Legal

Privacy Policy

1. Information We Collect

To provide International Logistics services, we adhere to the principle of Minimization under PIPL, collecting only information necessary for service delivery. Data is categorized as follows:

• Standard Account Data (PI): Company Name, Tax ID/Unified Credit Code, Business License, Contact Person Name, Business Email, and Phone Number.
• Third-Party Logistics Data (PI): Names, physical addresses, and phone numbers of your consignees (receivers) and suppliers (shippers).
  By providing third-party data, you warrant that you have obtained the necessary consent from said third parties to share their details with us for shipping purposes.
• Sensitive Personal Information (SPI) – Financial: We collect Payment Proofs (Bank Slips/Swift Copies) and Transaction IDs. This information is classified as Sensitive Personal Information under PIPL Article 28. We implement enhanced protection measures:
  ① Storage is limited to the statutory period for accounting reconciliation and tax compliance (irreversibly overwritten or erased afterward);
  ② Access requires dual approval from the Financial Supervisor and Data Compliance Officer (DCO);
  ③ Printed copies are prohibited unless required by law. By submitting such financial documents to our platform, you provide explicit separate consent for us to process this sensitive personal information for accounting, tax and freight settlement purposes.
• Digital Footprint Data: When you interact with our digital platform, we automatically collect limited technical data necessary for security and core functionality (e.g., IP address, session IDs). This collection is managed in accordance with our separate Cookie Policy, which details your control options.

2. Legal Basis for Processing

Pursuant to PIPL Article 13, our data processing is based on the following legal grounds:

• Contractual Necessity: Executing a freight forwarding contract (e.g., booking confirmation) requires processing and sharing consignee details with carriers and customs authorities; without this, cargo delivery cannot be completed.
• Legal Obligation: We are required by PRC Customs Law to file accurate manifests with PRC Customs, and by Anti-Money Laundering (AML) and Tax Laws to retain financial records for regulatory verification.

3. Cross-Border Data Transfer

3.1. Legal Basis for Cross-Border Transfer

We transfer personal information outside Mainland China only as necessary to execute international shipments. The legal basis for such transfers depends on the category of personal data involved:

• Account Contact Data (e.g., your company's designated contact person): Transferred on the basis of contractual necessity, as defined in PIPL Article 13(2) and CAC Provisions (2024) Article 5, to perform the logistics service agreement between your company and us.
• Consignee and Notify Party Data (third-party personal information): Transferred strictly on the basis of the explicit, informed consent of those individuals, which you, as the shipper, warrant you have obtained before providing their details to us, save where disclosure is required by mandatory laws of destination jurisdictions. This consent covers the transfer of their name, address, and contact information to the overseas carriers, handling agents, and government authorities listed in Section 3.2, for the sole purpose of customs clearance and delivery at destination.

We do not rely on exemptions for contract performance where the data subject is not a direct contractual party to CALL. You are responsible for providing the consignee with a privacy notice containing the information required by PIPL Articles 17 and 39, and for obtaining their consent to the cross-border transfer described in this policy.

3.2. Scope of Data Transfer & Recipients

Transferred Data Scope: We only transfer the minimum necessary information for logistics execution – specifically, the consignee and notify party details (name, physical address, phone number) as stated on the Bill of Lading (B/L).

Authorized Recipients:

• Sovereign Authorities: Customs and border control agencies of the destination country (e.g., Kenya Revenue Authority (KRA), South African Revenue Service (SARS), Nigerian Customs Service (NCS)).
• Carriers: The Ocean Carrier (e.g., Maersk, COSCO) or airlines responsible for physical cargo transport (for B/L issuance and route management).
• Destination Handling Agents: Licensed warehouses or customs clearance agents at the destination port (to complete cargo release and last-mile delivery).

We never sell, rent, or trade your data to foreign marketing agencies or unrelated third parties.

3.3. Third-Party Data Processing Framework

The transfer of consignee details to carriers and port authorities is a strict operational necessity for customs clearance and delivery. We only engage internationally recognised carriers, licensed destination agents and competent governmental authorities. For commercial overseas recipients, we conduct documented data protection due diligence; where commercially practicable, we seek to impose appropriate data security obligations by contract. Transfers to sovereign governmental authorities are subject to applicable local statutory rules, and formal contractual obligations cannot be imposed on such public bodies. We take all reasonable steps to ensure personal information receives an adequate standard of protection in overseas jurisdictions.

3.4. Important Data

If any data we process is subsequently designated as "important data" by competent authorities, we will complete the mandatory CAC security assessment before transferring such data across borders.

