PRIVACY POLICY

A. GENERAL PROVISIONS

The data controller within the meaning of the data protection laws, in particular the EU General Data Protection Regulation (GDPR), is

JA Solar Technology Co., Ltd.

No.123 Xinxing Street Ningjin, Xingtai City, Hebei Province, China
Telephone: +86 10 6361 1888
Fax: + 86 10 6361 1999
E-mail: jacompliance@jasolar.com
The data controller has, in accordance with Art. 27 GDPR, appointed the following representative:

JA Solar GmbH

Lyonel-Feininger-Str. 28
80807 Munich
Telephone: +49 89 327 2989 141
Fax: +49 89 327 2989 299
E-mail: info@jasolar.eu

JA Solar GmbH has appointed a data protection officer:

The data protection officer of JA Solar GmbH
c/o activeMind AG
Potsdamer Str. 3
80802 Munich, Germany
Telephone: +49 89 919294-900
E-mail: jasolar@activemind.de

1. Your rights as a data subject

You can exercise the following rights at any time using the contact details provided:

information about your data stored by us and its processing (Art. 15 GDPR),
rectification of inaccurate personal data (Art. 16 GDPR),
deletion of your data stored by us (Art. 17 GDPR),
restriction of data processing if we are not yet permitted to erase your data due to legal obligations (Art. 18 GDPR),
objection to the processing of your data by us (Art. 21 GDPR) and
data portability, provided that you have consented to the data processing or have concluded a contract with us (Art. 20 GDPR).

If you have given us your consent, you can revoke it at any time with effect for the future.

You can lodge a complaint with a supervisory authority at any time, e.g. with the competent supervisory authority in your federal state of residence or with the authority responsible for us as the controller.

A list of the competent European supervisory authorities (for the non-public sector) with addresses can be found under the following link from the European Data Protection Board (EDPB): Members | European Data Protection Board.

2. Right to object pursuant to Art. 21 GDPR

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(f) GDPR (processing for the purposes of legitimate interests); this also applies to profiling based on this provision within the meaning of Art. 4(4) GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves the establishment, exercise or defence of legal claims. Please direct your objection to the following recipient:

JA Solar Technology Co., Ltd.

No. 123 Xinxing Street Ningjin, Xingtai City, Hebei Province, China
Telephone: +86 10 6361 1888
Fax: + 86 10 6361 1999
E-mail: jacompliance@jasolar.com

3. Changes to our privacy policy

We reserve the right to adapt this Privacy Policy so that it always complies with current legal requirements or to implement changes to our services in the Privacy Policy, e.g. when introducing new services. The new data protection provisions will then apply to your next visit.

4. Questions for the data protection officer

If you have any questions about data protection, please send us an e-mail or contact the person responsible for data protection in our organisation or the data protection officer of JA Solar GmbH directly:

Data Protection Officer of JA Solar GmbH
c/o activeMind AG
Potsdamer Str. 3
80802 Munich, Germany
Telephone: +49 89 919294-900
E-mail: jasolar@activemind.de

B. DATA PROCESSING IN CONNECTION WITH OUR WEBSITE

1. Server log files

1.1 Nature and purpose of the processing:

When you access our website, i.e. if you do not register or otherwise transmit information, information of a general nature is automatically collected. This information (server log files) includes, for example, the type of web browser, the operating system used, the domain name of your internet service provider, your IP address and similar. In particular, this information is processed for the following purposes:

ensuring a smooth connection of the website,
ensuring the problem-free use of our website,
assessment of system security and stability, and
optimisation of our website.

We do not use your data to draw conclusions about your person. Information of this kind may be anonymised and statistically evaluated in order to optimise our website and the technology behind it.

1.2 Legal basis and legitimate interest:

The processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website.

1.3 Recipients:

Recipients of the data may be technical service providers who act as processors for the operation and maintenance of our website.

1.4 Storage period:

The data will be deleted as soon as it is no longer required for the purpose for which it was collected. For data used to provide the website, this is usually the case when the respective session has ended.

