1. For providing you with more convenient services and a better service experience on our platform, we may collect and use your personal information in the following additional functions. You may have no access to additional functions that might otherwise be available to you or you may need to fill some information repeatedly when purchasing certain items if you do not provide such information.  you still have access to basic service functions. Said additional functions include:

(1) Personalized recommendations based on location information: we collect your location information to determine where you are for recommending services reachable in your area (we only collect the geological location where you are and will not use it to determine your whereabouts). For example, we recommend the restaurant that is closest to you, and show you its menu, participating in check-in and other interactive activities based on your location.

(2) Additional functions based on camera:  function can provide you with scanning, sending photos, videos and other related services to online customer service.

The above permissions will not be enabled by default. Only after your express authorization, opening the corresponding permissions to us in your device (see "permission acquisition instructions" for details), can we use and collect the information involved in the function in order to realize a specific function or service. You can also withdraw the authorization at any time. It should be noted that even with your authorization, we will not collect your information when relevant functions or services are not needed.

2. In order to improve your experience of using our network platform and reduce the disturbance caused to you by irrelevant information, we will extract your preference characteristics based on the service log information when you visit or use our network platform and the device information, and recommend you the goods, services or other information that you may be interested in. Unless the third-party obtains your consent or authorization, we will not directly obtain your personal information from the third- party to make personalized recommendations to you.

If you do not want us to show personalized recommendation content for you, you can set it through Sherpa’s APP [my-Settings-Security privacy-personalized recommendation management].

After turning off the personalized recommendation function, the information you received will not be reduced, but the relevance will be reduced. Furthermore, the information we collected will not be used to recommend personalized content to you.In order to facilitate your control, your operation will take effect on our network platforms (including APP, mini app, official account and website and application)in 72 hours.

(III) Under any of the following circumstances, we may collect and use your personal information in accordance with applicable laws and regulations and national standards without your consent:

1. it relates to national security and national defense security;

2. It relates to public safety, public health, and significant public interests;

3. It relates to criminal investigations, prosecutions, trials and enforcement of judgment;

4. It is for protecting the life, property and other substantial legitimate interest of the owner of personal information or other individuals but is difficult to obtain his/her consent;

5. The personal information collected is disclosed by the owner of personal information to the public;

6. Your personal information collected from information disclosed to the public, such as legitimate news reports, government information disclosure and other channels;

7. It is necessary to execute and perform the contract as required by you;

8. It is necessary to maintain safe and stable operation of the products and/or services provided, such as identifying and eliminating any failure of products and/or services, cracking down on illegal industries, investigating and dealing with illegal transactions and other relevant situations;

9. Other circumstances set out in applicable laws and regulations.

(IV) Other information

If you choose to use any other service we provide, and if we need to collect your information based on the service, we will inform you about the scope and purpose of collection, and ask for your consent. We will use, store, provide and protect your information in accordance with this Policy and relevant user agreement. If you choose not to provide the above information, you may not have access to a certain service or any part thereof, but you still can use other services we offer.

1. Description about obtaining device permissions

In order to ensure that you can normally use various services provided by us, we will apply to the system for your following device permissions. Before applying, we will ask for your consent and you can choose "Allow" or "forbid" permission application. After your authorization, we will open relevant permissions, and you can cancel the authorization in the system at any time. In different devices, the display and closing methods of permissions may be different. For details, please refer to the device and system developer's instructions or guidelines.

Please note that by enabling these permissions, you authorize us to collect and use this personal information for specific functions. If you close the permission, it means that you have cancelled the authorization, and we will no longer collect and use your personal information, nor will we be able to provide you with the functions corresponding to these authorization. Your decision to turn off your permission will not affect the processing of your personal information based on your authorization.

(1) The obtaining of system permissions for various service functions of APP is as follows:

Storage: When you install the APP, we may ask you to obtain this permission for the purpose of saving pictures, files or caching information to your device.

Device Information: may apply for your permission for the purpose of security risk control and need to read your device information. If you choose not to enable this permission, you may use other services provided by us, but you may not be able to complete security risk verification.

Phone status: We may apply for your permission for the purpose of security risk control and need to read your equipment identification information, equipment status information and environment information. If you choose not to open this permission, you may use other services provided by us, but you may not be able to complete security risk verification.

