license information, vehicle sales invoice image, vehicle location information, other necessary information approved by you	In-app collection, user input or offline collection	Getting to know your needs for automotive finance and insurance ancillary services

  • 1.4.6

    Internet of vehicle card access service

    According to the requirements of national and local laws and regulations, if you purchase a vehicle containing an internet of vehicle card, we need to apply for the internet of vehicle card access for your car. The following table shows the scope and manner of collection of the Required Personal Information in this scenario. Your personal information collected by us under this scenario is necessary for us to perform our statutory obligations.

    In order to provide the internet of vehicle card access service, we (or the supplier authorized by us) need to use technical measures such as identity authentication and identification equipment, personal image comparison techniques to verify the authenticity of your ID documents and retain your full-face bareheaded photo. When facial authentication is turned on in this service scenario, GM will not capture your facial image. Your facial recognition features will be captured independently by our supplier. We will inform you again of the rules regarding the necessity of collecting and processing your facial recognition features, the impact on your personal legitimate rights etc., through pop-up windows and other similar means.

    Please note: When the purchaser is an enterprise, we will also collect the enterprise's vehicle information, internet of vehicle card information, valid ID of the purchasing enterprise, valid ID of the person in charge of the enterprise, letter of authorization from the enterprise and full-face bareheaded photo of the person in charge of the vehicle.

    Please note: If you do not choose to apply for the internet of vehicle card access service, we can only s provide emergency functions in relation to life safety such as emergency calls and emergency rescue, but cannot provide network connention and data transition, which will result in our incapability to provide you with some or all of the OnStar services.

    Channels Involved	Scope of collection of Required Personal Information	Manner of collection
    Offline Scenarios	Your name, ID number, vehicle information, internet of vehicle card information, your full-face bareheaded photo When the purchaser is an enterprise, we will also collect the front and back image of ID card and full-face bareheaded photo of the person in charge of the vehicle designated by the enterprise.	Offline collection

  • 1.4.7

    Charging station installation service

    You can use the charging station installation service through The Durant Guild App and Offline Scenarios. The following table shows the scope, manner and purpose of collection of the Required Personal Information in this scenario.

    Channels Involved	Scope of collection of Required Personal Information	Manner of collection	Purpose of collection
    The Durant Guild App and Offline Scenarios	Your name, mobile phone number, home address, installation address, license plate number, vehicle model, vehicle identification number/VIN, recording	In-app collection or user input, offline collection in Offline Scenarios	Determine the specific information about the installation address of the charging station and provide the charging station installation service accordingly

• 1.5

  Provision of driving-related services to you

  The following describes the driving-related services that we provide to you. These services include (1) OnStar service; (2) in-car entertainment service; (3) vehicle data monitoring; (4) after-sale support service; (5) pick-up and delivery service; and (6) vehicle replacement and second-hand car transaction service.

  Please note: You are required to complete user registration and bind the vehicle with such user account before using these services.

  • 1.5.1

    OnStar service

    You can use OnStar service through the Durant Guild in-car terminal and by directly calling OnStar customer service hotline, so that the realization of functions including locating and traveling, in-car wireless network connection, emergency rescue, vehicle condition detection, vehicle condition analysis, etc. The following table shows the scope, manner and purpose of collection of the Required Personal Information in this scenario.

    Please note: For certain Onstar services we provide, we need to collect your vehicle location information, and vehicle trajectory and recording information. At that time, we will separately seek your consent through The Durant Guild Car-mounted Terminal through pop-up windows or other applicable means and obtain authorization from you within the agreed period. At the same time, in order to provide relevant services, we must also obtain permissions for using the relevant equipment from you through the The Durant Guild App and The Durant Guild Car-mounted Terminal (see Section 1.7 for details).

    Please note: Based on the frequently updated legal and regulatory requirements, as well as GM’s business plan and the vehicle functions and technologies at the then timing (such as intelligent driving assistant), with your consent, we may engage a qualified entity to collect your vehicle's location information, trajectory, inside and outside images and images, while we will not have any control or decision making power of such data (i.e. we will not collect, store, or process such original personal information). You need to independently review the privacy policies in effect at that time of the engaged entities regarding the types and contents of personal information they deal with, as well as details such as how they handle and protect such personal information. Nevertheless, we may share some of your personal information with these entities to support their compliance requirements and ensure that we use their resources in compliance, so that you will be able to continue using the relevant services.

    Required Personal Information	Manner of collection	Purpose of collection
    Offline Scenarios
    Mobile phone number, SMS verification code If you need to transfer the ownership of the vehicle, you will also need to provide your driving license, ID number and a photo of you holding both documents	Offline collection	For determining your needs and proceed with next steps, confirm user identity, unlock vehicle, transfer the ownership
    The Durant Guild App and The Durant Guild Car-Mounted Terminal
    Your vehicle location information, home address, business address, vehicle whereabouts trajectory, vehicle condition, your device information	Home address and business address are entered by the user, and other information is collected through the vehicle communication module	For determining the approximate location of you, your mobile device or your vehicle so that we can provide and refine our location services, in-car navigation services or other services
    Mobile phone number, Mobile Device Number (IMEI) (not collected by Durant Guild in-car terminal)	In-app collection, in-car terminal collection, user input	For implementing the in-car wireless network connection function
    Vehicle location information, recording	In-app collection, in-car terminal collection, user authorization	For calling blue key customer service hotline
    Vehicle location information, vehicle speed, vehicle collision information, vehicle trouble information, accident information, diagnosis information, vehicle current and historical condition information, seat belt use information, vehicle surrounding environment information, contact information of driver or contact person.	In-app collection, in-car terminal collection, user authorization	For getting to know the current situation and provide emergency services
    Detailed information, historical condition (including the number of collisions), maintenance condition and usage condition evaluation of your vehicle.	Collected through vehicle sensors	Used for vehicle condition detection, vehicle evaluation services
    Vehicle location information, vehicle details	Collected through vehicle sensors	Used for remote control of vehicles
    Fuel and power consumption information, vehicle location information, vehicle whereabouts trajectory, acceleration or deceleration data	Collected through vehicle sensors	Provide driving behavior analysis report
    Your vehicle ID/VIN, mobile phone number, door state, trunk state, window state, sunroof state, double-blinking warning light state, engine start state, headlight state	Collected by car terminal	Inform of any abnormality of the vehicle in time
    Your vehicle ID/VIN, year and model of vehicle, vehicle screen model and configuration, record of wallpaper purchase, record of downloading and switching wallpaper, OTA record	In-app collection, in-car terminal collection, user authorization	Installation service of vehicle wallpaper
    Recording of calls between you and OnStar customer service advisor, the emergency services provider or the police	In-app collection, in-car terminal collection, user authorization	Resolve your issue and respond to your requests and assist in providing rescue services
    Your name, mobile phone number	In-app collection or in-car terminal collection	Provide you with notification, information and data necessary for vehicle maintenance and repair
    Your vehicle details and vehicle ID/VIN	In-app collection or in-car terminal collection	Assist you with troubleshooting, usage evaluation and research, as well as internally conduct vehicle related safety analysis and address potential troubleshooting
    Your name, mobile phone number, questions and comments, pictures of relevant questions	In-app collection or in-car terminal collection	Collect your feedback, understand your needs, and provide you with quality service
    Your name, contact number, vehicle information, troubleshooting information	In-app collection or in-car terminal collection	Assist you to make an appointment with a distributor

  • 1.5.2

    In-Car entertainment services

    Please note: In-car entertainment services are mainly provided by qualified in-car entertainment service providers who cooperate with us. You can obtain in-car entertainment services through The Durant Guild Car-Mounted Terminal, including online media playback, in-car voice wake-up and recognition, opening third-party applications members, applets, Baidu account services and map navigation. The aforementioned supplier will collect relevant personal information from you to provide such services based on the applicable privacy policy separately signed with you. Considering that we are the operator of the vehicle entertainment service platform, in order to ensure the smooth operation of the platform and comply with the requirements of relevant laws and regulations for the platform operator (to the extent applicable), you hereby agree that we can obtain your personal information from such suppliers. The specific personal information and supplier information referred to this paragraph are detailed in section 2.3.4.4.

    In addition, to enable you to download car applications from the app store, we need to collect basic vehicle information, record of applications download and installment from you through the car-mounted terminal.

