The provisions of this section apply to individuals located in the People’s Republic of China (“China”) in accordance with the Personal Information Protection Law of the People’s Republic of China (“PIPL”). For the purposes of this section, references to Personal Data and Sensitive Personal Data shall be interpreted in a manner consistent with the concepts of Personal Information and Sensitive Personal Information under the PIPL.

If you are located in China, this section supplements this Privacy Policy and, to the extent required by applicable law, shall prevail over any conflicting provisions of this Privacy Policy.

RemoFirst is committed to applying a high standard of privacy and Personal Data protection. Where required by applicable law, RemoFirst will provide the notices, obtain the consents, and implement the safeguards required under the PIPL.

Collection of Personal Data

Information regarding when and how RemoFirst collects Personal Data is described in the relevant sections of this Privacy Policy relating to the collection of Personal Data through the Website, Platform, and Services.

Where required under the PIPL, RemoFirst will provide appropriate notice and obtain your consent prior to processing your Personal Data.

Where required under the PIPL, RemoFirst will obtain your separate consent for the processing of Sensitive Personal Data, for the transfer of your Personal Data outside China, for disclosures to third parties requiring separate consent, and for any other processing activities for which separate consent is required by law, unless another lawful basis applies.

Categories of Personal Data Processed

The categories of Personal Data processed by RemoFirst are set out in the section titled “Types of Personal Data We Collect” of this Privacy Policy.

Depending on the nature of your relationship with RemoFirst and the Services being provided, such categories may include identification information, contact details, employment and workforce information, payroll and benefits information, financial information, government-issued identifiers, immigration-related information, communications, technical and device information, usage data, and other Personal Data relevant to the provision of the Services or to compliance with legal and regulatory obligations.

Where RemoFirst processes Sensitive Personal Data, it will do so only where necessary for a lawful and specified purpose, where strict protective measures are adopted, and where any required separate consent has been obtained.

Purposes of Processing

RemoFirst processes Personal Data for the purposes described in the relevant sections of this Privacy Policy, including for the operation of the Website, Platform, and Services, and for purposes related to workforce administration, payroll, employer of record services, onboarding, offboarding, benefits, compliance, security, business operations, legal obligations, and related legitimate business needs.

Depending on the circumstances, these purposes may include:

a. maintaining and managing Personal Data and records in order to comply with applicable legal, regulatory, document retention, accounting, tax, audit, and reporting obligations;

b. administering onboarding, employment, engagement, payroll, compensation, benefits, leave, expense management, offboarding, and workforce management processes;

c. administering immigration, work permit, visa, right-to-work, and residency-related matters where relevant;

d. managing performance, training, career development, disciplinary processes, and other workforce-related administration where applicable;

e. conducting due diligence, screening, verification, fraud prevention, background checks, and risk management activities to the extent permitted by applicable law;

f. responding to requests from regulators, public authorities, courts, law enforcement bodies, statutory boards, or other competent authorities;

g. establishing, exercising, or defending legal claims, rights, or remedies, and managing disputes, complaints, or investigations;

h. providing information or references where authorized or required, including in connection with employment verification or related matters; and

i. carrying out any other activities reasonably necessary in connection with the administration, operation, support, or delivery of the Services or related business operations.

If RemoFirst intends to process Personal Data for a new purpose not previously notified to you, RemoFirst will provide any additional notice and obtain any consent required by applicable law.

Your Rights Under the PIPL

Subject to applicable law, individuals located in China may have rights in relation to their Personal Data, including the right to:

a. know and decide how their Personal Data is processed;
b. restrict or refuse the processing of their Personal Data, where permitted by law;
c. access and copy their Personal Data;
d. request correction or completion of inaccurate or incomplete Personal Data;
e. request deletion of Personal Data where the conditions under the PIPL are met;
f. request an explanation of the rules governing the processing of their Personal Data;
g. withdraw consent, where processing is based on consent;
h. request the transfer of Personal Data to another personal information handler, where the conditions under applicable law are satisfied; and
i. exercise any other rights available under the PIPL and applicable law.

