Privacy Policy

CHINA WAYS LLC

Privacy Policy

This Privacy Policy (this “Policy”) is a part of the China Ways LLC (“China Ways”) Agreement between China Ways and the “Customer” who books a tour through this website or visits this website (together with the Service Agreement, Website Terms of Use Policy, and all other documents, addenda, schedules and exhibits incorporated therein, collectively, the “Agreement”)  governing Customer’s use of the travel booking and tour services provided by China Ways.

In the event of any conflict between the terms of the Agreement and this Policy, the relevant terms of this Policy will prevail. This Policy shall be effective for the duration of the Service Agreement.

1. Definitions. Capitalized terms used in this Policy will have the meanings set forth in this Section 1.  Other terms have the definitions provided for them in the Service Agreement or as otherwise specified below.
   “Authorized Employees” means China Ways’ employees who have a need to know or otherwise access Personal Information to enable China Ways to perform its obligations under the Service Agreement.
   “Authorized Persons” means (i) Authorized Employees; and (ii) China Ways’ contractors, agents and auditors who have a need to know or otherwise access Personal Information to enable China Ways to perform its obligations under the Service Agreement, and who are bound in writing by confidentiality obligations sufficient to protect Personal Information in accordance with the terms of this Policy.
   “Customer” means the Customer that has executed the Service Agreement.
   “Highly-Sensitive Personal Information” means (i) an individual’s government-issued identification number (including social security number, driver’s license number or state-issued identification number, or passport information); (ii) financial account number, credit card number, debit card number, credit report information; or (iii) biometric or health data.
   “Personal Information” means information provided to China Ways by or at the direction of Customer, or to which access was provided to China Ways by or at the direction of Customer, in the course of China Ways’ performance under the Service Agreement that: (i) identifies or can be used to identify an individual (including, without limitation, names, signatures, addresses, telephone numbers, e-mail addresses and other unique identifiers); or (ii) can be used to authenticate an individual (including without limitation, employee identification numbers, government-issued identification numbers, passwords and PINS, financial account numbers, credit report information, biometric or health data, answers to security questions and other personal identifiers), in cases of both sub-clauses (i) and (ii), including, without limitation, all Highly-Sensitive Personal Information.  Customer’s business contact information is not by itself deemed to be Personal Information.
   “Security Breach” means any act or omission that materially compromises either the security, confidentiality or integrity of Personal Information or the physical, technical, administrative or organizational safeguards put in place by China Ways or any Authorized Persons that relate to the protection of the security, confidentiality or integrity of Personal Information.
2. Standard of Care.
   • 2.1. China Ways acknowledges that, in the course of its engagement by Customer, China Ways may receive or have access to Personal Information. China Ways will comply with the terms and conditions set forth in this Policy in its collection, receipt, transmission, storage, disposal, use and disclosure of such Personal Information and be responsible for the unauthorized collection, receipt, transmission, access, storage, disposal, use and disclosure of Personal Information under its control or in its possession by all Authorized Employees.  China Ways shall be responsible for, and remain liable to, Customer for the actions and omissions of all Authorized Persons that are not Authorized Employees concerning the treatment of Personal Information as if they were China Ways’ own actions and omissions.
   • 2.2. In recognition of the foregoing, China Ways agrees and covenants that it will:
     1. keep and maintain all Personal Information in strict confidence, using such degree of care as is appropriate to avoid unauthorized access, use or disclosure;
     2. use and disclose Personal Information solely and exclusively for the purposes for which the Personal Information, or access to it, is provided pursuant to the terms and conditions of this Policy and the Service Agreement, and not use, sell, rent, transfer, distribute, or otherwise disclose or make available Personal Information for China Ways’ own purposes or for the benefit of anyone other than Customer, in each case, without Customer’s prior written consent or as otherwise permitted in the Service Agreement; and
     3. not, directly or indirectly, disclose Personal Information to any person other than its Authorized Persons, without express written consent from Customer. Notwithstanding the foregoing, contingent on receipt of written notice, China Ways may preserve or disclose all information that is or comes into China Ways’ possession or control, including Personal Information, if China Ways believes that it is reasonably necessary to comply with applicable law, regulation or a lawful order from a competent judicial, administrative or law enforcement authority with jurisdiction over China Ways or such information. U.S. law authorizes China Ways to respond to requests for user information from foreign law enforcement agencies that are issued via U.S. court either by way of a mutual legal assistance treaty or a letter rogatory. It is China Ways’ policy to respond to such U.S. court ordered requests when properly served.
3. Information Security.
   • 3.1. China Ways represents and warrants that its collection, access, use, storage, disposal and disclosure of Personal Information does and will comply with all applicable federal and state privacy and data protection laws, as well as all other applicable regulations and directives, provided that Customer specifically acknowledges and agrees that China Ways is not acting on your behalf as a Business Associate or subcontractor (as such terms are used, defined, or described in the Health Insurance Portability and Accountability Act of 1996, as amended and supplemented (“HIPAA”).