Information: you use verification code to log in to our network platform or other scenarios that require security risk verification, we may ask you to obtain this permission for the purpose of sending the login verification code. If you choose not to open this permission, you may not be able to complete security risk verification.

Location: searching restaurants, location-based service display, check-in and interactive activities. If you choose not to enable this permission, you will not receive location-based services or participate in location-based activities, but it does not affect your use of other services provided by us.

Camera and album: scanning and sending photos or videos to online customer service. If you do not open the corresponding permissions, you will not use this special function, but it does not affect your use of other services provided by us.

Microphone: you select to send voice when using the online customer service function, you need to enable the microphone right. If you do not enable the corresponding permissions, you will not be able to use this special function, but it does not affect your use of other services provided by us.

Note: Due to some device manufacturer Settings and some Android version restrictions, the system assigns the APP the permission to read the user's APP list by default. But it is important to note that we do not collect or use this information. You can choose to turn off authorization on your device. The permission display and closing modes may vary with devices. For details, please refer to the device and system developer's instructions or guidelines.

(2) Access to system permissions of various service functions of mini app is as follows:

Device information and User identification Information: When you start the mini app, we may apply for your permission for the purpose of security risk control. If you choose not to enable this permission, you can use other services provided by us, but you may not be able to complete security risk verification.

Location: For searching restaurants, location-based service display, check-in and interactive activities. If you choose not to enable this permission, you will not receive location-based services or participate in location-based activities, but it does not affect your use of other services provided by us.

Camera and album: you need to use the scanning and recognizing QR code in pictures and related functions, you need to enable the camera and album permissions. If you do not enable the corresponding permissions, you will not be able to use this special function, but it does not affect your use of other services provided by us.

Note: Due to the differences between the platform system and the services we provided, we have slightly different permissions and notification methods in each mini app. For details, please refer to the page tips of this platform. The mode for displaying and disabling permissions may vary with devices. For details, please see the device and system developer's instructions or guidelines.

Description of third-party SDK

To ensure the realization of relevant functions and the safe and stable operation of the application, we may access the software development kit (SDK) provided by a third-party to realize relevant functions or services and share the third-party with the information necessary to realize such functions or services. The collection and processing of information and other actions of such third-party shall be subject to their own privacy provisions and shall not apply to this Policy. To maximize your information security, we recommend that you check the privacy policy of any third -party SDK service before using it. In order to protect your legitimate rights, if you find any risks in this SDK or other similar applications, you are advised to terminate relevant operations immediately and contact us in time. At the same time, we will strictly monitor the SDK from which the third-party obtains information to protect information’s security.

Please click the link below to learn about the third-party SDK we accessed (the third-party SDK may have some changes in data processing types due to version upgrade, policy adjustment and other reasons, please refer to the official instructions) :

Access the third-party SDK directory

•  How do we use technologies like Cookie?

1. For making your access easier, we may identify you with small data files during your access to services on our Online Platforms for saving you from entering registration information or helping determine whether your account is secure. Said data files may be Cookie, Flash Cookie, or other local storage provided by your browser or associated applications (“Cookie”). Please understand that some of our services cannot be delivered without using Cookie. We will not use Cookie for any purpose other than those stated in this Policy. You may modify the acceptance of Cookie or reject our Cookies so far as your browser or its add-ons permit. Most browsers tell you how to prevent your browser from accepting new Cookie or completely turning off Cookie in the Help section of toolbar. Moreover, you can change settings of browser add-ons or visit provider’s webpage to turn off or delete similar data used by browser add-ons.

2. Our platforms can also contain some electronic images (“Network Beacon”). Using Network Beacon helps the website count users visiting the web or access certain Cookie. We will collect information about your web browsing through Network Beacon, such as url you visited, location of the reference page you visited earlier, your browsing environment, and display settings.

· How do we use your personal information?

1. We will use collected personal information as stated in this Policy and for enabling our products and/or services for the purpose of providing you with more accurate, smooth and convenient services, or helping us evaluate, improve or design services and operations;

2. In order to show you quality or suitable services, we may provide you with marketing campaign notices, commercial electronic messages or advertisements. If you do not want to receive such information, you can choose to unsubscribe as instructed by us.

3. We will desensitize, de-identify or otherwise process your personal information after collection. Please understand and agree that in this case we can use the de-identified information, and analyze and use the user database for commercial purpose without revealing your personal information.

