VIGGO ROBOT Privacy Policy

We take the protection of your personal information seriously. We will adopt security measures that meet legal requirements and mature industry standards. Please read and understand this Policy carefully before using our services.

This Policy will help you understand the following:

[Special notice] Before using any service we provide, please read this Policy carefully and fully understand it. Then make the choice you consider appropriate. We highlight all key content in bold. Please pay particular attention to those parts. Before you provide any sensitive personal information to us, you have carefully considered and confirmed that such provision is appropriate. You also consent that your sensitive personal information may be processed for the purposes and in the manner described in this Policy. If you have any questions, comments, or suggestions about this Policy, please contact us using the methods in [8. How to contact us]. We may revise this Policy from time to time. When a material change occurs as described in Section 7, we will present the updated content to you after the version update, including by in-app message.

Please note: this Policy does not apply where you follow a link in VIGGO ROBOT to a third party and that third party provides services to you. “Other third parties” include, without limitation, counterparties to transactions that do not take place on VIGGO ROBOT, and any third-party product or service providers. Please refer to that third party’s privacy policy or similar statement.

VIGGO ROBOT is provided only to adults. Before using VIGGO ROBOT, you must confirm that you are at least eighteen (18) years of age and have full civil capacity. If you discover that we have unintentionally collected personal information of a minor, please notify us immediately. We will delete the relevant data as soon as practicable.

1. How we collect and use your personal information

We follow the principles of lawfulness, legitimacy, and necessity. We collect and use your personal information only for the purposes stated in this Policy. We collect and use your personal information only where a lawful basis exists. You may choose not to provide your personal information. If you do not provide it, we may be unable to provide the relevant functions or to respond to your requests. Please note: if you provide personal information of another person, you must ensure that you have obtained that person’s consent.

We will not collect personal information that is unrelated to the services we provide to you. If we use your personal information for a purpose not stated in this Policy, or collect and use it for another specific purpose, we will inform you in a reasonable manner. We will obtain your consent again before such collection or use.

(I) Collection of personal information

1. When you create an account and set a password, we collect your mobile number, username, and password. This is to verify your identity and protect account security. If you refuse to provide this information, you may be unable to use the related functions. This will not affect your use of other services we provide.

2. To provide customer service and communication, you need to provide your mobile number. We use the registered number to contact you and to send service notices, security alerts, or customer-support messages. If you refuse to provide this information, you may be unable to use the related functions. This will not affect your use of other services we provide.

3. When you browse information, we collect device information generated while you use VIGGO ROBOT (including system version, device model, App version, and screen resolution). This is to provide an optimal information display. If you refuse to provide this information, you may be unable to use the related functions. This will not affect your use of other services we provide.

4. When you use email push for task messages, we need to collect the email address you provide (or that an administrator enters on your behalf). This allows the system to send you a task report after a task is completed. If you do not provide this information, you will be unable to use email push for task messages. This will not affect your normal browsing and use of VIGGO ROBOT.

Except as stated above, if we change the purpose of collection and use, or use the information for other purposes not stated in this Policy, we will obtain your express consent separately in advance.

(II) Device permissions

VIGGO ROBOT may request certain device permissions. The table below lists the related functions, the purpose of each permission, and when we ask you before requesting it. On different Android devices, how permissions are displayed and turned off may vary. To protect your privacy, please read and understand how we request device permissions. You may turn off a permission in system settings. If you do, you may be unable to obtain the related service or function, or the intended effect may not be achieved.

(III) Other lawful bases

Please note that, under applicable laws and regulations, we may collect and use necessary personal information without obtaining your consent in the following circumstances:

1. Where necessary to conclude or perform a contract to which the individual is a party;

2. Where necessary to perform a statutory duty or a statutory obligation;

3. Where necessary to respond to a public-health emergency, or to protect the life, health, or property of a natural person in an emergency;

4. Where personal information is processed within a reasonable scope for news reporting, public-opinion supervision, or similar acts carried out in the public interest;

5. Where, in accordance with the Personal Information Protection Law of the People’s Republic of China, personal information that the individual has disclosed on their own or that has otherwise been lawfully disclosed is processed within a reasonable scope;

6. Other circumstances provided by laws and administrative regulations.

2. How we use cookies and similar technologies

To ensure normal and efficient operation, and to provide a simple, easy-to-use, and personalized experience, we store small data files called cookies on your device and/or system. We may use cookies or similar technologies to analyze how you use our services. We may also use cookies or similar technologies to understand product traffic.

