KBH Global Privacy Policy
KBH Global Privacy Policy
Welcome to KBH Global.
This Privacy Policy explains how KBH Global collects, uses, stores, shares, discloses, protects and otherwise processes personal information when providing business information publishing, product supply and demand exchanges, supplier and buyer discovery, business showcases, business discussions, and related community and technical services. It also explains how users can exercise their rights concerning personal information.
In this Privacy Policy, “KBH Global”, “we” and “the platform” refer to the independent operator providing KBH Global services to users.
Users may contact the platform about privacy, personal information, account closure, data requests or related matters through the official contact email published on the KBH Global website.
This Policy applies to the KBH Global website, mobile web pages, and any official applications or other service channels formally provided by KBH Global in the future and expressly covered by this Policy.
Different countries and regions may grant users different rights relating to personal information or data protection. This Policy sets out KBH Global’s basic global privacy rules; it does not exclude or restrict mandatory data protection rights that apply by law.
1. Our basic principles for processing personal information
KBH Global processes personal information for service delivery, account security, platform governance, legal compliance, and other clear and reasonable purposes.
Depending on the circumstances, we will follow these principles:
1) Process only information needed for clear and reasonable purposes;
2) Avoid unnecessary collection of personal information unrelated to KBH services;
3) Adopt reasonable safeguards appropriate to the nature and risks of the data;
4) Delete, anonymize or otherwise appropriately handle information when it is no longer needed and there is no other lawful reason to retain it;
5) Explain significant data processing activities to users;
6) Provide users with access, correction, deletion, withdrawal of consent, objection and other applicable data rights under applicable law.
A description of possible data processing for a feature that is not yet available does not mean that the feature is currently offered to users.
2. Legal bases for processing personal information
Where the GDPR, UK GDPR or other laws requiring an explanation of the legal basis for processing apply, KBH Global may process personal information on one or more of the following bases, depending on the purpose.
This section does not mean that the GDPR or UK GDPR applies to every user. The applicable legal basis depends on the user’s location and the laws governing the particular processing activity.
2.1 Performing a contract or providing a service requested by the user
To provide services for which users register or which they request, the platform may process relevant personal information, for example for:
1) Registration;
2) Login;
3) Account management;
4) Publishing posts and replies;
5) AI writing refinement or other features actively requested by users;
6) Accounting for K Coin and delivering platform services already obtained by users;
7) Other platform features actively requested by users.
2.2 Legitimate interests
Provided the processing does not exceed users’ reasonable expectations or disproportionately affect their rights and freedoms, the platform may process personal information based on legitimate interests, for example for:
1) Account and platform security;
2) Spam prevention;
3) Fraud prevention;
4) KBH Safety and community governance;
5) Technical logs;
6) Abuse detection;
7) Product Tag content classification;
8) Maintaining and improving platform stability.
When processing personal information based on legitimate interests, the platform should consider necessity, users’ reasonable expectations, and their rights and freedoms.
Users may object to processing based on legitimate interests where applicable law grants a right to object.
2.3 Consent
The platform relies on user consent only where consent is genuinely required by law, for example for:
1) Certain optional features;
2) Cookies or tracking technologies requiring consent by law;
3) Cross-border processing or processing of sensitive personal information requiring consent or separate consent by law;
4) Other circumstances in which the law expressly requires consent.
The platform will not describe all personal information processing as being based on user consent.
2.4 Legal obligations
The platform may process personal information to meet obligations under applicable law, for example to:
1) Retain relevant records as legally required;
2) Respond to valid law enforcement or regulatory requests lawfully made by competent authorities;
3) Meet data security or other statutory obligations.
2.5 Establishing, exercising or defending legal rights, and protecting vital interests
Where permitted by applicable law and actually necessary, the platform may process necessary personal information to establish, exercise or defend legal rights, or to protect vital interests such as the life and physical safety of users or others.
3. Information we may process
Depending on the KBH services users actually use, we may process the following categories of information.
Not every user will provide or generate all of this information.
3.1 Account and registration information
When users register, log in or maintain a KBH account, we may process:
1) Username;
2) Email address;
3) Hashed password or other authentication data;
4) Email verification codes and related verification status;
5) Account UID;
6) Registration time;
7) Registration IP address;
8) Most recent login IP address;
9) Account status;
10) Other information reasonably necessary for registration, login and account security.