To exercise any of your rights under the PIPL, please contact us at:

dpo@remofirst.com

RemoFirst may need to verify your identity before responding to your request and may retain certain information where required or permitted by applicable law.

Disclosure of Personal Data

RemoFirst may disclose Personal Data within the RemoFirst group and to third parties where necessary for the purposes described in this Privacy Policy and where permitted by applicable law.

Depending on the circumstances, Personal Data may be disclosed to:

a. affiliates within the RemoFirst group;
b. local partners, payroll providers, employer of record partners, and other service partners involved in the delivery of the Services;
c. suppliers, vendors, and service providers, including providers of payroll, benefits, insurance, HR administration, IT, hosting, communications, analytics, security, identity verification, customer support, and professional services;
d. customers receiving the Services, where such disclosure is necessary for the provision of the Services;
e. banks, payment processors, insurers, benefits providers, immigration advisors, medical or occupational service providers, and other third parties involved in workforce administration or service delivery;
f. legal, tax, accounting, audit, and other professional advisors;
g. regulators, courts, law enforcement authorities, public authorities, and governmental bodies; and
h. actual or prospective purchasers, investors, lenders, or other participants in a merger, acquisition, financing, reorganization, sale of assets, or similar corporate transaction.

Where required under the PIPL, RemoFirst will obtain your separate consent before providing Personal Data to third parties, unless another lawful basis applies.

RemoFirst requires third parties processing Personal Data on its behalf to implement appropriate technical and organizational measures to protect such Personal Data in accordance with applicable law.

Cross-Border Transfers of Personal Data

Due to the global nature of RemoFirst’s business and Services, Personal Data may be transferred to, accessed from, or processed outside China.

Where required by the PIPL and other applicable laws, RemoFirst will adopt appropriate safeguards for cross-border transfers of Personal Data, including providing required notices, conducting any required assessments, entering into required contractual arrangements, implementing appropriate security measures, and obtaining your separate consent where required.

If Personal Data is transferred outside China, RemoFirst will take steps to ensure that overseas recipients process such Personal Data in compliance with applicable legal requirements and provide a level of protection required by applicable law.

If you would like more information regarding cross-border transfers of your Personal Data, you may contact us at:

dpo@remofirst.com

Retention of Personal Data

RemoFirst retains Personal Data only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Depending on the circumstances, retention periods may be determined by reference to:

a. the duration of your relationship with RemoFirst;
b. the period necessary to provide the Services;
c. applicable limitation periods;
d. legal, regulatory, tax, accounting, employment, immigration, and audit requirements; and
e. RemoFirst’s internal retention requirements and policies, where consistent with applicable law.

At the end of the applicable retention period, RemoFirst will delete or anonymize Personal Data in accordance with applicable law.

Company Systems, Devices, and Business Communications

To the extent permitted by applicable law, where RemoFirst provides access to company systems, corporate email accounts, devices, software, communication tools, or other business resources, such resources are intended primarily for business and work-related purposes.

RemoFirst may monitor, access, review, copy, preserve, and use information stored on or transmitted through such systems and resources where necessary for lawful business purposes, including system administration, security, fraud prevention, legal compliance, internal investigations, audits, protection of RemoFirst’s rights and property, or as otherwise permitted by applicable law.

Any such monitoring or access will be carried out in accordance with applicable law and subject to appropriate safeguards.

Changes to This Section

RemoFirst may update this section from time to time to reflect changes in law, regulatory guidance, business operations, or privacy practices. Where required by applicable law, RemoFirst will notify you of material changes in an appropriate manner.

Minors

The Website, Platform, and Services are not directed to minors under the age specified by applicable law, and RemoFirst does not knowingly collect Personal Data from minors except where permitted by law and subject to any required authorization or consent.

‍