Privacy Policy

I. How We Collect and Use Your Personal Information

1. “Personal Information” means all kinds of information recorded electronically or by other means that relates to an identified or identifiable natural person, excluding information that has been anonymized.

2. “Sensitive Personal Information” means personal information that, once leaked or illegally used, may easily infringe upon the personal dignity of a natural person or endanger the personal or property safety of a natural person, including biometric information, religious beliefs, specific identities, medical health, financial accounts, location tracking, and personal information of minors under the age of 14. Sensitive personal information covered in this Policy will be highlighted in bold.

3. ZTO Airlines will only collect and use your personal information for the purposes described below.

(I) Collection and Use of Personal Information

ZTO Airlines mainly provides air freight related services. Our collection and use of information will comply with the legal bases expressly provided by laws and regulations. We will collect and process your personal information for the purpose of providing relevant products and services to you in accordance with the principles of lawfulness, legitimacy, and necessity, and will disclose such information to you.

1. Business Cooperation Inquiries

When you have an intention to cooperate and fill out and submit a cooperation request form on the “Company Information – Business Cooperation” page of this website, we need to collect the following information: company name, company type, cooperation intention, contact person, phone number, and email address.

2. Ensuring Website Operation and Optimizing User Experience

While you browse this website, we will automatically receive and record your browser, device, and network information, including but not limited to IP address, browser type, operating system version, access date and time, dwell time, clickstream, and other log information. We may use tracking tools such as ZCat to collect such information for statistical analysis of user visits, page popularity, website performance, in order to optimize website layout and content and improve your browsing experience.

(II) Description of In‑house SDK Processing of Personal Information

To ensure the stable operation of ZTO Airlines or to implement relevant functions, we may access in‑house SDKs for the above purposes. We will conduct strict security monitoring of SDKs to protect your personal information.

SDK Name

Business Scenario/Function

Purpose of Use

Types of Personal Information Collected

ZCAT

Tracking function

Detect device and runtime environment

Device brand, device model, device system, device network, device screen size

(III) Description of Third‑party SDK Processing of Personal Information

In the process of providing services to you, in order to ensure the implementation of relevant functions of ZTO Airlines' products or services and the stable and secure operation of the products or services, we may access third‑party software development kits (SDKs) to achieve the relevant purposes. We will evaluate the information collection practices of such SDKs and require them to adopt legally compliant protection measures. Details of the relevant SDK are as follows:

[Third‑party SDK — Baidu Maps] Operator: Beijing Baidu Netcom Science Technology Co., Ltd.; Purpose of Use: Display the company office location on the Company Information page; Privacy Policy Link: https://lbsyun.baidu.com/docs/pcsa?title=compliance/openprivacy

1. If the information cannot identify your personal identity alone or in combination with other information, it does not constitute personal information under law, and we are entitled to use it reasonably.

We will de‑identify the personal information we collect through technical means. You acknowledge and agree that, if de‑identified information can no longer identify you personally, we may use de‑identified information for analysis and commercial exploitation without further notice to you or obtaining your consent, to the extent permitted by laws and regulations.

When your information can identify your personal identity alone or in combination with other information, or when we combine processed information (which cannot be linked to any specific personal information) with other personal information, such information shall be treated and protected as your personal information in accordance with this Privacy Policy during the period of combined use.

2. We will compile statistics on the use of our services and may share these statistics with the public or third parties to demonstrate overall usage trends of our services. However, these statistics do not contain any of your personally identifiable information.

3. When we display your personal information, we will take measures such as content replacement and anonymization to desensitize your information to protect your information security.

4. As our business develops, the services we provide may be adjusted or changed. In principle, when new functions or services are related to our current functions or services, the collection and use of personal information will be related to the original processing purposes. In scenarios unrelated to the original processing purposes, we will inform you again and obtain your consent before collecting and using your personal information.

5. When we intend to use your personal information for purposes not covered by this Policy, or use information collected for specific purposes for other purposes, we will separately explain the scope and purposes of collection to you and seek your consent in advance through reasonable means.

(V) Exceptions to Consent

1. You fully understand that we may collect and use personal information without obtaining your authorization and consent in the following circumstances:

(1) Where it is necessary for the conclusion or performance of a contract to which you are a party, or for the implementation of human resources management in accordance with legally formulated labor rules and regulations and lawfully concluded collective contracts;

(2) Where it is necessary for the performance of statutory duties or legal obligations;

(3) Where it is necessary for responding to public health emergencies or for protecting the life, health, and property safety of natural persons in emergency situations;

(4) Where personal information is processed within a reasonable scope for public interest purposes such as news reporting and public opinion supervision;

(5) Where personal information that you have voluntarily made public or that has been otherwise legally disclosed is processed within a reasonable scope in accordance with the Personal Information Protection Law of the People's Republic of China;

(6) Other circumstances provided by laws and administrative regulations.

