Vernex AI Data Security & Compliance Statement

We process data in accordance with applicable laws and regulations, including the Cybersecurity Law of the People’s Republic of China, the Data Security Law of the People’s Republic of China, the Personal Information Protection Law of the People’s Republic of China, and the Regulations on Network Data Security Management, following the principles of lawfulness, fairness, necessity, good faith, and minimum scope.

We process data only to the extent necessary to provide agreed services and fulfill contractual and statutory obligations, and do not expand the purpose, scope, or duration of processing without authorization. For data entrusted to us by customers, we process it in accordance with our contracts and the customers’ lawful instructions, and fulfill the corresponding security protection obligations.

Where consent, separate consent, or a specific assessment is required by law, we will follow the applicable procedures. This statement does not replace necessary notices and authorizations, nor do we treat reading it or using our services as blanket consent to all data processing activities.

The lawful rights and interests of customers and other relevant rights holders in business data and deliverables do not automatically transfer as a result of using the platform. Specific ownership and permitted uses are subject to applicable law and the agreements between the parties.

We do not sell customers’ business data or personal information, disclose non-public data, trade secrets, or confidential materials without authorization, or use them for unrelated marketing or unauthorized case studies. For data publication, sharing, or other uses, we will verify the lawful basis and follow the necessary procedures.

Without the customer’s separate, explicit authorization, we do not use non-public customer data, annotation deliverables, or information that identifies individuals for general-purpose model training or fine-tuning, or to provide other customers with data services independent of the project. Using AI to perform agreed tasks does not confer authorization for model training.

We implement appropriate technical and organizational measures based on data sensitivity, processing risks, and the service deployment model:

• Access control: Manage permissions by role, team, and task scope, restricting unauthorized access, downloads, exports, and modifications.
• Security protection: Protect accounts, passwords, and service credentials, and configure transmission, storage, network, and backup safeguards in accordance with the deployment plan.
• Personnel confidentiality: Limit access to data by internal personnel and entrusted service providers to what is necessary for their duties, and implement corresponding confidentiality responsibilities.
• Audit and traceability: Retain necessary security and operational records to support incident investigation and accountability, while avoiding the recording of sensitive content unrelated to the processing purpose.
• Ongoing management: Conduct security risk inspections, remediate vulnerabilities, respond to incidents, and continuously improve data security management.

The specific scope of encryption, backup policies, recovery objectives, and responsibilities for private deployments are subject to the relevant service descriptions and contractual terms.

We process only personal information that is relevant and necessary for the service purpose, and protect individuals’ rights under the law to be informed, make decisions, access, copy, correct, supplement, and delete their information, withdraw consent, and close their accounts.

When sensitive personal information or the personal information of minors under fourteen is involved, we will implement stricter safeguards as required by law and fulfill the necessary obligations concerning notice, separate consent, guardian consent, and assessments. Where automated decisions significantly affect individuals’ rights and interests, we will provide channels for explanation, objection, and human review as required by law.

For data entrusted to us by customers, we will assist in responding to lawful requests from relevant individuals in accordance with our respective responsibilities. Customers must also ensure lawful data sources and fulfill the notice, authorization, and other obligations imposed on them by law.

Where it is necessary to entrust a third party with data processing, we will assess its security capabilities, specify processing purposes, scope, duration, confidentiality, security, and deletion obligations by agreement, and exercise necessary supervision. External AI services are subject to the same management requirements.

When providing information to other personal information processors, disclosing it publicly, or transferring data overseas, we will fulfill applicable legal procedures concerning notice, consent, assessments, and other requirements. Where data is provided to fulfill statutory obligations or a lawful request from a competent authority, we will verify the lawfulness of the request and limit disclosure to what is necessary.

We determine data retention periods according to service purposes, contractual terms, and legal requirements, and do not retain information identifying individuals indefinitely. Actual storage locations, specific retention rules, and third-party processing arrangements are specified through applicable privacy policies, specific notices, or contracts.

When services end, an agreed retention period expires, or the legal conditions for deletion are met, we will return, delete, or anonymize the relevant data in accordance with our agreements and the law. Data that must continue to be retained by law or is temporarily difficult to delete for technical reasons will be restricted to storage and necessary security protection, and deleted when conditions permit. Backup data will be cleared in accordance with its applicable lifecycle.

If a security incident involving data leakage, alteration, loss, or similar risks occurs or may occur, we will promptly take steps to contain its impact, investigate the cause, and remediate the issue, and fulfill reporting, notification, and remedial obligations as required by law. Where customer-entrusted data is involved, we will promptly notify the relevant customers and provide necessary assistance.

For questions about data security, personal information rights, or compliance, please contact us using the details below. We will carry out necessary verification and respond within the period required by applicable law. If we cannot fulfill a request, we will explain the reasons and the available complaint channels.

We will update this statement as appropriate in response to applicable laws and actual data processing practices, and publish updates through appropriate means. Where renewed notice or consent is required by law, we will follow the corresponding procedures.