EMPLOYEE PRIVACY NOTICE

Updated on November 10, 2023

We are thrilled to have you as part of CHERY Corporation and its subsidiaries, joint ventures, and affiliates (“we” or “Company”). Your privacy is of utmost importance to us, and we are committed to protecting your privacy.

This EMPLOYEE PRIVACY NOTICE (“Notice”) is a notice that describes broadly how we collect information relating to Employees through our online recruitment system on a website on our domain, the exact website link of which may change from time to time (the “Site”) and through other means, as well as how we process and potentially use such information. The Company acknowledges that the laws of certain jurisdictions may restrict, limit, or prevent, either in whole or in part, the Company from collecting, processing, or using such information in the manner described below. Accordingly, in the event that any portion of this Notice conflicts with applicable federal, state, local, or other law(s), such law(s) shall supersede and govern. Similarly, the Company will not collect, process, or use any such information in a manner that violates any applicable federal, state, local, or other law(s).

The purpose of this Notice is to make you aware of how the Company will Process Personal Data that we obtain about Employees through the Site and other means. Please refer to Annex 1 for details of the data controller of the Personal Data if you are based within the European Economic Area and UK or the work location of job listings, we publish on the Site is within the European Economic Area and UK.

We will try our best to provide you with all information in a clear and readable format. However, if you have any questions about our use of your Personal Data after reading this Notice, please contact our DPO at cheryinternational@mychery.com.

1. The types of information we process and why

We collect and use information that concerns you in connection with your employment as described in the overview directly below:

In some cases we use your data in order to comply with the law or so that we can carry out our contractual responsibilities as an employer, such as payment of your salary and declaring such payments to the tax authorities.

In other cases we will use your data because this is necessary for a legitimate business interest of ours which is not overridden by your own privacy interests, such as the processing of your data while we secure our IT systems and premises. If you wish to know more about how we balance our interests against the impact of certain measures on our employees, please contact our DPO at cheryinternational@mychery.com.

In exceptional circumstances we can only use your data if you consent. If we ask you for consent so that we can use your data for a particular purpose, we will remind you that you are free to withdraw your consent at any time and we will tell you how you can do so.

2. How we share your personal data

The Personal Data may be shared across the Company and our subsidiaries and affiliated companies, where staff members travel or work abroad and in cases to evaluate individual performance and performance on an aggregate level. Your information will also be shared with companies providing services under contract to us, such as travel agencies and organizations, training providers, payroll providers, insurance companies and their intermediates, CRM providers, help desk providers and IT providers . Examples of aforementioned parties are service providers such as Microsoft and Lark. Your Personal Data will also be shared with third party service providers so that they can provide you with applicable benefits, such as insurance providers, occupational health and safety services and pension funds. Compliance with laws or any competent law enforcement body, regulatory body, government agency, court or third party: We may disclose information where we believe disclosure is necessary or required by law or regulation, to comply with legal process or government requests (including in response to public authorities to meet equal opportunity laws, national security or law enforcement requirements); or to exercise, establish or defend our legal rights. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, acquisition, dissolution, corporate reorganization or similar event. We will inform any buyer that your information shall only be used in accordance with this Notice. Any other person with your consent to the disclosure.

3. International transfers of your personal data

Sometimes we provide your data to other group companies, partners, suppliers, law enforcement agencies and other organisations outside of the countries/regions where you resided or hired, for example for our HR administration, to manage your employment with us (e.g. when relevant managers are based abroad), in case of legal proceedings or for outsourcing some of our business functions.

These countries/regions may include, among others, the countries/regions where other group companies are established or where our service providers are located or have data centres, such as China.

We transfer your personal data in accordance with legal frameworks required in different jurisdictions. Recipients of your personal data must agree to at least the same level of privacy safeguards required by applicable data protection laws. Such as those described below: a. In some cases, we rely on the following ade quacy decisions:
European Commission adequacy decisions; and UK adequacy regulations b. In some cases, we rely on the following agreements:
EEA Standard Contractual Clauses (SCCs); and UK International Data Transfer Agreement (IDTA)

If you require further information about our international transfers of personal information, please contact our DPO at cheryinternational@mychery.com.

4.How are your personal data secured?

We have taken adequate safeguards to ensure the confidentiality and security of your Personal Data. We have implemented appropriate technical, physical and organizational measures to protect Personal Data against accidental or unlawful destruction or accidental loss, damage, alteration, unauthorised disclosure or access as well as all other forms of unlawful processing (including, but not limited to, unnecessary collection) or further processing.

5. How long we keep your data?

Based on mandatory legislation, certain information must be kept by us for a minimum period of time. On the other hand, data protection laws require that we do not keep Personal Data in an identifiable form for any longer than is necessary for the purpose for which the Personal Data is being processed. In light of this principle, a large portion of the data that we hold of you will be deleted within two years after you leave our organisation.

We will balance its obligations to retain certain data (for our justifiable need to do so for business purposes) with its obligation to destroy or delete (or at the very least de-identify) information relating to individuals when we no longer have a justifiable need to retain it in identifiable form.

To learn more about how long we keep your data, please contact your local HR contact person.

6. How can you exercise your privacy rights?

You are entitled to ask us for an overview of your Personal Data or ask for a copy. In addition, you may request us to correct or delete certain data, restrict processing of your data, or ask us to transfer some of this information to other organisations. In some cases you may object to the processing of your Personal Data and where we have asked for your consent to process Personal Data, you can withdraw this consent at any time.

You can exercise your rights by contacting your local HR, and you also have the right to make a complaint to the data protection authority or to seek a remedy through the courts if you believe your rights have been infringed.

If you believe that your data protection rights have not been respected, you are encouraged to bring this to the attention of HR.

7. Changes to this Notice

We will review and update this Notice periodically in response to changing legal, technical, and business developments. When we update this Notice, we will note the date of its most recent revision above. If we make material changes to this Notice, we may take appropriate measures to inform you in a manner that is consistent with the significance of the changes we make.

8. How can you contact us or lodge a complaint?

If you have any questions about the way we process your Personal Data, please read this Notice first. For additional questions please contact our DPO at cheryinternational@mychery.com. Please note that we take your satisfaction very seriously. Should you have a complaint, please also direct it to the same email address and we will respond to you as soon as we can.

If we are unable to resolve your concerns, you can of course also lodge a complaint with your local data privacy supervisory authority.

Annex 1

The following companies are controllers of Personal Data within the European Economic Area or UK: