This Privacy Policy (hereinafter referred to as this “Policy”) applies to the website (innermountain.org), products, applications, technologies, software or services provided to you by Beijing Neifeng Technology Co., Ltd., owner of the website (hereinafter referred to as “Inner Mountain”, “Inner Mountain Platform”, “we”, “us” or “our”). When you use the services provided by Inner Mountain, we will collect and use your personal data pursuant to this Policy. It is our intention to clearly tell you how we process your personal data by means of this Privacy Policy, so we advise you to read this Policy in its entirety to help you understand how to protect your privacy.

We try to present this Policy in a concise, clear and understandable manner. Being fully aware of the importance of personal data to you, we will do our best to ensure the security and reliability of your personal data. To maintain your trust in us, we are committed to protecting your personal data by adhering to the following principles: lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability. We also undertake to put in place such security measures as consistent with industrially proven security standards to protect your personal data.

Please read and understand this Policy carefully before using our products so that you can better understand our products and the services we provide and make appropriate choices. In order for you to fully understand and be informed of the ways in which we process your personal data, the scope and consequences of such processing and other relevant rules, we have the Key Definitions and Personal Data Processing Instructions section prepared specially for fulfilling our notification obligation to you under the law. It being so, we strongly recommend that you first read those instructions carefully and give your consent or explicit consent on the basis of full understanding of the content of this Policy and the schedule hereto.

Key terms used in this Policy are defined based on the meaning specified in the EU General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”), and appropriate changes are made thereto in consideration of our actual situation. In case of any inconsistency, the provisions of GDPR, CCPA and CPRA shall prevail. You are kindly requested to pay extra attention to the fact that the key purpose of these instructions is to guide you to gain a fully understanding and knowledge of the ways in which we process your personal data, the scope and consequences of such processing and other relevant rules, so as to fulfill our notification obligation to you under the law. It being so, we strongly recommend that you read these instructions carefully and give your consent or explicit consent on the basis of full understanding of the content of these instructions.

1.1 Personal Data, under GDPR, means any information relating to an identified or identifiable natural person (data subject), such as personal phone number, account number of personal data subject, IP address and unique device identifier; and under CCPA, means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, which includes identifiers, personal location information, commercial information, personal financial information, biometric information, personal health information, network activity information, sensory information, and personal education or work information.

In this Policy, information that is personal data will be highlighted in bold to draw your attention; and any personal data that are special categories of personal data under GDPR or sensitive personal information under CCPA and CPRA will be highlighted in bold and indicated by an asterisk (*) to draw your attention and seek your explicit consent. You shall pay extra attention to the enumeration of such information. In addition, in order to help you understand the necessity of collecting personal data, we will distinguish and explain, in the form of lists, whether the personal data you provide to us under a particular business function is necessary personal data.

1.1.1 Special categories of personal data under GDPR means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and genetic data, biometric data for the purpose of identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. We do not process your special categories of personal data during our services hereunder (“Services”).

1.1.2 Sensitive personal information enumerated in CPRA includes (A) a consumer’s social security, driver’s license, state identification card or passport number; (B) a consumer’s account login, financial account, debit card or credit card number in combination with any required security or access code, password or credentials allowing access to an account; (C) a consumer’s precise geolocation; (D) a consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership; (E) the contents of a consumer’s mail, email and text messages, unless the business is the intended recipient of the communication; (F) a consumer’s genetic data; and (G) a consumer’s identity information. During the Services, we process “bank account information and precise geolocation information”, and we will only process your sensitive personal information to the extent necessary for the purposes of processing described in this Privacy Policy.

1.1.3 Necessary Personal Data means any personal data that must be collected in order to fulfill a particular basic business function or extended business function, without which, you will not be able to use such business function.

1.1.4 Optional Personal Data means any personal data, the absence of which will not affect your use of the relevant basic business function or extended business function.

1.2 Processing means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission or dissemination, or otherwise making available, alignment or combination, restriction, erasure or destruction. For information on how we collect and use your personal data, please refer to “2. How We Collect and Use Your Personal Data”.

1.2.1 Collect, for the purpose of this Privacy Policy, means obtaining control of personal data, including where personal data is provided to us by the personal data subject voluntarily, or collected through our interaction with the personal data subject or by recording the behaviors of the personal data subject (“automatic collection”), or received by us passively or collected by searching and gathering publicly available information (“indirect collection”). We will state specifically the ways in which we obtain the relevant personal data in the lists in “2. How We Collect and Use Your Personal Data”, in order to let you know the scope of our statutory obligations and inform you of the legal basis for our processing of your personal data. For example, if you object to our collection of any personal data that is necessary personal data for a basic business function, you will not be able to use such basic business function. Accordingly, we will inform you that our processing of such necessary personal data is justified on the grounds that it is necessary for performance of the contract.