1.5 Mandatory or required provision:

The provision of the aforementioned personal data is neither legally nor contractually required. Without the IP address, however, the service and functionality of our website cannot be guaranteed. In addition, individual services may be unavailable or restricted. For this reason, an objection is excluded.

1.6 Objections

Please read the information on your right to object in accordance with Art. 21 GDPR.

2. Contact form

2.1 Nature and purpose of the processing:

The data you enter will be stored for the purpose of personalised communication with you. For this purpose, a valid e-mail address and your name are required. This serves to allocate the enquiry and subsequently answer it. The specification of further data is optional.

2.2 Legal basis:

The data entered in the contact form is processed on the basis of a legitimate interest (Art. 6(1)(f) GDPR).

We would like to make it easy for you to contact us by providing the contact form. The information you provide will be stored for the purpose of processing your enquiry and for possible follow-up questions. If you contact us to receive a quote, the data entered in the contact form will be processed to carry out pre-contractual measures (Art. 6(1)(b) GDPR).

2.3 Recipients:

Recipients of the data are, if applicable, our processors.

2.4 Storage period:

The data will be deleted no later than 6 months after the enquiry has been processed.

If a contractual relationship is established, we are subject to the statutory retention periods and delete your data after these periods have expired.

2.5 Mandatory or required provision:

The provision of your personal data is voluntary. However, we can only respond to your enquiry if you provide us with your name, e-mail address and the reason for the enquiry.

2.6 Objections

Please read the information on your right to object in accordance with Art. 21 GDPR.

3.Cookies

Like many other websites, we also use so-called “cookies”. Cookies are small text files that are stored on your device (laptop, tablet, smartphone or similar) when you visit our website.

You can delete individual cookies or the entire cookie inventory. You will also receive information and instructions on how to delete these cookies or block their storage in advance. Depending on your browser provider, you will find the necessary information under the following links:

Mozilla Firefox: Delete cookies and website data in Firefox
Internet Explorer: Deleting and managing cookies
Google Chrome: Activate or deactivate cookies
Opera: Security and privacy
Safari: Deleting cookies in Safari on the Mac

If you allow us to use cookies through your browser settings or consent, the following cookies may be used on our websites:

(1) HMF_CI: This is used to generate a client ID to uniquely identify the client. The generated value is saved in HMF_CI and sent to the client. The client then requests access with the cookie and the BOT can analyse the CI value and assign it to the client;

(2) HOY_TR and HBB_HC: The BOT issues two cookies during the human check, HBB_HC and HOY_TR. HBB_HC is used to store the verification memory, which is stored in the browser until the verification expires, and HOY_TR is used for information interaction during the verification process and disappears after the verification is complete.

(3) PHPSESSID: This is a verification code store used at product.jasolar.com (this is the link in the top right corner of our official website called “Module Authenticity”). This cookie is used to check whether the confirmation code entered by the front-end user is correct. It only saves the code used at that time and is not used to obtain user information.

3.1 Nature and purpose of the processing

We use cookies to improve the user-friendliness of our website. Certain components of our website require the ability to identify the requesting browser even after a page change.

The use of technically necessary cookies is intended to simplify the use of the website for users. Certain functions of our website cannot be provided without the use of cookies. It is essential that the browser is recognised even after a page change.

We need cookies for the following applications:

Retention of language settings
Saving search terms

3.2 Legal basis and legitimate interest

The processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in a user-friendly design of our website.

3.3 Recipients

Recipients of the data may be technical service providers who act as processors for the operation and maintenance of our website.

3.4 Mandatory or required provision

The provision of the aforementioned personal data is neither legally nor contractually required. Without this data, however, the service and functionality of our website cannot be guaranteed. In addition, individual services and offers may not be available or may be restricted.

3.5 Objections

Please read the information on your right to object in accordance with Art. 21 GDPR.

