1. Introduction and Scope
This Privacy Policy explains how Chongyi Automobile Co., Limited ("Chongyi", "we", "us" or "our") handles personal data when you visit chongyiqc.com (the "Website"), when you download or use the Chongyi mobile management application distributed through the Apple App Store and Google Play (the "App"), and when you contact us by email, telephone or through the enquiry forms on this Website.
This Policy applies to our customers, prospective customers, business contacts, distributors, workshop partners, suppliers, visitors to the Website, and users of the App. It also applies to advertising and analytics providers acting on our behalf, as further described in Section 9.
Our registered business scope, which contextualises the services to which this Policy relates, is: Wholesale and retail of auto parts and car supplies; automobile information consultation; business consultation; import and export of goods and technology; supply chain management; general trade (excluding regulated businesses such as finance, insurance and lending).
2. Information We Collect
We collect personal data in the following categories.
2.1 Account and contact data
- Full name, company name, business email address, telephone number and correspondence details.
- Account credentials for App users, including a hashed password and device registration record.
- Order, quotation and enquiry history, including parts lists, vehicle references, quantities, delivery addresses and pricing tiers.
- Billing, invoicing and customs documentation data, where required to fulfil an order.
2.2 Device and technical data
- IP address, device model, operating system, application version, browser type and language.
- Crash logs, diagnostic data and performance statistics used to keep the App and Website stable.
- Session identifiers, referrer information and timestamps of interaction with the Website or App.
2.3 Usage data
- Pages visited, features used, search terms, and actions taken within the App, such as viewed part references, saved quotations and tracked shipments.
- Advertising interaction data, including impressions, ad requests, clicks and video playback events.
2.4 Optional location information
- If you enable location services, the App may collect your approximate location to help confirm delivery eligibility, calculate lead times and show nearby partners. We do not collect precise location in the background, and we do not use location data for advertising purposes.
2.5 Advertising identifiers
- The Apple Identifier for Advertisers (IDFA) and the Google Advertising ID (AAID), together with related advertising identifiers assigned by advertising networks, as permitted by your device settings.
- Data collected through advertising SDKs, as described in Section 9.
2.6 Communications
- Emails, messages and support tickets you send to us, and the replies we send back.
3. How We Use Your Information
We use personal data for the following purposes:
- To perform our contract with you, including processing orders, quotations, shipments, invoices and customs documentation.
- To provide the App features covering real-time orders, inventory, supply chain tracking, consulting dashboards, investment planning, and wholesale and retail management.
- To respond to enquiries, quotations and support requests, and to keep a record of business correspondence.
- To provide automobile information consultation and business consultation, including fitment confirmation and market or category guidance.
- To manage supply chain operations, including sourcing, consolidation, warehouse allocation, quality inspection and delivery scheduling.
- To maintain the security, integrity and availability of the Website and the App, and to prevent fraud and abuse.
- To personalise content and advertising, subject always to your consent and device settings as described in Section 9.
- To measure the performance of our marketing and advertising campaigns.
- To comply with legal, regulatory and contractual obligations, including export control, sanctions screening, tax and customs record-keeping.
- To send service announcements or business updates where you have consented or where they are necessary for the operation of an account.
We do not sell personal data for money. We do share certain data with advertising partners as described in Section 9, and where that constitutes a "sale", "sharing" or "targeted advertising" under applicable law, we do so only with a valid opt-in consent where that is required.
4. Legal Bases for Processing
Where the GDPR, the UK GDPR or comparable legislation applies, we rely on the following legal bases. Where other regimes apply, the corresponding basis is set out in the table below.
