PRIVACY NOTICE

The General Data Protection Law (LGPD) is a new legislation in Brazil that came to protect the rights of freedom and privacy of natural persons, whether through digital or physical means.

Through this Privacy Notice, we are committed to safeguarding your privacy and protecting your personal data, and this document is intended to show how we do this.

It is important to emphasize that we collect your data so that we can provide our services in a more adequate and efficient way. Precisely so that we can have confidence as a basis for providing our services, we treat any data or information collected about you as confidential and will only use it for the purposes described in this Privacy Notice and/or when authorized by you.

What data are we collecting?
We will process personal information at the beginning of the established relationship and during the relationship with ICBC. These are personal data of various natures that identify or can identify the individual, in the event that additional information for their identification is necessary.
Data processing takes place within what is strictly necessary to carry out the intended activities. The data is:
●Identification data: such as full name, date of birth, mother's name
●Documents: such as civil registration number, CPF number, CNH number
●Contact information: such as home or cell phone number, address
●Financial information: such as account number, branch, transactions
●Online activity information: can be, banking profile, records of the data that your browser transmits, including the date and time of access to your website, the volume of data transmitted and the access performance, your web browser, browser language and IP address.

How data is collected?
The origin of the collection of personal data can occur in some ways, including:
●When the data is provided by the owner, as they are entered or sent through our channels when contracting products or providing services.
●When the data is provided by third-party partners, or even when the data is publicly accessible, with the requirements established by the LGPD and its principles being fulfilled.

ICBC Brazil shares my data with someone?
ICBC Brazil does not share, sell or transfer your personal data to any company or individual, except in the following cases:
●With partner companies and suppliers (for example, we transfer our employees' identification data, such as name and CPF, to the insurance broker, Humanittare Consultoria de Direitos, which provides offer on all aspects of Benefits insurance and also shall handle personal data subject to the LGPD.)
●Entities, government authorities (for example, we may transfer personal data to the competent authorities when detecting activities that may represent serious indications of crimes, in accordance with applicable laws and regulations)
●By court order or by request of administrative authorities that have legal competence for your request.

How and why ICBC Brazil collects its data?
We may collect different types of personal data so that we can provide our services with quality.
We undertake to collect only the personal data necessary to provide the contracted service with quality, that is, we always seek to ensure that the collection of personal data is minimized.
In order for us to be transparent, we have listed below the purposes for which we may process your personal data:
●For the execution of services, products and other contracts or preliminary steps. (For example, to open an account for our customer, we need to collect identification data and contact information, such as full name, home address, CPF, etc., as well as relevant documents to verify the information)
●For the provision of services of companies linked to ICBC Brazil, such as banking, credit and cash management services; product portfolio expansion, trade finance services such as bank guarantee, international settlement and pre/post-shipment export credit, syndicated lending, corporate deposits and direct commercial lending; and expansion of the business area in terms of retail and financing.   
  (For example, to provide multi-currency financial services to our clients, we may recommend the client to other ICBC institutions abroad as granted / with the consent and accordingly share some necessary personal data such as identification data and contact information, as well as relevant Documents to verify the information).
  ●If ICBC Brazil companies have to comply with any legal or regulatory obligation.
  (For example, to accomplish the legal obligation of AML/CFT, we must collect some Identification data and Contact Information, such as full name, residence address, CPF, etc, as well as relevant Documents to verify the information, to identify the customers in accordance with applicable regulations.)
  ●For the regular exercise of rights in judicial, administrative or arbitration proceedings:
    oIn conducting the processes for receiving complaints in Ombudsman;
    oWhen receiving and preparing responses to complaints submitted before the judiciary or protection bodies;
    oIn the storage of necessary information in judicial, administrative or arbitration proceedings.
  (For example, we may treat your Identification data and contact information if you complain about ICBC Brazil in the regulatory channel, so that we can carry out investigation on specific cases and/or take corresponding actions.)
●Pursuing the legitimate interest, always within the limits of its expectations, and never at the expense of its interests, rights and fundamental freedoms; in the construction and evaluation of the profile of its customers, in order to offer personalized products that are compatible with their needs. In the implementation and development of our products and services; in the establishment of statistics, tests and evaluations for research and development, aiming at the management and assessment of business risks, the improvement and/or creation of new products.
   (For example, to provide financial products and services suitable for our customers, according to relevant regulations, we may collect your necessary Financial Information additionally, to evaluate the compatibility with your risk tolerance.)
●To carry out activities aimed at preventing the occurrence of fraud.
  (For example, when we detect possible occurrence of fraud through your consulting process, such as third parties fraudulently using the name of ICBC Brazil, we may collect your contact information, to carry out preventive measures.)
●By means of authorization granted by you (consent).