C. DATA PROCESSING OUTSIDE OUR WEBSITE: CORRESPONDENCE WITH JA SOLAR

1. Information according to Art. 13 and 21 of the General Data Protection Regulation (GDPR)

With the following information, we would like to give you an overview of how your personal data is processed by us and what rights you are entitled to under data protection law. Which specific data is processed and how it is used depends largely on the services requested or agreed. Therefore, not all sections of this information apply to you.

2. Responsible parties

Jointly responsible parties for the processing:

JA Solar Technology Co., Ltd.

No. 123 Xinxing Street Ningjin, Xingtai City, Hebei Province, China
Telephone: +86 10 6361 1888
Fax: + 86 10 6361 1999
E-mail: jacompliance@jasolar.com

and

JA Solar GmbH

Lyonel-Feininger-Str. 28
80807 Munich, Germany
Telephone: +49 89 327 2989 141
Fax: +49 89 327 2989 299
E-mail: info@jasolar.eu

The joint responsibility is governed by an agreement between the companies. The companies use the same database solution for their activities and access a common data set when required. Both companies are hereby independently responsible for the lawful processing of personal data and for ensuring the rights of data subjects, including the provision of mandatory information. If necessary, the companies support each other in this process.

You can contact the data protection officer of JA Solar GmbH using the contact information provided above.

3. We process your data for the following purposes and on the following legal basis:

We process personal data in accordance with the provisions of the GDPR and the German Federal Data Protection Act (BDSG) for the following purposes and on the following legal basis:

3.1 For the fulfilment of contractual obligations (Art. 6(1)(b) GDPR)

The processing is necessary for the fulfilment of a contract with you. This also includes the processing of warranty claims, which represent a contractual service.

The same applies to those processing operations that are necessary to carry out pre-contractual measures, such as enquiries about our services.

3.2 Due to legal requirements (Art. 6(1)(c) GDPR)

We are subject to various legal obligations that lead to data processing. These include, for example, tax laws and the respective statutory accounting, responding to enquiries and fulfilling the requirements of supervisory or law enforcement authorities as well as complying with tax audits and reporting obligations.

In addition, the disclosure of personal data may be necessary in the context of official/judicial measures for the purposes of gathering evidence, criminal prosecution or the enforcement of civil law claims.

3.3 In the context of a balancing of interests (Art. 6(1)(f) GDPR)

If necessary, we process your data beyond the actual contractual fulfilment to protect our legitimate interests or the interests of third parties. Examples of such cases are:

if you contact us by e-mail or telephone, the data you enter will be stored for the purpose of personalised communication with you,
enforcement of legal claims and defence in legal disputes and
storage of additional contacts in the CRM system for communication.

4. Who receives your data?

In our company, employees receive your data for contacting you and for contractual cooperation (including the implementation of pre-contractual measures).

Your data will only be passed on to service providers (processors) if this is necessary to fulfil our contractual obligations (e.g. support/IT maintenance/IT applications, accounting, data erasure). All service providers are obliged to treat your data confidentially in accordance with a data processing contract.

With regard to the transfer of data to recipients outside our company, we would like to point out that we only pass on the necessary personal data in compliance with the applicable data protection regulations.

Under these conditions, recipients of personal data may be

public bodies and institutions (e.g. tax authorities, law enforcement authorities) in the event of a legal or official obligation,
credit and financial services institutions (processing of payment transactions) and
tax consultants, auditors and income/corporate tax auditors (statutory audit mandate).

5. Is data transferred to a third country or an international organisation?

Your data will be transmitted to JA Solar Technology Co., Ltd. in China on the basis of standard contractual clauses.

6. How long will your data be stored?

We process and store your personal data for as long as this is necessary to fulfil our contractual and legal obligations. If the data is no longer required for the fulfilment of contractual or legal obligations, it is regularly deleted.

Exceptions to the above deletion criteria are:

Data required to fulfil statutory retention obligations, e.g. German Commercial Code and Fiscal Code. The respective prescribed retention or documentation periods are generally six to ten years.
Data to maintain evidence in accordance with the statutory limitation period. According to §§ 195 ff of the German Civil Code, these limitation periods can be up to 30 years, where the regular limitation period is three years.