| Jurisdiction | Regime | Typical legal basis relied upon |
|---|---|---|
| European Union / EEA | GDPR (Regulation (EU) 2016/679) | Art. 6(1)(b) performance of a contract; Art. 6(1)(c) legal obligation; Art. 6(1)(f) legitimate interests (security, service improvement, basic analytics); Art. 6(1)(a) consent for advertising and optional location; Art. 6(1)(e) public interest where applicable. |
| United Kingdom | UK GDPR and Data Protection Act 2018 | Same structure as the GDPR: contract, legal obligation, legitimate interests and consent, interpreted under UK guidance. |
| United States — California | CCPA as amended by the CPRA | Performance of a contract; "business purposes" as defined by the CPRA; opt-in consent for sharing and targeted advertising; opt-out sale or sharing. |
| United States — other states | State comprehensive privacy laws (e.g. Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Montana, Minnesota, Maryland, Indiana, Tennessee, Florida and Kentucky) | Consent where required; "legitimate interests" equivalents including the definition of "sale"; universal opt-out mechanisms honoured. |
| Brazil | LGPD (Lei nº 13.709/2018) | Consent for data processing; contractual and legal-obligation bases; legitimate interest with the LGPD balancing test; data subject rights exercised through the ANPD. |
| Canada | PIPEDA (and provincial equivalents such as PIPA, Law 25, or provincial legislation in effect) | Express, implied or deemed consent; performance of contract; legal obligation; reasonable security safeguards. |
| Australia | Privacy Act 1988 (Cth) and Australian Privacy Principles | APP 3 (collection and use), APP 6 (use and disclosure for direct marketing and targeted advertising) and APP 8 (Australian consumer guarantee). |
| Singapore | Personal Data Protection Act 2012 | Consent, contract, legal obligation and legitimate interests; comparison of data protection provisions across jurisdictions where a transfer assessment is required. |
| India | Digital Personal Data Protection Act 2023 and the PDPB Code of Practice (as notified) | Consent (including notice and consent managers where applicable); performance of a contract; legal obligation; certain legitimate uses permitted by statute. |
| Japan | APPI (Act on the Protection of Personal Information) | Consent for acquiring and using personal data through the App; disclosure to third parties and cross-border transfer disclosure as required by APPI. |
| South Korea | PIPA (Personal Information Protection Act) | Consent as the primary basis; provision of personal data to third parties; overseas transfer requires consent or an alternative basis. |
| Other regions | Local data protection laws, including the Swiss FADP, the UAE PDPL and Saudi PDPL | Consent, contractual necessity, legal obligation and legitimate interests, applied with the highest standard available in the relevant market. |
5. Sharing and Processors
We share personal data only with the categories of recipient below, and only to the extent needed for the stated purpose.
- Service providers and processors — cloud hosting, email delivery, customer relationship management, document generation, analytics, fraud prevention and customer support vendors, acting under written data processing agreements.
- Advertising partners — the advertising networks and SDKs listed in Section 9, acting as independent controllers or as our processors depending on the arrangement.
- Logistics and trade partners — carriers, freight forwarders, customs brokers and suppliers, to the extent required to deliver an order and complete the associated export documentation.
- Professional advisers and authorities — auditors, accountants, legal advisers, regulators, courts and law enforcement, where required or permitted by law.
- Corporate transactions — a successor entity in the event of a merger, reorganisation or sale of assets, subject to appropriate confidentiality protections.
We do not sell your personal data. We do not disclose personal data for the purpose of determining whether you qualify for an advertisement on a different advertiser's behalf, except as permitted under an applicable opt-in or opt-out framework.
6. International Transfers
Our head office is in Hong Kong, and our service providers may be located in Hong Kong, the European Economic Area, the United Kingdom, the United States, Singapore, mainland China, Japan and other locations. Your personal data may therefore be transferred internationally.
Where personal data is transferred outside your jurisdiction, we use an appropriate transfer mechanism, which may include a standard contractual clause (SCC), the UK International Data Transfer Addendum, an applicable adequacy decision, or another lawful mechanism recognised by the relevant supervisory authority. We apply supplementary measures where necessary, including access controls, encryption in transit and at rest, and periodic access reviews.
