贵州茅台酒股份有限公司数据与隐私政策

Kweichow Moutai Co., Ltd. Data and Privacy Policy

　　 贵州茅台酒股份有限公司（以下简称“公司”）深知个人信息对您的重要性,并会尽全力保护您的个人信息安全可靠。公司致力于维持您对公司的信任,恪守以下原则,保护您的个人信息：权责一致原则、目的明确原则、选择同意原则、最小必要原则、确保安全原则、主体参与原则、公开透明原则等。同时，贵州茅台酒股份有限公司承诺,公司将按业界成熟的安全标准,采取相应的安全保护措施来保护您的个人信息。

　　 Kweichow Moutai Co., Ltd. (hereinafter referred to as “the Company”) deeply understands the importance of personal information to you and will do our utmost to protect your personal information securely and reliably. The Company is committed to maintaining your trust in the company and will adhere to the following principles to protect your personal information: the Principle of Consistency of Rights and Responsibilities, the Principle of Specific Purpose, the Principle of Selective Consent, the Principle of Minimalism and Necessity, the Principle of Security, the Principle of Participation, and the Principle of Openness and Transparency. At the same time, Kweichow Moutai Co., Ltd. promises that the company will follow industry-leading security standards and take appropriate security measures to protect your personal information.

　　 一、 适用范围

　　 I. Scope of Application

　　 本政策适用于贵州茅台酒股份有限公司提供的产品和服务及其延伸的功能，包括但不限于网站、客户端、小程序以及随技术发展出现的新形态向您提供的各项产品和服务。如关联公司的产品或服务中使用了贵州茅台酒股份有限公司服务（例如i茅台、招聘网站），如公司提供的某款产品有单独的隐私政策或相应的用户服务协议当中存在特殊约定，则该产品的隐私政策将优先适用，未设独立数据与隐私政策的，则本政策同样适用于该部分产品或服务。

　　 This policy applies to the products and services provided by Kweichow Moutai Co., Ltd. and their extended functions, including but not limited to websites, app, mini-programmes, and new forms of products and services provided to you as technology evolves. If the products or services of affiliated companies use the services of Kweichow Moutai Co., Ltd. (such as iMoutai, and recruitment websites), or if a specific product has a separate privacy policy or a specific provision in the corresponding user service agreement, then that product’s privacy policy will take precedence. For products or services without an independent data and privacy policy, this policy will also apply.

　　 二、 信息的收集

　　 II. Collection of Information

　　 公司将依据《数据安全法》《个人信息保护法》《信息安全技术——个人信息安全规范》的要求，严格执行信息的收集和保护。公司将按照最小且必要原则进行信息的收集且在收集前明确告知您并取得您的同意，公司将对相关数据进行妥善的保存。

　　 The Company will strictly follow the requirements of the Data Security Law of the People"s Republic of China, Personal Information Protection Law of the People"s Republic of China, and the Information Security Technology - Personal Information Security Specification for the collection and protection of information. The Company will collect information based on the principles of minimalism and necessity and will inform you clearly and obtain your consent before collecting it. The Company will properly store relevant data.

　　 三、 信息的使用

　　 III. Use of Information

　　 公司会以下为目的使用个人信息：为服务提供支持、招聘、网上购物、与您沟通、实施安全以及遵守法律，公司也可能在经你同意的前提下将个人数据用于其他用途。

　　 The Company will use personal information for the following purposes: providing service support, recruitment, online shopping, communication with you, ensuring security, and complying with the law. The Company may also use personal data for other purposes with your consent.

　　 四、 公司如何存储与保护您的个人信息

　　 IV. How does the Company Store and Protect Your Personal Information

　　 （一） 存储

　　 1. Storage

　　 公司会按照法律法规及监管要求规定，将在境内收集和产生的个人信息存储于境内。公司仅会在法律法规及监管要求的期限内保留您的个人信息，除非需要延长保留期或受到法律的允许。在您的个人信息超出保留期间后，公司会根据适用法律的要求处理您的个人信息。

　　 The Company will store in China the personal information collected and generated in China in accordance with legal and regulatory requirements. The Company will retain your personal information only for the period required by laws and regulations unless an extended retention period is needed or permitted by law. Once the retention period of your personal information has expired, the Company will handle your personal information in accordance with applicable laws.

　　 （二） 保护

　　 2. Protection

　　 1.公司将遵守相关法律规定，采取必要措施保障个人信息的安全，以防止个人信息在意外的、未经授权的情况下被非法访问、复制、修改、传送、破坏、处理或使用。例如，信息加密存储、使用加密技术进行信息传输、匿名化处理信息、数据库加密等手段来保护您的个人信息。

　　 1) The Company will comply with relevant laws and regulations when taking necessary measures to ensure the security of personal information, in a bid to prevent illegal access, copying, modification, transmission, destruction, processing, or use of personal information in accidental or unauthorized situations. Examples include encrypted storage of information, using encryption technology for information transmission, anonymizing information, and encrypting databases, to protect your personal information.

　　 2.公司建立配套的管理制度和流程以保障您的信息安全。例如，建立数据安全管理办法、个人信息数据安全管理规范、数据分类分级制度来管理规范个人信息的存储与使用。同时严格限制信息访问权限、对信息访问及处理行为进行系统监控、要求相关工作人员签署保密协议，对可能接触到您信息的工作人员采取最小化权限原则等。

　　 2) The Company has established supporting management systems and processes to ensure your information’s security. This includes creating data security management measures, personal information data security management standards, and data classification and grading systems to regulate the storage and use of personal information. The Company also strictly limit access to information, monitor information access and processing activities, require relevant staff to sign confidentiality agreements, and apply the principle of minimal necessary access for employees who may encounter your information.

　　 3.若发生个人信息泄露等安全事件，公司会启动应急预案，阻止安全事件扩大，并将及时将事件相关情况会采取电话、公告等合理、有效的方式告知。

　　 3) In the event of a personal information breach or other security incidents, the Company will activate an emergency response plan to prevent the security incident from escalating. We will promptly inform you of the incident-related situation through reasonable and effective means, such as phone calls or public announcements.

　　 五、 公司如何共享与转移您的个人信息

　　 V. How does the Company Share and Transfer Your Personal Information

　　 （一） 如何共享与转移

　　 1. How does the Company Share and Transfer

　　 1. 基本原则

　　 1) Basic Principles

　　 1)合法正当与最小必要原则：数据处理应当具有合法性基础，具有正当的目的，并以实现处理目的最小范围为限。

　　 a. The Principle of Legality, Justification, Minimalism and Necessity: Data processing should have a legal basis, a legitimate purpose, and be limited to the minimum scope necessary to achieve the processing purpose.

　　 2)用户知情权与决定权最大化原则：数据处理过程中充分尊重用户对其个人信息处理享有的知情权与决定权。

　　 b. The Principle of Maximization of Users’ Right to Know and Decision-making Authority: During data processing, we fully respect users’ rights to be informed and to decide on the processing of their personal information.

　　 3)安全保障能力最强化原则：公司将采取必要措施保障所处理个人信息的安全，审慎评估使用数据的目的。

　　 c. The Principle of Strongest Security Assurance: the Company will take necessary measures to ensure the security of the processed personal information and carefully assess the purpose of using the data.

　　 （二） 公司不会向其他任何公司、组织和个人共享或转移您的个人信息，但以下情况除外：

　　 2. The Company will not share or transfer your personal information to any other company, organization, or individual, except in the following circumstances:

　　 1. 先获得您明确的同意或授权。

　　 a. With your explicit consent or authorization in advance.

　　 2. 根据法律法规、行政及司法部门强制性要求进行提供。

　　 b. As required by laws, regulations, or mandatory requests from administrative or judicial authorities.

　　 3. 应您需求为您处理您与他人的纠纷或争议。

　　 c. At your request, to handle disputes or conflicts between you and others.

　　 4. 符合与您签署的相关协议（包括在线签署的电子协议以及相应的平台规则）或其他的法律文件约定所提供。

　　 d. To provide in accordance with relevant agreements you have signed (including electronically signed agreements and corresponding platform rules) or other legal documents.

