Chain ESG Data Privacy Policy

To protect your lawful rights, we have issued this data privacy policy so you can understand the principles we follow and the security measures we take when we serve you. We process your user information (including collection, storage, use, processing, transmission, provision, disclosure, and deletion) under principles of consistent rights and duties, a clear purpose, ensuring security, involving the data subject, and being open and transparent.

Please read this Chain ESG Data Privacy Policy (the “Privacy Policy”) carefully before using our products or services. Chain ESG is committed to protecting your data security and privacy, and to providing safer, more convenient, and higher-quality ESG data services.

This policy applies only to services of the Chain ESG platform.

1. How we collect and use your user information

1.1 Purpose and scope of collection

  • Unless you are a customer to whom we issue a dedicated account and password, you need to register as a formal user to use our services. To complete registration and serve you, we need company information such as full legal name, unified social credit code, contact name, mobile number, and email address.
  • When you use ESG questionnaires and similar features, you may need to provide ESG-related data such as greenhouse-gas emissions, environmental data, social-responsibility performance, and governance information. User information you enter on input pages will be used in submitted ESG questionnaires or generated ESG reports. Except for storing the data as allowed by law and applying data-protection measures, we will not process that information for other purposes.
  • We may also collect information generated while you use the system through technical means such as system logs, including access time, frequency of use, and system response.
  • We may use separate surveys to collect your views on our services and related information (including your company, department, mobile number, and email) to understand your experience and your suggestions for the system and its features.

1.2 Use of information

  • The full company name, unified social credit code, contact name, mobile number, email address, topics of interest, and enquiry details you provide will be used to create your account and to communicate with you about Chain ESG services.
  • ESG-related data you provide while using Chain ESG will be used to generate ESG questionnaires, ESG reports, and similar services.
  • Information we collect about how you use the system will be used to fix technical faults, detect and respond to abnormal account activity, and provide more suitable and effective services.
  • Information you fill in on surveys we send via the website or otherwise will be used to improve our services and to contact you to understand your feedback.

2. How we store your user information

In principle, user information collected and generated while you use Chain ESG is stored in the People’s Republic of China.

We keep data you provide for as long as needed to fulfil the purposes in this privacy policy, unless a longer retention period is allowed by law.

3. How we protect your user information

We use industry-standard security technologies and measures to protect your user information against unauthorised access, use, alteration, damage, or loss. Measures include, without limitation:

  • Advanced encryption to protect ESG data in transit and at rest.
  • Dedicated protections such as firewalls, intrusion detection, and backup and recovery, to prevent leaks and unlawful access.
  • Regular security audits and vulnerability scans, with timely patching.
  • Access rights based on identity and role, so only authorised people can access sensitive data.
  • Monitoring of system logs that record access to and operations on data, so we can detect and respond to anomalies.

Please understand that no network environment is 100% secure. We will keep updating our technical and organisational measures to protect the user information we collect. If user information is or may be leaked, altered, or lost, we will take remedial measures promptly and notify regulators as required. If we cannot effectively prevent harm by those measures, we will notify you promptly.

4. Your rights

Under applicable Chinese law, as the data subject you may lawfully:

(1) Access your user information, except where the law provides otherwise.

(2) Correct or complete your user information if you find it inaccurate or incomplete.

(3) Request deletion of your user information if you believe our processing breaks the law, was done without your consent, or breaks this Privacy Policy, or if you no longer use our products or services, you close your account, or we no longer provide the products and services. We will respond as required by law. If we delete your information from the service, we may not delete it from backup systems at once, but will do so when backups are refreshed. If deletion is technically hard, we will stop processing other than storage and necessary security measures.

(4) Restrict or refuse our processing of your user information, unless the law provides otherwise.

(5) Transfer user information you provided to us to a designated processor. If the legal conditions are met, we will provide a transfer path.

(6) Withdraw consent where processing is based only on your consent. Withdrawal does not affect processing already carried out based on consent.

(7) Apply to close your account if you no longer need our products or services.

(8) Obtain a copy of your user information as provided by law.

(9) Ask us to explain this Privacy Policy.

You may exercise these rights through the contact details in section 7, “How to contact us”. Please understand that some features need basic user information. If you delete, restrict, or refuse processing, withdraw consent, or close your account, we may no longer be able to provide products or services.

5. Policy updates and notices

5.1 Updates

We will update this Privacy Policy from time to time as laws change and the business develops.

When there is a material change, we will provide the updated policy through system notices, email, or similar channels.

5.2 How to read and ask questions

You can read this Privacy Policy through the in-product help centre or by contacting support.

If you have questions or suggestions, contact us using the details in section 7, “How to contact us”.

6. Governing law and disputes

6.1 Governing law

Interpretation, validity, and dispute resolution of this Privacy Policy are governed by the laws of the People’s Republic of China.

6.2 Disputes

Any dispute arising from this Privacy Policy should first be resolved through friendly consultation, unless applicable PRC law requires otherwise. If consultation fails, either party may sue in a people’s court with jurisdiction.

7. How to contact us

You may email contact@chainesg.cn at any time about this Privacy Policy or to exercise your rights as a data subject.