7. Retention
We keep personal data only for as long as it is needed for the purposes described in this Policy, or as required by law.
| Category of data | Typical retention period |
|---|---|
| Enquiry and contact records | Up to 3 years from last contact, unless a client relationship is established. |
| Account and App registration data | For the life of the account, then archived for up to 12 months before deletion. |
| Order, invoice and customs records | Retained for the period required by tax, customs and commercial record-keeping law (typically 7 to 10 years). |
| Support and correspondence | Up to 3 years from closure of the matter. |
| Advertising and analytics event data | Typically 13 to 24 months, then aggregated or deleted, in line with the relevant vendor's retention terms. |
| Server and security logs | Up to 12 months, unless required for an active security investigation. |
8. Security
We apply technical and organisational measures appropriate to the nature of the data, including encryption of data in transit using TLS and encryption of sensitive data at rest, role-based access control with least-privilege permissions, multi-factor authentication for administrative accounts, environment separation between test and production systems, logging and monitoring of access to personal data, vulnerability scanning and patching, staff training, and incident response and breach notification procedures.
No method of transmission or storage is completely secure. We work to protect your data and will notify you and the relevant supervisory authority of a personal data breach as required by applicable law.
9. Advertising and Monetisation
To keep the Website and the App free to use, we work with third-party advertising networks and integrate their mobile advertising SDKs into the App. These providers act as independent controllers, or as our processors where they act solely on our instructions, and they may collect device identifiers, advertising identifiers, usage data and geolocation signals (including approximate location derived from an IP address) for the purposes of ad delivery, frequency capping, measurement, attribution and fraud prevention.
9.1 Advertising partners
| Platform | Role and purpose | Personalisation and data used | Opt-out / preference link |
|---|---|---|---|
| Google AdMob | Primary mobile ad mediation and delivery for the App. | Advertising ID, device model, OS version, IP-derived approximate location, ad interactions; personalised and contextual ads. | Google Ads settings |
| Google Ad Manager | Ad serving, exchange and yield optimisation. | Ad request data, cookies and device identifiers; audience segments where consented. | Google Ads settings |
| Meta Audience Network | Ad delivery in the App and on the Website. | Advertising ID, app activity, device and geo signals; interest-based and contextual ads. | Meta Ads preferences |
| Unity Ads | Additional demand source for ad inventory. | Device and app identifiers, geo signals and ad interaction data. | Unity privacy & ads |
| AppLovin | Mediation platform maximising ad yield across networks. | Advertising ID, device data, ad performance events and location signals. | AppLovin privacy |
| ironSource (LevelPlay) | Mediation and bidding across ad networks. | Device and advertising identifiers, IP-derived location, ad interaction events. | ironSource privacy |
| Vungle / Liftoff | Rewarded video and interstitial inventory. | Advertising ID, app and device data, geo signals, video engagement events. | Liftoff privacy |
| Pangle (TikTok for Business) | Ad delivery and monetisation demand. | Advertising ID, device and app data, approximate location, interaction data. | Pangle privacy |
| Mintegral | Additional ad demand and monetisation. | Device identifiers, geo signals, app activity and ad events. | Mintegral privacy |
| Chartboost | Ad delivery and mediation for the App. | Advertising ID, device and location data, ad interaction history. | Chartboost privacy |
| AdColony | Video ad inventory and mediation. | Device and advertising identifiers, geo data, engagement events. | AdColony privacy |
| InMobi | Advertising and audience monetisation. | Advertising ID, precise/approximate location where permitted, app usage data. | InMobi privacy |
| Amazon Ads | Retail media demand and campaign delivery. | Device and advertising identifiers, app and site interaction data, IP-derived location. | Amazon Ads |
| Digital Turbine | Ad delivery and app discovery campaigns. | Device and advertising identifiers, geo signals, install and click events. | Digital Turbine privacy |
| Smaato | Mediation and ad exchange for additional demand. | Advertising ID, device and network data, ad interaction events. | Smaato privacy |
| Fyber | Mediation and rewarded video demand. | Device identifiers, geo signals and ad performance events. | Fyber privacy |
| Ogury | Advertising and consent management infrastructure. | Advertising ID, device data, geo signals and consent status. | Ogury privacy |
| Criteo | Retargeting and commerce media campaigns. | Cookies, advertising ID, browsing and app interaction data. | Criteo privacy |
| Teads | Native and video ad inventory. | Device and advertising identifiers, app usage signals, geo data. | Teads privacy |
| Moloco | Machine-learning based ad delivery optimisation. | Device and app metadata, ad interaction events, no additional sensitive data. | Moloco privacy |
| PubMatic | Supply-side platform enabling publisher inventory management. | Cookies, advertising ID, IP-derived location, page and app context. | PubMatic privacy |
| Magnite | Real-time advertising exchange and programmatic demand. | Cookies, advertising ID, device and geo signals, contextual content data. | Magnite privacy |
9.2 Personalised and non-personalised advertising
- Personalised (behavioural) advertising uses your advertising identifier, app activity and inferred interests to select ads. Where required by law, this is presented only after you give consent through our consent platform, which also honours the Global Privacy Control signal described in Section 15.