  • 1.5.3

    Vehicle data monitoring

    In accordance with the requirements of national and local laws and regulations, we need to monitor vehicle data for your new energy vehicle and access your vehicle data to the new energy vehicle data collection and testing platform of the government and us. Your personal information collected by us in the vehicle data monitoring service scenario is necessary for us to fulfill our legal obligations. The table below demonstrates the scope, method and purpose of the personal information required to be collected by us in the context of vehicle data monitoring.

    Channels Involved	Scope of collection of necessary personal information	Collection method	Collection purpose
    Durant Guild Car-mounted Terminal	Vehicle static information, vehicle dynamic data, driving motor data, complete vehicle data, fuel cell data, engine data, vehicle location information, charging data, vehicle collision data, extremum data, alarm data, reserved terminal data, data for high-voltage system and spare parts, and other information required to be collected according to the latest laws and regulations or government requirements.	In-app collection, in-car sensor collection	Vehicle data monitoring of new energy vehicles in accordance with the requirements of national and local laws and regulations

  • 1.5.4

    After-sales support services

    You can access vehicle purchase and after-sales service through The Durant Guild App and Offline Scenarios. For some services, you may need to visit our offline stores for after-sales support services. The following table demonstrates the scope, method and purpose of the Required Personal Information collected by us under this scenario.

    Please note that you shall bind your vehicle info before you access to the after-sales support services via The Durant Guild App.

    Scope of collection of Required Personal Information	Collection method	Collection purpose
    The Durant Guild App
    Your name, ID number, driver's license information, mobile phone number, user ID, vehicle purchase information, vehicle information, vehicle type, license plate, vehicle name	In-app collection or user input, user authorization	For binding user account to vehicle and dispute handling
    Your name, ID number, driver's license information, mobile phone number, user ID, vehicle purchase information, vehicle information, vehicle type, license plate, vehicle name, historical maintenance information, vehicle insurance and policy information	In-app collection or user input, user authorization	Maintenance
    Your name, mobile phone number, (static) parking location, vehicle speed, vehicle collision information, failure information, accident information, diagnosis information, vehicle current and historical maintenance information, seat belt use information, vehicle surroundings information, contact information of driver or contact person	In-app collection or user input, user authorization, vehicle sensor collection	Used for vehicle failure analysis/diagnosis
    Your name, mobile phone number, static (parking) location, license plate number, vehicle model information, vehicle identification number/VIN, recording	In-app collection or user input	Road rescue
    Your name, mobile phone number, vehicle model information, vehicle identification number/VIN, historical vehicle maintenance record and vehicle insurance events records	We will collect basic information from the application and then conduct an interview with you offline. You will voluntarily provide the Required Personal Information	Vehicle replacement
    Offline Scenarios
    Your name, mobile phone number, vehicle location, ID number, driver's license information, vehicle information, vehicle type, license plate, vehicle name, historical maintenance information, vehicle identification/VIN, vehicle insurance and policy information In order to improve service quality, we will record after-sales service calls	Offline collection	To provide you with after-sales support services such as repair, maintenance, failure diagnosis, replacement of customized parts, after-sales claims, etc.

  • 1.5.5

    Door-To-Door Pick-Up and Delivery Service

    You can use your door-to-door service through The Durant Guild App and Offline Scenarios. The following table demonstrates the scope and manner of the Required Personal Information collection necessary for us to collect in this scenario. Our purpose for collecting the personal information below is to know the specific location of the vehicle and to pick up and deliver the vehicle to your door.

    The channels involved	Scope of collection of Required Personal information	Collection method
    The Durant Guild App and Offline Scenarios	Your name, mobile phone number, address, (static) parking location, vehicle delivery location, vehicle identification number/VIN, license plate number, vehicle model, vehicle purchase time, vehicle failure information, recording	In-app collection or user input, offline collection in Offline Scenarios

  • 1.5.6

    Vehicle replacement and second-hand car trading

    You can conduct vehicle replacement or second-hand car trading through our Offline Scenarios. The personal information we collect in this service scenario includes: your name, ID card number, driver's license information, mobile phone number, license plate number, vehicle information, location, historical warranty and maintenance information, vehicle purchase information and vehicle insurance information. We collect the aforementioned personal information to provide you with service for vehicle replacement and second-hand car trading. We collect the aforementioned personal information offline.

• 1.6

  Other services provided to you

  • 1.6.1

    Business promotion activities

    You may participate in various reward point feedback projects, auto shows, product or service promotion activities ("Commercial Promotion Activities") held through The Durant Guild App, The Durant Guild Enterprise WeChat, The Durant Guild WeChat Applet and other digital platforms and Offline Scenarios. The commercial promotion activities fall within the scope of the expanded business function. The following table demonstrates the scope, method and purpose of our Expanded Personal Information collection in this scenario.

    Expanded Personal Information	Manner of Collection	Purpose of Collection
    Your name, gender, interests and hobbies, current car model and price, preferred car model, residential address, birthday, ID number, marital status, family members, children's information, pet information, industry, job, commonly used social media, car purchase plan and budget, commonly used luxury brands, mileage, car purchase dealer, nationality, education background, religion, dietary restrictions To participate in certain activities held by us, it may also be necessary to collect your driver's license number, front and back pages of the scanned copies of driver's license In Offline Scenarios, if you visit our stores, in order to maintain security, safeguard store operation and public safety, our stores are equipped with video surveillance systems that film and record activities within the store scope.	In-app collection, user input or offline collection, or user’s voluntary release	To invite your joining into a reward point feedback project
    	In-app collection, user input and offline collection	Participation in a car show
    	In-app collection, user input or offline collection, or user’s voluntary release	Product or service promotion activities
    Your name, gender, interests and hobbies, current car model and price, preferred car model, residential address, birthday, ID number, marital status, family members, children's information, pet information, industry, job, commonly used social media, car purchase plan and budget, commonly used luxury brands, mileage, car dealer, nationality, education background, religion, dietary restrictions	User input	Expert online consulting services

  • 1.6.2

    Marketing survey activities

    You can participate in promotional marketing surveys, questionnaire surveys and customer profile analysis activities (“Marketing Survey Activities”) held through The Durant Guild App, The Durant Guild Enterprise WeChat, other digital platforms and Offline Scenarios. Marketing Survey Activities are expanded business functions. The following table demonstrates the scope, manner and purpose of our expanded personal information collection in this scenario via the channels mentioned in this paragraph.

    Expanded Personal Information	Manner of Collection	Purpose of Collection
    Your name, gender, date of birth, nationality, education background, occupation, income level, email address, hobbies, driving behavior, shopping behavior, lifestyle information, family information, video, audio, images, your location and whereabouts in Offline Scenarios, and your address, mobile phone number, email address, vehicles owned, driving license information, license plate, social media accounts, pet information, preferred car models, identification number, vehicle purchase and budget, commonly used luxury brands, car dealer, religion, dietary restrictions	In-app collection, user input or offline collection, user disclosure	Conduct promotional marketing surveys, questionnaires and customer behavior analysis, online and offline interviews

  • 1.6.3

    Personalized recommendations

    You can choose to establish your user profile and receive personalized recommended content and promotional information ("Personalized Recommendations") through The Durant Guild App, The Durant Guild WeChat Applet and The Durant Guild Enterprise WeChat. Personalized Recommendation Services are expanded business functions. The following table demonstrates the scope, manner and purpose of our extended personal information collection in this scenario.

    When providing Personalized Recommendations services, we may use your personal information to make automated decisions. We will ensure that the process is transparent, and the results are fair and equitable. We will not apply unreasonable discrimination to individuals in terms of transaction conditions (such as transaction price). You may choose to prohibit us from targeting your personal characteristics in accordance with section 9 and may decline to use Personalized Recommendations solely through automated decisions. You will also have the right to seek an explanation when we use automated decisions to make decisions that have a material impact on your legitimate interest. Any automated decisions made using your personal information will be subject to a personal information protection impact assessment in accordance with applicable laws and regulations. The basic principle of the automated decision-making we will use is: to provide personalized and customized services to you by processing and analyzing the user's personal information legally collected, forming the user profile and need characteristics, and combining information systems, machine learning, knowledge atlas and other computer technologies.