4. We may associate the information collected from your various devices and network platforms so that we can provide consistent services to you on these devices and platforms.

5. We will count the usage of our products and/or services and may share the de-identifying or anonymizing statistics with third parties to demonstrate the overall usage trends of our products and/or services. The statistics contain none of your identification information.

6. We invite you to participate in research on our products and services.

7. When displaying your personal information, we will desensitize it with methods including content replacement and anonymity to protect your information.

8. Please note that you authorize us to use all of your personal information provided in using our products and/or services as long as you use our products and/or services, unless you remove or refuse to let us collect the same by system settings. When you cancel your account, we will cease to use your personal information and delete or anonymize the same.

9. If we intend to use your personal information for other purposes not covered by this Policy, or use information collected for a specific purpose for a different purpose, we will try to obtain your consent in the form of confirmation agreement, copywriting confirmation action in a specific scene or any other form whatsoever in accordance with applicable laws, regulations and national mandatory standards.

· How do we store your personal information?

1. Storing your personal information is to serve the purposes for collecting, using, and sharing such information as set out in this Policy, and enable you to excise the rights to control and know.

2. We will retain your personal information for a period of time explicitly stipulated in laws governing us. If there are no explicit statutory provisions, we will retain your personal information until: (1) we accomplish all of the purposes for collecting, using, and sharing your personal information; (2) you terminate the use of our products or services; or (3) you explicitly require us to delete your personal information. When the retention period expires, we will delete, anonymize or otherwise dispose your personal information according to applicable legal provisions.

3. We only store your personal information within the territory of the People's Republic of China. Subject to applicable law, we may store your personal information outside the above mentioned territory in some special cases (e.g. disaster recovery and backup, improving user’s connection experience). If we send information abroad, we will follow relevant national regulations or seek your consent.

4. In transmitting your personal information to another territory, we ensure that the information will still be controlled by Sherpa’s and its protection will not be lessened under local laws. We will also take all necessary actions to protect your personal information. If it is specifically stated in applicable law, we will assess the security of cross-border data transmission on a regular basis and determine whether to continue transmitting your personal information across borders based on assessment result.

· How do we protect your personal information?

1. We will take all reasonable and necessary actions to protect your information after collection.

2. We are committed to using a variety of security technologies and supporting management systems, such as secure transmission through Secure Sockets Layer (SSL), encrypted storage, and strict control over access to data centers to minimize the risk of leakage, damage, misuse, unauthorized access or disclosure, or modification of your information. We will take steps, such as encryption, access control, and de-identification to transmit and store sensitive personal information (including biometric information).

3. We have an Information Security Department that ensures the compliance of the collection, use, sharing, and processing of personal information with applicable laws and regulations. We also introduce appropriate technical measures and organization framework, including encryption, hierarchy and authority management to protect your personal information. Moreover, we carry out training and audit activities regularly to have dedicated, qualified positions and personnel protect your personal information.

4. In addition to an information security incident response plan in place, we organize regular emergency response trainings and drills of internal personnel to help them familiarize job responsibilities and emergency response strategy and procedure. In the event of a security incident that may affect the security of your personal information, we will promptly notify you the basic information and possible impact of the incident, the action we have taken or will take, suggestions for self-prevention and risk mitigation action that can be taken by you, and remedies for you in accordance with applicable laws, regulations and government regulatory requirements. We will inform you about the incident immediately by means of push notification, email or SMS. If it is impossible to notify owners of information individually, we will issue a notice in a reasonable and effective manner. We will proactively report how we deal with the information security incident as required by regulators with the provisions of laws and regulations.

5. Please keep your account login name and other identity elements in a safe place. When you use our Online Platforms services, we will identify you by your login name and other identity elements. In case the above information is divulged, you may suffer losses and adverse legal consequences. If you find your login name and/or other identity elements might be or have been divulged, please contact us immediately so that we can take appropriate measures to avoid or minimize losses.

6. Unless otherwise required by applicable laws and regulations or regulators, we will stop collecting and using your information after your termination of our service. If the case of ceasing to provide services and carry out business activities, we will give you a notice at least 30 days in advance and delete or anonymize your personal information after termination.

7. Important Note

As a challenge that might face all businesses, your personal information could leak out in special cases (e.g. hacking, telecommunications failure) because of the characteristics of information technology and cyberspace, despite all the necessary actions we have taken according to applicable laws and regulations. Unless otherwise provided in this Policy, we suggest you not to provide sensitive information relating to security of you or your property, such as financial condition, physical health, account password or verification code to us or any third party serving you in our name over the public network for your and your property’s security.

