Privacy Policy

We, YUTONG Bus Co., Ltd. and its global affiliates (hereinafter referred to as “YUTONG” or “we”), pay full attention to your privacy. Please read over the Privacy Policy because it explains how YUTONG uses your personal information and other data, as well as how you can exercise your rights about it.

I. Core Terms

We are responsible for the personal information and data collected and processed by us in accordance with the Chinese laws and other applicable data privacy laws, including but not limited to the EU or UK General Data Protection Regulation and the data and privacy laws of your country/region ("Data Privacy Act"). We promise: your data rights take precedence over commercial interests. All data processing will be based on the data privacy law applicable in your country/region (such as Article 6 Legal Basis in GDPR), and your personal data and vehicle data are only used for after-sales services, contract performance, and legal obligations.

We will use your personal information for the purposes stated in Section III of this Privacy Policy.

For the purposes stated in the Privacy Policy, when necessary, we will share your personal information with our affiliates and authorized partners as well as with administrative or judiciary authorities in accordance with requirements under the applicable Data Privacy Laws. Please refer to Section IV for details.

If we rely on your consent, for example, for the purpose of marketing or providing the right of access to your personal information for a third party, you may withdraw your consent at any time.

For more information on your rights and how to exercise these rights, please refer to “Your Rights” in Section IX.

II. Personal Information and Data Collected by us and How do we Collect

Personal information means all information relating to an identified or identifiable natural person as defined under the applicable Data Privacy Laws. Your personal information can be (1) provided directly by you, (2) collected by electronic systems, or (3) provided by third parties. The provision of certain types of personal information and data may be necessary or optional. Mandatory information will be marked as such at the moment of collection of your personal information. If you refuse to provide the mandatory information, we may not be able to bear some or all of the obligations to you, or provide you with all our services or respond to or resolve the problems that you encounter. If you provide relevant information and data by yourself or on behalf of any data subject, we will assume that you have obtained the legal consent of the data subject and you are duly authorized to provide it to Yutong for necessary data processing, transmission or storage.

1. YUTONG APP or YUTONG website

While you create an account or log in to the website, you will need to provide us with the following personal information in full or part when necessary: your company name, company address, name, gender, position, contact information, email, passport number/ID number (as necessary to perform contractual obligations), and date of birth (as necessary to perform contractual obligations).

2. Sale of products/ services

While you conduct commercial communication, exchange business cards, sign sales contracts, distribution contracts, KD contracts, MoU and other agreements with us, to better perform the contracts and provide you with better services, we may collect your following personal information: company name, company address, name, gender, position, tel., mobile phone and E-mail.

3. Handling the Invitation Letter for you

When you are invited to visit YUTONG's head office in China, in order to help you handle the Invitation Letter with the Henan Provincial Department of Business, we will collect your following personal information: name, gender, passport number/ ID card number, date of birth, nationality and past visa information.

4. Using YUTONG Bus products or services

When using vehicle maintenance services and after-sale services, we will collect your following personal information: vehicle owner name, vehicle owner phone number, vehicle owner E-mail; repair man’s name and repair man’s phone number. If you use our IoV products and services, we may collect the following vehicle-end data for vehicle operation status evaluation and quality analysis, which is not associated with your personal information. The data includes: information related to vehicle parameters obtained through the IOV system (including vehicle sensing devices, vehicle application platform, vehicle SIM card service and other components), such as vehicle mileage parameters, vehicle power parameters, vehicle running process parameters, vehicle battery status parameters, vehicle A/C system operating status parameters and other vehicle condition data based on the provided after-sales services and vehicle comfort assessment. When you use our IoV system, please refer to the ""IoV Service Agreement"" and ""IoV Privacy Policy"" on the software login interface for data privacy policies and specific contents, so that you can have a more comprehensive understanding of data privacy matters related to IoV products and services.

5. Recruitment process

When applying for our jobs through YUTONG website, APP or a third-party recruiting website, we will collect your following personal information as the reference information for recruitment or conducting background investigation: name, gender, date of birth, E-mail address, mobile phone number and work experience.

