China’s Personal Information Protection Law Privacy Policy

November 1, 2022

Please carefully read this Policy carefully before using our products and/or services and ensure you understand that we will handle your personal information in accordance with the principles of clear purpose, consistency of rights and responsibilities, minimization and necessity, and security. If you have any questions, please contact our customer service team for further assistance.

How we collect your personal information

When you apply to use our services or products, we will collect various pieces of personal information based on your authorizations as more fully described in our Privacy Notice for the purpose of providing you with more precise, personalized, and convenient services and to improve your experience with us.

When you apply for a loan with us, per regulatory requirements, we collect the following information:

1. a) Personal credit information, including credit card, loan and other credit transaction information, debt status, relevant information on debt repayment liabilities, civil judgment, compulsory enforcement, administrative penalty and other non-credit transaction information, as well as other information that could reflect personal credit status.
2. b) Other information relating to the determination of the qualifications for real estate purchases: real estate transaction information, qualification/qualification certificate, property donation record.
3. d) When you use the personal information update service, we will require you to provide e-mail address, mobile number, home number, office number and communication address.
4. e) To fulfill our legal obligations and regulatory requirements for due diligence and sanctions/anti-money laundering/anti-terrorist financing, during our provision services to you, we may need to collect the personal information of your associated Spouse/Parent/Partner/Other third parties (including but not limited to name, birthday, nationality/area, residence, contact number, company name, work experience and source of income, etc.) from time to time. Please ensure that the information is true and valid, and is collected, processed and transferred in accordance with applicable laws , and ensure you have obtained the consent of such third parties.

How we use your personal information

We will use the collected personal information in accordance with the provisions of this Policy and to provide or improve the functions of our financial products and/or services. During the period of services, you authorize us to continuously collect and use your information. When you deregister the services, we will stop collecting personal information related to you, but we may continue to use collected personal information under certain circumstances such as business filing, auditing, regulatory assistance, and fulfilling anti-money laundering and sanctions requirements.We may use your personal information to provide you with Acra products and services that may be of interest to you.

In order to enhance your experience with our products or services, or for risk prevention purpose, we will summarize, analyze and process the usage statistics of services. However, such information will not contain any personal identifying information about you. If we use the information for other purposes which are not stated in this Policy or for another purpose other than the purpose it was collected for, we will seek your consent in advance.

Exceptions

In accordance with the relevant laws, regulatory requirements and national standards, we may process (including collecting, storing, using, processing , transmitting , providing, disclosing, deleting, etc.) your personal information without seeking your separate consent or consent in any of the following circumstances:

• Necessary for the Acra to perform its statutory duties or obligations;
• Directly related to national security or national defense security;
• Necessary to respond to public health emergencies, or to protect the life, health and property safety of natural persons in emergencies;
• Directly related to criminal investigation, prosecution, judicial trial, enforcement of judgment and etc.;
• Collect or use personal information that has been willingly disclosed to the public by you;
• Collect or use personal information received & generated from legally and publicly disclosed information, such as legitimate news reports, government information publication or other channels;
• Necessary for entering into and performing contract(s) according to your instructions;
• Necessary for maintaining secure and stable operation of our products or services, such as to detect, handle fraud in or misappropriation of the products and services.

Website beacons and pixel tags

In addition to cookies, we may use similar technology as beacons and pixel tags to collect your browser, mobile devices and other information such as web browsing time, pages visited, language preferences, and other interacting data from Acra sites. This data may be associated with your terminal device information (e.g., IP address, installation fonts, language and browser settings, time zone, and etc.) to facilitate our understanding on your preference of Acra products or services and improve our customer service.

Do Not Track

Many website browsers provide a Do Not Track function that can send a signal to the websites you visit to indicate you do not wish to be tracked. Currently, major Internet standardization organizations have not established policies to specify how websites should handle these requests. Because there are no uniform standards, we do not honor these requests.

Secure Processing

Certain services are provided by third-party suppliers. For example, we may engage service providers to assist us in providing customer support and servicing. The activity performed by such third-party suppliers will not exceed the scope of the agreed processing purpose or method. We ensure all third-party suppliers have applicable information security procedures and policies in place and require them to sign a contract with us, requiring the third party to process your personal information in accordance with laws and regulations, this policy, and other confidentiality and security requirements applicable to us. If the third party fails to process personal information in accordance with our requirements, or fails to effectively fulfill the responsibility of personal information security protection, we will take or request the third party to take effective remedial measures to control or eliminate the security risks in connection with any personal information. When necessary, we will terminate the business relationship with the third party and require the third party to delete the personal information obtained from us in a timely manner.

When required by applicable laws and regulations, regarding our provision of your personal information to third parties, we will inform you of the relevant matters including the name and contact information of the personal information recipient, the processing purpose, processing method and type of personal information, and obtain your separate consent thereof.

Sharing

We share your personal information as follows:

• With your explicit consent: We will share your personal information with other parties as necessary to perform the services after obtaining your explicit consent.
• To comply with laws and regulations or mandatory requirements from governmental authorities.
• We may share your personal information with third parties for the following purposes:

1) Sharing with our affiliates.

We will share your information with our affiliates for joint marketing purposes. However, we will only share necessary personal information and such parties are bound by the stated purpose in this Policy. If our affiliates want to change the purpose of processing personal information, they will again seek your authorization and consent.

2) Sharing with our partners and third parties.

We may disclose your personal information to suppliers, service providers, and other partners to allow us to provide the services to you. However, we will only share your personal information for legal, legitimate, necessary, specific, and clear purposes, and will only share personal information necessary to provide the services. Our partners have no right to use the shared personal information for any other purpose.