    Scope of Expanded Personal Information	Manner of Collection	Purpose of Collection
    Your name, gender, date of birth, nationality, education background, occupation, income level, email, hobbies, driving hobbies, shopping behaviour, lifestyle information, family information, video, audio, recordings, information on Durant Guild vehicles, information on other vehicles you own, driver's license number, front and back copy of the scanned copy of driver's license, license plate, social media accounts, pet information, preferred car models, ID number, car purchase plan and budget, commonly used luxury brands, car dealers, religion, dietary restrictions, etc.	In-app collection or user input	Build your user profile, provide personalized recommendation content and promotional information

  • 1.6.4

    Visitor Registration Service

    You may apply for visitor registration service through the GM Enterprise WeChat to visit GM China Campus or other applicable GM premises in the future.

    For the visitor registration service scenario, the personal information required to be collected by us includes name, mobile number and employer. You will also be required to provide the vehicle license plate number when you need to park your vehicle in the campus. The purpose of collecting the aforementioned personal information is to build a visitor registration file. Our method of collection is that: (1) GM employees who invite a visitor to input the visitor's mobile number and arrival time, and (2) afterwards, the visitor subsequently inputs his/her employer, name, mobile number and vehicle license plate number (if available).

  • 1.6.5

    Online Mall

    Based on our current operational plan, you can purchase GM boutique in our digital mall through scanning the QR code in an Offline Scenario. In order to enter the online mall, you need to register as a user of TDG Fashion Life WeChat Applet, and during this process we will collect your WeChat number, WeChat user unique identification (Union ID & Open ID), WeChat nickname, WeChat profile picture, phone number and mobile device information. Accordingly, in order to complete the relevant order and deliver the goods, and to provide exchange or return services, we will collect the name, address and contact number of the consignee that you have entered. If you are not the consignee and / or the actual payer, you should ensure that you have obtained the informed consent of the actual consignee or the actual payer before you type in the personal information of such person.

• 1.7

  Access Permissions to Your Device

  Certain kinds of personal information collected in the above business functions may require you to enable us to access to your device (including your mobile devices and car-mounted terminal), including but not limited to access to camera, photo album, microphone, audio recording, and geolocation. Details are in the following table:

  • 1.7.1

    Access at Car-Mounted Terminal

    Device Permissions Scope	Business Scenario	Purpose of Use	Permission Prompt
    Access Permissions to Microphone, Audio Recording	OnStar Service	Record call content for emergency assistance, clarifying user requests or improving service quality	If you use the Blue Button in the car to make a call, the microphone permission will be enabled. If you do not want us to enable microphone permission, please do not use the Blue Button for calls.
    	In-car entertainment services with voice activation and recognition	Facilitate users to give instructions in a more convenient voice manner	Before accessing the permission, you can choose the duration of the authorization. When the authorization expires, we will seek your consent again.
    Geographic Location	Vehicle data monitoring	Performance of legal data monitoring obligations	Before accessing the permission, you can choose the duration of the authorization. When the authorization expires, we will seek your consent again.
    	In-car entertainment services with voice activation and recognition	Allow users to set destinations, check the weather, and other services requiring location information via voice commands; we access your location when you search for nearby gas stations, parking lots, dining spots, attractions, and other places	When the user uses the in-car entertainment's voice activation, recognition, or applet features for the first time, we will seek your consent and you can choose the duration of the authorization. Once the period expires, we will ask for your consent again. If you decline to grant permission, the in-car entertainment service will still function normally. However, if your voice command requires access to location data, we will prompt you for authorization via voice notification.
    	OnStar Service	Used to ascertain your or your vehicle’s approximate location so that we can offer and enhance our location-based services, navigation destination dispatch services, or other services; used to dial the blue-key customer service hotline; to understand the current situation and provide emergency services; for remote control of the vehicle; and to offer driving behavior analysis reports.	When the user uses the OnStar service for the first time, if the user has not granted permission or the permission is outside the validity period of the authorization, the system will request authorization again when accessing the OnStar service.
    Contacts	In-car entertainment services with voice activation and recognition	Enable users to make phone calls in a more secure manner.	When the user uses the voice service function for the first time, if the user has not granted permission or the permission is not within the authorization validity period and the system will request the authorization again when accessing the contacts permission.
    Notification	Commercial promotions, promotional surveys, personalized recommendations	Used to push updates to you about vehicles, products, and services	Notification permissions will be turned on when you use Durant Guild Car-Mounted Terminal. You can turn off notifications in the manner described in section 9.

  • 1.7.2

    Access Permissions to Mobile Device

    The Durant Guild App will request access your (1) camera and/or photo album read and write permissions, (2) microphone, audio recording access permissions, (3) geographic location; and (4) notification permissions. When you use The Durant Guild App for the first time, we will ask you for permissions. If a user has not granted permission or the permission is not within the authorization validity period, resulting in the inability to use the corresponding services, you will need to make adjustments manually in your system settings.

    Device Permission Scope	Business Scenarios	Purpose of Use	Permission Prompt
    Camera and/or Photo Album Read and Write Permissions	User registration	Upload profile picture	Ask before accessing permissions
    	OnStar Services	Capture relevant issue images
    Microphone, Audio Recording Access Permissions	Make test drive and test rides, or buy a vehicle	Authentication	Ask before accessing permissions
    	OnStar services, after-sales support services	Record call content for emergency assistance, clarifying user requests, or improving service quality
    Geographic Location	OnStar services, after-sales support services	Used to show you the location of your vehicle and/or to better locate the vehicle and you when you need to use the relevant after-sales service	Ask before accessing permissions
    	Make test drive and test rides, buy a vehicle	Recommend nearby vehicle sales and service outlets to you	Ask before accessing permissions
    Notification	Commercial promotions, promotional surveys, personalized recommendations	Used to Push updates to you about vehicles, products and services	Ask upon the first launch of the The Durant Guild App
    Bluetooth	Bluetooth key	Used for near field control of your vehicle with Bluetooth connection	Ask before accessing permissions

    The Durant Guild WeChat Applet will request access to your (1) camera and/or photo album read and write permissions; (2) geographic location; and (3) notification permissions. When you use the Durant Guild WeChat Applet for the first time, we will ask for your permission. If a user has not granted permission or the permission is not within the authorization validity period, resulting in the inability to use the corresponding services, you will need to make adjustments manually in your system settings.

    Device Permission Scope	Business Scenarios	Purpose of Use	Permission Prompt
    Camera and/or Photo Album Read and Write Permissions	User registration	Upload or replace profile picture	Ask before accessing permissions
    	Account Management
    Geographic Location	Make test drive and test rides, buy a vehicle	Recommend nearby vehicle sales and service outlets to you	Ask before invoking permissions
    Notification	Commercial promotions, promotional surveys, personalized recommendations	Used to Push updates to you about vehicles, products and services	Ask before invoking functions of the Durant Guild WeChat Applet

  • 1.8

    Personal Information Collected by Tencent Platforms

    We will not collect any of your PI when you access the Tencent Platforms. However, for the purpose of participating in Tencent Platform activities and interacting with us, you authorize us to obtain your WeChat user account information, including your profile picture, nickname, user ID, geographic location and other PI.

    In addition, Tencent may process your PI as an independent PI processor, as described in Section 2.3.1 in more details. Kindly note that the Tencent Platforms may include a WeChat related SDK (Software Development Kit) and standard functionality for all platforms created in the WeChat environment (as described in Section 2.3.4). For the purpose of data monitoring and user behavior analysis, we will need Tencent to process your PI through the SDK. Tencent will collect and use your PI in accordance with its Personal Information Protection Policy. You have the right to decide whether or not to consent to such content for the purpose of participating in data monitoring and user behavior analysis. We will require Tencent to collect and use your PI in a lawful and compliant manner.

  • 1.9

    Personal Information Collected on Official Weibo

    We will not collect any of your PI when you access the Official Weibo. However, for the purpose of participating in activities of Official Weibo and interacting with us, you authorize us to obtain your Weibo user account information, including your profile picture, nickname, User ID, geographic location and other PI.

    In addition, Beijing Wei Meng Chuang Ke Network Technology Co., Ltd. ("WMCK" or "Sina Weibo") may process your PI as an independent personal information processor, as described in Section 2.3.2 in more details. Kindly note that the Official Weibo may include SDK (Software Development Kit) relating to Sina Weibo and standard functionality for all platforms created in the Weibo environment (as described in Section 2.3.4). For the purpose of data monitoring and user behavior analysis, we will need Sina Weibo to process your PI through the SDK. Sina Weibo will collect and use your PI in accordance with its Personal Information Protection Policy. You have the right to decide whether or not to consent to such content for the purpose of participating in data monitoring and user behavior analysis. We will require Sina Weibo to collect and use your PI in a lawful and compliant manner.

