Notice to Participants of Shanghai Stock Exchange Market on Personal Information Protection

Dear participants:

In order to protect your personal information, pursuant to Civil Code of the People's Republic of China, Personal Information Protection Law of the People's Republic of China, Securities Law of the People’s Republic of China, other laws, administrative regulations, departmental rules and normative documents (collectively referred to as laws and regulations), Shanghai Stock Exchange (hereinafter referred to as we or the Exchange) hereby issues the following notice regarding the protection of personal information involved in the performance of self-regulatory duties and the conduct of self-regulatory activities.

I. Why we collect and use your personal information

1.1 Objectives of processing personal information by the Exchange. The Exchange handles your personal information in accordance with laws, regulations and business rules and for the following purposes of performing self-regulatory duties and conducting self-regulatory activities:

1.1.1 providing venues, facilities and services for centralized securities trading;

1.1.2 establishing and amending business rules of the Exchange;

1.1.3 reviewing applications for the public offering and listing of securities pursuant to the regulations of the State Council and China Securities Regulatory Commission (hereinafter referred to as the CSRC);

1.1.4 reviewing and arranging for listing and trading of securities and making decisions on the securities' suspension, resumption, termination of listing and re-listing;

1.1.5 arranging transfers for non-public offering securities;

1.1.6 organizing and overseeing securities trading;

1.1.7 organizing and implementing innovation in trading instruments and trading mechanisms;

1.1.8 supervising its members;

1.1.9 supervising its listed companies and relevant persons who have information disclosure obligations, and providing website(s) for information disclosure obligors to release information in accordance with the law;

1.1.10 supervising its securities service providers' businesses regarding listing and trading of securities;

1.1.11 establishing or participating in the establishment of securities registration and clearing institutions;

1.1.12 managing and releasing market information;

1.1.13 educating and protecting investors; and

1.1.14 other functions stipulated by laws, administrative regulations, and permitted, authorized or delegated by the CSRC.

1.2 Principles of processing personal information by the Exchange. Following the principles of legality, legitimacy and necessity, the Exchange collects and uses personal information of the aforementioned securities market participants only to the minimum extent necessary to achieve the processing purposes.

1.3 Scope of personal information processed by the Exchange. The Exchange processes the personal information of market participants based on the actual needs of self-regulatory activities, including one or more of the following: name, identity documents, information of spouse and close relatives, job and position, contact information, securities and derivatives account information, trading information, and shareholding and fund holding information, among others.

II. How we collect your personal information

The Exchange primarily collects personal information of market participants from the following sources:

2.1 From market participants: For example, market participants may provide personal information in securities issuance and listing application documents and disclosure documents, including personal information of directors, supervisors, senior management, core technical personnel, shareholders, actual controllers, and their concerted parties, among others.

2.2 From intermediaries: For example, investors participating in securities trading activities on the Exchange, for the purpose of entering into securities trading or transfer contracts, may submit personal information through intermediaries, such as members of the Exchange.

2.3 As required by the Exchange: For example, in the course of securities issuance and listing reviews, trading surveillance, disciplinary actions, supervisory measures or performance of other self-regulatory responsibilities, the Exchange may require entities subject to its self-regulation to provide personal information directly or through intermediaries in accordance with applicable rules.

2.4 Through business activities: For example, personal information generated when market participants use the Exchange’s website(s), mobile app(s), investor education, training services, or other services.

2.5 From third-party institutions: For example, the Exchange may require its members to provide client-related personal information in accordance with business rules, or obtain personal information of market participants through third-party institutions with which it has business cooperation.

III. How we use your personal information

3.1 The personal information of market participants collected by the Exchange is used for the purposes listed in Section I of this Notice, as well as for other uses prescribed by laws, regulations and business rules.

3.2 In accordance with law, regulations and business rules, the Exchange is generally required to provide personal information of market participants to relevant organizations under the following circumstances:

3.2.1 to securities regulatory authorities, self-regulatory organizations in the securities market, investor protection institutions, among others;

3.2.2 to organizations engaged in securities businesses, such as securities trading venues, securities registration and clearing institutions, and securities companies (including overseas entities engaged in cross-border connectivity businesses);

3.2.3 to competent administrative, judicial, supervisory, audit and other authorities or their designated organizations;

3.2.4 other circumstances as stipulated by laws, regulations and business rules.

3.3 According to relevant laws, regulations and business rules, in the course of routine supervision, disciplinary actions, supervisory measures and other self-regulatory activities, the Exchange may publicly disclose certain information concerning the regulated parties, as specified in the business rules.

3.4 In accordance with Securities Law of the People’s Republic of China, the Exchange is legally required to keep investors’ information confidential and must not illegally sell, provide, or disclose such information. Therefore, except for the circumstances described in Item 2 of this Section—where information is provided to competent authorities and organizations in accordance with laws, regulations and business rules—the Exchange does not disclose investor information to any other organizations or individuals.

3.5 In accordance with laws, regulations and business rules, the Exchange may, within a reasonable scope, process personal information that has been voluntarily self-disclosed or otherwise lawfully made public.

IV. How we protect your personal information

4.1 The Exchange has established a dedicated management system to ensure the security of market participants’ personal information.

4.2 In accordance with laws and regulations, the Exchange takes technical measures and other measures necessary to ensure the security of personal information of market participants.

4.3 Due to technical limitations and possible malicious acts, security issues may arise due to factors beyond the control of the Exchange. When a personal information security incident occurs, the Exchange will inform relevant parties through such appropriate means as issuing announcements or notifying via its members in accordance with laws, regulations and business rules.

4.4 The personal information of market participants collected by the Exchange will be stored within the Mainland of the People's Republic of China, except for outbound transfer of data as prescribed by laws, regulations and business rules.

4.5 Retention period. The Exchange retains the personal information of market participants for a period of twenty years. Where there are other provisions in laws and regulations, such provisions shall prevail. After the expiration of the retention period, if further retention is deemed not necessary upon assessment, the data will be deleted.

4.6 You have the right to access and copy your personal information provided to the Exchange by securities issuers, securities companies, securities service providers and other entities through the channels where your personal information is collected and provided. If you find that your personal information is inaccurate or incomplete, you have the right to request correction or supplementation.

V. Contact us

The Exchange designates staff in charge of personal information protection. If you have any questions, comments or suggestions, please feel free to contact us at pip@sse.com.cn.

Contact address: No. 388, South Yanggao Road, Pudong District, Shanghai

Tel: 021-68808888

Postal Code: 200127

Website: www.sse.com.cn