2. According to law, the sharing and transfer of de‑identified personal information, provided that the data recipient cannot restore or re‑identify the individual, does not constitute the sharing, transfer, or public disclosure of personal information. The retention and processing of such data will not require further notice to you or your consent.

II. How We Use Cookies and Similar Technologies

(I) Cookies

To ensure the normal operation of our website, we may store small data files called Cookies on your computer or mobile device. Cookies usually contain an identifier, site name, and some numbers and characters. Through Cookies, the website can store your preferences and other data. ZTO Airlines uses Cookies for the same purpose as most websites or internet service providers – to improve user experience. With Cookies, the website can remember a user's single visit (using session Cookies) or multiple visits (using persistent Cookies). With Cookies, the website can save settings such as language, font size, and other browsing preferences on your computer or mobile device. This means that users do not need to reconfigure their preferences every time they visit. If a website does not use Cookies, it will treat each page you open as a new visitor. For example, if you log in to a website and then go to another page, the website will not recognise you and you will be logged out again. ZTO Airlines will not use Cookies for any purposes other than those described in this Policy. You may manage or delete Cookies according to your preferences. For more information, please visit AboutCookies.org. You can clear all Cookies stored on your computer, and most web browsers have features to block Cookies. However, if you do so, you will need to change your user settings manually each time you visit our website. For details on how to change browser settings, please visit the following links: IE, Google, Firefox, Safari.

(II) Web Beacons and Pixel Tags

In addition to Cookies, we also use other similar technologies such as web beacons and pixel tags on our website. For example, emails sent by ZTO Airlines may contain click‑through URLs that link to content on the ZTO Airlines website. If you click on such a link, ZTO Airlines will track that click to help us understand your product and service preferences and improve customer service. A web beacon is usually a transparent image embedded in a website or email. With pixel tags in emails, we can know whether an email has been opened. If you do not wish your activities to be tracked in this way, you may unsubscribe from ZTO Airlines' mailing list at any time. Your use of our website means that you agree to our use of Cookies, web beacons, and pixel tags as described above.

(III) Do Not Track

Many web browsers have a Do Not Track function that can send a Do Not Track request to websites. Currently, major internet standards organizations have not established policies on how websites should respond to such requests. However, if your browser enables Do Not Track, all our websites will respect your choice.

III. How We Entrust Processing, Share, Transfer, and Publicly Disclose Your Personal Information

(I) Entrusted Processing

In order to achieve the business functions of specific products, we may entrust partners to assist us in providing relevant services to you. If we need to entrust third parties to process your personal information, we will sign strict confidentiality agreements with them, requiring them to process your personal information in accordance with our requirements, this Privacy Policy, and any other relevant confidentiality and security measures.

(II) Sharing

We attach great importance to the protection of your personal information. In principle, we will not share your personal information with third‑party companies, organizations, or individuals outside ZTO Airlines, unless we obtain your explicit consent or fall within statutory exceptions that do not require consent. However, we may provide your personal information to the following partners:

1. Third parties authorized by you;

2. In order to better provide air freight services, meet your requirements, fulfill our obligations and exercise our rights under relevant user agreements or this Privacy Policy, or comply with legal requirements, you understand and authorize us to share your personal information with our partners (including downstream service cooperation companies, third‑party logistics companies, cooperative merchants, etc.) to provide you with better delivery services and enhance your user experience. Such sharing may include your name, contact number, address, etc. Please refer to Section I(III) for details on specific sharing arrangements.

We will share your personal information only after obtaining your explicit consent, for lawful, legitimate, necessary, specific, and clear purposes, and only share the minimum personal information necessary for providing the service to you. Our partners are not authorized to use shared personal information for any purpose other than those stated in this Policy.

For third‑party SDK providers, their identities, purposes, methods, and scope of personal information collection, please refer to Section I(III).

You understand that anonymized or de‑identified information that cannot identify or be associated with you is not your personal information, and we are entitled to share such information with third parties in accordance with laws and regulations.

Please note that information you voluntarily share or even publicly disclose when using our services may involve your or others' personal information or even sensitive personal information. Please consider and make decisions more cautiously.