2. How We Collect and Use Your Personal Information

• 2.1

  Exceptions to the Authorization by Consent

  You fully understand and agree that, in accordance with the relevant laws and regulations, we can collect and use your PI without your authorization (but in any event within a reasonable scope as permitted by applicable laws and regulations) in the following situations: (1) Where it is necessary to conclude or fulfill a contract entered between you and GM; (2) Where it is necessary to fulfill statutory duties and responsibilities or statutory obligations; (3) Where it is necessary to respond to a public health emergency or in the case of emergency in order to protect the life, health, and property of natural persons, under emergency conditions (for instance, the emergency rescue under OnStar Services) (we will nevertheless promptly notify you of such collection and use of your PI after such emergency ceases to exist); (4) In order to implement news reporting, supervision by public opinion, and other such activities for public interest; (5) Where the PI has been disclosed to the public by yourself or otherwise lawfully disclosed to the public; (6) Other circumstances as stipulated by laws, regulations, ordinances and policies.

• 2.2

  Separate Consent to Processing SPI

  • 2.2.1

    As required by national and local laws and regulations, we may need to obtain your separate consent to processing PI in certain personal information processing situations or in the event of PI processing activities that may materially affect your interests. You can view the Checklist for further details. We will update and refine this list on an ongoing basis according to laws and regulations as updated from time to time, actual needs of business scenarios and user suggestions we received.

  • 2.2.2

    Any processing of the SPI you provide to us will be subject to a Personal Information Protection Impact Assessment conducted in accordance with applicable laws and regulations. We strongly recommend you to cautiously share with us any SPI as any illegal use of such information might lead to the infringement of your personal dignity or personal and property safety.

  • 2.2.3

    Under the circumstances listed in the Checklist, we will obtain your separate consent before collecting and processing your SPI. When giving separate consents, you will have the option to choose the duration of your consent. If the duration expires, we will seek your consent again when you try to continually use the service.

• 2.3

  Potential Independent Personal Information Processor of Your Personal Information

  • 2.3.1

    Tencent.

    Please note that, as the Tencent-related Platforms are established in the Tencent environment, any personal information you share through the Tencent-related Platforms may be collected and processed by Tencent directly, over which we will have no control, decision or detailed knowledge. For more details on the type and content of your personal information processed by Tencent and how Tencent handles and protects such personal information, please refer to Tencent's Personal Information Policy and Statement (https://weixin.qq.com/cgi-bin/readtemplate?lang=zh_CN&t=weixin_agreement&s=privacy).

    Upon Tencent’s request, we will support Tencent to meet your request to fulfill your rights upon the PI that is available to us solely through Tencent (except for any PI directly collected by us from you pursuant to this Statement). Upon Tencent’s request, we might also share with Tencent your certain PI necessary to support its compliance audit and inspection to ensure our compliant use of Tencent resources to operate the Tencent-related Platform (please see more details in Section 2.3.4 below). Subject to relevant laws and regulations, we may use such personal information after confirmation of the legality of the source of such personal information in accordance with the agreement between us and Tencent.

  • 2.3.2

    Sina Weibo.

    Please note that, as the Official Weibo is established in the Sina Weibo environment, any personal information you share through the Official Weibo may be collected and processed by Sina Weibo directly, over which we will have no control, decision or detailed knowledge. For details on the type and content of your personal information processed by Sina Weibo and how Sina Weibo handles and protects such personal information, you should refer to the Weibo Personal Information Protection Policy (https://privacy.weibo.com/policy) separately.

    Upon Sina Weibo’s request, we will support Sina Weibo to meet your request to fulfill your rights upon the PI that is available to us solely through Sina Weibo (except for any PI directly collected by us from you pursuant to this Statement). Upon Sina Weibo’s request, we might also share with Weibo your certain PI necessary to support its compliance audit and inspection to ensure our compliant use of Sina Weibo resources to operate the Official Weibo (please see more details in Section 2.3.4 below). Subject to relevant laws and regulations, we may use such personal information after confirmation of the legality of the source of such personal information in accordance with the agreement between us and Sina Weibo.

  • 2.3.3

    Shanghai Genyan Network Technology Co., Ltd.

    Please note that, as the Qiyuesuo for the facial recognition procedure is established under the environment of Shanghai Genyan Network Technology Co., Ltd. (“Shanghai Genyan”), your facial image and other personal information for the facial recognition process will be directly collected and processed by Shanghai Genyan, over which over which we will have no control, decision or detailed knowledge. For details on the type and content of your personal information processed by Shanghai Genyan and how Sina Weibo Network Technology Co., Ltd. handles and protects such personal information, you should refer to the privacy policy of the electronic signature platform of Shanghai Genyan. When you access to the facial recognition process, you will be forwarded to the electronic signature platform of Shanghai Genyan where its privacy policy will be displayed.

    GM will not collect facial features or images in identity authentication procedure, which will be solely collected by Shanghai Genyan. GM does not keep and retain any original facial image information, but only the result of identity authentication. Upon Shanghai Genyan’s request, we might also share with Shanghai Genyan your certain PI necessary to support its compliance audit and inspection to ensure our compliant use of its resources to complete identity authentication procedure (please see more details in Section 2.3.4 below).

  • 2.3.4

    Other Third-party Platforms

    In order to provide you with good service, our products and services may be connected with other third-party platforms, devices, systems, software, plugins, SDKs, etc. (collectively, “Other Third-Party Platforms”) for your convenience. These third-party platforms may operate independently and have their own personal information protection policies. We suggest that you read and understand their personal information protection policies before using such services. Since the third-party platforms are not owned or controlled by us, we are not responsible for the services and content of the third-party platforms and your use of the third-party platforms. If you have any questions regarding the third party's services, please consult the corresponding third party.

    （1）The information of Other Third-Party Platforms which may be involved in The Durant Guild App is shown in the table below:

    No.	App Name	Third-Party App Provider	Scenario and Purpose	Personal Information Collected	Third Party Personal Information Processing Rules
    1.	Account	SAIC General Motors Co., Ltd.	Used to change the phone number bound to the user account	Phone Number	http://www.saic-gm.com/www/information
    2.	Financial Loans - Individual\ H5	SAIC General Motors Finance Co., Ltd.	For credit pre-assessment and loans application by loans institutions	Name, gender, nationality, ethnicity, ID No., front and back photo of ID, occupation, telephone number, marital status, family status, address, employer, Revenue, real estate owned, tax payment, bank account opening, payment information, credit information, insurance policies, vehicle purchase contracts, Loans contracts, registration certificate information, driving license information, vehicle sales invoice image, other necessary and approved by you	https://www.saicgmac.com/PrivacyPolicy.aspx
    3.	Financial Calculation - Individual API	SAIC General Motors Financial Co., Ltd.	Used to calculate the principal and interest amount of a loan based on a specific product and repayment cycle, enabling users to evaluate the suitability of the corresponding car finance service product	Your preferred car model and configuration information, the car finance product you are interested in	https://www.saicgmac.com/PrivacyPolicy.aspx
    4.	JPush SDK	Shenzhen Hexun Huaguu Information Technology Co., Ltd.	Sends system notifications for individual mobile platforms through JPush	Device information, network information, vehicle location, permissions to read and write (albums, media and other files), list of installed apps for device	https://www.jiguang.cn/license/privacy
    5.	Baidu Maps SDK	Beijing Baidu Netcom Science and Technology Co., Ltd.	Used to display the map when users access it	Network information, vehicle location, permissions to read and write (albums, media and other files), device sensor information, list of installed apps for device	https://map.baidu.com/zt/client/privacy/index.html
    6.	WeChat Open Platform SDK	Shenzhen Tencent Computer Systems Co., Ltd.	Supports WeChat authorized login, WeChat sharing and WeChat payment each time users select WeChat login, WeChat sharing and WeChat payment	Order information, payment information, device information	https://support.weixin.qq.com/cgi-bin/mmsupportacctnodeweb-bin/pages/RYiYJkLOrQwu0nb8
    7.	Alipay SDK	Alipay (China) Network Technology Co., Ltd.	Helps users use Alipay in the The Durant Guild App each time users select an Alipay payment method	Device information, network device hardware address, network information, permissions to read and write (albums, media and other files), access to phone status	https://help.alipay.com/lab/help_detail.htm?help_id=201602900850&flag=0
    8.	JPush Security Authentication SDK	Shenzhen Hexun Huaguu Information Technology Co., Ltd.	Used for one-click login to the The Durant Guild App using the device's phone number during user login	Network operator, network information, mobile phone number, list of installed apps for device, device information, permissions to read and write (albums, media and other files)	https://docs.jiguang.cn/jverification/guideline/jghgzy
    9.	Weibo SDK	Beijing Weimeng Chuangke Network Technology Co., Ltd.	For achieving Weibo sharing and process risk control when users use Weibo Sharing	Device information	https://open.weibo.com/wiki/Sdk/privacy
    10.	Contract Lock (Qiyuesuo) SDK	Shanghai Cenyan Network & Technology Co., Ltd.	For collecting facial recognition characteristics for identity verification	Facial recognition characteristics, ID number, audio recording, name	When you enter the Electronic Signature Platform, you can click on the link to the Privacy Policy on the platform to view the full text of the Privacy Policy
    11.	UnionPay SDK	China UnionPay Co., Ltd.	Used each time a user selects a third-party payment method	Device information (hardware serial number, IMEI, IMSI, MAC address, BSSID), phone number, location information, device model, app information (app name, app version number).	https://www.chinaums.com/xwzx/gsgs/yszc/