If the data processing is in our legitimate interest or that of a third party, the personal data will be deleted as soon as this interest no longer exists. The above-mentioned exceptions also apply here.

7. What data protection rights do you have?

Every data subject has the right to information in pursuant to Art. 15 GDPR, right to rectification pursuant to Art. 16 GDPR, right to erasure pursuant to Art. 17 GDPR, right to restriction of processing pursuant to Art. 19 GDPR, right to object pursuant to Art. 21 GDPR and the right to data portability pursuant to Art. 20 GDPR.

The restrictions pursuant to Sections 34 and 35 BDSG apply to the right to information and the right to erasure.

In addition, you have the right to lodge a complaint with a competent data protection supervisory authority (Art. 77 GDPR). A list of the responsible European supervisory authorities (for the non-public sector) with addresses can be found under the following link from the European Data Protection Board (EDPB): Members | European Data Protection Board.

8. Am I obliged to provide data?

As part of the contractual relationship, you can provide the necessary personal data that is required for the commencement, execution and termination of the contractual relationship and for the fulfilment of the respective contractual obligations or that we are legally obliged to collect. Without this data, we will not be able to contact you, enter into a contract with you or perform the services described therein.

9. Information on your right to object pursuant to Art. 21(1) GDPR

9.1 Right to object in individual cases

You have the right to object to the processing of your personal data by us at any time for reasons arising from your particular situation, provided that the objection is made in accordance with Art. 6(1)(f) GDPR (data processing on the basis of a balancing of interests).

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or if the processing serves the establishment, exercise or defence of legal claims.

9.2 Recipient of the objection

The objection can be made without formal requirements with the subject “Objection”, your name, your address and your date of birth and should be sent to the following address:

JA Solar Technology Co., Ltd.

No.123 Xinxing Street Ningjin, Xingtai City, Hebei Province, China
Telephone: +86 10 6361 1888
Fax: + 86 10 6361 1999
E-mail: jacompliance@jasolar.com

JA Solar GmbH

Lyonel-Feininger-Str. 28
80807 Munich, Germany
Telephone: +49 89 327 2989 141
Fax: +49 89 327 2989 299
E-mail: info@jasolar.eu

D. DATA PROCESSING OUTSIDE OUR WEBSITE: SOCIAL MEDIA

JA Solar Technology Co., Ltd. is represented in various social networks. Information on the storage and use of your data as well as your rights and settings options for protecting your privacy can be found in the privacy policy of the respective social media provider:

1. Facebook and Instagram

JA Solar Technology Co., Ltd. is represented on the social networks Facebook and Instagram. These platforms are provided by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. We operate these Facebook/Instagram pages to inform users, interested parties and customers about our services.

We cannot rule out the possibility of a transfer to a third country, e.g. when calling up our company presence in these social networks, a transfer to servers based in the USA may occur. We would also like to point out that, as the operator of a Facebook/Instagram fan page, we are jointly responsible with Facebook for processing the personal data of page visitors (Art. 26 GDPR). We have concluded corresponding contracts with Facebook for this purpose.

Facebook recognises the joint responsibility for Insights data with page operators and assumes primary responsibility, see: Facebook.

If you have a Facebook/Instagram profile and are logged in, Facebook can, for example, analyse your usage behaviour and create a usage profile corresponding to your usage behaviour. This user data is regularly processed for market research and (personalised) advertising purposes.

The processing of the data is based on your consent in accordance with Art. 6(1)(a) GDPR.

If you wish to make requests for information or assert your user rights, it is possible to assert these rights against us or Facebook.

Further information on the collection and use of data as well as your rights and protection options can be found at Facebook - Meta Privacy Policy - What is the Privacy Policy and what it covers and Instagram - Meta Privacy Policy - What is the Privacy Policy and what it covers.