KBH Global does not require users to disclose their registration email, password or verification codes to other ordinary users.
Users should not give their account password or verification codes to any other user.
3.2 Email verification codes and email verification information
When users log in, register or verify their email using an email verification code, we may process:
1) Email address;
2) Email hash;
3) Verification code hash;
4) Code sending and verification times;
5) Code validity period and status;
6) Number of attempts;
7) IP address;
8) Technical identifiers or hashes used to identify the browser or verification session.
This information is used to:
1) Verify control of the email address;
2) Complete registration or login;
3) Prevent verification code abuse;
4) Protect account security;
5) Investigate unusual registration or login activity.
In the current implementation, verification records in email-code login and registration store the email address and code as hashes, not the code in plain text; temporary credentials issued during registration store the email address in encrypted form.
The code itself is valid only for the short period needed to complete verification.
In the current implementation, the system clears these verification records and temporary credentials from email-code login and registration after the retention period, currently set to 7 days. Necessary records concerning account security, fraud or unusual verification activity may be retained separately under the “Data retention periods” section of this Policy.
3.3 Third-party login information
If users choose Google or another third-party login service actually offered by the platform in the future, we may receive information from that third party based on the user’s authorization and the actual login flow.
For the current Google login, this may include:
1) The Google account’s unique identifier;
2) Name or display name supplied by the third party;
3) Email address;
4) Email verification status;
5) The domain associated with a Google Workspace account, where applicable;
6) Information necessary for login security or account linking.
KBH Global uses this information for third-party authentication, account creation, account linking or subsequent logins.
In the current implementation, temporary credentials used during third-party login store this information in encrypted form and are cleared by the system after the retention period, currently set to 7 days. Once linking is complete, the platform retains the third-party account’s unique identifier and display name for subsequent logins.
Third-party login services may also process user information independently under their own privacy policies.
Using third-party login does not mean that KBH Global can access all data in the user’s third-party account.
We process only information supplied through the actual login flow and needed for the relevant features.
3.4 Profile information provided voluntarily by users
Users may complete their public profile or account details using the features actually available on the platform.
This may include:
1) Avatar;
2) Bio;
3) Company or business information;
4) Country or region;
5) Other information voluntarily entered by the user.
As KBH Global is based on Discuz, the underlying system may have additional native profile fields. Corresponding data processing takes place only for fields actually made available by the platform and completed by users.
The platform should not require information unrelated to KBH services merely because a field exists in the underlying system.
As a general principle, the platform does not actively request more sensitive information, such as identity document numbers, financial information, precise home addresses or health information, unless there is a clear, lawful and necessary purpose.
4. Information users publish publicly
KBH Global is a community for exchanging business information.
Information users publish or choose to make public may be accessible to other users, visitors who are not logged in and, where technically possible, search engines.
Public information may include:
1) Username;
2) Avatar;
3) Public profile;
4) Bio;
5) Product supply or demand information;
6) Posts;
7) Replies;
8) Business discussions;
9) Images and attachments;
10) Business showcase information;
11) Business information users choose to make public, such as country or region.
Before publishing personal information, business contact details or other content in public areas, users should consider that it may be seen, copied, saved or otherwise distributed by an unspecified audience.
KBH Global does not automatically treat information as available for any purpose merely because a user has made it public.
The platform will continue to process that information under this Policy, the Terms of Use, the Community Rules and applicable law.
4.1 Business contact details
Because KBH Global is intended for exchanging business information, users may voluntarily provide genuine business contact details in permitted areas.
For example:
1) Business email address;
2) Business telephone number;
3) Company website;
4) Other business contact details permitted by the platform.
Once users publish this information in public areas, other users may be able to access it.
Users should not disclose sensitive personal information unrelated to business communication that could put their own safety at risk.
4.2 Other people’s personal information
Users publishing content containing another person’s personal information should ensure they have a lawful and reasonable basis to do so.
Users must not disclose another person’s following information without authorization:
1) Identity documents;
2) Home address;
3) Bank account details;
4) Private telephone number;
5) Non-public private communications;
6) Other information that could seriously affect their privacy, safety or lawful rights and interests.
The platform may take action under the Community Rules against content that improperly discloses another person’s personal information.