When you sign the employment contract with us, we will collect your following personal information as the reference information for recruitment: name, phone number, nationality, local country, gender, ID card number (or passport number), family address, work experience, qualification certificate, emergency contact’s name, emergency contact’s phone number and salary.

6. Supplier/ Service provider provides services

When you register the supplier’s qualification or sign the service procurement contract with us through the YUTONG website, we will collect your following personal information to perform the contract or conduct background investigation: name, gender, date of birth, ID card number (or passport number), contact address, practicing qualification, E-mail address and mobile phone number.

When you sign the service authorization contract and after-sale agreement with us, in order to better perform the contract, we will collect your following personal information: company name, company address, contact name, position, telephone, E-mail, service station personnel’s name, and service station personnel’s salary.

7. Customer return visit

We may collect your following personal information in the customer’s return visit business process: name, phone number, WhatsApp, customer needs and return visit result, personal information collected in the process of accepting the customer’s active consultation, including name, phone number, E-mail and customer needs.

8. Financing service

When applying for the financing service, you may need to provide us your following personal information: bank statements, housing information, vehicle information, credit information, detailed property condition and debt condition.

9. Third-party source information and public information

Where permitted by law, we will acquire relevant information from public and commercial third parties or public sources (e.g., information of YUTONG ‘s customers from suppliers, deals and service providers, including customer name, company address, contact name, position, phone number and E-mail).

To find an international supplier, YUTONG Bus will obtain the contact information (name, phone number and E-mail) of the business party through the supplier’s official website for negotiations on daily purchase price, contract signing, quality issue settlement, marketing and other business cooperation.

III. Purpose for which we Use Personal Information and What Permission do we Process Personal Information

We do not process your personal information, unless we have a specific and legitimate purpose as well as a legal basis to do so. The purposes and legal bases for the processing of your personal information are described below:

1. Communicating and interacting with you

(1) Informing you of important safety related information of vehicles or new energy products, based on consent or our contract with you;

(2) Informing service personnel where the vehicle has a fault or an accident, based on consent or our contract with you and our legitimate interests regarding customer satisfaction;

(3) Sending information of products, services, terms and policies and changes to you, based on consent or our contract with you;

(4) Informing you of our marketing activities, based on consent or our contract with you;

(5) For internal management and backstage support, sharing your contact information with our branches based on compliance with the legality of transmission, to improve internal business processes and provide you with better after-sales service.

2. Providing you with products and services

(1) Realizing your order: processing payment, delivery and evaluating your financing needs based on our contract with you;

(2) Accessing vehicle performance data in accordance with the contract we have signed with you to improve vehicle performance for the purpose of fulfilling necessary and legal obligations under the contract;

(3) Road rescue, care and maintenance and other after-sale services either on our contract with you, or based on the performance of necessary and legal obligations under the contract to ensure the safety, security and improvement of our products.

3. Verifying the reasons for accidents

Verifying vehicle position and cause of the accident as well as vehicle status based either on our contract with you, or our legal obligations to ensure the safety, security and improvement of our products.

4. Based on the EU Data Act or relevant laws of other countries/regions, cooperating with government agencies to retrieve necessary vehicle data (such as vehicle location, driving paths, etc.) in public emergencies (such as extreme weather, major accidents, epidemics), or complying with other laws and regulations, court order or legal process to obtain relevant vehicle data based on clear local legal basis.

5. Improving of our products and services

(1) Product system upgrade (Legitimate interest);

(2) Satisfaction degree investigation (Legitimate interest);

(3) Analyzing and improving product performance, R&D and new technology related to the products including the three-way cameras (Legitimate interest).

6. Information flow analysis

When you access YUTONG's relevant website or use the services provided by YUTONG, we may analyze your access through small-scale data documents. These data documents could be Cookies, Flash Cookies or your browser or other local storage provided by associated applications (collectively referred to as “Cookies”). We use Cookies to analyze the information flow, customize services, contents and ads, evaluate the promotion effect and promote trust and security. Please refer to the Cookie policy for details.

