GAC Global

Data Privacy Policy, Use of Cookies, and Anti-spam Measures

Last updated: 03/31, 2025

Effective Date: 03/31, 2025

Overview

To effectively protect your personal information, GAC INTERNATIONAL CO., LTD. (hereinafter referred to as “GAC INTERNATIONAL” or “we”) has formulated this Privacy Policy (“this Policy”) in accordance with applicable laws and regulations. This Policy explains how we use the personal information collected from you through our website (www.GACgroup.com/CHL, “this Website”) or provided by you via this Website.

GAC INTERNATIONAL is the official importer of brands such as GAC MOTOR, AION, and HYPTEC. For more information about GAC INTERNATIONAL, its website, and operations, please refer to the “About Us,” “History,” or “Contact Us” sections.

GAC INTERNATIONAL hereby informs you of this Policy, which describes in detail how we use the information collected through this Website or the information you provide when contacting us via this Website. Our goal is to offer clear, understandable, and transparent information regarding what data we collect, how we process it, and your rights concerning your data.

We highly value your privacy and are committed to providing you with a seamless and unrestricted website browsing experience. While offering high-quality products and services, we will collect, use, share, store, and protect your personal information in accordance with this Policy.

This Policy is intended to help you understand how we process your personal information and to provide you with ways to access and control your personal data.

This Policy applies to personal information collected through this Website or provided directly by users but does not apply to other third-party platforms or services. This Website may contain links to other websites. You have the choice to access the links, content, products, and services provided by third parties. However, if you click on these links, we are not responsible for the protection of your personal data. Accessing these websites is not governed by this Policy. Since we have no control over third-party privacy and data protection policies, such third parties are not subject to this Policy. Before submitting any personal information to third parties, please review their privacy policies. By agreeing to this Policy, you acknowledge and accept our processing and protection of your personal information as outlined herein. If you have any questions, complaints, or suggestions regarding this Policy, please contact us using the information provided herein.

This Policy aims to explain the following:

• How We Collect and Use Your Personal Information
• How We Use Cookies and Similar Technologies
• How We Share, Transfer, and Disclose Your Personal Information
• Processing of Personal Information When Using Third-party Services
• How We Protect Your Personal Information
• How We Access and Control Your Personal Information
• Protection of Minors’ Personal Information
• Contact Us
• Updates to This Privacy Policy

1. How We Collect and Use Your Personal Information

For the purposes of this Policy, “personal information” refers to any information recorded electronically or otherwise that relates to an identified or identifiable natural person, excluding anonymized data. In accordance with applicable laws and regulations, “sensitive/special personal information” refers to personal data that, if disclosed or misused, could potentially infringe on an individual’s dignity or endanger their personal safety or property. Such data may include biometric information, religious beliefs, specific identity details, medical and health records, financial account information, and location tracking data. Additionally, it includes the personal information of children under the age of thirteen or the legal age of a child in their respective jurisdiction.

1. Collection and Use of Necessary Personal Information

We adhere to the principles of legitimacy, lawfulness, and necessity when collecting and using your personal information for the purposes outlined in this Policy. The personal information we collect includes information you voluntarily provide while using our products and/or services, information we directly collect as a result of your use of our products and/or services, and information provided to us by third-party partners with your authorization. If we intend to use your personal information for purposes not specified in this Policy or process collected information for a different purpose, we will inform you in an appropriate manner and obtain your consent again. To enable extended business functions that enhance our products and/or services, you may choose to grant us permission to collect and use your information. If you choose not to provide such information, you may be unable to use certain extended business functions or may not experience their intended functionality. However, this will not affect your ability to use the core functions of our products and/or services. When you use our products and/or services, we may need or may be required to collect and use your personal information in the following scenarios:

1.1 Browsing information

When you visit and browse this Website, our server will automatically record certain information to better provide you with products or services, continuously improve our offerings, and enhance your user experience. Such information may include the browser you use, the name of your internet service provider, the URL from which you accessed our website, your browsing history on our website, and the date and duration of your visit.

1.2 Test drive appointment

To provide you with test drive appointment services, we require you to provide information such as your preferred vehicle model, province and city of residence, mobile phone number with SMS verification code, and your selected dealer. We will arrange for a sales representative to contact you promptly to ensure an optimal test drive experience.

1.3 Exceptional circumstances

In the following circumstances, we may collect and use personal information without your authorization or consent:

(1) When necessary for the conclusion or performance of a contract between you and us;

(2) When necessary for us to fulfill our legal duties or statutory obligations;

(3) When necessary to respond to public health emergencies or to protect the life, health, and property safety of a natural person in an emergency;

(4) When necessary for conducting news reporting, public opinion supervision, or other activities in the public interests, within a reasonable scope;

(5) When personal information is processed within a reasonable scope in accordance with laws and regulations using personal information that has been voluntarily disclosed by the individual or otherwise legally disclosed;

(6) When necessary for the legitimate interests of us or a third party, except where such interests are overridden by the need to protect the rights, freedoms, and fundamental interests of the data subject, particularly if the data subject is a child;

(7) Any other circumstances prescribed by applicable laws and administrative regulations in your jurisdiction where your consent is not required.