1.2.3 Sharing means, with respect to the Services, the sharing of your personal data by us with external recipients to complete the functions or services you choose. The identities and categories of such recipients (if any) will be disclosed in detail in “2.4 Sharing”.

1.2.4 Anonymization means the technical processing of personal data in such a manner that the personal data subject can no longer be identified or associated with, and the information after such processing cannot be restored. Any information obtained after anonymization is not personal data.

1.2.5 Pseudonymization (De-identification) means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

1.2.6 Affiliate means, with respect to a person, any other person that has control, joint control or significant influence over such person, and two or more persons are affiliates if they are under the control, joint control or significant influence of the same person.

We will collect from you and process your personal data (as listed below) in a lawful and proper manner where necessary for the purpose of fulfilling relevant functions. We will try our best to disclose information about the collection and use of your personal data to you in a full, complete and timely manner. If you find any errors or omissions in our disclosure, please contact us promptly.

2.1 Collection and use of personal data for basic business functions

Basic business functions refer to the business functions we provide that meet your fundamental expectations and most important needs in choosing and using the services we provide. Basic business functions and the personal data they collect and use will change as the products or services develop, grow and upgrade. Under basic business functions, you may prevent us from collecting relevant personal data by refusing to give consent or turning off relevant functions, but this will result in us being unable to provide you with the relevant services or achieve the service results.

2.2 Collection and use of personal data for extended business functions

Extended business function refers to any function we provide other than basic business functions. For the following extended business functions, you may prevent us from collecting relevant personal data by refusing to give consent or turning off relevant functions. This will result in us being unable to provide you with the relevant services or achieve the service results, but it will not affect your use of the basic business functions of the Services.

2.3 How we use cookies and similar technologies

2.3.1 Use of cookies and similar technologies

In order to meet your personalized demand for online experience and provide you with an easier access experience, we will send one or more small data files named cookies or similar technical files on your computer or mobile device. The cookies assigned to you are unique, and can only be read by the Web server in the domain that has issued the cookies to you. We send cookies to you to simplify your repeated login steps, and help determine your login status and account or data security.

We will not use cookies for any purpose other than those stated in this Privacy Policy. You may manage or delete cookies based on your preferences. See AboutCookies.org for details. You may remove all cookies saved on your computer. Most Web browsers will accept cookies automatically, but usually you may modify the browser settings as you need to reject cookies. In addition, you may remove all cookies saved in software, but if you do so, you may have to change the user setting in person each time you visit our website, the relevant information you previously recorded will be deleted in its entirety, and the security of the services you use may be affected to some extent. To learn more about how to change your browser settings, please visit the relevant setting page of the browser you use.

2.3.2 Web beacons and pixel tags

In addition to cookies, we will apply website beacons, pixel tags and other similar technologies to the website. For example, the email we send to you may include a URL that links to the contents of our website. If you click on such link, we can track your click, so as to help us understand your product or service preferences and improve customer services. Generally, website beacon is a kind of transparent image embedded in a website or email. By virtue of pixel tags in an email, we can know whether the email has been opened. If you do not want to be tracked like this, you can unsubscribe from the mailing list at any time.

2.3.3 Do Not Track

Many Web browsers have the function Do Not Track which can issue Do Not Track requests to websites. At present, major organizations for Internet standardization have not set policies relevant to how websites shall cope with such requests. But if Do Not Track is enabled in your browser, we will respect your choice.

2.4 Sharing

We may disclose your personal data to third parties for business/commercial purposes in a form that is consistent with GDPR and CCPA (a list of partners is available at: innermountain.org). Detailed information about sharing to third parties is summarized and disclosed in the table below. We will enter into strict data security responsibility agreements with companies, organizations and individuals with whom we share personal data, requiring them to process personal data in accordance with our instructions, this Policy and any other relevant confidentiality and security measures, and not to use the data for any purpose other than performance of the contract. If you are a California resident, in the preceding 12 months, we have disclosed your personal data to the following categories of third parties for commercial purposes, and the categories of personal data disclosed are as listed in the table below:

2.4.2 For the avoidance of doubt, you shall acknowledge and understand that relevant products may contain links to websites, applications, products or services operated by independent third parties. No warranties, express or implied, are provided by us with regard to such third-party websites, applications, products and services, and such links are provided only to facilitate users’ browsing of relevant pages. When you visit such third-party website, application, product or service links, you shall further agree to the privacy policy or personal data protection terms they provide to you. We and such third-party website, application, product and service providers assume independent personal data protection responsibilities to you respectively to the extent required by laws and mutually agreed.

