Site Policies

Personal information protection principles

Transparency and the duty to inform

A privacy policy fulfills a legal duty to inform and should follow the principles of openness and transparency.

Before processing personal information, the individual should be clearly and prominently informed, in accessible language, of the processor's name and contact details; the purpose and method of processing; the types of information and retention period; and the procedures for exercising rights, including access, correction and deletion. Processing rules should be public and easy to consult and save.

Consent

Consent is one of the principal legal grounds for processing personal information. The policy should explain how consent is obtained and withdrawn. Valid consent must be voluntary, explicit and fully informed.

Separate consent is required for activities such as providing information to third parties, processing sensitive information and cross-border transfers; it must not be bundled with unrelated matters.

Convenient withdrawal of consent must be available. Services should not be refused because consent is withdrawn unless the information is necessary to provide the service.

Data minimization

Processing should have a clear, reasonable purpose and be directly related to that purpose. Collection should be limited to the minimum necessary, without excessive collection. Information should be retained for the shortest period necessary to achieve the purpose.

Sensitive personal information

Sensitive information requires specific notice and stricter safeguards. It includes biometrics, religious beliefs, specific identities, medical and health information, financial accounts, location history and personal information relating to children under 14.

Processing sensitive information requires a specific purpose, sufficient necessity and strict protective measures. Individuals should also be informed of why the processing is necessary and how it may affect them.

Processing information about children under 14 requires the consent of a parent or other guardian and dedicated processing rules.

Automated decisions and disclosure

Automated decision-making, including algorithmic recommendations and pricing, should be transparent and fair, without unreasonable differential treatment. Commercial marketing should offer an option that does not target personal characteristics or a convenient way to refuse it.

Personal information should not be made public without separate consent. Images and identification information collected in public places for public safety may only be used for that purpose.

Legal basis

These principles derive from the Personal Information Protection Law of the People's Republic of China, effective November 1, 2021. Individuals may exercise their rights under that law where a privacy policy breaches its requirements, such as excessive collection or the absence of a way to withdraw consent.