Transfer

We will not transfer your personal information to any company, organization, or individual except in the following cases:

• After obtaining your consent.
• In the case of mergers, acquisitions or bankruptcy liquidation, if it involves transfer of personal information, we will request the new company or organization, which holds your personal information, to be bound by this Policy. Otherwise we will ask the new company or organization to resolicit your authorization.

Public disclosure

We will only publicly disclose your personal information under the following circumstances:

• Where we have obtained your separate consent in advance
• Disclosure based on law: based on a mandatory legal or regulatory requirement

Storage

We will only retain your personal information within the minimum period required by laws and regulations or for the implementation of the anti-money laundering and sanction rules, and within the minimum period necessary we require to perform the services for you. Upon expiration of the retention period, we will delete or anonymize your information.

Protection

We have used industry-standard security measures in place to protect the personal information you provide to prevent unauthorized access, public disclosure, use, modification, damage or loss of data. We will take all commercially reasonable and feasible action to protect your personal information. We have established systems, procedures, and policies to ensure the security of information. We strictly limit the scope of persons who can access the information, require them to undertake confidentiality obligations, and conduct regular internal audits.

The Internet environment is not 100% secure, and we will do our best to ensure the security of any information you send to us. In accordance with the requirements of laws and regulations, in the event of a security incident (including information loss, damage, leakage, tampering and etc.), we will promptly notify you of the following in accordance with laws and regulations: basic information about the security incident and its potential impact, treatment measures we have taken or will take, suggestions about proactive defense and risk mitigation, remedial measures, etc. We will also report the handling status of personal information security incidents as required by regulatory authorities.

Your rights

In accordance with China’s relevant laws, regulations, standards, and the common practice of other countries and regions, you have the following rights of your personal information:

1. Access to your personal information

You are authorized to access your personal information, except for some circumstances stipulated by law and regulations. You could, after identity verification, exercise your right of data access by emailing us at [email protected].

2. Correct your personal information

When you identify any error in your personal information by our process, you are entitled to require us to make the correction. You can raise a correction request by emailing us at [email protected].

3. Delete your personal information

Under the following circumstances, you can request us to delete your personal information:

• If our processing of your personal information violates any law or regulation
• If we collect or use your personal information without your consent, or if you withdraw your consent and we continue to use your personal information
• If our processing of personal information breaches our agreement with you.
• If you no longer use our products or services, or you cancel your account
• If we no longer provide products or services to you and are not required by law to keep your information

Where the storage period stipulated by law or administrative regulation has not expired, or deletion of personal information is technically difficult to accomplish, we will cease the processing of personal information other than storing and taking necessary security protection measures for such information. We will respond to your request of deletion in accordance with applicable laws or regulations, we will also notify the entity(ies) which obtained your personal information from us and request them to delete such information in a timely manner, unless otherwise stipulated under laws or regulations, or if these entity(ies) has(have) obtained your separate authorization.

4. Change your authorization scope

Provided that your personal information is not required for us to provide you with the products or services and we are not required or allowed to collect and retain such information under applicable law, you can withdraw your authorization and consent at any time to no longer allow us to use such personal information by emailing [email protected].

5. Transfer your personal information

In accordance with applicable law and regulations, you can request us to transfer your personal information to your designated third party. If the transfer meets the conditions required by applicable law, we will provide you with the channel for such transfer.

Responding to your Request

In order to ensure the security of your personal information, you may need to provide a written request or other supporting documentation to verify your identity. We may ask you to verify your identity before processing your request. We will respond to you within 15 business days. If you are unsatisfied with services, you can also make complaints by calling Toll Free: (888) 800-7661 or filling out and submitting the Contact Us – Acra Lending form online.

In principle, we do not charge for your reasonable request, however, for those repetitive, beyond reasonable requests, we may charge a reasonable fee on a case by case basis. For those unreasonably repetitive requests which require excessive technical means (for example, require us to develop new systems, require fundamental changes to our existing practices, pose risks to others’ legal rights, or are very impractical (for example, involving information stored on backup tapes)), we may reject such requests.

In the following situations, we will not be able to respond to your request as required by law or regulation:

• Directly related to national security and national defense security.
• Directly related to public safety, public health, or significant public interests.
• Directly related to criminal investigation, prosecution, judicial trial, enforcement of judgment and etc.
• There is sufficient evidence that you have subjective malice or abuse of rights.
• Responding to your request may result in serious damage to the legitimate rights and interests of you or other individuals or organizations.
• Your request involves our trade secrets.

This policy is not intended to limit your other rights applicable laws and regulations.

How we protect the information of children or minors

Our products, services and websites are for adults. Children and minors cannot create their own accounts.  If you are a child/minor, do not use our website or services. For the purposes of this Policy, “children” in this chapter refers to natural persons under the age of fourteen, and “minors” refer to natural persons over the age of 14 but under the age of 18.

How your personal information is transferred globally

Our products are intended to be used in the United States. If you provide personal information to us while you are located outside the United States, your personal information will be transferred to the United States or be accessed from these jurisdictions. By providing your information to us, you are agreeing to allow your personal information to be transferred overseas.

How we update this Policy

We may change this Policy from time to time. We will post any changes and revisions of this Policy on this page. For significant changes, we may also provide a notification to you via email. Please pay attention to changes in relevant announcements, reminders, agreements, rules, and other related content from time to time. Please be aware and confirm that, if you do not agree with the updated terms and conditions, please stop using our services and products; if you continue to use our services and products, it is deemed that you agree to accept the updated terms and conditions.

How to contact Us

If you have any questions about this Policy, please contact us at [email protected] or fill out our Privacy Request form located here.

. We will reply within about 15 business days after receiving your request, up to 30 days or a shorter period (if any) stipulated by laws and regulations.

Matters not covered in this Policy shall be handled in accordance with applicable laws and regulations, our relevant business rules and prevailing financial business practices.