    （2） The information of Other Third-Party Platforms which may be involved in The Durant Guild WeChat Applet is shown in the table below:

    No.	App Name	Third-Party App Provider	Scenario and Purpose	Personal Information Collected	Third Party Personal Information Processing Rules
    1.	UnionPay API	China UnionPay Co., Ltd.	Invoked when users submit a deposit	Order number, product name, product amount	https://www.chinaums.com/xwzx/gsgs/yszc/

    （3） The information of Other Third-Party Platforms which may be involved in TDG Fashion Life WeChat Applet is shown in the table below:

    No.	App Name	Third-Party App Provider	Scenario and Purpose	Personal Information Collected	Third Party Personal Information Processing Rules
    1.	UnionPay API	China UnionPay Co., Ltd.	Invoked when users submit a deposit	Order number, product name, product amount	https://www.chinaums.com/xwzx/gsgs/yszc/
    2.	SF Express API	SF Express Co., Ltd.	Invoked when users place an order and the warehouse dispatches the goods	Name, phone number, address	https://www.sf-express.com/chn/sc/privacy

    （4）The information of other third parties in the Durant Guild Car-Mounted Terminal is shown in the table below:

    No.	App Name	Third-Party App Provider	Scenario and Purpose	Personal Information Collected	Third Party Personal Information Processing Rules
    1.	Account	SAIC General Motors Co., Ltd.	Used to change the phone number associated with the user account	Mobile Phone Number	http://www.saic-gm.com/www/information
    2.	Account	Jiangsu Xian’an Technology Co., Ltd.	For device enrollment and obtaining device certificates	Vehicle Identification Number (VIN), Vehicle MTC (Manufacturing Traceability Characters)	through the following contact methods: 025-86639108-611 or 025-86639108-612
    3.	Account	Beijing Baidu Netcom Science and Technology Co., Ltd.	For triggering Baidu login, obtaining Baidu public information, etc.	Vehicle Identification Number (VIN), User ID	https://map.baidu.com/zt/client/privacy/index.html
    4.	Notification System	Shenzhen Hexun Huaguu Information Technology Co., Ltd.	Sending system notification through Jpush	Vehicle Identification Number (VIN), Network Information	https://www.jiguang.cn/license/privacy
    5.	App Store	Jiangsu Xian’an Technology Co., Ltd.	For device enrollment and obtaining device certificates	Vehicle Identification Number (VIN)	through the following contact methods: 025-86639108-611 or 025-86639108-612
    6.	Baidu Maps	Beijing Baidu Netcom Science and Technology Co., Ltd.	Provides map navigation services	Vehicle location information, user search records, user favorite records	https://vehicle.baidu.com/edcplatform/api/contractfile?ak=gmc_t1xc&type=101&sign=d03cff42044be291844820f41b5249e9
    7.	Applet	Beijing Baidu Netcom Science and Technology Co., Ltd.	Provides services such as car washing, refueling, hotel reservation, flight inquiry, movie inquiry, scenic spot ticket purchase, refueling and parking, etc.	Basic vehicle information, vehicle location information, owner’s license plate number, owner’s mobile phone number, owne’s ID number	applicable to the “Xiaodu In-Vehicle Application Privacy Policy”. When you use the relevant applications in Durant Guild Car-Mounted Terminals, you can view the full text of the “Xiaodu In-Vehicle Application Privacy Policy” in the application.
    8.	Baidu account	Beijing Baidu Netcom Science and Technology Co., Ltd.	Provides in-vehicle Baidu account login related services	Baidu account number, car owner’s license plate number, mobile phone number and other basic user information
    9.	Voice assistant	Beijing Baidu Netcom Science and Technology Co., Ltd.	Provides in-vehicle voice wake up, recognition related services	Personal voice information, address book contacts and vehicle location information
    10.	IQIYI	Beijing Baidu Netcom Science and Technology Co., Ltd.	Provides in-vehicle video playback related functions	IQIYI account basic information, play record, favorite list and user order information
    11.	Online media	Beijing Baidu Netcom Science and Technology Co., Ltd.	Provides in-vehicle online media playback related functions	Resource side account basic information, play record, favorite list, vehicle location information and user order information
    12.	Baidu Pay	Beijing Baidu Netcom Science and Technology Co., Ltd.	Provides in-vehicle scene related goods purchase services	Baidu Pay account basic information, order information
    13.	Baidu Input	Beijing Baidu Netcom Science and Technology Co., Ltd.	Provides in-vehicle input functions	None	https://ime-privacy.cdn.bcebos.com/online/agreement_gm20230329.html

  • 2.4

    GM Entrusts Third Parties to Process Your PI on GM's Behalf

    GM may entrust third parties (“Entrusted Third Parties”) to process your personal information on GM's behalf. Such Entrusted Third Parties may include marketing companies, market research and consulting companies, public relations companies, technology development companies (including suppliers that develop software and platforms for GM or authorize GM to use their software platforms, etc.), third parties that assist us to provide you with customer service, third parties that assist us with electronic certification and other service agents that we deem necessary. The Platform may embed platforms, devices, systems, software, plug-ins, SDKs, etc., of the Entrusted Third Parties. We will conduct strict security examination on the channel through which the entrusted third parties acquire relevant information. Meanwhile, with a view to properly protecting your personal information, GM will enter into a proper agreement with such entrusted party, which shall specify the purpose, term and method of entrusted processing of personal information, the type of personal information and protection measures of such entrusted party, as well as issues related to sub-entrustment of the entrusted party and the rights and obligations of each party. GM will monitor the personal information processing activities of the Entrusted Third Parties and prudently approve in advance any further sub-entrustment of the Entrusted Third Parties to process your PI.

