Personal Information Protection Policy of MTour

Update Date: October 7, 2023

Effective Date: October 7, 2023

In order to effectively protect the personal information of MTour users and optimize user experience, MTour (hereinafter referred to as "we", meaning Shanghai Rebase Network Technology Co., Ltd.) has formulated the "MTour Personal Information Protection Policy" (hereinafter referred to as "this policy") in accordance with current laws and policies. This policy will detail our policies and measures in obtaining, using, managing, and protecting user personal information.

We strive to express in simple, clear, and concise words, and mark the terms closely related to your rights in bold in this policy to remind you to pay attention. Therefore, before using MTour, please read and fully understand this policy, and use MTour services only after confirming that you fully understand and agree.

Important reminder:

1 This policy applies to all products and services we provide to you, including but not limited to websites, clients, mini-programs, H5, quick applications, components, widgets, and new forms that appear with the development of technology, whether you are through computer equipment, mobile terminals or other devices obtained MTour service. This policy does not apply to:

Information collected by third-party products or services (including any third-party websites) accessed through MTour;
Information collected by third parties that help MTour advertise;
Information collected by third parties conducting advertising activities in MTour.

Your use of these third-party services (including any personal information you provide to these third parties) will be subject to these third parties' terms of service and privacy policies (not this policy), the specific provisions please read the relevant terms of the third party carefully. Please protect your personal information and only provide it to third parties when necessary.

2 Please note that the client and related services mentioned in this policy may vary depending on the model of your client device, system version, browser version, software application version, etc. The final product and service are subject to the MTour client you use.

3 The relevant terms in this policy, unless otherwise agreed, all adopt the interpretation of applicable data protection laws.

"Applicable data protection laws" mainly refer to Chinese personal information protection-related laws and regulations (Personal Information Protection Law, Data Security Law, Civil Code, Cybersecurity Law) and their supporting implementation rules, national standards, and regulatory requirements (to avoid doubt, excluding Hong Kong Special Administrative Region, Macau Special Administrative Region, and Taiwan region law).

4 You acknowledge and understand that some of the services we provide to you may require the processing of your sensitive personal information. Such sensitive personal information will be marked in bold to remind you to pay attention. We will only process your sensitive personal information based on your consent, to provide you with the services you need, or for the need to fulfill legal obligations, and such processing activities will not adversely affect your rights. We will take security and technical measures that match the risk level of relevant sensitive personal information in accordance with the law to prevent unauthorized access and personal information disclosure, alteration, loss.

In this policy, we will legally disclose to you the necessary matters for processing your sensitive personal information (including but not limited to processing purposes, methods, and types of sensitive personal information, etc.), and pop-up windows or separate pages in MTour will remind you again and seek your separate consent (except as otherwise provided by applicable data protection laws).

This policy will help you understand the following:

How we collect and use your personal information
Cookie and related technology notice
How we delegate processing, share, transfer, and publicly disclose your personal information
How we protect your personal information
How we store your personal information
Your personal information subject rights
How we collect and process the personal information of minors
Updates to this policy
Third-party SDK directory
How to contact us

I. How We Collect and Use Your Personal Information

1 Personal information you voluntarily provide to us

1.1 Registration and login account

When you register a MTour account or use the account management function to add other accounts, we will collect your account nickname, password, password protection options, and mobile phone number through the registration and login process.

If you log in to MTour in other ways, we will request your personal information from the associated third party. For personal information that we request but the third party cannot provide, we may still ask you to provide: (1) When you log in with a WeChat account, we will obtain your WeChat avatar, WeChat nickname, gender, and regional information; (2) When you log in with an Apple ID, we will obtain your Apple ID's email address. To ensure account security and implement the real-name system online, you may still need to bind a valid mobile number when you log in with other methods or use certain features of MTour. We collect this information to create your MTour account and verify your real identity. If you refuse to provide this information, it will affect your registration and use of MTour.

To make it convenient for you to log in and use our products and those of our associates, we use a unified account system. You can log in and use MTour and other products with your MTour account. If you modify account information (including account password, password protection options, and mobile phone number) in any of our products, the modification will automatically sync to your unified account. You understand and agree that if you cancel your account in any of our products, it may affect your use of other products.

1.2 When editing your personal homepage, you can edit your nickname and avatar. If you need to change your avatar, you need to authorize us to access your photo album or external storage information; otherwise, we cannot obtain the file content in your device. If you need to take an avatar photo, you may also need to turn on the camera on your device.

1.3 When you copy or follow information, we need to access your clipboard to read the contained passwords, copy codes, and links to enable redirection, sharing, and other features or services. This helps you open copied or followed content and enhances your product usage experience.