IV. Our Sharing of Personal Information

In accordance with the applicable Data Privacy Laws, we may disclose your personal information to the following recipients, who may be affiliated with YUTONG or may have an inseparable relationship with us due to the purchase and sale of our vehicles:

•In order to facilitate us to provide you with sales and after-sales services on the basis of YUTONG’s internal system and manage your personal information and transaction behaviors, your personal information may be shared between YUTONG’s affiliates;

•Third parties which help provide you with products and/or services, such as deals, service providers;

•Other third parties which help us carry on business and conduct market investigations, for example, marketing institutions, satisfaction degree investigation institutions;

•Credit reference institutions;

•Banks we cooperate.

In addition to the above-mentioned relevant authorized partners, if required, we may share your personal information with administrative, regulatory or judiciary authorities or agencies and other third parties in the country or region where the business is located to comply with any legal or regulatory obligation and/or in the cases of an express and justified request or in case of an alleged violation of legal or regulatory provisions. Following or during a restructuring, reconstitution, merger, acquisition or debt financing, transfer, sale of assets of YUTONG, as well as insolvency, bankruptcy or receivership, your information will be disclosed to our counselor or the counselor of any potential buyer and delivered to the new owner of business.

We will only share the personal information necessary to provide you with services and be constrained by the purposes stated in the Privacy Policy.

Under the circumstance where we have evaluated the protective measures taken by the authorized partners for personal information and consider that their data protection measures are enough to guarantee information security, we allow them to process your personal information. When you access the service of our authorized partners, they will also provide you with their own privacy policy in view of collecting and using your personal information. We suggest reading such privacy policy of third parties. We also impose contractual obligations and confidentiality obligations on authorized partners to ensure that they shall process your personal information in accordance with the applicable Data Privacy Laws. Once any partner is discovered to violate the contractual provisions, we will take effective measures till the cooperation is terminated.

V. Storage of Information and Data

The vehicle-end information of vehicles operating in China or personal information collected in China is encrypted and stored in our company's data center, and no data will be transferred from China. The vehicle-end information in overseas EU regions will be stored on our company's server located in the EU. The vehicle-end data in other countries/regions will be stored in accordance with the data privacy regulations of your country/region. All customer information and internal employee information will be collected, transmitted and stored based on contractual authorization and your legal consent, and, when necessary, will be shared with our overseas branches or authorized partners. In the whole process, we will carry out strict data encryption to control access rights to specific data and ensure the secure storage and access of your data.

No matter where our server is located, we will take proper organization, technologies, and other safety measures to protect your rights and the security of your personal information according to the Privacy Policy. For example, we will use encryption techniques and protection mechanism to prevent information disclosure; ensure that only the specified authorized personnel can access the personal information; and we will hold privacy protection training courses to strengthen employees’ understanding of the importance of protecting personal information. We will try to protect your personal information. However, please note that any security measures cannot be impeccable.

VI. Retention Time of Information and Data

When you have the account of our website or we provide you with products and/or services, we will retain your personal information and the data of the vehicle used according to the minimum necessary principle. Hereafter, we will reserve your personal information and vehicle data when necessary:

•Responding to any questions, complaints or claims to you;

•Recommending marketing information and materials to you;

•Improving product performance and satisfaction degree investigations;

•Keeping records required by law;

•Solving vehicle operation faults and maintenance information.

For the purpose stipulated in the Policy, we will not keep your personal information longer than necessary unless the retention period needs to be extended or we are permitted by law. Different retention periods are applicable to different types of personal information. When the retention period expires, we will completely delete or anonymize your relevant data in the system to ensure that the data cannot be restored or traced to you.

Despite of this provision, we may reserve your personal information to assist in any government and judicial investigation and use it to file legal claims or civil, criminal or administrative litigation or provide support for that.

VII. Cross-Border Data Transfer

In order to provide services to you, we sometimes need to share your personal information outside your country, for example:

•Our offices, branches and subsidiaries and affiliates all over the world;

•Service providers outside your local country;

Note: The cross-border transfer of personal data in the European Economic Area (EEA) is subject to the special provisions of the EU GDPR. YUTONG promises, where applicable, to ensure that (in the absence of an adequacy decision and, where necessary, after having carried out a transfer impact assessment) appropriate legal and technical and organizational safeguards required by the EU GDPR are in place (in particular, EEA standard contract clauses). All cross-border data transfers will be carried out in accordance with the data privacy regulations of your country/region, and necessary contractual, technical and organizational measures will be taken to ensure that your data is equally protected.