    The information of the Entrusted Third Parties is shown in the table below:

    No.	Entrusted Third Parties	Code Name	Scope of Personal Information Collected	Purpose	Manner
    1.	Shanghai Genyan Network Technology Co., Ltd.	Individual Owner Information	Individual owner name, ID type, ID number, mobile phone number	Electronic Vehicle Purchase Contract Generation and Signing, Identity Authentication, Mobile Phone Number Change, Identity Authentication	API/H5 data collection
    2.	Shanghai Moyan Network Technology Co., Ltd.	Enterprise Owner Information	Name, ID type, ID number and mobile phone number of the legal representative	Electronic Purchase Contract Generation and Signing, Identity Authentication, Mobile Phone Number Change, Identity Authentication	API/H5 data collection
    3.	SAIC General Motors Limited	SAIC General Motors SDK	Mobile phone number, VIN, license plate number, mobile location information, owner name, mobile phone location and ID card	The first-time use of the Bluetooth key function requires identity verification corresponding to the real-name information on the ID card. Collect Mobile Phone Number for Owner's Approval to Share Keys; Collect VIN for Binding Bluetooth Vehicle; Collect License Plate Number for Owner to Display License Plate Number when Sharing Mobile Phone Key, Clear Sharing Vehicle; Collect Owner Name for Page Display; Collect Mobile Location Information for Demarcation of Welcome Lamp Quiet Area; Collect Mobile Phone Location Information for Recommendation of Surrounding Charging Station/Gas Station/POI, Path Planning, for Bluetooth Connection	API data collection
    4.	Shanghai OnStar Information Services Limited	OnStar API	Home address, business address, vehicle location information, ID card, VIN	The activation of the OnStar Vehicle Link vehicle control function needs to verify the identity corresponding to the real-name information using the ID card and bind the vehicle to the Vehicle Identification Number (VIN). Collect Home Address and Business Address for Fast Navigation; Collect Vehicle Location Information for Remote Start, Destart, Door Unlock, Door Lock, Sunroof Open, Sunroof Close, Windows Open, Windows Close, Flashing Horn, Obtaining Vehicle Location, ODD Delivery for In-Vehicle Navigation and Other Remote Control Operations	API data collection
    5.	Huawei Terminal Co., Ltd	Huawei	Device information, network information	Message Push for Huawei Mobile Phones	SDK data collection
    6.	Honor Terminal Co., Ltd	Honor	Device information, network information	Message Push for Honor Mobile Phones	SDK data collection
    7.	Guangdong OPO Mobile Telecommunications Co., Ltd.	OPPO	Network information	Message Push for Oppo Mobile Phones	SDK data collection
    8.	Vivo Mobile Telecommunications Co., Ltd.	VIVO	Network information, read and write (albums, media and other files) rights	Message Push for Vivo Mobile Phones	SDK data collection
    9.	Xiaomi Mobile Software Co., Ltd.	Xiaomi Mobile Phones	Device information, geographic location, network information, read and write (albums, media and other files) rights	Message Push for Xiaomi Mobile Phones	SDK data collection

3. How We Use Cookies and Similar Technologies

• 3.1

  Use of Cookies

  • 3.1.1

    In order to ensure the normal operation of the Platforms so that you can access the Platforms more easily and conveniently, we will store a small data file named Cookie on your computer or mobile device when you use the services provided by the Platforms. A Cookie usually contains identifiers, the site name, and some numbers and characters. We use such information to simplify your repeated login steps, store your preferences for products purchased on the Platforms, help determine your login status and account or data security, improve service quality and optimize user experience and other purposes stated in this Privacy Policy including marketing purpose, user-profile building.

  • 3.1.2

    We will not use the Cookie for any purpose other than those stated in this Privacy Policy. You can manage or delete the Cookie based on your preferences. However, if you choose to disable the Cookie, you may not be able to use the functions that depend on the Cookie.

• 3.2

  Use of Other Similar Technologies

  • 3.2.1

    In addition to a Cookie, we also use other similar technologies such as page tagging, pixel tags and web beacons, on the Platforms. The purpose for which we use these similar technologies mainly includes calculating the visitor volume of the Platforms, collecting information on the user's browsing web activities, and identifying registered users by visiting the Cookie, to provide you with better and more personalized services.

  • 3.2.2

    At this time, we do not honor “do no track” signals from a web site browser. However, you may refuse or delete Cookies. Please refer to your browser Help instructions to learn more about Cookies and other technologies and how to manage their use. If you elect to refuse or delete Cookies, you will need to repeat this process if you use another computer or change browsers. If you choose to decline Cookies, some of the functionality of a website may be impaired.

4. HOW WE PROVIDE, TRANSFER AND PUBLICLY DISCLOSE PI COLLECTTED

• 4.1

  Providing Your PI

  We have the obligation to keep your PI confidential and will not sell or provide any of your PI to any third party for their independent marketing purposes (except for the third parties and for the purposes of provision with your separate consent below). Except for the data-provision described in this section, we will not provide your PI to any other company, organization or individual without your prior authorization and consent. In the following situations, we will ask for your separate authorization and consent for providing your PI. Any provision of your PI will be subject to a Personal Information Protection Impact Assessment conducted in accordance with applicable laws and regulations.

  • 4.1.1

    SHARING

    Sharing with the authorized partners or vendors: because certain features and services of the Platforms and the Offline Scenarios specified in this Privacy Policy may need to be provided to you by our third-party partners or vendors, we may share some of your PI with third party partners so that we can provide imperative customer service and better user experience to you. Your PI within necessary limit will be used for specific and legitimate purposes by us. The authorized partners do not have the right to use the shared PI for any other purpose than providing the specific services under this Privacy Policy and any of your PI shared will be protected by our authorized partners or vendors through “encryption”, “anonymization” and other protection measures as provided in their own PI protection policies.

    You can view the Checklist for further details about our authorized partners or vendors and separately agree to any shared matters. Prior to sharing your PI with any of our Affiliates, Authorized Partners or Suppliers that are not listed in this Checklist, we will provide you with the regulatory required details of aforementioned entities for your separate consent first.

  • 4.1.2

    CROSS-BORDER TRANSFER

    Since GM is a global multinational company, and quite a few systems and tools are globally developed or located outside of China, the PI you provide us may be cross-border transferred (including remote access) to our Affiliates located in the United States of America to enable us to achieve the core function of the Platforms and the Offline Scenarios or to provide the products or services you need.

    We will strictly perform relevant legal obligations in accordance with applicable laws and regulations before we transfer your PI overseas. Any cross-border transfer of your PI will be subject to a Personal Information Protection Impact Assessment conducted in accordance with applicable laws and regulations. We will only share your PI to the extent necessary to achieve the purpose described in this Privacy Policy.

    If your SPI is to be transferred overseas, we will inform you of the necessity of transfer and of the impact on your rights. If the PI of a minor under the age of fourteen (14) is to be transferred overseas, we will also obtain the separate consent from the guardian of such minor. If you do not give your separate consent to the cross-border transfer, we will stop collecting your personal information and may be unable to provide you with the relevant product or service.

    You can view the Checklist for further details about our foreign recipients and separately agree to any shared matters. Prior to sharing your PI with any of our foreign recipients that are not listed in this Checklist, we will provide you with the regulatory required details of aforementioned entities for your separate consent first.

  • 4.1.3

    We or our delegated agencies as specified in Section 2.4 above, may share your PI and SPI with certain marketing agencies, event organizations and logistic vendors (including post office, travel agency, airliner, railway carriers, hotels, insurance companies etc.) to fulfil our incentive programs, marketing events and other activities hosted by us on a case-by-case basis, after our receipt of your consent to participate in such events and your authorization to us and our delegated agencies to share the necessary PI with the specific third parties. Prior to us sharing your PI and SPI with the aforementioned marketing agencies, event organizations and logistic vendors, we will provide you with the regulatory required details of aforementioned entities for your separate consent first.

  • 4.1.4

    In order to achieve the purposes stated herein, implement relevant provisions of this Privacy Policy and ensure of the security of related transactions, we may need to authenticate your identity and carry out other accompanying activities (such as face image collection). If you agree that we continue to authenticate, which is deemed as your authorization to us and our delegated party to share your necessary personal information with specific third parties, we or the delegated party mentioned in Section 2.4 above will share your identity certificate, name and other necessary information with UnionPay, telecom service providers and government agencies (such as industry and commerce, public security, etc.) on a case by case basis to complete relevant identity authentication. GM will not collect facial features or images in identity authentication procedure, which will be solely collected by Shanghai Genyan. GM does not keep and retain any original facial image information, but only the result of identity authentication.

  • 4.1.5

    We may share your PI as stipulated by laws, regulations, ordinances, policies and the mandatory requirements of government agencies.

• 4.2

  Transfer of PI

  We will not transfer your PI to any legal entity, organization or individual except in the following situations:

  • 4.2.1

    Transfer with your prior authorization and consent: we may transfer your PI to third parties after obtaining your express authorization and consent. You can view the Checklist for further details.

  • 4.2.2

    In the event of a merger, acquisition, business restructuring or other similar transaction involving us: in case transfer of PI is required as a result of these events, we will require the new legal entity or organization holding your PI to continue to be bound by this Statement. Any processing of your PI exceeding the original processing purposes and processing methods stated in this Privacy Policy by the new legal entity and organization will require your prior authorization and consent. We will inform you of the identity and contact information of the new legal entity or organization, reasons for transfer, types of PI involved, possible impacts and obligations of the recipients by means of a pop-up window notice or other appropriate ways.