5. Posts, replies, images and other user content
When users publish posts, replies, product supply or demand information, business discussions, images, attachments or other content, we process that content and the necessary related account and technical information.
Purposes may include:
1) Displaying content to other users;
2) Providing search, classification and browsing features;
3) Preserving the context of discussions;
4) Enforcing the Community Rules;
5) Preventing spam, scams and other abuse;
6) Handling reports and appeals;
7) Providing AI, tagging or other assistance features actually used by users;
8) Maintaining platform security and normal operation.
Deleting public content does not mean that all related backend records immediately disappear from all systems, logs, backups, security records or case records at the same time.
Where genuinely necessary for security, reports, appeals, fraud investigations, intellectual property complaints, dispute resolution, backup cycles or legal obligations, relevant information may be retained for limited purposes and necessary periods.
See the later “Data retention periods” provisions for the applicable retention principles.
6. Device, network and security information
When users access or use KBH Global, the platform may automatically generate or record certain technical and security information, such as:
1) IP address;
2) Registration IP address and most recent access IP address;
3) Login time;
4) Request time;
5) Account activity records;
6) Browser or device technical identifiers or hashes;
7) Sessions, cookies or other necessary session identifiers;
8) Error, security and anti-abuse logs;
9) Other technical records necessary for unusual logins, attacks, automated abuse prevention or platform security.
In the current live-site implementation, some KBH Global features use technical identifiers such as browser hashes. This does not mean the platform necessarily retains the full original User-Agent string.
6.1 IP addresses associated with posts and replies
When users publish a topic or reply, the platform’s X5 system records the IP address and related network information associated with that content.
These IP addresses:
1) Are not disclosed to ordinary visitors or ordinary users;
2) May be viewed only by administrators or moderators with the relevant permission, to the extent necessary for community governance, security, anti-abuse or related management duties.
The account administration interface may also show an account’s registration and most recent login IP addresses, for use only by personnel with the corresponding administrative permissions to the extent necessary.
This information is mainly used for:
1) Account and session security;
2) Login verification;
3) Prevention of bots, spam and malicious registrations;
4) Detection of attacks and unusual behavior;
5) Technical troubleshooting;
6) Enforcement of platform security and community rules;
7) Protection of the lawful rights and interests of users, the platform and other relevant parties.
7. Cookies and similar technologies
KBH Global uses cookies, sessions and similar technologies to maintain login status, language preferences, security verification and other necessary platform functions.
These may currently include:
1) Login and authentication cookies;
2) Session cookies;
3) Security and anti-forgery request technologies;
4) Language selection cookies;
5) Temporary state information needed for third-party login or email registration;
6) Other technologies necessary to provide features requested by users.
The Cookie Policy explains specific cookie categories, purposes and how users can manage cookies.
If KBH Global introduces analytics, advertising or other non-essential tracking technologies requiring consent by law in the future, the platform should update its explanations according to the actual features and applicable law, and obtain the relevant choices or consent where required.
8. Personal information processing in AI and automated features
KBH Global may use artificial intelligence, automated classification, tag matching or other automated technologies to provide assistance when the relevant features are actually available.
Different AI features process different scopes of data.
The platform should process data according to the features actually enabled and the service providers actually used, and should not describe AI features that have not been enabled as current data processing activities.
8.1 AI writing refinement and title assistance
When users actively use AI writing refinement, title assistance or similar features, KBH Global may send the text they submit or select for processing, together with the context necessary for that feature, to the relevant AI service provider.
In the current implementation, these AI features use model services provided by DeepSeek.
Processing purposes include:
1) Improving wording as requested by the user;
2) Generating or helping generate titles;
3) Performing other text processing actively requested by the user.
AI features actively used by users, such as writing refinement, may be available only to accounts meeting the platform’s current eligibility, permission, verification or usage allowance requirements. The rules for the relevant feature determine eligibility and usage limits.
AI output may contain errors or be incomplete or inaccurate.
Users should check the final content themselves before publishing.
KBH Global should not unnecessarily send account information unrelated to a feature to an AI service provider in order to provide a single writing refinement operation.
8.2 AI translation
KBH Global does not currently offer AI translation to users.
If KBH Global offers AI translation in the future, post titles, bodies or other content requiring translation may be sent to the machine translation provider actually used.