We may use cookies or similar technologies for the following purposes:

1. Remembering your identity. For example, cookies or similar technologies help us recognize you as a registered user, store other information you provide to us, or help determine whether your login status is normal and whether the account is abnormal;

2. Analyzing how you use our products and/or services. We may use cookies or similar technologies to understand which functions you use, or which products and/or services are most popular.

We will not use cookies for any purpose other than those stated in this Policy.

You may manage or delete cookies according to your preferences. You may clear the cache to delete locally stored tracking data. If you do so, you may be unable to fully enjoy certain convenience and security features.

Please note: if you refuse to use tracking technologies or clear existing ones, you will need to change user settings yourself on each visit. We may then be unable to provide a better experience, and some services may not work properly.

3. How we entrust processing of, share, transfer, and disclose your personal information

(I) Entrusted processing

To provide more complete and higher-quality services, certain functions may be provided by our technical service partners. We may entrust those partners, as processors, to process certain personal information of yours. For companies, organizations, and individuals that process personal information on our behalf, we will enter into strict confidentiality agreements. Those agreements will specify the processing activities, processing period, nature of processing, purpose of processing, and the parties’ responsibilities. We require processors to process your personal information only in accordance with our instructions, this Policy, and other applicable confidentiality and security measures. If you refuse to allow our vendors to collect personal information necessary to provide their services, you may be unable to use those vendor-provided functions while using VIGGO ROBOT.

(II) Sharing

In the following circumstances, we will provide your personal information to other data controllers. We will inform you of the recipient’s name, contact details, purpose of processing, method of processing, and categories of personal information, and we will obtain your separate consent.

1. Sharing required by law: we may share your personal information as required by laws and regulations, for dispute resolution in litigation, or pursuant to lawful requests of administrative or judicial authorities.

2. Sharing with affiliates: to provide consistent services and to facilitate unified management, and based on your separate consent, we may provide your personal information to our affiliates. We will share only necessary personal information. Such sharing remains subject to the purposes stated in this Policy. If we share your sensitive personal information, or if an affiliate changes the purpose of use, we will obtain your separate consent again.

3. Necessary sharing with partners: to provide more complete and higher-quality services, certain services will be provided by partners. For details, see the List of Personal Information Shared with Third Parties.

If you refuse to allow our partners to collect personal information necessary to provide their services, you may be unable to use those partner-provided functions through VIGGO ROBOT. Please note: even after we have obtained your separate consent, we will share your personal information only for lawful, legitimate, necessary, specific, and explicit purposes. For companies, organizations, and individuals with whom we share personal information solely to achieve the purposes stated in this Policy, we will enter into strict information-protection and confidentiality agreements. We will require them to comply with those agreements, to take appropriate security measures to protect your personal information, and not to use the shared personal information for any other purpose.

(III) Transfer

In principle, we will not transfer control of your personal information to other companies, organizations, or individuals. If a merger, acquisition, or bankruptcy liquidation involves a transfer of personal information, we will inform you of the recipient’s name and contact details. We will require the new holder of your personal information to continue to be bound by this Policy. If the collection or processing methods stated in this Policy change, that company or organization will obtain your consent again.

(IV) Disclosure

In principle, we will not disclose your personal information, except in the following cases:

1. With your express consent, or based on your active choice, we may disclose your personal information.

2. Where laws and regulations, mandatory administrative enforcement, or judicial requirements require us to provide your personal information, we may disclose it according to the required types of personal information and the required manner of disclosure. Subject to applicable laws and regulations, when we receive such a disclosure request, we will require corresponding legal documents, such as a subpoena or investigation letter.

Under applicable law, entrusted processing, sharing, transfer, or disclosure of de-identified personal information does not constitute entrusted processing, sharing, transfer, or disclosure of personal information, if it is ensured that the recipient cannot restore and re-identify the data subject. Storage and processing of such data will not require further notice to you or your consent.

(V) Indirect collection of personal information

If we indirectly collect your personal information from a third party through sharing, transfer, collection of public information, or similar means, we will, before collecting the relevant personal information, require that third party to undertake that the source of the personal information is lawful and compliant. If the third party is in breach, we will expressly require it to bear corresponding legal liability. If our processing goes beyond the scope of consent already obtained, we will obtain your express consent within a reasonable period after obtaining the personal information, or before processing it.

4. How we store and protect your personal information

(I) Storage of personal information

1. Retention period

Unless otherwise required by laws, regulations, or normative documents, we will retain your personal information only for the shortest time necessary to achieve the stated purposes, or as otherwise agreed. After the applicable retention period expires, we will delete your personal information or anonymize it as soon as practicable in accordance with laws and regulations.