(III) Transfer

We will not transfer your personal information to any company, organization, or individual, except in the following cases:

1. Transfer with explicit consent: after obtaining your explicit consent, we will transfer your personal information to other parties;

2. In the event of a merger, acquisition, or bankruptcy liquidation involving the transfer of personal information, we will notify you at least thirty days in advance, and we will also require the new company or organization holding your personal information to continue to be bound by this Policy; otherwise, we will require that company or organization to obtain your authorization and consent again;

3. Transfer required by applicable laws, regulations, legal procedures, or mandatory administrative or judicial requirements.

(IV) Public Disclosure

We will publicly disclose your personal information only in the following circumstances:

1. After obtaining your explicit and separate consent;

2. Disclosure based on law: we may publicly disclose your personal information when required by law, legal procedures, litigation, or mandatory requests from government authorities.

(V) Exceptions Not Requiring Your Authorization and Consent

In accordance with relevant laws, regulations, and national standards, we may provide, process, share, transfer, or publicly disclose your personal information to third parties without obtaining your authorization and consent in the following circumstances:

1. Where it is related to our performance of obligations under laws and regulations;

2. Where it is directly related to national security and national defense security;

3. Where it is directly related to public safety, public health, or major public interests;

4. Where it is directly related to criminal investigations, prosecutions, trials, and enforcement of judgments;

5. Where it is necessary to protect your or other individuals' life, property, reputation, or other significant lawful rights and interests, but it is difficult to obtain your consent;

6. Where you have voluntarily made the information public or it has otherwise been legally disclosed;

7. Where the information is collected from legally publicly disclosed sources, such as lawful news reports, government information disclosure, etc.

IV. How We Protect and Retain Your Personal Information

(I) How We Protect the Security of Your Personal Information

1. ZTO Airlines has established an information security management organization and formulated a strict information security management system, including but not limited to security management policies, security management institutions, personnel security management, system construction management, and system operation and maintenance management. ZTO Airlines has adopted strict technical controls in terms of physical security, network security, host security, application security, and data security:

- Physical Security: established comprehensive computer room management and monitoring systems, strict physical security controls over work areas, etc.;

- Personnel Security: signed confidentiality agreements with employees, provided data security and privacy protection training, etc.;

- Network Security: ensure transmission encryption via HTTPS browsing, deploy firewalls, bastion hosts, and monitoring systems, and use IPSEC and SSL encryption technologies to ensure data integrity and confidentiality during transmission;

- Host Security: designed complex user permission mechanisms, protected host security through security auditing, access control, etc.;

- Data Security: use encryption technologies to ensure encrypted data storage, desensitize and anonymize the display of sensitive information, and establish a high‑level data security committee for comprehensive data security;

- Application Security: deployed dual‑factor authentication access controls, automated code inspection, log auditing, etc.

2. We regularly conduct security emergency response drills to prevent security incidents. We have cooperated with relevant government authorities to establish a network security police office. In the event that data stored by ZTO Airlines is compromised, or if non‑public user information is disclosed to unrelated third parties due to external actions (such as hacker attacks), despite other disclaimers in this Policy, ZTO Airlines will activate an emergency response plan, form an emergency team, initiate procedures, conduct internal investigations, promptly report to regulatory authorities, cooperate with them, mitigate the impact on users, and will notify affected users by push notifications, email, or public announcement, as appropriate, informing them of the disclosed information and our awareness of the situation.

In the event of a personal information security incident, we will, in accordance with legal requirements, promptly inform you of: the basic facts and possible impact of the incident, the measures we have taken or will take, recommendations for you to protect yourself and mitigate risks, and remedial measures for you. We will notify you of the incident via email, letter, phone, push notification, etc. Where it is difficult to notify each individual individually, we will publish announcements through reasonable and effective means. At the same time, we will proactively report the handling of personal information security incidents to regulatory authorities as required.

3. ZTO Airlines uses comprehensive security safeguards to strive to protect your personal information from unauthorized access, use, disclosure, modification, damage, loss, and other unlawful processing, and will continuously update our information security measures as information technology advances. However, please be aware that no internet transmission or electronic storage method is absolutely secure. Therefore, although we protect your personal information through commercially acceptable means, we cannot guarantee absolute security.

(II) Retention Period of Personal Information

1. The specific retention period of your personal information is determined based on the type of personal information, legal requirements, and the purposes described in this Policy.

2. If we terminate services or operations, we will promptly cease further collection of your personal information, notify you at least thirty days in advance, and delete or anonymize your personal information after termination of services or operations.

V. Your Rights

In accordance with relevant laws, regulations, and standards of the People's Republic of China, as well as common international practices, we guarantee that you can exercise the following rights over your personal information:

(I) Access to Your Personal Information

You have the right to inquire about your personal information through the contact information provided in this Privacy Policy.