If translation results are cached or stored in the future, the platform should explain the processing according to the actual implementation and applicable law.
AI translation may contain mistranslations or shifts in meaning. Users should not rely solely on automated translations for significant decisions in important business activities.
8.3 Automatic Product Tag matching
Product Tag is the platform’s automatic content classification process for posts. It does not depend on users actively clicking “AI writing refinement” or another AI feature.
When enabled, automatic Product Tag processing may be triggered asynchronously:
1) After the initial post of a topic is published;
2) After the initial post is edited;
3) After content is approved through review;
4) After relevant edits following review approval.
This processing occurs after the page response is completed and does not affect the outcome of the user’s content publication.
During feature testing, the platform may process only posts or accounts meeting the test conditions at that time; the test scope does not establish a permanent product rule.
Product Tag currently uses Exact Matcher to perform local exact phrase matching against the Published Product Tag Library for the current forum (FID).
A match is made only when one of the following phrases explicitly appears:
1) Official;
2) Approved Alias;
3) A published localized phrase.
Matching does not infer meaning. A post may have 0 Tags, with a maximum of 5 Tags per post.
Product Tag does not currently call AI service providers to select or match tags. Post content does not need to be sent to a third-party AI service provider for tag matching.
Product Tag results are used for content classification, discovery, search, recommendations or other functions organizing product information.
Where the GDPR, UK GDPR or similar laws apply, the platform may carry out this processing based on legitimate interests in classifying, discovering and organizing content.
Where applicable law grants a right to object, users may object through official contact channels. Upon receiving an objection, the platform will assess it in light of applicable law, the necessity of the processing and the user’s individual circumstances.
8.4 AI request and operational logs
To control service costs, prevent abuse, troubleshoot issues and maintain AI services, KBH Global records necessary logs of AI requests.
In the current implementation, AI request logs may record:
1) User UID, where applicable;
2) IP address, where applicable;
3) Task type;
4) Service provider;
5) Model;
6) IDs of related content, such as posts;
7) Input character count;
8) Input content hash;
9) Token count;
10) Cost;
11) Request status;
12) Duration;
13) Time.
Current AI request logs do not retain the post body or prompt text submitted by users. They retain only metadata needed for logging, cost control, security and troubleshooting, such as length and hashes.
Log structures differ between AI tasks.
The platform should set reasonable retention periods based on log purposes and should not retain logs indefinitely merely because this is technically possible.
8.5 Data processing by AI service providers
Third-party AI service providers may process data submitted by the platform under the applicable service terms, data processing terms and technical arrangements between them and KBH Global.
When selecting and using these providers, KBH Global should reasonably assess:
1) Data purposes;
2) Data retention;
3) Security measures;
4) Cross-border processing;
5) Whether API data is used for model training or other independent purposes;
6) Applicable data processing agreements or other safeguards.
Unless users are separately and clearly informed and legally required authorization or consent is obtained, KBH Global will not provide user content to third parties for training third-party general-purpose AI models.
Specific providers and their processing may be explained in this Policy, feature descriptions or provider information published by the platform.
9. KBH Safety and community safety data
KBH Global may use local rules, keyword matching, automated tools, human review or other safety mechanisms to help identify content violating the Community Rules.
In the current implementation, KBH Safety processes content using the platform’s local safety rules and does not currently send content to external content safety providers.
Depending on platform settings, KBH Safety may operate in observation-only mode or check new topics and replies before publication.
If an external content safety service is integrated in the future, the platform should update this Policy or relevant explanations according to the actual data flow.
9.1 Information Safety may process
When the safety system identifies content requiring further handling, the platform may process:
1) Post title;
2) Post body;
3) Reply content;
4) Username or related account identifier;
5) UID;
6) IP address;
7) Forum section and topic IDs;
8) Matched rules or safety categories;
9) Review status;
10) Action records;
11) Other information necessary to assess the case.
In the current implementation, Safety does not retain submissions that pass pre-publication checks (PASS). For submissions that are blocked, require human review, trigger rate limits or cannot be checked due to system failure, the full content title and body, UID and IP address may be retained. Submissions held for human review may also retain the username and attachment references.
This information may be used to:
1) Determine whether the Community Rules have been violated;
2) Conduct human review;
3) Prevent repeated violations;
4) Investigate malicious evasion;
5) Handle appeals;
6) Maintain platform security;
7) Preserve necessary evidence when legally required.