2.4.3 Data sharing for direct marketing purposes: The Section 1798.83 of the California Civil Code permits a California resident to request and obtain from us once per year information regarding personal data about you that we shared to a third party for the third party’s direct marketing purposes. If you are a California resident, you may request that we refrain from sharing your personal data with certain affiliates or other third parties for marketing purposes. Please inform us of your preferences using the contact details in Section 8 How to Contact Us in order to make such a request.

2.5 Transfer

We will not transfer your personal data to any company, organization or individual, except where:

2.5.1 Explicit consent is obtained: We will transfer your personal data to other parties after obtaining your explicit consent;

2.5.2 The personal data is transferred in connection with a merger, acquisition or bankruptcy and liquidation, provided that we will require the succeeding company or organization that holds your personal data to be bound by this Policy, or alternatively we will require such company or organization to seek consent from you again.

2.6 Public disclosure

We will publicly disclose your personal data only in the following circumstances:

2.6.1 We have obtained your explicit consent;

2.6.2 Such disclosure is based on laws: We may publicly disclose your personal data if mandatorily required by laws, legal proceedings, lawsuits or competent authorities of the government.

3.1 We have taken security measures meeting industry standards to protect the personal data you provide against unauthorized access, public disclosure, use, alteration, damage or loss. We will take all measures reasonably practicable to protect your personal data. For example, your browser is under SSL encryption protection when exchanging data (such as credit card information) with the “server”; we also provide https safe browsing for Inner Mountain website; we will use encryption techniques to ensure the confidentiality of data; we will use reliable protection mechanisms to prevent data from hostile attacks; we will deploy access controls to ensure that access to personal data is limited to authorized persons only; and we will provide security and privacy protection training courses to increase employees’ awareness of the importance of personal data protection.

3.2 Our data security capabilities: Inner Mountain is equipped with a strong information security department to build complete and advanced data security protection systems for Inner Mountain products, including implementing classification and grading of user information, encrypted storage and division of data access rights; internal data management systems and operating procedures have been formulated, and stringent process requirements are put in place from data collection and use to destruction to protect user privacy data against illegal use; security management responsibilities are made clear for the departments and their persons in charge that have access to users’ personal data; work processes and safety management systems are established for the collection, use or other activities related to users’ personal data; the authority of employees and agents are controlled, and export, reproduction or destruction of personal data in batches is subject to review, and measures are taken to prevent against leaks; any paper, optical, electromagnetic or other types of carriers that record users’ personal data are properly kept and safe storage measures have been taken as appropriate; access to information systems that store users’ personal data is checked, for which anti-intrusion and anti-virus measures are taken; information about the person that operates on users’ personal data, and the time, location and particulars of such operation is recorded; and security and privacy protection training is provided on a regular basis to raise employees’ awareness of personal data protection.

3.3 We will take all measures reasonably practicable to ensure that no irrelevant personal data is collected. We will retain your personal data only for so long as necessary for achieving the purposes described in specific privacy guidelines, unless the retention period is extended as strictly necessary or as permitted by law.

3.4 The Internet environment is not 100% secure, and we will use our best efforts to ensure or guarantee the security of any information you send to us. We will be legally liable for any damage to your legitimate rights and interests arising from unauthorized access to or public disclosure, alteration or destruction of information caused by any damage to our physical, technical or organizational protection facilities.

3.5 Upon the occurrence of a personal data security incident against our will, we will, as required by laws and regulations, promptly inform you of: the basic particulars and potential impacts of such security incident, the responsive actions we have taken or will take, suggestions on how to prevent and reduce risks on your part, and the remedies available to you, etc. We will promptly inform you of the information about the incident by email, letter, phone call, push notification or otherwise, and will, where it is difficult to notify the personal data subjects one by one, issue announcements in a reasonable and effective manner.

In addition, we will actively report the resolution of personal data security incidents as required by supervisory authorities.

Please contact us using the contact details contained herein immediately after you find any leak of your personal data, to enable us to take appropriate measures promptly.

In accordance with the general requirements of GDPR, we will try to guarantee that you can exercise the following rights with respect to your personal data. If you are unable to control your personal data through the means notified by us, you may contact us at any time using the contact details provided in Section 8 “How to Contact Us”.