　　 5. 基于符合法律法规的社会公共利益、突发公共卫生事件而使用。

　　 e. Based on the public interest in compliance with laws and regulations or during public health emergencies.

　　 六、 您如何管理您的个人信息

　　 Ⅵ. How You Can Manage Your Personal Information

　　 6. 按照中华人民共和国相关的法律法规和监管规定，公司保障您对自己的个人信息行使以下权利。

　　 In accordance with relevant laws and regulations of the People’s Republic of China, the Company ensure that you can exercise the following rights regarding your personal information:

　　 1. 访问、更正及更新您的个人信息

　　 1. Access, Rectification, and Update Your Personal Information.

　　 1） 您有权查阅、更新、下载公司持有您的特定的个人信息。

　　 1) You have the right to access, update and download your specific personal information held by the Company.

　　 2） 要求公司更新或更正您的不准确的个人信息。

　　 2) You can request us to update or rectification any inaccurate personal information.

　　 2. 删除您的个人信息

　　 2. Delete Your Personal Information

　　 在以下情形中，您可以向公司提出删除用户信息的请求

　　 You can request the Company to delete your personal information under the following circumstances:

　　 1）如果公司处理个人信息的行为违反法律法规；

　　 1) If the Company"s processing of personal information violates laws and regulations.

　　 2）如果公司收集、使用您的个人信息，却未征得您的明确同意；

　　 2) If the Company collects and usesyour personal information without obtaining your explicit consent.

　　 3）如果公司处理个人信息的行为严重违反了与您的约定；

　　 3) If the Company"s processing of personal information seriously breaches our agreement with you.

　　 4）如果公司的处理目的已实现、无法实现或者为实现处理目的不再必要；

　　 4) If the purposes for which the Company processed your personal information have been achieved, cannot be achieved, or are no longer necessary.

　　 5）如果公司停止提供产品或者服务，或者保存期限已届满。

　　 5) If the Company ceases to provide products or services, or the retention period has expired.

　　 3.改变您授权同意的范围

　　 3. Change the Scope of Your Consent

　　 当您撤回同意或授权后，公司无法继续为您提供撤回同意或授权所对应的服务，也将不再处理您相应的个人信息。但您撤回同意或授权的决定，不会影响此前基于您的同意或授权而开展的个人信息处理。

　　 When you withdraw your consent or authorization, the Company will no longer be able to provide you with the corresponding services and will cease processing your relevant personal information. However, your decision to withdraw consent or authorization will not affect any prior processing of personal information based on your previous consent or authorization.

　　 七、 未成年人信息的保护

　　 VII. Protection of Minors’ Information

　　 根据《未成年人保护法》规定，禁止向未满十八周岁的未成年人出售烟酒。如果您是未成年人，请不要以任何方式购买公司含酒精商品和/或使用服务。

　　 According to the Law of the People"s Republic of China on the Protection of Minors, it is prohibited to sell tobacco or alcohol to minors under the age of eighteen. If you are a minor, please do not purchase any alcoholic products or use the services in any way.

　　 公司建议父母或监护人指导未满十八岁的未成年人使用公司的服务。公司建议未成年人鼓励他们的父母或监护人阅读本《贵州茅台酒股份有限公司数据与隐私政策》，并建议未成年人在使用公司的产品/服务前（含酒精商品除外），应事先寻求您的父母或监护人的同意和指导。

　　 The Company recommends that parents or guardians guide minors under the age of eighteen in using the Company"s services. The Company also suggests that minors encourage their parents or guardians to read this Kweichow Moutai Co., Ltd. Data and Privacy Policy and seek their consent and guidance before using the Company"s product/services (excluding alcoholic products).