2. Place of storage

Personal information collected and generated in our operations within the People’s Republic of China will be stored within the People’s Republic of China in accordance with national laws and regulations. We will not transfer your personal information outside the People’s Republic of China.

3. Cessation of operations

If we stop operating VIGGO ROBOT, we will notify you at least 30 days in advance, including by message. We will promptly stop collecting your personal information. We will delete or anonymize personal information we hold that relates to the discontinued business. Where personal information of minors is involved, we will also promptly notify the minors’ guardians of the cessation of operations.

(II) Measures to protect personal information

1. Data security measures

To protect your information security, we strive to adopt physical, electronic, and managerial security measures that meet industry standards. These include SSL secure communication protocols and dedicated certificates for encryption in transmission; a front-end bastion host for access control; IP allowlists and security-rule group policies for network-layer protection; and monitoring and early-warning mechanisms on Alibaba Cloud servers. We have established a unified body responsible for network security and data security. We have also established dedicated management systems that specify operational standards for information-security construction, including specific security requirements for endpoint and network management, information-system management, and data-center management.

2. Security certification

We have established sound coordination with regulators and third-party assessment bodies. We promptly defend against and handle various information-security threats, so as to provide comprehensive protection for your information security. We have obtained assessment and filing under China’s Multi-Level Protection Scheme (Level 3). We meet the requirements of authoritative domestic certification standards for information security and have obtained the corresponding certificates.

3. Contractual safeguards with partners

Before we indirectly collect your personal information from a third party, we will expressly require in writing (such as a cooperation agreement or letter of undertaking) that the third party collect and process your personal information only after obtaining your express consent. We will also require the third party to undertake that the source of the personal information is lawful and compliant. If the third party is in breach, we will expressly require it to bear corresponding legal liability.

Before we share your personal information with business partners, we will obtain your separate consent and strictly require those partners to assume information-protection obligations and liabilities. To that end, we will require partners to sign a data-processing agreement before cooperation, or we will include data-protection clauses in the cooperation agreement. Those agreements strictly bind partners to confidentiality obligations regarding user information. Custody, use, and onward transfer of information must meet our control requirements and are subject to our review, supervision, and audit. In the event of any breach, we will require the other party to bear corresponding legal liability.

4. Security incidents

To address risks such as personal-information leakage, damage, and loss, we have established multiple systems. These systems specify classification and grading standards for security incidents and vulnerabilities, and the corresponding handling procedures. We have also established a dedicated emergency-response team for security incidents. In accordance with incident-handling specifications, the team activates security plans for different incidents, containing the damage, analyzing and locating the issue, formulating remedial measures, and working with relevant authorities on tracing and enforcement.

If a personal-information security incident unfortunately occurs, we will immediately form a dedicated emergency team and activate the emergency plan to prevent the incident from expanding. We will promptly inform you, as required by laws and regulations, of: the basic facts of the incident and its possible impact; the measures we have taken or will take; suggestions for how you may independently prevent and reduce risks; and remedial measures for you. We will promptly notify you of relevant facts by email, letter, telephone, push notification, or similar means. If it is difficult to notify each data subject individually, we will make an announcement in a reasonable and effective manner. We will also proactively report the handling of the personal-information security incident as required by regulators.

Please understand that the internet is not an absolutely secure environment. If you discover that your personal information has been leaked, especially if a related account has been compromised, please contact us immediately using the contact details in this Policy, so that we can take corresponding measures.

5. How you can manage your personal information

We attach great importance to, and do our utmost to protect, your rights as a data subject, so that you can fully safeguard your privacy and personal-information security. To exercise your rights as a data subject, or if you have any questions, comments, or suggestions about those rights, you may contact us using the methods in [8. How to contact us] of this Policy. We will complete identity verification and reply with the handling result within 15 working days after receiving your request.

(I) Right of access: You may access the personal information we have collected about you via [Me] - [Settings] - [List of Collected Personal Information], or you may contact our customer service using the methods in [8. How to contact us] of this Policy.

(II) Right to rectification: If you believe any personal information we hold about you is incorrect or incomplete, you may contact our customer service using the methods in [8. How to contact us] of this Policy and request that we correct, update, or supplement your personal information.

(III) Right to erasure: You may contact our customer service using the methods in [8. How to contact us] of this Policy and request that we delete some or all of your personal information from our systems, except where the personal information has been anonymized or where laws and regulations provide otherwise.