   •  3.2. Without limiting China Ways’ obligations under Section 3.1, China Ways will implement commercially reasonable administrative, physical and technical safeguards to protect Personal Information that are consistent with accepted industry practices, including:
     1. Taking measures to prevent physical access, such as security systems for securing the premises.
     2. System access controls, which may include authentication via passwords and/or two-factor authentication, documented authorization processes, documented change      management processes, logging of access/log-ins, and firewall protections.
     3. Data access controls, to ensure that Personal Information cannot be read, copied, modified or removed without authorization.
     4. Except as otherwise specified in the Service Agreement, transfers of data outside our website are not encrypted. The content of communications (including sender and recipient addresses) sent through some email or messaging services may not be encrypted once received through such services. Customer is solely responsible for the results of its decision to use non-encrypted communications or transmissions.
   • 3.3. At a minimum, China Ways’ safeguards for the protection of Personal Information will include:  (i) limiting access of Personal Information to Authorized Employees and Authorized Persons; (ii) securing business facilities, data centers, paper files, servers, back-up systems and computing equipment, including but not limited to, all mobile devices and other equipment with information storage capability; (iii) implementing network, device application, database and platform security; (iv) securing information transmission, storage and disposal; (v) implementing authentication and access controls within media, applications, operating systems and equipment; (vi) encrypting Highly-Sensitive Personal Information stored on any mobile media; (vii) encrypting Highly-Sensitive Personal Information transmitted over public or wireless networks; (viii) strictly segregating Personal Information from information of China Ways or its other customers so that Personal Information is not commingled with any other types of information; (ix) implementing appropriate personnel security and integrity procedures and practices, including, but not limited to, conducting background checks consistent with applicable law; and (x) providing appropriate privacy and information security training to China Ways’ employees.
4. Security Breach Procedures. China Ways will inform Customer within three (3) business days if China Ways determines that Personal Information has been subject to a Security Breach.  Notification shall be made by telephone or email to China Ways’ primary business contact within Customer.  China Ways will promptly investigate any Security Breach and take reasonable measures to identify its root cause(s) and prevent a recurrence. As information is collected or otherwise becomes available, China Ways will provide Customer with a description of the Security Breach, the type of data that was the subject of the Security Breach, and other information Customer may reasonably request concerning the affected persons. China Ways will coordinate in good faith with Customer to develop the content of any related public statements or any required notices for the affected persons.
5. Audit.  Upon Customer’s written request, which is supported by reasonable documentation of Customer’s belief that China Ways’ systems are not in compliance with this Policy, Customer or its designated representative will have the right to examine and audit China Ways’ computer systems, facilities, networks, records and security systems to verify China Ways’ compliance with the terms of this Policy, at Customer’s sole expense. All such information learned or disclosed relating to China Ways’ business that is not generally known to the public shall be deemed the Confidential Information of China Ways.
6. Cookies. Cookies are small data text files and can be stored on your computer’s hard drive. Most browsers will tell you how to prevent your browser from accepting new cookies and how to disable cookies altogether. Please note that if you refuse to accept cookies, you may not be able to access many of the travel tools offered on our sites.We use cookies for the following purposes:
   1. To recognize your browser as a previous visitor and remember any preferences you may have set while visiting our site. For example, we may record your password in a cookie. Please note that passwords and any other account-related data included in such cookies are encrypted. Unless you book a trip with us, these cookies will not contain any personal information.
   2. To measure and research the effectiveness of website features, email communications, and advertisements.
   3. To customize the content and advertisements provided to you on our website and on other Internet sites. When you access our website, a cookie is automatically set to recognize your browser as you browse the Internet and to present you with advertising based on your apparent interests.
7. Choice of Law.  This Policy shall be subject to and governed by the laws of the state of Oregon. Any dispute, controversy, or claim arising out of or in connection with or relating to this Policy or any breach or alleged breach hereof, will, upon the request of any party involved, be submitted to, and settled by, arbitration in Beaverton, Oregon, pursuant to the American Arbitration Association rules of arbitration.  Any award rendered shall be final and conclusive upon the parties and a judgment thereon may be entered in the highest court of the forum, state, or federal, having jurisdiction. In the event that neither party requests Arbitration, each customer hereby consents to the exclusive jurisdiction of Washington County, Oregon, Circuit Court in any action on a claim arising hereunder.