CALIFORNIA RESIDENTS PRIVACY POLICY

5.3 FOR CALIFORNIA RESIDENTS

5.3.1 California Shine the Light

Subject to certain limitations, California residents may ask us to provide them with a list of the types of personal data that Zhengming has disclosed to third parties for their direct marketing purposes during the past 12 months, and the identities of such third parties. To make such a request, California residents can write to us at privacypolicy@bjzm.org, and include your name and the address to which you would like us to respond.

5.3.2 California Privacy RightsThe California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act of 2020 (“CPRA Regulations”), requires that we provide certain details about how we collect and use personal data, and give specific rights to California residents, which are detailed below. Where indicated, certain terms in this section 5.3.2 have the meaning given to them in the CCPA or CPRA Regulations (hereinafter collectively “CPRA”).

5.3.2.1 Notice to California Residents

We and select third parties use Advertising Cookies to choose and deliver ads we believe are relevant to you and your interests, to understand their effectiveness, and conduct market research. This involves accessing information from your browser or device, such as advertising and device identifiers, and processing this and other personal data, such as your IP address. Advertising Cookies remember what you have looked at or purchased on the Zhengming Services and other sites over time, and may be combined with other information received from third parties, such as demographics.

5.3.2.2 Notice of Financial Incentive

We may offer financial incentives to participate in certain surveys or focus groups. Details of the incentive, if applicable, including how to opt in or out and the basis for the value of the incentive, will be provided prior to your participation.

5.3.2.3 CPRA Privacy RightsIn addition to rights of access, correction and deletion, as described above, California residents may have certain rights under the CPRA, many of which are subject to limitations or exceptions:

Right to access/know and disclosure and portabilityYou may have the right to request, twice during a twelve month period, the following information that we may have collected about you for the time period from the date of your request to January 1, 2022:
• the categories and specific pieces of personal data we may have collected about you;
• the categories of sources from which we collected the personal data;
• the business or commercial purpose for which we collected or sold the personal data;
• the categories of third parties with whom we shared the personal data;
• the categories of personal data that we sold or disclosed for a business or commercial purpose,
• the categories of third parties to whom we sold or disclosed personal data for a business or commercial purpose; and
• the specific pieces of personal data we obtained from you in a format that is easily understandable.

Right to nondiscrimination

We will not deny, charge different prices for, or provide a different level of quality of goods or services if you choose to exercise these rights.

Right to opt out of the sale or sharing of your personal data

You have the right to opt out of the “sale” or “sharing” of your personal data with third parties who are not our service providers. California law broadly defines “sale” such that it may include allowing third parties to receive certain information, such as IP address and/or browsing behavior to deliver interest-based (also called targeted) advertising, or the sharing of a print mailing address with unaffiliated third party companies whose products and services may be of interest to you.

We do not knowingly “sell” or “share” (as defined under the CPRA) the personal data of minors under 16 years old.

Right to limit the use or disclosure of sensitive personal data

You may have the right to request that we limit the use or disclosure of your sensitive personal data (e.g. account numbers, racial or ethnic information) to uses necessary to provide the Zhengming Services to you and for purposes permitted by applicable law (e.g. to ensure security and integrity). Zhengming does not use sensitive personal data outside of these limited purposes.

5.3.2.4 How to Exercise your California Privacy Rights

California residents may exercise the right to opt out of the “sale” of personal data by going to the home page of the Zhengming Services and clicking on the “Do Not Sell or Share My Personal Information” link in the footer of the site or in the settings, profile or menu of the apps. Note, opting out of interest-based advertising is a device-based action because interest-based advertising is delivered using Cookies. So you must use the link in the footer of the site or adjust your Cookies settings, as described in our Cookie Notice.

California residents may request that we limit the use or disclosure of their sensitive personal data by going to the home page of the Zhengming Services used and clicking on the “Limit the Use of My Sensitive Personal Information” link in the footer of the site or in the profile or settings page of the app.

For your protection, we will take steps to verify your identity before proceeding with your request as appropriate.

Authorized Agents

You may designate an agent to exercise your rights under CPRA as described above. If you use an authorized agent, we will take steps both to verify the identity of the person seeking to exercise his or her privacy rights as listed above, and to verify that your agent has been authorized to make a request on your behalf through a signed written authorization or a power of attorney.

Once we have verified your identity (and your authorized agent, as applicable), we will respond to your privacy request as appropriate. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your privacy request. If we are unable to complete your privacy request in whole or in part, we will let you know why.

Retention of Data

We may retain your personal data for as long as reasonably necessary to fulfill the purposes described in the Privacy Notice, unless a longer period is required or permitted by law. The purposes for which we process personal data may dictate different retention periods for the data. For example, we may keep your email address to log-in (where applicable) as long as you have an account with us and for an additional period of time after that for our legitimate interests and to carry out fraud detection and prevention, or on suppression lists to honor your requests to not be contacted.

We take the following information into account when deciding how long to retain personal data:
• Whether the data is necessary to provide you with the Zhengming Services;
• How long we have had a relationship with you or provided you with the Zhengming Services;
• Whether the data is necessary to carry out fraud detection and prevention;
• Whether the data is necessary to defend, establish, exercise or bring any existing or potential legal claims;
• Whether there is any other statutory or legal requirement to retain the data.