(IV) Right to withdraw consent: You have the right to withdraw consent previously granted to us for a specific purpose at any time. You may withdraw consent via [Me] - [Settings] - [Turn on/off task-report subscription], or by contacting our customer service using the methods in [8. How to contact us] of this Policy. We will handle your request within a reasonable time after you make it, and we will stop processing your personal information. We will also delete all of your personal information. Your decision to withdraw consent will not affect the validity of personal-information processing we conducted based on your consent before the withdrawal.

(V) Right to restrict or object to processing: You may contact our customer service using the methods in [8. How to contact us] of this Policy and request that we restrict or refuse to process your personal information. We will provide means of restriction or objection in accordance with applicable law.

(VI) Right to delete (close) your account: You may close a previously registered account at any time. You may do so yourself via [Me] - [Settings] - [Delete account], or you may contact our customer service using the methods in [8. How to contact us] of this Policy and request account closure. After the account is closed, we will stop providing products or services to you and, at your request, delete your personal information, except as otherwise provided by laws and regulations.

(VII) Right to data portability: You may request a machine-readable copy of your personal information. If you request that your personal information be transferred to a data controller you designate, and the conditions prescribed by the national cyberspace administration are met, we will provide a means of transfer.

(VIII) Protection of interests in a deceased person’s personal information: After a natural person dies, their close relatives may, for their own lawful and legitimate interests, exercise rights of access, copying, rectification, and erasure in respect of the deceased’s relevant personal information through the contact methods in this Policy, unless the deceased arranged otherwise during their lifetime.

6. How we handle personal information of minors

Please note: our services are intended for adults with full civil capacity. Minors under eighteen (18) years of age should not use VIGGO ROBOT services. If you are a minor, please do not use or access VIGGO ROBOT in any way, and do not provide related personal information. If you discover that we have unintentionally collected personal information of a minor, please notify us immediately. We will delete the relevant data as soon as practicable.

7. How this Policy is updated

To provide you with better services, our business will change from time to time. We continuously improve our technology and may launch new or optimized functions. This Policy will be adjusted accordingly. Without your express consent, we will not reduce the rights you enjoy under this Policy. We will remind you of updates by issuing an updated version on VIGGO ROBOT or by other means. Please also visit us to stay informed of the latest privacy policy. In the foregoing circumstances, if you continue to use our services, you consent to the revised Policy and agree to be bound by it.

For material and substantial revisions, we will provide prominent notice (for example, we may notify you by posting on VIGGO ROBOT, explaining the revisions to this Policy). We will use feasible channels and methods as far as possible to notify you of revisions. Please visit VIGGO ROBOT to view the latest version of this Policy.

Material and substantial changes include, without limitation, the following:

1. A material change in our service model, such as the purposes of processing personal information, the types of personal information processed, or the manner of use of personal information;

2. A material change in our ownership structure, organizational structure, or similar matters, such as a change of owner caused by business adjustment, bankruptcy, or merger and acquisition;

3. A change in the main parties with whom personal information is shared, transferred, or to whom it is disclosed;

4. A material change in your rights in connection with personal-information processing and in how those rights are exercised;

5. A change in the department responsible for personal-information security, contact details, or complaint channels; and

6. When a personal-information security impact assessment indicates a high risk.

8. How to contact us

The company has a dedicated compliance department that supervises personal-information protection. For questions about this Policy or our privacy practices, you may contact us as follows:

(1) Send an email to Velobotics Legal Department at Idriver_legal@velobotics.ai;

(2) Call 400-688-9697 to contact our customer service and obtain contact details for compliance personnel;

(3) Visit our principal office at Building C-3, Zhongguancun Dongsheng Science Park · North Territory, No. 66 Xixiaokou Road, Haidian District, Beijing, to contact us and obtain corresponding support.

After receiving your call or visit, we will reply to or handle your questions or requests within no more than 15 working days. If you are not satisfied with our reply or handling, especially if you believe we have harmed your lawful rights and interests relating to personal information, you may complain or report to regulators such as the cyberspace, telecommunications, public-security, and market-regulation authorities, or bring a lawsuit before a people’s court with jurisdiction.

9. Miscellaneous

This Policy shall be interpreted and governed by the laws of the People’s Republic of China. Any dispute of any form between you and us shall first be resolved through friendly consultation. If consultation fails, you agree to submit the dispute to the Beijing Arbitration Commission. The arbitral award is final and binding on both parties.

If any court of competent jurisdiction holds or adjudges any provision of this Policy to be invalid, that provision shall be removed from this Policy. The invalidity of that provision shall not affect the validity of the remaining provisions. The remaining provisions of this Policy shall continue in effect.

The headings in this Policy are for convenience of reading only and do not affect the meaning or interpretation of any provision of this Policy.