VIII. Data Processing Records

YUTONG’s system maintains necessary data sharing, transfer and processing records. The content includes third party information, disclosed information, disclosure time, etc. The aforesaid content is generated by our software during data processing. Records are generally made in electronic form. Based on the requirements of the regulatory institutions, as the controller or processor and when necessary, we may provide data processing records that are available.

IX. Your Rights

Depending on the applicable Data Privacy Laws that apply to your situation, you may be able to freely exercise the following rights regarding your personal information, free of charge:

If you want to exercise any of these rights, please conduct through the following means:

• Sending E-mail, making phone calls or writing letters – see below ""How to contact us"";

•Telling us the rights you would like to exercise and the personal information involved in the request.

X. Responding to Your Requirements Aforesaid

To guarantee your information security, we will first require you to verify your identity and then process your request. Generally, we will accept your request fed back via E-mail within 7 working days and your request fed back via telephone within 5 working days. We will process your legitimate request within 15 working days after accepting and may give you feedback on the results of the processing via telephone, E-mail and other channels.

For your reasonable requests, we do not charge fees in principle. However, in view of repeated requests exceeding the reasonable limit, we will address them on a case-by-case basis depending on the specifics of your situation. In terms of those unreasonably repeated requests that require too many technical means (for example, the need to develop new systems or fundamentally change existing practices), bring risks to the legitimate rights and interests of others, or are very unrealistic requests (for example, involving information stored on backup tapes), we may refuse.

In the following cases, we are unable to respond to your request:

1. Related to personal information controllers fulfilling obligations stipulated by laws and regulations;

2. Directly related to national security and national defense security;

3. Directly related to public safety, public health, and major public interests;

4. Directly related to criminal investigation, prosecution, trial and execution of judgments;

5. The personal information controller has sufficient evidence to show that the personal information subject has subjective malice or abuses of rights;

6. It is for the purpose of protecting the life, property and other major legitimate rights and interests of the personal information subject or other individuals, but it is difficult to obtain the consent of the person;

7. The response to the request of the personal information subject will cause serious damage to the lawful rights and interests of the personal information subject or other individuals or organizations;

8. Involving business secrets.

XI. Guaranteeing the Security of Personal Information

We will take appropriate technical and organizational security measures to protect your personal information security. We have established an information security management organization to build and improve the information security management system and privacy security management system, and take necessary technical measures to effectively protect the life cycle security of your personal information. We also have formulated the procedures for processing any suspicious data security holes. We will inform you and the corresponding regulatory institutions of the suspicious situations of data security holes.

XII. Processing Minors’ Personal Information

Except applicable legal requirements, we will not knowingly collect minors’ (according to legal provisions of each country) personal information. Minors are not allowed to provide us with their personal information without the consent of their guardian.

If we discover that we have collected minors’ personal information without a verifiable parent or guardian’s prior consent, we will manage to delete relevant data immediately. If the parent or guardian has a reason to believe that minors provide their personal information to YUTONG without their prior consent, please contact us to ensure to delete such personal information and guarantee that minors cancel ordering any applicable YUTONG products and services.

XIII. Jurisdiction

If the relevant provisions of the Privacy Policy conflict with the laws and regulations in the specific jurisdiction, the latter shall prevail.

XIV. Changes in Privacy Policy

The privacy statement was issued on May 30, 2019 and finally updated on December 15, 2025.

We may modify the Privacy Policy from time to time - we will publish it on the website https://www.yutong.pk/privacy/ at that time. We may also send a change notice via different channels, for example, sending a separate notice to you via E-mail.

XV. Exceptions

Information collected by third party services (including any third party websites) accessed through our services is inapplicable to the Privacy Policy. Please refer to the privacy policies of third parties before submitting personal information to them.

XVI. How to Contact us

If you have any doubt about the Privacy Policy or your information we hold, or claim your above-mentioned legal rights and interests, please contact us via mailing letters, E-mail or making phone calls.