- Non-personalised (contextual) advertising is served using only the content of the page or app screen you are viewing, without building a profile of you. Where you have opted out of personalised advertising, we limit the advertising identifiers shared with our partners and ask them to serve contextual advertising only.
- Where the App Tracking Transparency framework applies (Apple devices, iOS 14 and later), we request your permission before tracking. If you decline, we serve contextual advertising and do not access the IDFA for advertising purposes.
- On Android, the AAID is reset if you clear "Delete advertising ID" in your device settings. We then receive a limited, non-unique identifier and cannot re-associate it with you.
10. Advertising Formats and Your Controls
The App and the Website may present the following advertising formats:
- App open (开屏) ads — displayed when the App is launched. Typically skippable after a short countdown and not rendered on every launch.
- Rewarded video ads — opt-in video that you choose to watch in exchange for a stated benefit, such as free delivery on a quotation or extended shipping tracking. You may decline at any time without losing functionality.
- Interstitial ads — full-screen ads shown at natural break points, such as after completing an order or closing a tracking screen. They are not shown during active data entry.
- Banner ads — small static or animated units placed within the interface and clearly distinguishable from functional content.
You control these formats through your device settings and through the in-app privacy options: limiting ad tracking in your operating system, resetting your advertising ID, revoking consent in the consent platform, or uninstalling the App. We also honour a universal opt-out from Google Ads (GPC) and the corresponding limit-ad-tracking controls on iOS and Android.
11. Cookies and Similar Technologies
The Website uses cookies, local storage and similar technologies to operate the site and to understand how it is used.
| Category | Purpose | Typical retention |
|---|---|---|
| Strictly necessary | Session integrity, security, load balancing and remembering your privacy choices. | Session duration |
| Functional | Remembering preferences such as language and layout. | Up to 12 months |
| Analytics | Aggregated measurement of pages visited, referrers and general usage patterns. | Up to 24 months |
| Advertising | Ad delivery, frequency capping, attribution and measurement. | Up to 13 months |
You can clear or block cookies through your browser settings, and you can change advertising permissions on your device. Blocking cookies may reduce the functionality of the Website.
12. Your Rights by Region
Subject to the law of your jurisdiction, you may hold the following rights. To exercise any of them, email support@chongyiqc.com from the address associated with your account, or write to us at the postal address in Section 17. We respond to verified requests within the period required by the applicable law (generally within 30 days, extendable where permitted).