1. How We Use Cookies and Similar Technologies

We will use cookies when you visit this Website. Cookies are small text files stored on your device’s hard drive by a web server. We may use cookies and similar technologies, such as web beacons that store user preferences and settings, to prevent fraud, authenticate users, and collect operational data regarding our services. You can refuse or manage cookies by adjusting your browser settings. However, please note that disabling cookies may result in a suboptimal service experience, and certain services may not function properly. For more information about cookies and how we use them, please refer to the Cookie Policy Statement on this Website.

1. How We Share, Transfer, and Disclose Your Personal Information

With your consent or upon your explicit instruction, we may share, transfer, or disclose your personal information to third parties. Additionally, to enhance the quality of our products and services, we may share, transfer, or disclose your personal information with third parties under the following circumstances:

3.1. Affiliated companies
We may share your personal information with our affiliated companies and ensure that they process and protect your personal information in accordance with the purposes and requirements outlined in this Policy. If an affiliated company intends to use your personal information for purposes beyond those specified in this Policy, we will seek your consent again.

3.2. Third-party service providers
We may collaborate with third-party service providers in specific areas to provide services to you. We may share the necessary personal information with these third-party service providers to enable them to perform their functions, ensuring that they process your personal information as instructed by us, in compliance with the purposes and requirements stated in this Policy. They must also implement confidentiality and security measures that are no less stringent than those outlined in this Policy to safeguard data security.

3.3. Sharing for legal reasons
Without violating the requirements of this Policy, we may need to share or disclose your personal information under certain circumstances, such as to comply with laws and regulations, fulfill mandatory government orders, protect the legitimate rights and interests of you, us, or third parties, or to prevent or address fraud, security, or technical issues.

3.4. Changes in corporate structure or business status
If our corporate structure or business status changes (e.g. in the event of a reorganization, merger and acquisition (M&A), or bankruptcy), your personal information may be transferred to the newly established entity or our affiliated companies (the “Data Transferee”). The Data Transferee will continue to be bound by the requirements set forth in this Policy.

1. Processing of Personal Information When Using Third-party Services

When you visit this Website or when we provide services to you, we may offer links that direct you to third-party products or services. These links are provided solely for your convenience. We do not control, guarantee, endorse, or authorize any of these third-party links. We remind you that if you access or use third-party products or services through such links, which results in the collection of your personal information by the third party, such information will be subject to the privacy policy of the respective third-party product or service.

1. How We Protect Your Personal Information

5.1. Personal information security measures
We are committed to ensuring the security of your personal information. We employ various security technologies and procedures to protect your personal information from unauthorized access, use, modification, destruction, or disclosure. The main security measures we have implemented include:

1. a) Storing your personal information on computer systems located in controlled environments and implementing general security measures.
2. b) Restricting access to personal information to designated employees who require it for product and service operations, and requiring them to comply with strict confidentiality obligations.
3. c) Continuously working to safeguard your personal information by whole-process encrypting data transmission to prevent unauthorized access, use, modification, destruction, or disclosure.
4. d) Applying heightened security measures such as encryption when transmitting and storing you sensitive/special personal information.

In the event of a personal information security incident, we will notify you promptly via push notification, announcement, or other means in accordance with laws and regulations. The notification will include the basic information of the security incident, potential impacts, the measures we have taken or plan to take, recommendations for self-protection and risk mitigation, and any remedies available to you. We will also take immediate action to address system vulnerabilities, cyberattacks, malware threats, and other security risks.

5.2. Retention period of personal information
We will retain your personal information only for the minimum period necessary to fulfill the purposes outlined in this Policy, unless otherwise stipulated by laws or administrative regulations (e.g. tax records are typically required to be kept for at least six years). The retention period may vary depending on different scenarios, products, and services. We determine the retention period based on the following criteria, whichever is longer:

• The time required to retain personal information to fulfill the business purpose, including providing products and services, maintaining the corresponding transaction and business records, managing and improving product and service quality, ensuring the security of systems, products, and services, addressing potential user inquiries or complaints, and troubleshooting issues.
• Whether the user has agreed to an extended retention period.
• Responding to your potential inquiries, complaints, or legal proceedings.
• Whether there are legal, contractual, or other specific requirements for data retention.

Once your personal information has reached the retention period required for the purposes stated in this Policy, we will irreversibly delete or anonymize it in accordance with applicable laws, unless otherwise required by laws and regulations or permitted by you for an extended retention period.

5.3. Storage location of personal information
As a multinational company, the personal information we collect may be processed in the country or region where you access this Website, or in other countries or regions where we, our affiliated companies, subsidiaries, service providers, or business partners operate, or where access is permitted from such locations. In accordance with laws and regulations, we store your personal information in [São Paulo/Singapore/Riyadh/Dublin/Moscow]. The data protection laws of these countries or regions may differ. In such cases, we take measures to ensure that the personal information we collect is processed in accordance with this Policy and applicable laws. For instance, when personal information of individuals located in the European Union (EU) is transferred to a country or region that is not recognized by the EU as providing an equivalent level of data protection, we will adopt various legal mechanisms, such as signing standard contractual clauses approved by the European Commission, obtaining your consent for cross-border data transfers, or implementing security measures such as data anonymization before transferring the data, to ensure that your personal information remains protected and secure under applicable data protection laws.