2. LinkedIn

JA Solar Technology Co., Ltd. maintains a corporate presence on LinkedIn. This takes place on a platform of LinkedIn Unlimited Company, Wilton Place, Dublin 2, Ireland.

We provide information on our website and offer users the opportunity to communicate. The company’s website is used for advertising and information/PR.

When you visit, follow or engage with our LinkedIn company page, LinkedIn processes personal data to provide us with anonymised statistics and insights. This gives us insights into the types of actions that visitors perform on our site (so-called Page Insights). In particular, LinkedIn processes data that you have already provided to LinkedIn via the information in your profile. In addition, LinkedIn processes information about how you interact with our LinkedIn company page, e.g. whether you are a follower of our LinkedIn company page. Personal data is not transmitted to us by LinkedIn. It is also not possible to draw conclusions about individual members from the Page Insights information.

This processing of personal data in the context of Page Insights is carried out by LinkedIn and us as joint controllers. We have entered into an agreement with LinkedIn as joint controllers, which sets out the allocation of data protection obligations between us and LinkedIn. The agreement is available at the following link: LinkedIn Pages Joint Controller Addendum.

Under this agreement, LinkedIn is responsible for responding to requests from data subjects. To do this, you can contact LinkedIn online or reach LinkedIn using the contact details in the privacy policy.

You can contact us to exercise your rights in connection with the processing of personal data in the context of Page Insights by contacting us via the contact form by selecting the request subject “Data protection”. In such a case, we will forward your enquiry to LinkedIn.

The processing of the data is based on your consent in accordance with Art. 6(1)(a) GDPR, which you provided to LinkedIn when you registered.

Further information on data processing by LinkedIn can be found in LinkedIn’s privacy policy.

We cannot rule out the possibility that data may be transferred to a third country, e.g. to servers based in the USA, when you visit our LinkedIn page. Your visit to our website can therefore be tracked by LinkedIn.

3. YouTube

JA Solar Technology Co., Ltd. is also represented on YouTube. YouTube is a service of Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).

We cannot rule out the possibility that data may be transferred to third countries, e.g. to servers in the USA, when our YouTube channel is accessed. Your visit to our website can therefore be tracked by YouTube.

By using YouTube, your personal data will be collected, transmitted, stored, disclosed and used by Google. Google analyses your user behaviour and creates a corresponding user profile, regardless of whether you have a Google account. This data can be used to customise content or advertising for you.

The processing of the data is based on your consent in accordance with Art. 6(1)(a) GDPR.

Further information on the collection and use of data as well as your rights and protection options can be found in the Guide to data protection in Google products and in the Privacy Policy - Privacy and Terms of Use - Google.

4. X (formerly Twitter)

We maintain a company profile on X.

This platform is operated by Twitter International Unlimited Company, an Irish company. We maintain this X company page to inform users or interested parties and customers about our company. We provide information via our X profile and offer users the opportunity to communicate with us.

You can download a copy of our contracts with X here and here. To assert these rights of the data subject, you can contact X online or contact X using the contact details provided in the privacy policy. You can also contact X’s data protection officer via the following link: Data protection.

In addition, you can contact us in this context to exercise your rights as a data subject. All you need to do is contact us via the contact form and select the subject “Data protection X” for your enquiry. In such a case, we will forward your enquiry to X.

As soon as you visit our X company profile, follow this page or interact with this page, X processes personal data. This allows X to provide us with insight and statistics in anonymised form, according to which we are informed about the types of actions that visitors take on our site (so-called Audience Insights). It is not possible for us to draw conclusions about individual members on the basis of the Page Insights information. On the one hand, X processes data that you have saved in your profile based on your own published information. In addition, X processes data in particular about how you interact with our X company page, e.g. whether you are a follower of our X company page.

The processing of your personal data is based on your consent in accordance with Art. 6(1)(a) GDPR, which you provided to X as part of your registration.

Further information on the processing of your data by X can be found in X’s privacy policy.

We cannot rule out the possibility that data may be transferred to third countries, e.g. to servers in the USA, when you visit our X company page.