9.2 Retention limits for Safety data
Safety governance requires some evidence retention, but this does not mean all Safety data should be kept permanently.
The platform should consider:
1) Whether a violation is ultimately confirmed;
2) The severity of the violation;
3) Whether an appeal has been made;
4) The risk of repeat violations;
5) Whether fraud or a major security incident is involved;
6) Whether a legal retention obligation applies;
when setting reasonable retention periods.
Full content snapshots relating to false positives, content ultimately cleared, or content no longer needed should be deleted, anonymized or otherwise appropriately handled once there is no reasonable governance, security or legal purpose for retaining them.
Records supporting actual penalties, fraud investigations, security incidents or disputes may be retained for longer periods that are reasonably necessary.
10. Reports, responses, appeals and community governance data
KBH Global may process reports, responses, appeals and related evidence submitted by users under the Community Rules.
Where the online reporting system does not yet provide the relevant functionality, users may submit materials through the official contact email.
10.1 Information processed when a report is made
When a reporter submits a report, the platform may process:
1) The reporter’s account information;
2) The subject of the report;
3) The reason for the report;
4) Relevant posts, replies, images, public profiles or business information;
5) Screenshots;
6) URLs;
7) Explanations submitted by the reporter;
8) Other evidence submitted by the reporter;
9) Technical and security information necessary to prevent abuse of reporting.
10.2 Responses and appeals from reported users
When a reported user responds or appeals, the platform may process:
1) User account information;
2) The response;
3) Screenshots;
4) Authorization documents;
5) Business materials;
6) Transaction-related materials;
7) Other counter-evidence;
8) Grounds for appeal;
9) Other information necessary for review.
When submitting evidence, users should avoid providing identity documents, bank information, home addresses or other sensitive personal information unrelated to the case wherever possible.
10.3 Disclosure of information between parties to a case
To allow a reported user to respond effectively, KBH Global may provide the necessary reported facts, relevant Community Rules numbers and reasonably necessary evidence.
This does not entitle the reported user to all original materials submitted by the reporter.
For privacy, safety, protection against retaliation or other lawful needs, the platform may:
1) Redact personal information;
2) Conceal private contact details;
3) Conceal identity document numbers;
4) Conceal bank information;
5) Summarize evidence;
6) Restrict disclosure of the reporter’s identity;
7) Take other reasonable data minimization measures.
When informing a reporter of a case outcome, the platform should likewise avoid unnecessarily disclosing the reported user’s private information or backend records.
10.4 Public penalty information
KBH Global may currently display some account penalty information on its public penalties or banned accounts page. Under the existing system, the page may show the username, penalty type, time, duration and the reason recorded by the platform.
KBH Global is gradually narrowing the scope of public penalty information to the necessary minimum consistent with the Community Rules. As a general principle, the new public penalty rules will disclose only:
1) Username;
2) The CR number of the Community Rule violated;
3) Penalty type;
4) Penalty duration or current status.
The new public penalty rules will avoid disclosing:
1) Reporter identity;
2) Complete reporting evidence;
3) Email;
4) IP address;
5) Private telephone numbers;
6) Identity documents;
7) Private communications;
8) Backend review materials;
9) Detailed case information unrelated to the purpose of public governance.
When a penalty is revoked or no longer meets the Community Rules’ conditions for public disclosure, the relevant public record should be promptly removed or updated.
11. K Coin, platform benefits and order data
K Coin consists of virtual service points used within the KBH Global community.
K Coin can currently be obtained through methods actually available on the platform, such as platform activities, rewards, official gifts, service compensation and redemption codes.
The KBH Global website currently does not directly sell K Coin or redemption codes. Users who obtain a valid redemption code can redeem it for K Coin through the KBH Global redemption entry. The current redemption feature is not a K Coin top-up service.
11.1 K Coin accounting information
To maintain K Coin balances and accounting integrity, the platform may process:
1) User UID;
2) K Coin balance;
3) K Coin acquisition records;
4) K Coin spending records;
5) Values before and after balance changes;
6) K Coin source;
7) Related business type and service;
8) Transaction ID, related order or business identifier;
9) Idempotency or duplicate-prevention identifiers;
10) Time;
11) Necessary records of corrections to irregularities.