| Region | Rights | How to exercise |
|---|---|---|
| European Union & United Kingdom | Access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right not to be subject to automated decision-making. | Email support@chongyiqc.com; complain to your local supervisory authority (in the UK, the ICO). |
| United States — California | Know and access categories of personal information, delete, correct, opt out of sale or sharing for cross-context behavioural advertising, limit use of sensitive personal information, and non-discrimination. | Email support@chongyiqc.com; use the "Do Not Sell or Share My Personal Information" control where presented; use the GPC signal. |
| United States — other states | Access, correction, deletion, portability, opt-out of targeted advertising and of the sale of personal information, and appeal of a denied request. | Email support@chongyiqc.com; universal opt-out mechanisms are honoured where applicable. |
| Brazil | Confirmation, access, correction, anonymisation, blocking, deletion, portability, information about sharing, revocation of consent, and review of automated decisions. | Email support@chongyiqc.com; lodge a complaint with the ANPD. |
| Canada | Access, correction, withdrawal of consent, and protection against inappropriate collection, use or disclosure. | Email support@chongyiqc.com; complain to the Office of the Privacy Commissioner of Canada or the relevant provincial authority. |
| Australia | Access and correction of personal information, and the right to lodge a complaint with the Office of the Australian Information Commissioner. | Email support@chongyiqc.com. |
| Singapore | Access, correction, and protection against data not collected or used in accordance with PDPA consent. | Email support@chongyiqc.com; complain to the PDPC. |
| Japan | Disclosure of the purpose of use, disclosure of personal data to third parties, correction and suspension of use, as provided by APPI. | Email support@chongyiqc.com; the Personal Information Protection Commission of Japan. |
| South Korea | Access, correction, suspension of use, and rights concerning third-party provision and overseas transfer under PIPA. | Email support@chongyiqc.com; the Personal Information Protection Commission. |
| India | Access, correction, erasure, nomination, grievance redressal and withdrawal of consent under the DPDP Act and the notified Code of Practice. | Email support@chongyiqc.com; use the grievance contact in the App; the Data Protection Board of India. |
| Other regions | Access, correction, deletion, objection and portability to the extent provided by local law. | Email support@chongyiqc.com. |
13. Children's Privacy and Age Policy
The Website and the App are directed at businesses and business users. They are not directed at children, and we do not knowingly collect personal data from anyone under the age of 13 (or the equivalent minimum age in your jurisdiction, which may be 16 in certain European countries).
- We comply with the US Children's Online Privacy Protection Act (COPPA) and do not knowingly collect personal information from children under 13.
- Where the GDPR applies, we do not knowingly process the personal data of a child below the applicable consent age without valid consent from the holder of parental responsibility.
- The App is not directed to children and is not listed in the "Children" category on the Apple App Store or in the "Designed for Families" category on Google Play.
- If you believe a child has provided us with personal data, contact us at support@chongyiqc.com and we will delete it promptly.
14. App Store Compliance
- Apple App Store Review Guidelines — the App complies with Apple's privacy requirements, including App Tracking Transparency prompts, the privacy nutrition labels, and the account deletion requirement where account creation is offered.
- Google Play Data Safety — the App's data collection, sharing and security disclosures reflect the practices described in this Policy, and the Data Safety form is updated whenever collection practices change.
- Families and age ratings — the App carries a rating reflecting its business-only audience, and no child-directed content or advertising is served to children.
- Account deletion — users can request deletion of their App account at any time by emailing support@chongyiqc.com; we action verified requests in accordance with the applicable law and the App Store and Google Play requirements.
15. Do Not Track and Global Privacy Control
Where a browser or device sends a "Do Not Track" (DNT) or "Global Privacy Control" (GPC) signal, we treat it as a request to limit data collection and to serve non-personalised advertising where applicable. We do not use DNT or GPC to serve behaviourally targeted advertising, and we do not sell personal information in response to these signals. Because there is no agreed standard for DNT across all browsers, we apply a uniform, privacy-protective interpretation.
16. Changes to This Policy
We may update this Policy from time to time, for example to reflect changes in the services we offer, in our advertising partners, or in legal requirements. The revised Policy will be posted on this page with an updated effective date, and where the change is material we will notify you through the App, by email, or by an in-app notice before the change takes effect. We keep previous versions available on request.
17. Contact Us
For any privacy question, request or complaint, please contact us. Please describe your enquiry in as much detail as possible so that we can locate the relevant data, but do not send identity documents by ordinary email.
- Business support and privacy requests: support@chongyiqc.com
- Key accounts: liyunhan@chongyiqc.com
- Company: Chongyi Automobile Co., Limited
- Office: RM 29-33 5/F, BEVERLEY COMM CTR, 87-105 CHATHAM RD, TSIM SHA TSUI, HONG KONG
- Website: chongyiqc.com
18. Effective Date
Effective date: 12 November 2026
Last updated: 12 November 2026
Version: 1.0
This Policy is governed by the laws of the Hong Kong Special Administrative Region of the People's Republic of China, together with the privacy legislation applicable to you where required. Please also see our Terms of Service.