4.1 Right of access, right to rectify

4.1.1 You may check and rectify your personal data by visiting My Profile interface (innermountain.org) and opening the user account center page. Please note that although we try our best to allow you to rectify your personal data, some of your personal data cannot be rectified, primarily for reasons of protecting the security of online transactions and determining the objects to whom the online products and services are provided. Such information mainly includes account information (including xx information).

4.1.2 You may check and rectify your name, gender, date of birth, country, email address, contact information, social media or device, etc. by visiting My Profile interface (innermountain.org).

4.1.3 You may check and rectify your address by visiting the Address Book interface (innermountain.org).

4.1.4 You may check your inbox messages by visiting My Message interface (innermountain.org).

4.1.5 If you are unable to access your personal data using the said methods, please feel free to send us an email at [social@innermountain.org]. You may also contact us using the contact details provided in Section 8 of this Policy or on the Inner Mountain Platform.

4.2 Right to delete

4.2.2 After you delete any information from our services, we may not immediately delete such information from our backup system, but will delete the same when the backup is updated.

4.3 Right to withdraw consent

As disclosed in “2.1 Collection and use of personal data for basic business functions” and “2.2 Collection and use of personal data for extended business functions”, the justification for our processing of some of your personal data is your “consent”. You may withdraw your consent at any time. We will cease to process the relevant personal data upon withdrawal of your consent, provided that your decision to withdraw your consent shall not affect any processing of personal data based on your consent prior to such withdrawal.

4.4 Right to restrict and object to the processing of your personal data

4.4.1 Right to restriction

You may restrict our processing of your personal data in accordance with the provisions of GDPR, in which case, we will store your personal data in accordance with GDPR only and will so notify you in accordance with the law.

4.4.2 Right to object

As disclosed in “2.1 Collection and use of personal data for basic business functions” and “2.2 Collection and use of personal data for extended business functions”, we need to process your personal data for our own business interests, including for the purpose of profiling or direct marketing. You may exercise your right to object to such processing and profiling activities by sending us an email. If you object to such processing, we will cease to process your personal data for these purposes unless we can demonstrate that our interests outweigh yours, or we process your personal data in connection with legal proceedings.

4.5 Right to data portability

4.5.1 You have the right to request us to provide, in electronic form, any personal data of you that have been collected upon your consent or as necessary for the execution and performance of a contract to any third party designated by you in writing.

4.5.2 We will use reasonable efforts to protect such right of you subject to technical availability. If data interfaces match, we may also transfer a copy of your personal data directly to a third party designated by you at your request and using communications technology currently available. If such third party refuses to receive the copy of your personal data, resulting in a transmission failure, you shall communicate with such third party in person, and Inner Mountain is not responsible for such transmission failure.

4.6 Right to lodge a complaint with the supervisory authority

If you are dissatisfied with our response, in particular if you believe that our processing of the personal data has damaged your legitimate rights and interests, and negotiation fails, you have the right to lodge a complaint with the [competent supervisory authority for personal data protection].

4.7 Response to your aforesaid requests:

4.7.1 For the sake of security, you may be required to submit a written request or otherwise prove your identity. We may ask you to verify your identity before processing your request.

4.7.2 We will give a reply within 30 days. You may file a complaint using the methods provided in [Section 8] hereof in case of dissatisfaction.

4.7.3 Generally, we do not charge any fee on your reasonable requests, but we will charge a certain fee as appropriate for repeated requests beyond the reasonable limit. We may refuse any requests that are repeated for no reason, call for excessive technical means (e.g., where it is required to develop a new system or fundamentally change the existing practices), pose a risk to the legitimate rights and interests of others, or that are extremely impractical (e.g., requests involving information stored on backup tapes).

If you are a California resident, you will have the following rights. We welcome such requests to the extent required by applicable laws and within the time specified by laws.

4.9 Right to know the personal data collected, disclosed or sold

4.10 Right to rectification

You have the right to rectify any inaccurate personal data we have collected. According to the requirements of CPRA, we need to verify your identity before allowing you to rectify your personal data.

4.11 Right to delete

You have the right to request that we delete any of your personal data which we have collected from you and retained, but this is a limited right, and based on an exception clause under CCPA or other statutory obligations, we may still retain certain data for a reasonable period of time to the extent permitted by laws. Once we receive, verify and confirm your request, we will delete (and direct our service providers to delete) your personal data from our records, unless otherwise required by laws and regulations, or such third party has obtained separate authorization from you.