This information is used to:
1) Calculate balances;
2) Prevent duplicate deductions;
3) Investigate accounting irregularities;
4) Restore orders and benefits;
5) Handle users’ accounting queries;
6) Prevent fraud and abuse.
11.2 Platform services and orders
If users obtain Global Businesses showcases, memberships, promotions or other platform services provided by KBH Global itself, the platform may process:
1) User UID;
2) Service type;
3) Required K Coin or price;
4) Purchase or redemption time;
5) Service start time;
6) Expiry time;
7) Service status;
8) Order status;
9) A snapshot of service conditions or benefits at purchase;
10) Other information necessary for service delivery and correction of errors.
Describing paid or top-up services not yet actually available does not mean that the related payment data processing currently takes place.
11.3 Future purchases with fiat currency, top-ups or other payments
If KBH Global introduces purchases with fiat currency, top-ups or other payment features in the future, the platform should update this Privacy Policy when those features launch to reflect the actual process and explain:
1) Payment service providers;
2) Payment data actually received by the platform;
3) Payment status;
4) Refunds;
5) Chargebacks;
6) Tax or invoice information;
7) Other payment processing information required by law.
KBH Global should not invent payment data processing that does not currently exist before payment functionality has been determined.
12. Global Businesses and business showcase data
When users apply for or use Global Businesses, Showcase, Prime, Featured, Spotlight or other business showcase features actually available, the platform may process the following according to the feature:
1) User account;
2) Username;
3) Avatar;
4) Business bio;
5) Product or business category;
6) Country or region;
7) Showcase type;
8) Showcase start time;
9) Showcase expiry time;
10) Order status;
11) Other information necessary to provide the showcase feature.
Whether a showcase service is available depends on the platform’s actual features.
Unless the platform expressly launches a genuine identity verification or business certification service, a business showcase alone does not mean that KBH Global has verified the business’s identity, creditworthiness, qualifications, products or ability to perform its obligations.
13. Third-party service providers
We may use third-party service providers to deliver KBH services.
Depending on current features or configuration, categories may include:
1) Third-party login services;
2) AI service providers;
3) Email delivery providers;
4) Cloud servers or hosting infrastructure;
5) Security and technical services;
6) Machine translation or payment providers actually enabled in the future;
7) Other providers reasonably necessary to deliver KBH services.
Currently confirmed services that process user data when their relevant features are used include:
- Google: third-party login;
- DeepSeek: AI text processing actively used by users, such as writing refinement.
Integrated technical services whose associated user features are not currently enabled include:
- Alibaba Cloud International (Qwen-MT): machine translation.
Hosting providers, email delivery providers and future payment providers depend on the services actually used by the platform.
KBH Global should provide service providers only with data reasonably necessary to perform their services, and adopt contractual, security or other data protection measures according to applicable law and practical feasibility.
14. Cross-border data processing
KBH Global serves users in different countries and regions and may use infrastructure and technical services located in different countries or regions.
Users’ information may therefore be stored, accessed or processed outside their own country or region.
According to the technical architecture currently verified:
1) KBH Global’s servers are located in Hong Kong;
2) When KBH Global uses DeepSeek for relevant AI services, data submitted to that service may be processed and stored in the People’s Republic of China. The specific arrangements depend on the DeepSeek service actually used by KBH Global, the relevant contracts or service terms, and DeepSeek’s data processing rules then in effect;
3) Google login may involve cross-border data processing by Google;
4) If machine translation is enabled in the future, processing may involve the service regions used by Alibaba Cloud International, depending on the actual configuration.
Actual processing locations may change as service configurations, provider infrastructure or platform features change.
14.1 Cross-border safeguards
Where applicable law imposes requirements on cross-border processing of personal information, KBH Global will take the necessary measures appropriate to the circumstances, such as:
1) Providing legally required notices;
2) Obtaining consent or separate consent where legally required;
3) Using applicable standard contractual clauses or other contractual measures;
4) Conducting legally required data protection or cross-border impact assessments;
5) Applying necessary security safeguards;
6) Meeting other legally applicable cross-border data requirements.
Cross-border rules differ between countries and regions.
This Policy should not be read as stating that every cross-border mechanism applies to all users simultaneously.