· How do we provide information to external parties?

1. Business-based sharing

(1) Your personal information may be shared among our affiliates for standardization of services provided to you by our affiliates and affiliated brands, as well as for the purpose of identifying abnormal accounts and security risk control.

(2) When you use services provided to you by third-parties by our franchisees, as well as partner payment agencies, suppliers and other partners (such as advertising agencies, information services, logistics services, customer service services, system service providers or our distributors and other relevant parties), We will share with these affiliates and third parties the information necessary to realize the business. If it is necessary to share your information with a third-party in order to provide services to you, we will evaluate the legality, justness and necessity. We will require third parties to protect your information and strictly abide by relevant laws, regulations and regulatory requirements.

(3) If you choose to participate in a lottery or a similar promotion activity jointly organized by us and a third party, we may share information that is generated from and is necessary for the activity, so that the third party can give prize or provide services to you on a timely basis. We will clearly inform you about the information to be provided to the third party on the page of activity rules or through other means according to applicable laws and regulations or national mandatory standards and get your approval ;

(4) Subject to your express consent, we will share your information with third parties within the scope authorized by you to the extent permitted by applicable laws and regulations, without violating public order and morals.

(5) We will strictly supervise and manage our partners. Once we find any violation of personal information processing, we will immediately stop cooperation and hold them accountable.

2. Information transfer

Generally, we do not transfer your personal information to any firm, organization or individual outside of Sherpa’s, except:

(1) with your prior explicit consent;

(2) as required by applicable laws and regulations or mandatory administrative or judicial provisions;

(3) when it comes to asset transfer, acquisition, merger, reorganization or bankruptcy liquidation. In the case of transfer of personal information, we will notify you and require the new firm or organization that holds your personal information to be bound by this Policy. In the case of change of the purpose of your personal information, we will require such new firm or organization to obtain your explicit consent again.

3. Public disclosure

(1) Except showing de-sensitized winners' mobile phone number or login name in announcing winners, we generally do not disclose your information to the public. If it is necessary to do so, we will inform you about the purpose of public disclosure, type of information to be disclosed, sensitive information that may be involved, and ask for your explicit consent.

(2) Disclosure under law: we may disclose your personal information to the public as mandatorily required by applicable law, legal procedure, litigation, or government authority.

4. Delegated processing

We may engage one of our competent affiliates or other specialist organization to process information on our behalf for increasing the efficiency, lowering the costs or improving the accuracy of information processing. We will require the engaged affiliate or organization to observe strict obligations of confidentiality and take effective security measures by means of written agreements, and prohibit them from using your personal information for any purpose other than those authorized by you.

· How do you manage your personal information?

We take your concern about your personal information seriously and do our best to protect your right to access, correct, delete your personal information and revoke your consent with respect to it, so that you have the full ability to protect your privacy and security. You have the right to:

1. Access, obtain and correct your personal Information/copy of your personal information

You have the right to access and correct your personal information, including your nickname, avatar, mobile phone number , email address, delivery address and other relevant information, unless otherwise required by applicable laws and regulations. You can log in to our network platform account to access and obtain the correction method as follows:

Access, obtain and correct your personal information, including profile picture, nickname, mobile phone number, email and password, through Sherpa’s APP [My-account].

Access, obtain and correct your delivery address through Sherpa’s APP [My - Address];

You can also contact customer service through the "preface" publicity at any time, we will verify your user identity after 15 working days to reply to your access and correction request.

Personal information unavailable for access and correction: except those listed above, access and correction service is unavailable for some of your personal information, including information about your device collected for improving user experience and ensuring transaction security and your personal information generated during your use of additional functions. Such information will be used within your authorization. While it is unavailable for access and correction, you can request us to delete or anonymize them.

2. Delete your personal information

You can directly access the settings of Online Platforms to delete your information, including your nickname, avatar, delivery address and other relevant informatio;

You can request us to delete your personal information under any of the following circumstances:

(1) if we deal with your personal information in violation of applicable laws and regulations;

(2) if we collect and use your personal information without your consent;

(3) if we deal with your personal information in breach of any agreement with you; or

(4) if we cease to provide services and carry out business activities.