• 4.3

  Public Disclosure of PI

  Subject to a Personal Information Protection Impact Assessment conducted in accordance with applicable laws and regulations, we will publicly disclose your PI only if we adopt security measures that meet industry standards, and in the following circumstances:

  • 4.3.1

    Disclosure with your prior separate consent. You can view the Checklist for further details.

  • 4.3.2

    Disclosure in statutory circumstances: in the event that your PI is required to be disclosed in accordance with laws and regulations, legal proceedings, litigations or the mandatory requirements of competent government agencies, we may publicly disclose your PI in accordance with the type of PI and the disclosure manner required. Subject to laws and regulations, when we receive the above request for disclosure, we will require relevant party to provide corresponding certificate, written or legal documents, such as notices, summons or investigation letters.

  • 4.3.3

    Before disclosing your PI, we will inform you of the reasons for disclosure, types of PI involved, de-identification measures taken by us and possible impacts by pop-up window notice or otherwise. If the scope of disclosure changes, for example, from a certain scope to the public, we will inform you of the reason for change again by means of pop-up window notice or otherwise, to improve your understanding of the rules on PI processing.

• 4.4

  Exceptions to the Authorization by Consent

  You fully understand and agree that, in accordance with the relevant laws and regulations, we can share, transfer and publicly disclose your PI without your authorization (but in any event within a reasonable scope as permitted by applicable laws and regulations) in the following situations: (1) Where it is necessary to conclude or fulfill a contract entered between you and GM; (2) Where it is necessary to fulfill statutory duties and responsibilities or statutory obligations; (3) Where it is necessary to respond to a public health emergency or in the case of emergency in order to protect the life, health, and property of natural persons, under emergency conditions (for instance, the emergency rescue under OnStar Services) (we will nevertheless promptly notify you of such collection and use of your PI after such emergency ceases to exist); (4) In order to implement news reporting, supervision by public opinion, and other such activities for public interest; (5) Where the PI has been disclosed to the public by yourself or otherwise lawfully disclosed to the public; (6) Other circumstances as stipulated by laws, regulations, ordinances and policies.

5. How we protect and store personal information

• 5.1

  Techniques and measures of PI protection

  We attach great importance to the security of your PI. we will take all reasonable and feasible measures to protect the security of your PI, including but not limited to:

  • 5.1.1

    Taking all reasonably practicable steps to ensure that no PI irrelevant to the services / products provided by us is collected.

  • 5.1.2

    Adopting standard security protection measures in internet industry, including establishing reasonable system specifications, adopting security technologies, including encryption, anonymization, desensitization etc. to protect your PI and prevent unauthorized access, disclosure, use, modification, damage or loss of information. We use many different security measures such as encryption technologies (e.g. SSL), data anonymization, and security detection methods such as security logging to prevent and contain illegal acts such as fraud, account theft and impersonation. We also follow industry best practices for limiting the access to PI, implementing privileged access management and training PI handlers on their obligations when processing and handling PI.

  • 5.1.3

    The internet is not an absolutely secure environment. During your use of the Platforms, you may receive content or web links from third parties other than GM. You fully understand that the Platforms cannot control the privacy and PI protection policies of the third parties, and such third parties are not bound by this Privacy Policy. You can choose whether to access or accept links, contents, products, and services provided by third parties. Before submitting your PI to third parties, please ensure that you have read and accepted the privacy policies of these third parties.

  • 5.1.4

    In the event of a PI security incident, where we have already taken measures to effectively avoid the harm caused by information leakage, tampering, or loss, we may not notify you; However, where we believe that the PI security incident may cause harm, we will promptly inform you the following in accordance with the requirements of laws and regulations: the basic situation, reasons and possible impact of the security incident, the remedy measures we have taken or will take, the recommendations to you which will help you prevent and reduce risk, the contact information of the person/department of GM responsible for the protection of PI, etc. We will promptly inform you of the relevant circumstances of the incident by mail, letter, telephone, notification, pop-up window, etc. When it is difficult to inform the PI subject one by one, we will issue an announcement in a reasonable and effective manner. At the same time, we will report the handling of PI security incidents in accordance with the requirements of the regulatory authorities.

• 5.2

  Storage of PI

  • 5.2.1

    In principle, all of your personal information will be stored in Beijing and/or Shanghai, the PRC. We provide products or services based on our resources and servers worldwide, therefore, your PI may be transmitted outside the territory of China with your consent. When we need to provide your PI outside the territory to any other entities not set out in Section 4.1.2, we will, in addition to meeting other legal requirements, notifying you of the detailed information of overseas receiving party and obtain separate consent from you. If the PI provided to such offshore recipient contains the personal information of a minor, we will also obtain the separate consent of the minor's guardian. In the event that the jurisdiction where the overseas receiving party located has a different data protection law, or even no relevant laws, we will take necessary measures to ensure that your PI will enjoy the same level of protection as it does in China.

  • 5.2.2

    We will only store your PI for a reasonably shortest period of time required to achieve the purposes stated in this Privacy Policy which is estimated to be around five (5) years, but we may appropriately prolong the storage period of the PI to comply with applicable laws and regulations, court decisions or rulings, requirements of other competent authorities, and under other circumstances where your authorization and consent are not legally required.

  • 5.2.3

    If we completely terminate the services or operations of the Platforms or discontinue to provide certain business function due to expiration of storage period, business adjustment, bankruptcy liquidation, etc., we will inform you at least thirty (30) calendar days in advance in the form of one-by-one delivery of email, message, private message or public announcement of how to copy or transfer your PI and of the time limit for deleting or anonymizing PI. We will stop the collection of your PI after termination of service or operation and delete or anonymize your PI that has been collected.

6. Your Rights and Choices

• 6.1

  Your Rights

  According to relevant laws, regulations and standards in China, as well as common practices in other countries and regions, we will ensure your following rights to your PI. At this moment, mostly, we will manually process your request to fulfil the following rights and meanwhile we will continue to build up our systems to facilitate any of your future requests and once such systems are ready, we will update this Statement by adding more automatic approach(s) in accordance with Section 8 below without adverse impact on the approaches currently available to you in this Statement. Your continued use of the services / product on the Platforms or in the Offline Scenarios will be deemed as you have accepted our updates and modifications to the terms of this Privacy Policy.

  • 6.1.1

    Know about your PI: unless laws and regulations specify otherwise, you have the right to know about your PI controlled by us by contacting us through the contact information set out in Section 9 below.

  • 6.1.2

    Rectify your PI: you have the right to amend or correct your PI by submitting a rectification request through the contact information set out in Section 9 below.

  • 6.1.3

    Delete your PI that is collected subject to your consent or authorization: Under the following circumstances, we will proactively delete your PI, meanwhile you have the right to actively submit a request to delete (hereinafter as “deletion request”) your PI: (1) The purpose for processing your PI has been achieved or can no longer be achieved, or your PI is no longer necessary for the purpose to be achieved; (2) We cease to provide you with the products and services of the Platforms, or the period of storage has expired; (3) You have withdrawn your authorization and consent; (4) We violate the applicable laws and regulations, or we breach the agreement between you and us in the course of collection, use, provision, transfer, disclosure and storage of PI; (5) Other circumstances as stipulated by applicable laws and regulations .

    When deleting your PI, we will also inform the Affiliates/delegated agencies/authorized partners/vendors that acquire your PI from us and ask it to delete your PI without delay, unless otherwise specified in laws and regulations, or the entity has acquired specific authorization from you.

    When you delete the PI from our services, we might not immediately delete the corresponding PI for compliance or technical reasons, but in such a scenario, we will only process your PI for the purposes of storage or protection of the PI by taking any required security measures (like desensitization, encryption etc.).

    You hereby consent that as another alternative to fulfil the deletion of your PI as per your request, we will use our proper business judgement to choose to anonymize your PI to achieve the PI deletion purpose.

  • 6.1.4

    Change or withdrawal of authorization and consent: you have the right to change the scope of or withdraw your authorization and consent given for PI collection and use which was subject to your prior consent/authorization, at any time by contacting us through the contact information set out in Section 9 below. When you withdraw your authorization and consent, we will stop processing the corresponding PI. However, your withdrawal of consent will not affect the processing activities of PI carried out based on your previous authorization and consent. Please note that your withdrawal of consent will impact your incentive account (as applicable) if such incentives were granted based on your previous consent..

