Introduction

In this Privacy Notice we will provide you information about the collection and processing of your personal data when you use this Website (“Website”). Unless explicitly stated otherwise, Yiche is the "controller" for the personal data processing described in this Privacy Notice.

BITAUTO is referred to as “we”, “us”, “our” or “ours”. Any person using and accessing this site, the content or the services is referred to as the “user”, “you” or “yours”.

Acknowledgement and Consent

By communicating with us, using our services, purchasing products or services from us, submitting your personal data to us, or otherwise engaging with us, you acknowledge that you have read and understood this Notice and agree and consent to the collection, use, disclosure, processing and transfer of your Personal Data by us in accordance with this Notice and the Personal Data Protection Act 2010.

We reserve the right to modify, update or amend the terms of this Notice from time to time by publishing the revised Notice on BITAUTO’s websites (“Websites”). Your continued communication with us, use of our services, purchase of our products or services, or continued engagement with us after the effective date of the revised Notice shall constitute your acknowledgement and acceptance of such modifications, updates or amendments.

In the event of any inconsistency between the English version and any translated versions of this Notice and/or the revised Notice, the English version shall prevail.

Collection of Personal Data

"Personal Data" refers to any information in respect of commercial transaction that relates directly or indirectly to you, who is identified from the information or from that and other information in our possession, and includes any sensitive personal data and expression of opinion about you, where applicable.

The Personal Data that BITAUTO may collect about you will vary depending on how you interact and engage with us. For example, it may include:

• your name, address, telephone number, mobile phone number, social media account and email address;
• your interests and preferences in relation to our products and/or services and those of our business partners;
• device data and log data when you access any of BITAUTO’s applications or Websites, including but not limited to your username, operating system version, device type, device identifiers (IDs) such as IMEI, UUID and MAC address, system and performance information, browser type, network information and IP address;
• your communications with us such as email, telephone recordings, registration forms, survey forms or any other similar forms, comments on our posts, online chat messages; and
• such other information that is reasonably necessary for the purposes set out in this Notice or otherwise required or permitted under applicable written law.

Certain Personal Data requested by us is mandatory in order for us to provide our products or services, process your requests, perform our contractual obligations or comply with applicable legal and regulatory requirements. Where the provision of such Personal Data is mandatory, failure to provide the requested Personal Data may result in our inability to provide the requested products or services, process your requests or otherwise fulfil the purposes described in this Notice.

We may collect, use, disclose, and process your Personal Data for the Purposes and Marketing Purpose outlined below.

Sources From Which Your Personal Data May Be Obtained

a. We may obtain Personal Data from you directly when you:

• communicate with us, including when you contact us regarding any inquiries;
• enter into any commercial transactions or contractual relationship with us;
• use any BITAUTO products and/or services;
• request any information or register any interest in any of our or our partners’ products and services;
• respond to any marketing or promotional materials circulated by BITAUTO;
• enter or participate in any campaign organized by or on behalf of BITAUTO;
• visit any BITAUTO or our partners’ offices or premises;
• visit, browse, post on or otherwise submit any information through BITAUTO applications, social media platforms and/or Websites; and
• provide any feedback to BITAUTO.

b. Other than Personal Data obtained from you, we may also obtain your Personal Data from third parties, including our business partners, publicly available sources, social media platforms linked by you (such as your Facebook or YouTube account), or other person authorized by you to disclose your Personal Data to us, and/or where otherwise permitted under applicable written law.

c. We collect information about your use of our Websites from cookies. Cookies are packets of information stored in your computer or device which assist your website navigation by customizing site information tailored to your needs. Cookies in themselves do not identify the individual user, just the computer or device used. You are not obliged to accept cookies and may disable it through your browser settings. If you are concerned, you can set your computer or device either to accept all cookies, to notify you when a cookie is issued, or not to receive cookies at any time. However, rejection of cookies may affect your use of our Websites as we will be unable to personalize aspects of your use of the website.

d. Please be informed that this Privacy Notice applies solely to BITAUTO’s applications, social media platforms, Websites and BITAUTO’s products and/or services and does not apply to any third party websites you may access from our applications or Websites. We are not responsible for the privacy practices of such third-party websites. You are encouraged to review their respective privacy notices before providing any Personal Data. If you use or subscribe to any product and/or service from any third party and you subsequently provide your Personal Data directly to that third party, your Personal Data will be subject to that third party’s privacy notice.