3. Change the scope of your authorization or revoke your authorization

You can change the scope of your authorization for us to continue collecting your personal information or revoke your authorization by deleting information, turning off device access or setting privacy on our Online Platforms(Set path: my-Settings-Security privacy-system permission management). You can also fully revoke your authorization for us to continue collecting your personal information by canceling your account.

Please understand that no business function can be enabled without some of your basic personal information. Once you revoke your consent or authorization, we cannot continue providing you with the service in respect of the revoked consent or authorization, nor will we process the corresponding part of your personal information. However, your decision to revoke your consent or authorization will not affect the processing of your personal information previously made within your authorization.

4. Delete user account

You can call our customer service to apply for deleting your account. We will review your application within 48 hours if conditions for account deletion are satisfied (see terms concerning how to delete user account in the Membership Service Agreement for more information). After approval of your application, we will delete your personal information and cease to collect, use personal information related to the account or provide to external parties. However, we still need to retain your personal information provided or generated during your use of our services as required by regulators and cooperate with inspection of competent authorities within the retention period according to laws and regulatory requirements of the government.

5. Receive response to request

(1) If you fail to access, correct or delete your personal information in the manner described above, or if you need to access, correct or delete some other part of your personal information generated during your use of our products and/or services, or if you believe that we commit any act in violation of applicable laws and regulations or any agreement regarding the collection or use of your personal information with you, you may contact us via any of the means provided in this Policy. You may be required to provide a written request or otherwise prove your identity for security purpose. We will respond to your request within 15 days of receiving your feedback and verifying your identity. We may decline to process requests that are unreasonably repetitive, require disproportionate technical effort (including the need to develop new systems or radically change existing practices and related situations), jeopardize the privacy of others, or are extremely impractical (for example, it involves information stored on backup tapes ).

(2) According to applicable laws and regulations, we cannot respond to your request under any of the following circumstances:

a. it relates to national security and national defense security;

b. it relates to public safety, public health, and significant public interests;

c. it relates to criminal investigations, prosecutions and trials;

d. there is sufficient evidence showing that you have malicious intent or misuse your right; or

e. responding to your request will seriously jeopardize the legitimate rights of you or other individuals or organizations.

(3) We will process your request in accordance with this Policy and applicable laws and regulations. You can file a lawsuit in a court of competent jurisdiction in accordance with applicable law if you are not satisfied with our response after communicating with us.

· How do we protect minors’ personal information

1. We expect parents or guardians to instruct minors to use our services. We will keep minors’ information confidential and secure in accordance with applicable local laws and regulations.

2. If you are under 18 years old, we recommend you to ask your parents or guardians to read this Policy and use our services or provide your information to us with the prior consent of your parents or guardians. For information collected with the consent of your parents or guardian, we will use or disclose it only as permitted by applicable law, or with explicit consent of your parents or guardian, or as necessary to protect your rights and interests. If your guardian do not allow you to use our services or provide your information to us according to this Policy, please stop using our services and notify us immediately for us to take appropriate action.

3. If you are a parent or guardian of a minor, please contact us via any of the means provided above for us to take immediate and appropriate action in case you have any question about the processing of information about the minor in your custody.

· Application and update of this Policy

1. This policy applies to all services available on Sherpa’s Online Platforms, unless relevant service is subject to a separate privacy policy or relevant user service agreement specifies otherwise.

2. We will update this Policy according to law and indicate the last update date at the beginning of this Policy. As we have a large number of users, we will notify you by pushing notification or relevant reasonable means. If the update of the content of this policy will result in reduction or major change of your rights and interests, we will inform you through pop-up window. By continuing to use our services after the update hereof takes effect, you have carefully read, understood and accepted the updated policy, and are willing to be bound by the updated policy.

3. You can view this policy in Sherpa’ s APP or “My” of other network platforms. We encourage you to check this Policy each time before you use our services.

· Contact us

If you have any questions, comments or suggestions regarding information contained herein, or regarding how we deal with your personal information, please contact us or customer service as follows:

Sherpa’s customer service:4009030900

Address: 3rd floor of the Jinhuan Mansion c, 489 Xiangyang south Road, Xuhui District, Shanghai 200031

Normally, we will verify your user identity and reply within 15 working days.

If you are not satisfied with our reply, or due to the understanding of this privacy policy, the dispute is unable to negotiate, you can file a lawsuit to the defendant.