MTour only uploads it to our server when the content of the clipboard is identified locally as a MTour redirect command. Other than that, MTour does not upload any other information from your clipboard to our server. Some mobile devices' systems will notify that an app is reading the clipboard, but this system notification does not distinguish whether it is collecting clipboard information and may give false alarms. Therefore, if you notice similar alerts, please contact us so that we can locate the issue.

1.4 If you provide us with a contact method (such as a mobile phone number) during the use of MTour, we or a third party cooperating with us may send you commercial information via text message. If you do not wish to receive these messages, you can unsubscribe via the method provided in the text message or contact us directly to unsubscribe.

1.5 If we obtain your personal information outside of the above scenarios, we will re-obtain your explicit consent, and fully explain the application scenario and the content and scope of the information we obtain from you before obtaining your explicit consent, except where applicable data protection law provides otherwise.

2 Personal Information We Collect Indirectly

When you use third-party applications accessed through The MTour, we may, for the purpose of providing docking technical support and other purposes, obtain necessary personal information about you from the developers of such third-party applications and their technical service providers, such as device information and operational behavior log information. If this involves your sensitive personal information, we will obtain your authorization separately. If you refuse us to collect related personal information, it may lead to the inability to implement all or part of the functions of the third-party applications, but it will not affect your use of other functions of The MTour.

The developers and technical service providers of such third-party applications may directly collect and use your personal information in accordance with their privacy policy. However, we will not obtain this personal information. We suggest you read and confirm your understanding of their privacy policy before accepting related services and providing personal information.

3 Personal Information We Collect Automatically

When you use our services through entrances such as websites, clients, and mini-programs, we may automatically collect your IP address, device model, unique device identification code, SN code, browser model, rough location information (such as country or city information), installed application information, Android ID, sensor information, and other device technology information from your device. We will also collect some log information of you using our services, such as the pages visited or links clicked.

The collection of such information is mainly to ensure the safe operation of the service, and also to better understand you, such as where you come from and what content of our service attracts you. We use this information for internal analysis, as well as to improve service quality and service relevance for you. We also need to retain the corresponding logs to record the operating status of our website, mobile clients, and other service entrances to comply with legal regulations.

This information is generally collected through the use of cookies or similar tracking technology we use. For details, please see the "Cookie and Related Technology Notice" section below.

4 Device Permissions We Obtain

In order to provide you with convenient and high-quality services, we may need to call upon some permissions on your device. When you use the corresponding functions, you will see a pop-up reminder asking if you grant permission. You can choose to turn off some or all permissions in the settings function of the client or device. The methods to turn on and off the above permissions may vary in different devices, please refer to the instructions or guidelines of the device and system developers.

5 According to the relevant provisions of applicable data protection laws, we have the right to process (including collect, use, commission processing, share, transfer and publicly disclose) your personal information without obtaining your authorization under the following circumstances:

5.1 Needed to establish and fulfill a contract in which you are a party;

5.2 Needed to fulfill our legal obligations;

5.3 Needed to respond to sudden public health events, or necessary to protect the life, health, and property safety of natural persons in emergencies;

5.4 Processing your personal information within a reasonable range for the implementation of news reporting, public opinion supervision, and other behaviors for public interest;

5.5 Processing your publicly disclosed or other legally public personal information within a reasonable range as stipulated by law;

5.6 Other circumstances stipulated by laws and administrative regulations.

6 Unless you refuse our processing by deleting, withdrawing consent or other means, during your use of MTour, we will use your personal information within the scope that complies with applicable data protection laws and is directly or reasonably related to the purpose declared in this policy. For example, after de-identifying your personal identity information for analysis and commercial use, or using your publicly disclosed information within a reasonable range (without affecting the visibility of some information that you adjust through the privacy setting items provided in MTour, such as setting private MTour, or setting only half-year public MTour, etc.).

II. Notification of Cookies and Related Technologies

1 Cookies and related technologies can help websites recognize registered users and count the number of users. They are typically used by websites to determine whether users who have completed registration have logged in. We use cookies and related technologies mainly to achieve the following functions or services:

1.1 Ensure the safety and efficient operation of products or services. We may set cookies for authentication and safety to confirm whether you have safely logged into the service or whether you have encountered theft, fraud, and other illegal acts. These technologies also help us improve service efficiency and increase log-in and response speed.

1.2 Simplify your operation steps. Using such technologies can help you avoid the steps and processes of repeatedly filling in personal information and inputting search content, and help you get a more relaxed access experience.

2 If you wish to disable cookies, you can configure your browser: choose "refuse cookies" or "notify you when a website sends cookies". Given that our services are realized through supporting cookies, after completely closing cookies, your access to the MTour may be affected or you cannot fully obtain our services. If you do not disable cookies, you may be prompted, for example, whether to retain user information for simplifying login procedures (such as automatic login) the next time you enter this website.

III. How We Protect Your Personal Information

1 We will make all reasonable efforts to protect your personal information that we have obtained and have a dedicated data security department to protect personal information to prevent your personal information from being illegally accessed, copied, modified, transmitted, lost, damaged, processed, or used under accidental, unauthorized circumstances.

Currently, MTour has passed the national network security level protection (level three) evaluation and record, and has reached the requirements of domestic authoritative certification standards in terms of information security and has obtained corresponding certification.

2 We take the following technical measures to protect your personal information:

2.1 Our network services have adopted encryption technologies such as the transport layer security protocol and provide browsing services through HTTPS to ensure the safety of user personal information during transmission;

2.2 Encrypt user personal information for storage and isolate it using isolation technology;

2.3 When using personal information, such as displaying personal information and calculating personal information associations, we will use a variety of data desensitization technologies, including content replacement and encryption desensitization, to enhance the security of personal information in use;

2.4 Establish strict data use and access systems, use strict data access permission control and multi-identity authentication technology to protect personal information and prevent your personal information from being misused; and

2.5 Carry out specialized data and technology security audits, set up log audits, and conduct multiple behavioral audits.

3 In addition, we have also taken the following other measures to protect your personal information:

3.1 Establish data classification and grading systems, data security management norms, and data security development norms to regulate the storage and use of personal information;

3.2 Establish a specialized data security department responsible for organizing security emergency response to promote and safeguard personal information security;

3.3 Strengthen staff awareness of personal information protection security. We will also hold security and privacy protection training courses to enhance staff awareness of the importance of protecting personal information; and

3.4 Other personal information protection measures required by applicable data protection laws.

4 Despite having taken reasonable and effective measures above and complied with the standards required by relevant laws, we still cannot guarantee the security of your personal information when it is communicated through insecure channels. Therefore, you should take proactive measures to ensure the security of personal information, such as regularly changing account passwords and not disclosing your account password and other personal information to others.

5 There are always various risks of information leakage in the network environment. When accidental events or force majeure lead to a leak of your information, we will strive to control the situation and promptly inform you of the cause of the event, the security measures we have taken, the security measures you can take, and other relevant information. We will develop emergency response plans and immediately initiate emergency plans when user information security events occur, striving to prevent the impact and consequences of these security events from expanding. Once a user information security event occurs, we will promptly inform you in accordance with legal requirements: the basic situation of the security event and its possible impact, the measures we have taken or will take, suggestions for you to independently prevent and reduce risks, and remedial measures for you. We will promptly notify you of event-related situations through push notifications, emails, letters, text messages, and other forms. When it is difficult to notify one by one, we will publish announcements in a reasonable and effective manner. At the same time, we will also report the handling situation of user information security events according to the requirements of relevant regulatory departments.

6 Please understand that the personal information protection measures we provide only apply to MTour. Once you leave MTour and browse or use other websites, services, and content resources, we neither have the ability nor the obligation to protect any personal information you submit on websites other than MTour, regardless of whether you log in or browse the above-mentioned websites based on the link or guidance of MTour.

IV. How We Store Your Personal Information

Storage Location

In accordance with applicable data protection laws, we store your personal information collected within the territory in the People's Republic of China. Currently, we will not use, store, share or disclose your personal information in cross-border operations, or transfer your personal information overseas.

If there are changes in our business in the future, we may need to transfer your personal information to other countries or regions. These countries or regions may have different data protection laws, or even no relevant laws.

In such cases, we will ensure that your personal information receives the same level of protection as within the territory in accordance with the relevant applicable data protection laws, inform you of necessary matters, implement corresponding compliance procedures as required by law, and seek your separate consent (unless otherwise provided by applicable data protection laws).

Storage Duration

We only retain your personal information for the period necessary for the purposes described in this policy and within the time limit required by laws, regulations, and regulatory requirements. We will retain your personal information for the period prescribed by applicable data protection laws. After the legal retention period, we will delete or anonymize your personal information.

V. Your Rights as a Personal Information Subject

We attach great importance to your management of personal information and do our best to protect your access to, correction of, deletion of, withdrawal of consent, and other statutory rights to personal information, empowering you fully to maintain your privacy and personal information security.

1 Access, modify, copy, delete your personal information

1.1 Once you have completed the account registration with us, you can access, modify, and copy your personal information at any time.

1.2 Under the following circumstances, you can request us to delete your personal information:

1.2.1 If our handling of personal information violates laws and regulations;

1.2.2 If our handling of personal information violates our agreement with you;

1.2.3 If we terminate our operations and services, or if you withdraw your authorization consent;

1.2.4 Other circumstances stipulated by laws and administrative regulations.

If we decide to respond to your deletion request, we will also notify third parties who have obtained your personal information from us to delete it as soon as possible, unless otherwise provided by laws and regulations or these third parties have obtained your independent authorization.