Purposes of Collection

We may collect, use, disclose and process your Personal Data for business, and administrative purposes of BITAUTO, including but not limited to the following (“the Purpose”):

• to process your registration, subscription, purchases of our products and services;
• to perform our obligations in respect of any contract entered into with you;
• to provide you with any services or products you have requested;
• to process your participation in any events and activities including research studies, surveys, promotions, campaign, and any productions or events organized by or on behalf of BITAUTO;
• process, manage or verify your order, purchase or booking of our services and products;
• to understand and analyse your needs and preferences;
• to develop, enhance and provide products and services to meet your needs;
• to process changes to our services and products;
• to respond to questions, comments and feedback from you;
• to communicate with you for any of the purposes listed in this Notice;
• to maintain, improve or enhance our products, services and customer experience;
• for internal administrative purposes, such as auditing, data analysis, database records;
• for purposes of investigation, detection, prevention and prosecution of security breaches, crime or fraud;
• for us to comply with our legal, regulatory and contractual obligations ; and
• for such other purposes as set out in the terms of use for each of our applications and Websites.

By using our applications, Websites and/or products and services, you agree and consent that we may collect, use, disclose, process and store your Personal Data for the Purposes and in the manner as identified in this Notice.

Marketing Purpose

We may also collect, use, disclose, store and process your Personal Data for the following marketing purposes (“Marketing Purpose”), including but not limited:

• To send you alerts, newsletters, updates, mailers, promotional materials, special privileges, quotations from us, our partners, sponsors or advertisers, such as vehicle manufacturers, automotive dealers or agents;
• To notify and invite you to events or activities organized by us, our partners, sponsors or advertisers;
• To process your registration to participate in or attend an event or activity and to communicate with you regarding your attendance at the event or activity;
• To disclose your Personal Data amongst our holding company, affiliates, subsidiaries, associate companies and jointly controlled entities for the Purpose and to market their products, services, events or promotions; and
• To disclose your name, email, social media account and contact number with our partners, advertisers, event companies or sponsors who may communicate with you, for the purpose of marketing and promotions;

by way of postage, personal delivery, courier service, e-mail, call, WhatsApp message or SMS message either through electronic devices or mobile applications, or any other platforms on the internet.

If you no longer wish to receive marketing communications from us or object to the processing of your Personal Data for direct marketing purposes, you may notify us in writing using the contact details set out in this Notice. Upon receipt of your request, we will cease, or not begin, processing your Personal Data for direct marketing purposes in accordance with the Personal Data Protection Act 2010.

Transfer of Personal Data

Your Personal Data may be transferred to, stored, used and processed in a jurisdiction outside Malaysia, including by BITAUTO’s related corporation, affiliates, service providers and/or where BITAUTO’s servers are located outside Malaysia, such as Hong Kong and Singapore.

Any such transfer of your Personal Data shall be carried out in accordance with the Personal Data Protection Act 2010 and any other applicable laws. Where your consent is required under applicable law, such transfer shall be made with your consent. Where appropriate, BITAUTO will take reasonable steps to ensure that your Personal Data transferred outside Malaysia continues to be afforded a level of protection comparable to that provided under the Personal Data Protection Act 2010.

You understand and consent to the transfer of your Personal Data outside Malaysia as described herein.

Disclosure to Third Parties

Your personal data may be transferred, disclosed or made accessible to third parties for the Purposes and the Marketing Purpose set out in this Notice. Further, we may engage other companies, service providers or individuals to perform functions on its behalf, and consequently may provide access to or disclose your Personal Data to such service providers or third parties. The third parties referred to in this section include (without limitation):

• Our partners and advertisers, which include parties with whom we collaborate with for certain events, campaigns and activities;
• Event management companies and event sponsors;
• Marketing research companies;
• Service providers, including but not limited to, information technology (IT) service providers for infrastructure, software and development work, cloud hosting providers, payment processors and financial institutions, courier and logistics providers and/or customer support providers;
• Professional advisors and external auditors, including legal advisors, financial advisors and consultants;
• Other entities within BITAUTO; and
• Governmental authorities to comply with statutory, regulatory and governmental requirements.

