PRIVACY POLICY
Last updated: 27 August 2025
What does this policy cover?
This Privacy Policy applies to the subsidiaries, affiliates, and other entities controlled by XCMG Construction Machinery Co., Ltd. as identified in Appendix A (List of XCMG Data Controllers/Legal Entities) (collectively referred to as "XCMG"). This Privacy Policy is applicable only when XCMG collects or processes personal information for its own purposes (i.e., when XCMG, either alone or jointly with other entities, acts as the controller and thereby determines the purposes and means of processing any personal information). This Privacy Policy does not apply when XCMG collects or processes personal information on behalf of other companies (such as XCMG’s dealers, suppliers, and customers).
This policy describes how XCMG (also referred to as "XCMG", “our organization”, "we" or "us") will make use of your data when you interact with us and the XCMG websites, systems and Apps ("XCMG Platforms"), and this privacy policy will explain how our organization uses the personal data we collect from you when you use our platforms or potential offline scenarios.
It also describes your data protection rights, including the right to object to some of the processing which XCMG carries out. More information about your rights, and how to exercise them, is set out in the “Your choices and rights” section.
Topics
- Personal data we may collect about you, origin of data and data controller(s)
- How do we use this data, and what is the legal basis for this use？
- How do we share your personal data？
- Where do we transfer your personal data？
- Your choices and rights as a data subject
- Security
- How long do we retain your personal data？
- Your obligation to provide data
- Updates to this privacy policy
- Contact us
Personal data we may collect about you, data origin and data controller (s)
Where we refer to personal data below, we mean any information relating to an identified or identifiable living person.
We may collect and process personal data about you when you interact with us and the XCMG Platforms. This means that we are collecting personal data from the data subject itself on a regular basis. Besides that we may collect data from third parties, such as, but not limited to, public authorities (where applicable), and this privacy policy will explain how our organization uses the personal data we collect from you when you use our platforms. This may (subject to the individual case and circumstances) include:
| Category |
Details |
| Identification and Contact Information |
First name, last name, country, email address, phone number |
| Delivery Details |
Country/state, city, current time, address, post code |
| Device Information |
Browser, language, IP address |
| Marketing Information |
Subscription choice, including email and privacy consents |
| Transaction Information |
Account name, transaction reference number, check information number |
The processing of the following sensitive personal data will only occur when necessary for explicitly defined and legitimate purposes or in case we have your consent present, where required (such requirement is indicated in the table below)
| Category |
Details |
| Voice Recording Information (basing on your consent) |
Recording of your calls with our call centre services team |
| Bank Account Information |
Bank account number, international bank account number(IBAN) |
| National Identification Information |
Type of identification, identification number |
The controller, meaning the legal entity responsible for processing your data is the one XCMG-affiliate company out of the global entirety of XCMG (appendix A), that you are initiating or holding a contract or further legal relationship with. Please note that in case you should be in or about to initiate a business relationship with more than just one of the XCMG global portfolio of subsidiaries, each of these companies may be a controller in the aforementioned sense, however, only in the respectively underlying context.
How do we use this data, and what is the legal basis for this use?