1. How We Access and Control Your Personal Information

Depending on your location and applicable data protection laws, you may have certain rights regarding your personal information. These rights may include, but are subject to any applicable exceptions or limitations:

6.1. Access, modification, and correction of your personal information
You have the right to access, edit, modify, and correct your personal information. You may request to know whether we are processing your personal information and, if so, you have the right to access your personal data and obtain the following information:

• The purposes of the processing;
• The types of personal information concerned;
• The recipients or categories of recipients to whom the personal information has been or will be disclosed, including when recipients are located in third countries;
• The expected retention period of the personal information, or the criteria used to determine that period;
• Your right to request the correction or deletion of your personal information, to restrict processing, or to object to the processing of your personal data;
• Your right to lodge a complaint with a regulatory authority.

6.2. Change in your consent scope
Where required by applicable laws, if we process your personal information based on your consent, you may modify the scope of your consent for processing your personal data at any time. Please note that withdrawing consent for certain types of data processing may affect our ability to provide certain services to you.

Upon receiving your request to withdraw consent, we will cease processing the relevant personal information. However, withdrawal of consent does not affect the lawfulness or validity of processing based on consent prior to its withdrawal, nor does it affect our right to process your personal information on other appropriate legal grounds.

6.3. Deletion of your personal information
We will proactively delete your personal information under the following circumstances. If we have not deleted it, you may request us to do so:
a) Your personal information is no longer necessary for the purposes for which it was collected or processed;
b) You have withdrawn your consent for us to process your personal information;
c) Your personal information has been processed unlawfully;
d) We are required by applicable laws to delete your personal information.
For technical reasons, we may not be able to delete your personal information immediately. We will delete the data when our system updates. During the period between your request for deletion and the system update, we will cease any processing of your collected personal information. If legal or regulatory retention periods have not yet expired, or if deletion is technically infeasible, we will suspend processing except for storing the data and implementing necessary security measures.

6.4. Response to your requests
If you wish to exercise any of the above rights, you may contact us by sending an email to (----------) or calling our customer service hotline at (----------). Upon receiving your request, we may first verify your identity and require you to provide necessary information for identity authentication.
We will contact you as soon as possible after receiving your request. Generally, we do not charge for reasonable requests. However, for repeated requests or requests that exceed reasonable limits, we may charge a fee based on actual costs. We may refuse requests that are technically difficult to fulfill, are not required to be addressed under applicable laws and regulations, or would violate legal or administrative regulations, and explain the reason. If we determine that no action is necessary in response to your request, we will notify you of our decision and provide an explanation.

We will make every effort to resolve any issues you raise. If you are not satisfied with our response, you may lodge a complaint with the relevant regulatory authority or file a lawsuit with a competent judicial body.

1. Protection of Minors’ Personal Information

If you are under the age of thirteen or below the minimum legal age in your jurisdiction, you may only use this Website under the supervision and participation of a parent or guardian. For children under the age of thirteen or the legal age in their jurisdiction, we will process their information only to the extent permitted by law and with the consent of their guardian. We do not knowingly collect personal information from children without the consent of their parents or guardians. We will use relevant technical measures to verify, to the best of our ability, whether the processing of a child’s information has obtained parental or guardian consent. If we discover that we have collected a child’s personal information without verifiable prior consent from their guardian, we will make efforts to delete the relevant data as soon as possible. If you are a parent or guardian and have concerns about the processing of information related to the child under your guardianship, please contact us using the information provided below.

1. Contact Us

If you have any questions or suggestions regarding this Policy or discover any violations of this Policy, please feel free to contact us. We offer multiple communication channels to provide you with satisfactory solutions:

(1) Customer service hotline: You can reach us by calling our customer service hotline: (----------).

(2) Dedicated email support: You can contact us via email at (----------).

In general, we will respond within fifteen business days. If you are not satisfied with our response, particularly if you believe that our processing of your personal information has infringed upon your legal rights and interests, you may also lodge a complaint or report the issue to the relevant national regulatory authorities.

1. Updates to This Privacy Policy

We may modify or update this Policy from time to time. Before any changes take effect, we will notify you through prominent notices on the website. Please ensure that you read and fully understand the updated privacy policy. By continuing to use this Website, you will be deemed to have accepted the updated version of this Policy. We will not reduce your rights under this Policy without your explicit consent.

Changes to this Policy include but are not limited to:

(1) Significant changes in our service model, such as the purpose of personal information processing, the types of personal information processed, or how personal information is used;

(2) Changes in the primary recipients of shared, transferred, or publicly disclosed personal information;

(3) Changes in your rights regarding personal information processing and how you can exercise those rights;

(4) Other changes that may have a material impact on your personal information rights and interests.