(II) Correction of Your Personal Information

When you discover that the personal information we hold about you is inaccurate, you have the right to request us to make corrections through the contact information in this Privacy Policy.

(III) Deletion of Your Personal Information

1. You may request deletion of your personal information in the following circumstances:

(1) Where the purpose of processing your personal information has been achieved, cannot be achieved, or is no longer necessary to achieve the purpose;

(2) Where we no longer provide services to you, or the retention period has expired;

(3) Where you withdraw your consent;

(4) Where our processing of personal information violates laws, administrative regulations, or our agreement with you;

(5) Where we publicly disclose your personal information or share or transfer it to third parties in violation of laws, regulations, or our agreement with you.

2. If we decide to comply with your deletion request, we will also, to the extent possible, notify entities that have received your personal information from us to delete it promptly, unless otherwise provided by laws and regulations or unless such entities have obtained independent authorization from you.

3. If the retention period prescribed by laws or administrative regulations has not expired, or if deletion is technically difficult, we will cease processing except for storage and necessary security measures.

(IV) Change the Scope of Your Authorization and Consent

You have the right to decide whether to continue to authorize us to collect, process, and use your personal information. If you need to withdraw your authorization, you may do so through the contact information in this Privacy Policy. We will complete user identity verification and respond within 15 working days.

Once you withdraw your consent, we will no longer process the corresponding personal information. However, your withdrawal of consent will not affect the processing of personal information previously carried out based on your authorization.

(V) Responding to Your Above Requests

To ensure information security, you may be required to provide a written request or otherwise prove your identity. We may first ask you to verify your identity before processing your request. We will respond within fifteen working days.

In the following circumstances, we will be unable to respond to your request as required by laws and regulations:

(1) Where it is directly related to national security or national defense security;

(2) Where it is directly related to public safety, public health, or major public interests;

(3) Where it is directly related to criminal investigations, prosecutions, trials, and enforcement of judgments;

(4) Where there is sufficient evidence that you have subjective malice or abuse of rights;

(5) Where responding to your request would cause serious harm to the lawful rights and interests of you or other individuals or organizations;

(6) Where it involves trade secrets;

(7) Where it is related to our performance of obligations under laws and regulations;

(8) Where it is necessary to protect the life, property, or other major lawful rights and interests of you or other individuals, but it is difficult to obtain your consent.

VI. Protection of Minors’ Information

This website is primarily intended for enterprises and business professionals and does not target minors as its user base. We do not actively collect personal information of minors. If we discover that we have collected personal information of minors without prior verifiable parental or other guardian consent, we will delete such information as soon as possible. If parents or guardians discover that a minor has provided personal information to us without consent, please contact us via the contact information in this Privacy Policy, and we will delete the relevant data promptly.

VII. How Your Personal Information Is Transferred Globally

Personal information we collect and generate within the territory of the People's Republic of China is stored within the People's Republic of China.

VIII. Notices and Revisions

(I) In order to provide you with better services and as ZTO Airlines’ business develops, this Privacy Policy will be updated from time to time. However, without your explicit consent, we will not reduce your rights under this Policy. We will notify you of updates through prominent means, such as pop‑up reminders when you use ZTO Airlines application services or via SMS, before the updated version takes effect on the ZTO Airlines website. Please visit the ZTO Airlines website to stay informed of the latest Privacy Policy.

(1) Pop‑up reminders when you use ZTO Airlines application services;

(2) SMS notifications.

(II) Major changes under this Policy include, but are not limited to:

1. Significant changes in our service model, such as the purposes of processing personal information, types of personal information processed, and ways of using personal information;

2. Significant changes in our ownership structure or organizational structure, such as changes in ownership due to business adjustments, bankruptcy, mergers and acquisitions, etc.;

3. Major changes in the primary recipients of personal information sharing, transfer, or public disclosure;

4. Major changes in your rights and the ways in which you may exercise them regarding the processing of your personal information;

5. Changes in our department responsible for personal information security, contact methods, or complaint channels;

6. Where the personal information security impact assessment report indicates a high risk.

IX. How to Contact Us

(I) If you have any questions, comments, or suggestions regarding this Privacy Policy or your personal information, you may contact us by calling our customer service hotline at 021-60556762.

You may also contact us via the following:

Personal Information Protection Officer Email: ztoairlines@zto.com

(II) In general, we will respond within fifteen working days. If you are not satisfied with our response, particularly if our processing of your personal information has harmed your lawful rights and interests, you may also file a complaint or report to regulatory authorities such as the cyberspace administration, telecommunications, public security, and commerce authorities.