We will only use your personal data for the purposes and legal bases set out below:
| Purpose |
Legal Basis |
| We will collect and use your identification and contact information, delivery details, for the purposes of recording, maintaining, and updating potential business opportunity information. |
Your consent where such consent is required and obtained, |
| To initiate a contract you requested. |
| We will collect and use your identification and contact information, delivery details for the purposes of dealer onboarding, renewal, and termination management. |
Necessary in order to take steps at your request prior to entering into our contract with you. |
| We will collect and use your identification and contact information, delivery details for the purposes of customer onboarding and customer information management. |
Necessary in order to take steps at your request prior to entering into our contract with you. |
| We will collect and use your identification and contact information, delivery details, and bank account information for the purpose of sales, payment collection, and refund management of complete machines and spare parts. |
Necessary for the performance of our contract with you. |
| We will collect and use your identification and contact Information, bank account information, transaction information, national identification information for the purpose of completing the collection and payment of internal and external corporate funds and capital clearing, ensuring accurate and timely arrival of transaction funds. |
Necessary for the performance of our contract with you. |
| We will collect and use your bank account information, transaction information for the purpose of completing a transaction by check. |
Necessary for the performance of our contract with you. |
| We will collect and use your Identification and Contact Information for the purpose of completing a transaction by letter of credit. |
Necessary for the performance of our contract with you. |
| We will collect and use your identification and contact information, delivery details for providing service resource planning and allocation, as well as engineer qualification certification. |
Necessary for the performance of our contract with you. |
| We will collect and use your identification and contact information, delivery details, and bank account information for vendor technical support, after-sales service management and payment. |
Necessary for the performance of our contract with you. |
| We will collect and use your identification and contact Information, voice recording information for consultation, complaints, repair requests, and related feedback purpose in the call center. |
Your consent where such consent is required and obtained. |
| We will collect and use marketing Information to send you direct marketing in relation to our relevant products and services, or other products and services provided by us, our affiliates and carefully selected partners. |
Your consent where such consent is required and obtained, our legitimate interest in sending ads where permitted under local legislation |
| We may process your data to comply with request issued by local authorities such as, but not limited to, police forces, public prosecution offices, public health insurances, tax authorities, customs authorities, etc. |
Our legal obligation to comply with compulsory requests issued by competent local authorities as per the individually underlying law |
How do we share your personal data？
We may share your data with the following categories of recipients:
| Personal Data Category |
Category of Recipient |
Why? |
| Identification and Contact Information, Delivery Details, Marketing Information |
XCMG group companies involved, refer to Appendix A |
To better address customers/dealers needs, we may share and allocate lead information across different regions to connect customers/dealers with the most appropriate service teams or representatives, ensuring a higher quality of service. |
| Identification and Contact Information, Delivery Details, Marketing Information, Device Information, Bank Account Information, Transaction Information, National Identification Information, Voice Recording Information |
Third party service providers as indicated with the underlying contractual relationship |
We employ other companies and individuals to perform functions on our behalf. Examples include website hosting and maintenance, customers/dealers relationship management, fulfilling orders for products or services, banks for payment, sending postal mail, cloud hosting services. |
| Personal master data (contact data, name, surname, title, appellation), any further data lawfully requested in the underlying case |
Competent (local) public authorities as per the law applying |
Complying with mandatory requests for cooperation or the implementation of mandatory obligations |
Where do we transfer your personal data？
Personal data that we collect from you may be stored on servers located in Frankfurt and Singapore. Personal data that we collect from you may be transferred to and stored at a destination outside the country where you reside, so-called third countries. Due to the global nature of our business, your personal data will be disclosed to service providers outside the country where you reside including, in particular to China, assisting us with hosting and maintenance of the system (as indicated in the data protection information issued within the underlying contractual relationship). Where these locations do not provide an adequate level of data protection, we ensure appropriate safeguards are in place to protect the transfer of your personal data to these countries. That means, we have implemented the instruments required to ensure that your data is protected on a level that can be assessed as acceptable from an global-perspective. Therefore we have concluded Standard Contractual Clauses (“SCC”) and agreed on additional warranties with the data recipient.
| Purpose |
Category |
Mechanism |
Country |
| To better manage and maintain contracts with dealers or customers |
Identification and Contact Information, Delivery Details, Bank Account Information |
SCCs, Additional Warranties, TIA |
Singapore, China |
| To promptly respond to relevant business inquiries or collaboration intentions |
Identification and Contact Information, Marketing Information, Delivery Details, Device Information, Voice Recording Information |
SCCs, Additional Warranties, TIA |
Singapore, China |
|
| To better complete the approval and transaction |
Identification and Contact Information, Transaction Information， National Identification Information, Bank Account Information |
SCCs, Additional Warranties, TIA |
Singapore, China |
Your choices and rights
You have the following rights:
The right to information: Enables you to receive information regarding whether we are processing your personal data and which data that is.
The right to rectification: Enables you to correct any inaccurate or incomplete personal data we hold about you.