4.12 Right to opt-out

We have not sold any personal data in the preceding 12 months. We may use your personal data collected for sale in the future, and you have the right to opt out of the sale of your personal data for monetary or other valuable consideration. You may opt out of the sale by clicking Do Not Sell My Personal Data. We will not sell any personal data we collect from a minor under the age of 16 unless we obtain explicit authorization from the minor’s parent or guardian in accordance with the law.

4.13 Right not to be discriminated against for exercising California privacy rights

Notwithstanding the foregoing, we may charge you a different price or rate, or provide a different level or quality of goods or services to you, if that difference is reasonably related to the value provided to Inner Mountain by your personal data.

4.14 How to exercise your California privacy rights

4.14.1 You can exercise your rights by:

Completing and submitting an online request form to us

Email: [social@innermountain.org]

4.14.2 Please note that where permitted by law, we may take steps to verify your identity before granting you access to information or acting on your request for exercise of rights.

4.14.3 In certain circumstances, you may appoint an authorized agent to make requests on your behalf. You must provide a written letter of authorization to your authorized agent, and we may request you to verify your identity directly with us.

4.14.4 In addition, you may only initiate two verifiable requests within a 12-month period.

4.14.5 We may not be able to fulfill your request under certain circumstances. For example, we will not fulfill a request if we cannot verify your identity or check whether an authorized agent has the authority to make such request on your behalf. In addition, we will not comply with your request in exceptional circumstances, for example, where disclosure of the personal data may have an adverse impact on the rights and freedoms of other consumers, or where we are not subject to the right of access or right to deletion under CCPA with respect to the personal data we store about you.

4.14.6 We will try to complete your request within 45 days after receipt of the same. If extension is required, we will notify you in writing of the reasons and period of extension.

4.15 Right to cancel account

4.15.1 Regardless of whether you are a California resident or not, you may cancel your account registered with Inner Mountain at any time. You may either cancel your account yourself by visiting the relevant page of [innermountain.org], or request us to cancel your innermountain account by sending an email to [social@innermountain.org]. We may ask you to verify your identity to ensure the security of your account.

4.15.2 After canceling your account, we will cease to provide services to you, and will, upon your request, delete your personal data within the time specified by applicable laws, unless otherwise specified by laws and regulations or agreed between you and us.

5.1 Our products, websites and services are intended for adults only. Children are not allowed to create their own user accounts.

5.2 Notwithstanding any definition to the contrary given by local laws and custom, we treat anyone under the age of 18 as a child.

5.3 You should report your age actively. If you are under the age of 16, you shall provide the contact information (e.g., email address, phone number) of your guardian, and we will contact your guardian using such contact information and take reasonable measures to obtain the explicit consent of your guardian. You shall clearly understand that if we find or suspect that you are under the age of 16 in the course of service, we may suspend or terminate the service to you at any time until you provide us with evidence that you have reached the age of 16, or assist us in obtaining the explicit consent of your guardian (for example, making your guardian sign the relevant request of you or provide us with a signed statement that they agree to your use of the service).

5.4 We will manage to delete any personal data collected from a minor within the shortest time possible if we find that such data is collected by us without obtaining the prior verifiable parental consent.

5.5 To the extent that you are the parent or guardian of a minor, you may contact us using the contact details in Section 8 below if you have any doubts about the processing of the personal data of the minor under your custody.

6.1 You understand and expressly agree that generally we collect your personal data for storage and processing in [the People’s Republic of China]. We hereby draw your attention to the fact that the People’s Republic of China is not a third country that has an adequate level of protection as determined by the European Commission. We will do our utmost to provide appropriate safeguards for the transfer of your personal data and to enable you to exercise your rights and obtain effective legal remedies. Such data transfer is risky. You should have a full understanding of such risks and hereby authorize us to transfer your personal data to the foreign judicial authorities in the country or region where you use the services, including China.

7.1 Our privacy policy is subject to change. We will not reduce your rights available under this Policy without your explicit consent. We will issue updated versions of this Policy.

7.2 For significant changes, we will also provide a more prominent notice (including, for certain services, sending a notification by email explaining the specific changes to this Policy).

8.1 Basic information about us:

Company Name: Beijing Neifeng Technology Co., Ltd.

8.2 We have established a personal data protection department. If you have any questions or advice about this Policy, or if you want us to update information about you or your preferences, you may contact us using the following contact information. Generally, we will give a reply within a reasonable period of time.

Contact information: [social@innermountain.org]

8.3 If you are a disabled person and unable to access and obtain information related to this Privacy Policy, you may contact us using the contact details provided in this section, and we will try our best to provide this Privacy Policy to you in such other formats that are easily accessible by you.