1.3 For personal information that is difficult to directly access, modify, copy, delete on the client, or to exercise other legal rights, you can also submit the relevant application to us through the contact method provided in this policy.

2 Withdrawal of Consent

Certain business functions in MTour will need to be completed based on the information you provide or the device permissions you enable with your authorization. You can withdraw such consent by disabling the corresponding business function. When you withdraw your consent, we cannot continue to provide you with the corresponding function and will no longer process your personal information. However, your decision to withdraw consent will not affect our previous processing of personal information based on your authorization.

3 Account Cancellation

You can cancel your account in the MTour client [Me] - [Settings] - [Cancel Account]. Please understand that account cancellation is an irreversible operation. Given our unified account system, once you cancel your account, we will delete all information related to your account (including information in other applications provided by us and our affiliates that you log in with the same account), except as otherwise provided by laws and regulations. You also cannot regain the services of MTour and other applications through the cancelled account.

4 Responding to Your Requests

4.1 In order to ensure safety, we will process your requests in a timely manner after verifying your identity. We may refuse requests that are groundless and repetitive, require excessive technical means (for example, needing to develop new systems or fundamentally changing current practices), pose risks to the legal rights and interests of others, or are extremely impractical. We may not be able to respond to your request in the following circumstances:

4.1.1 Related to our obligations under laws and regulations;

4.1.2 Directly related to national security, national defense security;

4.1.3 Directly related to public safety, public health, and major public interests;

4.1.4 Directly related to criminal investigations, prosecutions, trials, and judgment enforcement;

4.1.5 We have sufficient evidence to show that you are malicious or abusive;

4.1.6 In order to protect the life, property and other major legal rights and interests of you or others, and it is difficult to obtain the authorization and consent of the person;

4.1.7 Responding to your request would cause serious harm to the legal rights and interests of you or others, or organizations;

4.1.8 Involving trade secrets.

5 If we terminate the service or operation, we will notify you at least thirty days in advance, and delete or anonymize your personal information after the termination of the service or operation.

VI. How we collect and process the personal information of minors

If you are a minor under the age of 18, before using the MTour, you should read and decide whether to agree to this policy under the guardianship and guidance of your parents (or other guardians). We protect the personal information of minors in accordance with relevant national laws and regulations.

VII. Updates to this Policy

In order to provide you with better services and in line with our business development, this policy will also be updated accordingly. For significant changes, we will also provide more noticeable notifications (we will explain the specific changes to this policy in ways including but not limited to emails, text messages, private messages, or special prompts on browsing pages). The significant changes referred to in this policy include but are not limited to:

1.1 Significant changes in our service model. Such as the purposes of processing personal information, types of personal information processed, ways of using personal information, etc.

1.2 Significant changes in our ownership structure, organizational structure, etc., resulting in changes to the actual entity that collects and processes your personal information, such as changes in the owner caused by business adjustments, bankruptcy mergers, etc.

1.3 Changes in the main object of sharing, transferring, or publicly disclosing personal information.

1.4 Significant changes in your rights to participate in personal information processing and its exercise methods.

1.5 When there are changes in the department responsible for handling personal information security, contact methods, and complaint channels.

1.6 When the personal information security impact assessment report indicates a high risk.

We will issue updated versions on our website and client (Settings - "About MTour"), and remind you of the updated content in advance through website announcements or other appropriate methods, so that you can understand the latest version of this policy in a timely manner. By agreeing to and continuing to use the MTour, you are agreeing to the content of this policy (including updated versions).

VIII. Third-party SDK Directory

1.1 **SDK Name: APP Payment Client SDK Developer: Alipay (Hangzhou) Information Technology Co., Ltd. Privacy Link:https://opendocs.alipay.com/open/54/01g6qm#%E6%94%AF%E4%BB%98%E5%AE%9D%20App%20%E6%94%AF%E4%BB%98%E5%AE%A2%E6%88%B7%E7%AB%AF%20SDK%20%E9%9A%90%E7%A7%81%E6%94%BF%E7%AD%96**

1.2 **SDK名称：微信OpenSDK Android 开发者:深圳市腾讯计算机系统有限公司隐私链接：https://support.weixin.qq.com/cgi-bin/mmsupportacctnodeweb-bin/pages/RYiYJkLOrQwu0nb8**

IX. How to contact us

If you have any questions about this policy or related matters, especially if you believe that our personal information handling behavior has harmed your legal rights and interests, you can contact us at any time through the following ways. We will review the issues involved as soon as possible and reply in a timely manner in accordance with the requirements and deadlines of applicable data protection laws.

Email: contact@rebase.com.cn