The right to erasure: Enables you to ask us to delete your personal data in certain circumstances (meaning that we may be obliged or entitled to keep your data in case any respective obligation or entitlement applies).
The right to restricted processing: Enables you to ask us to halt the processing of your personal data in certain circumstances. You have the right to request the restriction of the processing of your information were (a) you are challenging the accuracy of the information, (b) the information has been unlawfully processed, but you are opposing the deletion of that information, (c) where you need the information to be retained for the pursuit or defence of a legal claim, or (d) you have objected to processing and you are awaiting the outcome of that objection request.
The right to object: Enables you to object to us processing your personal data on the basis of our legitimate interests (or those of a third party), including processing for direct marketing purposes - your objection will be upheld, and we will cease processing your personal data, unless the processing is based on compelling legitimate grounds or is needed for the exercise or defence of legal claims that may be brought by or against us.
The right to data portability: Enables you to request us to transmit personal data that you have provided to us, to a third party without hindrance, or to give you a copy of it so that you can transmit it to a third party, where technically feasible.
The right to withdraw consent: Should we process your data basing on your declaration of consent, you are entitled to withdraw consent any time, without having to name any reason and with immediate effect for the future.
The right to refuse automated decision-making (including profiling): Individuals have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning them or similarly significantly affects them. We may assure you that all decision of legal effect on any data subject are finally taken by humans. Should – in exceptional cases- another apply, we will inform you accordingly and implement all respective legal requirements such as, but not limited to, your right to have any such decision reviewed by a human.
These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep.
If you wish to exercise any of these rights, please contact us at the contact details set out below.
If you have unresolved concerns, you have the right to lodge a complaint to a data protection authority in the country that you reside in or, the country of your place of work, the country of our statutory seat or the country where the alleged infringement took place.
Security
We make reasonable efforts protect your personal data from loss, misuse, disclosure, alteration, unavailability, unauthorised access and destruction and maintain the confidentiality of your personal data. This is also ensured using appropriate technical and organisational measures. We choose our security measures taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons and continuously improve them.
How long do we retain your personal data
We only maintain the personal data we collect for as long as it is necessary for us to provide our services, for as long as it is required to fulfil the purposes of the processing of personal data, or as required by law.
We determine the retention period of personal data based primarily on the following criteria:
1. To fulfill the transactional purpose related to you, maintain corresponding transaction and business records, and to address any queries or complaints you may have;
2. Whether you have agreed to a longer retention period;
3. Based on the needs related to the statute of limitations for litigation;
4. Whether there are other special agreements or legal regulations concerning the retention period.
After exceeding the retention period, we will delete or anonymize your personal information in accordance with applicable laws.
Your obligation to provide data
Please consider that certain processing activities require that you provide personal data. Depending on the underlying purpose of processing, certain data may be required as a mandatory precondition. If you should not provide data at all or not all the data marked as mandatory in the underlying context, we may not be able to implement the respective contact request, contract, further legal relationship etc. If there should be situations where certain data is indicated as a voluntary contribution, not providing any or all of that data will not have any negative consequences for you.
Updates to this privacy policy
We reserve the right to update this Privacy Policy at any time, and we will provide you with a new Privacy Policy when we make any substantial updates, including change of operator and technology provider, etc. We may also notify you in other ways from time to time about the processing of your personal information. In the event of any changes to local data privacy laws and regulations, this policy shall automatically be construed to provide the minimum level of protection required by such statutes.
Contact us
The data controller for your personal data is the subsidiary, affiliate, or other entities controlled by XCMG Construction Machinery Co., Ltd. that actually processes your data or that has your data processed as identified in Appendix A (List of XCMG Data Controllers/Legal Entities) (collectively referred to as "XCMG"). (Registered Address: No. 26 Tuolanshan Road, Xuzhou Economic and Technological Development Zone, Jiangsu Province, China.)
If you have questions about this Privacy Policy or wish to contact us for any reason in relation to our personal data processing, please contact us at mail to: privacy@xcmg.com.
Appendix A.pdf