How long will we store your personal data?
We will keep your personal data only for as long as necessary to fulfill the purposes for which we collect it, including for the purpose of complying with any legal, contractual, accountability obligations or request from competent authorities.

Where we store your personal data?
●All the personal data we collected will be stored at database of ICBC Brazil with adequate security protection and restricted access.
●The personal data we collected will be treated only by corresponding functional areas, and available to the information security area and DPO.
●As mentioned above, some of the personal data may be transferred to local suppliers and/or partners, who will also store and treat personal data subject to LGPD.
●Through authorization granted by you (consent), we may input your personal data into the systems developed by ICBC Head Office to carry out necessary management activities, of which the server is located in China, with strict protection, backup and access control mechanism, in accordance with relevant Chinese laws that provide a level of protection adequate to Brazilian LGPD. During this process, we will also strictly follow the provisions of LGPD regarding international transfer and the regulations and guidelines that will still be established in due course by the National Data Protection Authority (ANPD).

What are your rights?
Importantly, you will always have rights relating to privacy and protection of your data, and ICBC, in addition to being concerned with the security of this data, is also concerned that you have access and knowledge of all your rights.

Therefore, below we summarize all the rights you have, with a brief explanation of each:
●Confirmation of the existence of the processing of personal data, thus being able to exercise control over them.
●Right of access to data being able to know details about the purposes of the processing, data categories, origin, period of conservation, existence or not of automated decisions, for example.
●Right to correct incomplete, inaccurate or outdated data, that is, the possibility to rectify the data.
●Right to anonymize, block or delete data unnecessary or even excessive. All data collected will be anonymized or deleted from our servers when you request it or when it is no longer necessary or relevant for us to offer our services, unless there is another reason for its maintenance, such as any legal obligation to retain personal data or case there is a need for preservation to safeguard our rights. If we are treating your data as a data operator, we will need to transfer your order to the Controller who has contracted our services or products.
●Right of portability, so that the data can be transmitted to another supplier, upon express request, in a structured format and respecting commercial and industrial secrets.
●Opposition to processing you also have the right to contest where and in what context we are processing your personal data for different purposes. In certain situations, we can demonstrate that we have legitimate reasons to continue processing your data, which override your rights, if, for example, they are essential for the provision of our service.
●Withdraw your consent and know the consequences of not providing consent, which is the right not to provide consent, at which time you will be informed about the consequences of denial. You are also entitled to withdraw your consent at any time, however this will not affect the legality of any data processing previously carried out on the basis of that consent. If you withdraw your consent, we may not be able to provide certain services. And if that's the case, we'll let you know when that happens.
●Automated decision review, you also have the right to request a review of decisions made solely on the basis of automated processing of your personal data affecting your interests.
●Obtain information on data sharing carried out by ICBC.

Contact information:
The person in charge of data processing is the one who establishes a communication channel between controller, holders and the National Data Protection Authority. He is responsible for accepting complaints and communications from the holders, providing clarifications and taking action. If you have any questions or need to exercise your rights, please contact us via email dpo@br.icbc.com.cn.