　　 对于经父母或监护人同意而收集儿童个人信息的情况，公司只会在法律允许、父母或监护人明确同意或者保护儿童所必要的情况下使用或披露此数据，如您的父母或监护人不同意您按照本政策使用公司的服务或向公司提供信息，请您立即终止使用公司的服务并及时通知公司，以便公司采取相应的措施。

　　 For cases where children’s personal information is collected with parental or guardian consent, the Company will only use or disclose this data as permitted by law, with explicit parental or guardian consent, or as necessary to protect the children. If your parents or guardians do not agree with your use of the Company’s services according to this policy or with your providing information to the Company, please immediately cease using the Company’s services and notify us promptly so the Company can take appropriate measures.

　　 如果父母或监护人发现公司在未获父母或监护人同意的情况下收集了儿童个人信息，请联系公司，同时提交相关材料以便公司验证身份，公司会尽快审核并设法尽快删除相关数据。

　　 If parents or guardians find that the Company have collected children’s personal information without their consent, please contact the Company and provide relevant materials for identity verification. The Company will review the request as soon as possible and strive to delete the relevant data promptly.

　　 八、 隐私协议更新的规则

　　 VIII. Rules for Privacy Policy Updates

　　 1. 隐私政策的修订

　　 1. Revision of Privacy Policy

　　 公司可能适时修订本隐私政策的条款，该等修订构成本《隐私政策》的一部分。

　　 The Company may revise the terms of this Privacy Policy in due time, and such revisions constitute part of this Privacy Policy.

　　 2. 隐私政策的更新通知

　　 2. Notification of Privacy Policy Updates

　　 如可能造成您在本隐私政策下权利的实质减少或扩大收集、使用信息的范围等重要规则变更时，公司将通过个人信息主体登录信息系统时、更新信息系统版时弹出窗口提示更新或在网站进行更新公布。

　　 In the event of changes to important rules, such as substantial reduction of your rights under this Privacy Policy or expansion of the scope of information collection and use, the Company will provide notifications through pop-up windows prompting updates when personal information subjects log into the information system or update the system version, or announce updates on the website.

　　 附 则

　　 Supplementary Provisions

　　 定义

　　 Definitions

　　 个人信息数据：指以电子或者其他方式记录的与已识别或者可识别的自然人有关的各种信息，不包括匿名化处理后的信息。

　　 Personal Information Data: Refers to various information recorded in electronic or other ways related to identified or identifiable natural persons, excluding information that has been anonymized.

　　 敏感个人信息：敏感个人信息是一旦泄露或者非法使用，容易导致自然人的人格尊严受到侵害或者人身、财产安全受到危害的个人信息，包括生物识别、宗教信仰、特定身份、医疗健康、金融账户、行踪轨迹信息，以及不满十四周岁未成年人的个人信息。

　　 Sensitive Personal Information: Refers to personal information that, once leaked or illegally used, may easily lead to the infringement of the dignity of natural persons or endanger the personal safety and property, including biometric data, religious beliefs, specific identities, medical health, financial accounts, trajectory information, and personal information of minors under the age of fourteen.

　　 儿童：指不满十四周岁的未成年人。

　　 Children: Refers to minors under the age of fourteen.

　　 个人信息的处理：个人信息的处理包括个人信息的收集、存储、使用、加工、传输、提供、公开、删除等。

　　 Processing of Personal Information: Includes the collection, storage, use, processing, transmission, provision, disclosure, deletion, etc., of personal information.

　　 个人信息处理者：个人信息处理者是指在个人信息处理活动中自主决定处理目的、处理方式的组织、个人。

　　 Personal Information Processor: Refers to an organization or individual that autonomously decides on the purpose and method of processing personal information in personal information processing activities.

　　 个人信息主体：个人信息主体指个人信息所标识或者关联的自然人。

　　 Personal Information Subject: Refers to the natural person identified or associated with the personal information.

　　 去标识化：指个人信息经过处理，使其在不借助额外信息的情况下无法识别特定自然人的过程。

　　 De-identification: The process by which personal information is processed so that it is impossible to identify a specific natural person without the aid of additional information.

　　 匿名化：指个人信息经过处理无法识别特定自然人且不能复原的过程。

　　 Anonymization: Refers to the process by which personal information is processed to make it unidentifiable as a specific natural person and irrecoverable.