  • 6.1.5

    Opt-out advertisements: you have the right to opt-out the advertisements you subscribe from us at any time by contacting us through the contact information set out in Section 9 below.

  • 6.1.6

    Cancel your user account to the extent that the registration of account is solely subject to your consent/authorization: you have the right to cancel your user account at any time by contacting us through the contact information set out in Section 9 below. After de-registration, we will stop providing you with any product and service and delete your PI according to you request, unless laws and regulations specify otherwise.

  • 6.1.7

    Acquire a copy of PI if it is confirmed that such PI is controlled by us.

  • 6.1.8

    Reject personalized push and restrict automated decision-making by information system.

  • 6.1.9

    Require us to transfer of your PI to your designated PI processor, which in our view, is in compliance with the conditions specified by the competent government authorities. This request cannot be fulfilled unless the clear conditions of competent government authorities are announced.

  • 6.1.10

    Require us to further explain our rules for processing your PI.

  • 6.1.11

    When a registered user of the Platforms is deceased, his / her lawful authorized person or his / her next of kin may, for the sake of executing the will of the deceased or their own lawful and legitimate interests, exercise the rights provided in this Section 6.1 towards the PI of the deceased. GM has the right to conduct the necessary identification and information verification with regard to such requests.

• 6.2

  Request and Response

  You may submit a request relating to your rights set forth above by contacting us through the contact information set out in Section 9 below. Upon your request, we will instantly notify you of the possible effects of exercising these rights by way of pop-up window notice for your prudent consideration. In your request, please identify yourself and provide information relating to GM products, specify your user account and/or user information and other information to enable us to authenticate and respond to your request. We may assume any requests initiated from your user account will be from you and we also may but are not liable to authenticate your identity or further request for certain other information from you to verify your identity. Where legally permitted, we may decline to process requests that are unreasonably repetitive or systematic, require disproportionate technical effort, may result in our failure to perform legal obligations or the agreement with you, or to complete any possible or ongoing litigation, investigation or relevant government requirements, or may jeopardize the PI or legal rights of others.

  In addition, you may find and click applicable module on these Platforms (if any) to fulfill some PI requests (e.g., request to delete some or all of your PI, deregister of account, or reject personalized recommendation).:

  • Using the The Durant Guild App to fulfil PI requests:

    a) To deregister account in The Durant Guild App: (1) Click "My" at the bottom right corner; (2) Click "General Management"; (3) Click "Application for Deregistration of Account" at the bottom.

    b) To reject Personalized Recommendation in The Durant Guild App: if you don't want to receive notifications, you may reject the notifications during the first installation of The Durant Guild App. The detailed procedure will be subject to the policy released in The Durant Guild App at that time. Meanwhile you may submit a request relating to your rights by contacting us through the contact information set out in Section 9 below.

  • Using The Durant Guild WeChat Applets to fulfil PI requests (the module is developed according to the requirements of WeChat applets and existing design):

    a) To delete PI in The Durant Guild WeChat Applet and other WeChat applets: (1) Click the button of three small round dots on the top of right corner of the homepage; (2) Click "Settings"; (3) Click "Information obtained by the applet"; (4) Click "Management"; (5) Click the button of deletion on the left side the i interface; (6) Click "Notify the Developer to Delete".

    b) To deregister account in The Durant Guild WeChat Applet: (1) Click "Me" on the bottom of right corner; (2) Click "Application for Deregistration of Account".

    c) To reject Personalized Recommendation in The Durant Guild WeChat Applet: if you don't want to receive notifications, you may submit a request relating to your rights by contacting us through the contact information set out in Section 9 below.

  • Using The Durant Guild Car-Mounted Terminal to fulfil PI requests:

    To reject Personalized Recommendation in the Car-Mounted Terminal: if you don't want to receive notifications, you may reject the notifications in the Durant Guild Car-Mounted Terminal. The specific process is: (1) Enter the homepage and click "Settings"; (2) Click "Notification"; (3) Click the button to close notification.

7. Minors’ Personal Information Protection

• 7.1

  The Platforms and the Offline Scenarios are mainly adult oriented. We process the PI of minors only under the following specific circumstances. You should view the Guidelin for further details.

  • 7.1.1

    You can sign up for minors through the The Durant Guild App, Durant Guild WeChat Applet, Other Digital Platforms and Offline Scenario for our various reward point feedback projects, car shows, and product/service promotions activities. We will organize parent-and-child themed activities and events mainly attended by minors.

  • 7.1.2

    In principle, we provide the corresponding services only to adults. However, in Offline Scenario, if you purchase a vehicle for a minor under your guardianship and sign a vehicle purchase contract, you will need to visit our offline stores to complete guardianship verification according to the procedure that GM may develop at that time.

• 7.2

  As it is difficult for us to identify the real age of a user, if we inadvertently collect PI of a minor, the minor's guardian can contact us to delete such PI.

8. Scope and Updates of this Privacy Policy

• 8.1

  Scope of Privacy Policy: The products and services of the Platforms and the Offline Scenarios will only be provided to users in China.

• 8.2

  Updates of Privacy Policy. With the change or expansion of the services of the Platform and the Offline Scenarios, the types, purposes and methods of PI that we process may change. We reserve the right to update or revise this Privacy Policy from time to time in accordance with the requirements of relevant laws and regulations. If such updates or modifications result in any substantial change in your rights under this Privacy Policy, we will send you a change notice in the form of a one-by-one notice or announcement when you reuse our products or services again and obtain your consent. If you do not agree to the updated or modified Privacy Policy, you shall immediately stop using the services of the Platforms and the Offline Scenarios. By continuing to use the services of the Platforms and the Offline Scenarios, you are deemed to have accepted our updates and modifications to the terms of this Privacy Policy.

• 8.3

  For material changes of this Privacy Policy, we will provide more prominent notices (including email, message, private message, pop-up window notice and other ways to explain the specific changes of this Privacy Policy). Material changes of this Privacy Policy include but are not limited to: (1) Significant changes to our service mode, such as the purposes of processing personal information, categories of personal information to be processed, the ways to use personal information, etc.; (2) Substantial changes to the ownership structure, organizational structure, etc., such as changes to the owners as a result of business adjustments, bankruptcy, mergers and acquisitions etc.; (3) Changes to the subjects we share with, transfer to or publicly disclose personal information; (4) Significant changes to your rights in respect of your participation in personal information processing and to the ways in which you can exercise such rights; (5) Changes to our department responsible for the security of personal information, contact information of such department, or complaint channels; (6) Personal information security impact assessment report indicates high level of risk. We will also keep the former versions of this Privacy Policy available to you for reference.

9. How to Contact Us

For questions or comments, to opt out from certain services, or to submit a PI request (including all rights under Section 6.1), please contact our department or person in charge of PI protection by any of the following means:

• Email us at gmpi.privacyprotection@gm.com.
• Write to us at 56 Jinwan Road, Pudong, Shanghai 201206, P. R. China.
• Call The Durant Guild Custom Service Center at 4001001818

Under normal circumstances, we will reply to you in ten (10) working days after receiving your requests. Account log-out service shall be completed within fifteen (15) working days, and deletion of PI shall be completed within ten (10) working days. When you contact us for the reason that you consider certain rules under this Privacy Policy are unclear, we will provide further explanation by means of information push, private message, pop-up window notice and other instant notice when you use our products or services. In event that you are not satisfied with our responses, you may report to Illegal and Harmful Information Reporting Center of Cyberspace Administration of China on its official website: https://www.12377.cn/.

10. Special Acknowledge to Sharing Your PI with Us

For all the PI you shared with us, which may include the personal information of your relatives and friends (such as video, audio, image data, etc.), you hereby confirm that you have obtained the consent of the relevant individuals (and his/her guardian), and all your consents under this Privacy Policy or your behavior of sharing others’ relevant personal information on the Platforms and in the Offline Scenarios or with us shall be deemed as you promise to have obtained the informed consent and lawful authorization of relevant individuals (and his/her guardian) and your agreement to bear any losses actually incurred to us due to providing PI of relevant individuals in violation of the law and regulations.

 

[THE END]

  Back to Top