4. Payment & Data Security

We implement a three-tier security protection system in accordance with PIPL and the Network Security Law of the PRC:

4.1. Payment Data Protection

We never store online banking credentials, credit card numbers, or other sensitive payment information. CALL operates on an offline B2B payment model; financial documents uploaded to our system are stored on encrypted servers, with access restricted to a pre-approved whitelist of financial personnel (all access operations are logged for audit).

4.2. Technical Security Measures

• Data in transit: Protected by SSL/TLS 1.3 encryption to prevent interception or tampering;
• Access control: Role-Based Access Control (RBAC) ensures only personnel with work necessity can access data;
• Risk prevention: Quarterly vulnerability scans and annual penetration testing to eliminate system loopholes;
• Backup mechanism: Daily automated backups of core data, with offline storage in PRC-based computer rooms (disaster recovery capability ≥ 99.9%).

4.3. Organizational Security Measures

We enforce strict confidentiality through legally binding Non-Disclosure Agreements (NDAs) signed by all employees and contractors. These agreements explicitly define personal and sensitive personal information as protected confidential data, legally obligating personnel to use such information solely for authorized business purposes, maintain its security, and prohibit any unauthorized disclosure or use.

4.4. Data Breach Notification

In the event of a data breach that may harm your rights (e.g., consignee information leakage), we will:
① Activate the emergency response plan within 1 hour (block unauthorized access, restore data from backups);
② Notify you via registered business email and platform pop-up notification within 72 hours (including breach scope, potential impact, and remediation measures);
③ Complete incident reporting to the Cyberspace Administration of China and other relevant regulators within the statutory 72-hour time limit as required by applicable laws.

4.5. Data Retention Rules

We retain ordinary personal information of shippers and consignees only for the period necessary to complete the logistics service and satisfy applicable statutory record-keeping obligations (including but not limited to the PRC Tax Administration Law, the PRC Maritime Code, and relevant AML regulations). Upon expiry of the mandatory retention period, we shall securely anonymise or erase such personal information.

5. Your Rights (PIPL Articles 45-50)

As a data subject, you hold the following rights:

5.1. Core Rights

• Right to Know & Access: View your account profile, historical booking records, and data processing details (e.g., cross-border transfer recipients) via the platform Dashboard; request a formal data copy by contacting the DCO.
• Right to Correction: Modify erroneous business information (e.g., contact person's phone number) directly through the Dashboard; for logistics data (e.g., consignee details), submit a correction application with supporting documents to the DCO.
• Right to Interpretation: Request a written explanation of our data processing rules (e.g., exemption applicability, SPI protection measures) via the DCO.
• Right to Deletion: Apply for account deletion or data erasure if:
  ① The logistics service contract is terminated and no statutory retention obligation exists;
  ② You revoke consent (where applicable);
  ③ Our processing violates laws.
• Right to Data Portability: Request your PI (e.g., account information, booking records) in a structured, machine-readable format (e.g., CSV) to transfer to another logistics service provider.
• Right to Restriction/Objection: Object to or request restriction of non-essential data processing (e.g., using your information for logistics business promotion beyond the contract scope). This right shall not apply to processing activities that are mandatory for performing freight forwarding contracts or complying with statutory regulatory obligations.
• Right to Withdraw Consent: If data processing is based on your consent (e.g., optional service update notifications), withdraw consent at any time via the Dashboard or DCO (without affecting the validity of prior processing).

5.2. Rights Exercise Procedures

• Self-Service Channel: Rights to access and correct basic information are available via the Dashboard, with system completion within 24 hours.
• DCO Review Channel: For rights requiring verification (deletion, data portability), submit:
  ① Signed and sealed copy of the company's business license;
  ② Authorization letter from the legal representative;
  ③ Specific description of the right to be exercised.
  We will acknowledge receipt within 5 working days and provide a final response within 30 days (extendable by 30 days for complex matters, with written notice).

5.3. Retention Exception

6. Cookies and Digital Tracking

7. Updates to This Policy

We may update this policy to reflect changes in our practices, for operational or legal reasons, or to align with new regulatory requirements (including those from the Cyberspace Administration of China). We will notify you of any material updates that affect your rights or our data processing activities through a prominent notice on our platform and/or via your registered business email.

Where updates are made primarily for legal compliance, security enhancement, or to correct inaccuracies, they will become effective immediately or as required by law. Your continued use of our services after the effective date of any update constitutes your acceptance of the revised policy. For other material changes, we will provide reasonable notice as described above.

Where material updates concern rules governing cross-border personal information transfer, we will provide separate notice and obtain acknowledgement as required by applicable data protection regulations.

8. Contact Us

For privacy concerns, to exercise your PIPL rights, or for any questions about this policy, contact our Data Compliance Officer (DCO):

This policy is available in both Chinese and English versions. In case of any discrepancy between the two versions, the Chinese version shall prevail.