Your Personal Data may also be disclosed in connection with a corporate transaction, including but not limited to any merger, acquisition, restructuring, disposal of assets, sale of shares, consolidation, business transfer or winding-up.

Security Measures

We are committed to take reasonable practical measures to safeguard your Personal Data from any loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction, by ensuring that:

• your Personal Data is kept as required by the Personal Data Protection Act 2010;
• requiring our employees who have access to your Personal Data to comply with appropriate confidentiality obligations;
• any appointed suppliers and service providers who process any of your Personal Data on BITAUTO’s behalf to comply with appropriate confidentiality, security and data protection obligations, in accordance with the terms of their contractual arrangement with BITAUTO.

Nevertheless, you are responsible for maintaining the confidentiality of your account credentials, including your username and password, and should not disclose them to any third party. BITAUTO shall not be responsible for any unauthorized access arising from your failure to safeguard such credentials.

Retention Period

We will maintain your Personal Data in our business records while you remain a subscriber, customer or user of any of our products and/or services or a user of the BITAUTO applications and Websites. We will also maintain your Personal Data for as long as necessary to fulfil the Purposes set out in this Notice, to comply with applicable legal or regulatory requirements, resolve disputes or enforce our legal rights.

When your Personal Data is no longer required for the purposes for which it was collected or otherwise required by applicable law, we will take reasonable steps to securely destroy, permanently delete or anonymise such Personal Data in accordance with the Personal Data Protection Act 2010 and our internal retention policies.

Your Rights in Respect of Your Personal Data

In most instances, it is necessary for us to process your Personal Data in order to provide BITAUTO’s products and services and for BITAUTO to operate in the ordinary course of business. However, subject to the Personal Data Protection Act 2010 and any applicable legal restrictions, you may exercise your rights in relation to your Personal Data in the manner described herein.

You may at any time contact BITAUTO’s Personal Data Protection Team via registered post or email as set out in our contact details in the last section below to make inquiries or raise complaints about the processing of your Personal Data and you may request in writing to:

• access your Personal Data;
• withdraw your consent to BITAUTO’s processing of your Personal Data;
• limit the processing by BITAUTO of your Personal Data;
• request the correction (including the deletion) of your Personal Data where it is inaccurate, incomplete, misleading or not up to date; and
• request that BITAUTO cease processing your Personal Data for direct marketing purposes or cease sending marketing communications via email, phone, WhatsApp message or SMS message.

BITAUTO will respond to your data access and data correction requests within the 21 days, subject to any extension permitted under Personal Data Protection Act 2010.

Please note that we reserve our right to decline any data access request or data correction request in certain situations, including:

• where we are unable to confirm your identity;
• where information requested for is of a confidential nature;
• if we receive repeated requests from you and the burden or expense of providing access is disproportionate to the risks of your privacy; and

We also reserve the right to charge a reasonable fee (where permitted under the applicable law) for processing any data access request.

Personal Information From Minors and Other Individuals

We do not knowingly collect or process Personal Data from individuals under 18 years of age. If you are a parent or legal guardian, please ensure that any minor under your care does not submit Personal Data to us without your consent or supervision. In the event that such Personal Data relating to a minor is provided to us, the parent or legal guardian submitting such Personal Data confirms that he or she has the authority to do so, you hereby consent to the processing of the minor’s Personal Data in accordance with this Notice, and personally accept and agree to be bound by this Notice and take responsibility for his or her actions.

In some circumstances you may have provided personal data relating to other individuals (such as your spouse, family members or friends) and in such circumstances you represent and warrant that you have obtained the necessary consent or are otherwise authorized under applicable law to provide their Personal Data to us and to permit us to process and use such Personal Data in accordance with the manner as set forth in this Notice.

Contact Us

Should you have any queries, requests to exercise your rights under this Notice (including requests to access, correct and/or to limit the processing of your Personal Data), concerns or complaints in relation to the processing of your Personal Data, kindly contact our Personal Data Protection Team through the following channels:

• by post at the following address: Suite 13A.03 of Level 13A, Low Zone, Menara Bank Pembangunan, Plaza Conlay, Jalan Conlay, 50450, Kuala Lumpur, Malaysia; or
• by email at malaysia.auto@bitauto.com.