China Addendum to Toll Privacy Policy

Subject to any applicable data protection laws or regulations of the People’s Republic of China (“PRC”) including but not limited to the Personal Information Protection Law ("Applicable Law"), the provisions in this addendum (“Addendum”) shall apply as a supplement to the Toll Group Privacy ("Policy") and prevail over any conflicting provisions in the Policy, and shall apply and only apply to the Toll companies in the PRC.

1. scope

Toll Global Logistics (China) Co. Ltd, Toll Logistics (Shanghai) Co Ltd, Toll Global Logistics (Taicang) Co., Ltd, Toll Logistics (Jiaxing) Co. Ltd, Toll Global Forwarding (Beijing) Ltd, Seamaster Global Forwarding (Shanghai) Ltd., or BALtrans International Special Freight Ltd. ("Toll")is the data controller, i.e. the organisation that independently determines the purposes and means of processing in their activities of processing of personal data.

1. principles

Personal Data

"Sensitive personal data" means the personal data of which the leakage or illegal use could easily lead to the violation of the personal dignity of a natural person or harm to personal or property safety, including information on biometric recognition, religious belief, specific identity, medical and health, financial account, and personal location tracking, and personal data of minors under the age of fourteen.

Personal Data Collection

We will process your personal data based on your consent, unless we are allowed to process your personal data without your consent if otherwise permitted by Applicable Law, including:

(a) Where it is necessary for the conclusion or performance of a contract to which the data subject is a contracting party; 

(b) Where it is necessary for carrying out human resources management under an employment policy legally established or a collective contract legally concluded;

(c) Where it is necessary for performing a statutory responsibility or statutory obligation;

(d) Where it is necessary for responding to a public health emergency, or for protecting the life, health or property safety of the natural person in the case of an emergency;

(e) Where the personal data is processed within a reasonable scope to carry out any news reporting, supervision by public opinions or any other activity for public interest purposes;

(f) Where the personal data, which has already been disclosed by the data subject or otherwise legally disclosed, is processed within a reasonable scope and in accordance with the Personal Information Protection Law; or

(g) Any other circumstance as provided by laws or regulations.

We will only process sensitive personal data about you where you have given your separate consent unless we are otherwise permitted by Applicable Law.

The sensitive personal data we collect may include the following underlined personal data:

• When you as a customer or the personnel of customers, or are a recipient or sender of goods transported by us or services provided by us, create an account or use or receive the benefit of our services, we, or our service providers acting on our behalf, may collect the following types of information: your name, date of birth, driver number ID, personal ID, address, phone, email, full bank account details and/or credit card numbers that you link to your account or input when you use our services. We will use this information to fulfil your requests and provide the relevant services; 
• We may require you to provide additional information which we may use in collaboration with service providers acting on our behalf to verify your identity or address, and to manage our exposure to risk. This information may include your date of birth, taxpayer or government identification number, a copy of your government-issued identification, a photo of you, or other personal data. We may also obtain information about you from third parties such as credit bureaus and identity verification services; 
• Financial information; 
• If you exchange emails, telephone conversations or other electronic communications with our employees and other staff members, our information technology systems will record details of those conversations, sometimes including their content; or 
• Some of our premises have closed circuit TV systems or other monitoring devices which may record you if you visit our premises, for security and safety purposes. 

Use and Disclosure of Personal Data

You agree that we have the right to share your personal data with: 

• any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries. 
• selected third parties including business partners.
• in exceptional circumstances to competent regulatory, prosecuting and other governmental agencies in the PRC. Without the approval of competent PRC authorities, we will not provide any personal data to a foreign judicial or law enforcement body.

For sharing your personal data with the above third parties, we will obtain your separate consent in accordance with Applicable Law.

When we share your personal data with other third parties who can independently determine how and why personal data is processed and who is not disclosed above, we will inform you the name and contact information of such third parties and obtain your separate consent to share your personal data with them. 

Access, Correction and Retention

You have the rights to request deletion of your personal data held by us in the following circumstances:

(a) Where the purpose of processing has been achieved or is unable to be achieved, or the personal data is no longer necessary for achieving the purpose of processing;

(b) Where the data controller ceases the provision of the product or service involved, or the retention period has expired;

(c) Where consent is withdrawn by the data subject;

(d) Where the processing of personal data by the data controller is in violation of any law, regulations or agreement; or

(e) Any other circumstance as provided by law or regulations.

You have the right to decide on the processing of your personal data, as well as the right to restrict or deny another person from the processing of your personal data.

You have the right to require the data controller to explain its rules of processing of personal data.

Storage and Security of Personal Data

The data that we collect from you will be transferred to, and stored at, a destination outside the PRC. It will also be processed by staff operating outside the PRC who work for us or for one of our suppliers.

Transfer of Personal Data Outside the Country in which it was Collected

We may, as part of the disclosures set out at "Use and Disclosure of Personal Data" and "Storage and Security of Personal Data " above, transfer your personal data outside the country in which the personal data was collected. 

For transferring your personal data to the above recipients, we will obtain your separate consent in accordance with Applicable Law.When we transfer your personal data to other recipients outside the PRC who are not disclosed above, we will inform you the name and contact information of such recipients and obtain your separate consent to transfer your personal data to them. 

Toll will enter into data transfer agreements (as applicable on terms of the standard contract for outbound cross-border transfer of personal data issued for this purpose by the Cyberspace Administration of China) with the recipients of the personal data to ensure that the recipient abides by Toll's obligations under applicable data protection laws.

Further Information

We may amend this Policy from time to time, especially when the types of personal data processed, processing purposes and means, etc. change. Updated versions of this Policy will be placed on our website (http://www.tollgroup.com).