15. Legal requirements and necessary disclosures
KBH Global will not arbitrarily disclose users’ non-public personal information merely because it receives an ordinary third-party request.
Depending on the circumstances, the platform may process or disclose necessary information where:
1) Required by applicable law;
2) A competent authority makes a valid lawful request;
3) A court, arbitral institution or other competent body lawfully requires it;
4) Serious fraud, security incidents or unlawful conduct are being investigated;
5) Necessary to protect the life, physical safety or significant lawful rights and interests of users, the platform or others;
6) Necessary to establish, exercise or defend legal rights;
7) Otherwise permitted or required by law.
The platform should examine requests in light of the circumstances and, wherever possible, limit disclosure to what is reasonably necessary.
Platform governance decisions are not determinations of users’ legal liability by judicial, administrative or law enforcement authorities.
16. Data retention periods
KBH Global should not retain personal information indefinitely merely because long-term storage is technically possible.
The platform determines reasonable retention periods for different information based on:
1) The time needed to provide the relevant KBH services;
2) Whether the account remains active;
3) The nature and sensitivity of the data;
4) Security, fraud prevention and community governance needs;
5) Whether reports, responses, appeals or disputes are still being handled;
6) Whether K Coin, orders or platform benefits require verification;
7) Backup and disaster recovery cycles;
8) Retention obligations under applicable law;
9) The time reasonably necessary to establish, exercise or defend legal rights;
10) Other reasonable needs directly related to the original processing purpose.
When the processing purpose has been fulfilled, the retention period has expired, the information is no longer necessary and there is no other lawful basis for retention, the platform should delete, anonymize or otherwise appropriately handle it according to the circumstances.
16.1 Account data
Basic account information necessary for normal account operation may be retained while the account exists.
After account closure or termination, profile information no longer needed for public display should cease to be public under the account closure rules and be handled according to this Policy.
To prevent users responsible for serious violations from evading penalties through account closure or re-registration, the platform may retain minimized necessary security identifiers within a reasonably necessary scope and period.
16.2 Verification codes and temporary verification data
Verification codes, temporary login credentials, temporary OAuth states and similar verification data should be retained only for the short period needed for the relevant verification, security checks and abuse prevention.
After verification is complete, has expired or the related risk has ended, temporary data no longer needed should be cleared under the platform’s data retention rules.
Necessary records relating to account security, fraud or unusual verification activity may continue to be retained for a reasonable period.
16.3 AI logs and technical logs
Reasonable retention periods should be set for AI request logs, security logs, access records and other technical logs according to their actual purposes.
Logs used for general cost statistics, troubleshooting or routine abuse prevention should not be retained permanently without a clear reason.
Records involving major security incidents, fraud, attacks, disputes or legal retention requirements may be kept longer while the relevant purpose exists.
16.4 Safety, reporting and appeal records
Safety, reporting, response and appeal data should be retained according to case outcomes and risk levels.
For example:
1) Full content relating to false positives or cases ultimately requiring no action may be deleted or anonymized after a reasonably short period;
2) Cases resulting in actual penalties may be retained for a reasonable period for appeals, assessment of repeat violations and platform security;
3) Cases involving serious fraud, minors’ safety, major security incidents, intellectual property disputes or other potential legal disputes may be retained longer according to the actual risk and legal requirements.
The platform should avoid retaining every case’s complete content and IP addresses indefinitely on the basis that they “might be useful later”.
16.5 K Coin, order and platform benefit records
K Coin transaction histories, orders, platform benefits and data related to accounting verification may require longer retention than ordinary content.
Retention purposes may include:
1) Checking balances;
2) Restoring irregular data;
3) Handling refunds or corrections;
4) Resolving disputes;
5) Preventing fraud;
6) Meeting legally applicable accounting, tax or other recordkeeping obligations.
Even after account closure, these data may continue to be retained on a restricted basis for the period required by law or reasonably necessary.
16.6 Internal retention schedule
KBH Global should establish internal data retention rules matching its actual systems and adjust them according to data categories, risks and applicable law.
Internal retention periods, backup cycles, security architecture and specific technical implementation details need not all be made public, but actual processing should not contradict the principles explained to users in this Policy.
17. Account closure and deletion of personal information
Users may request account closure and deletion of personal information through the account closure features actually provided by the platform or its official contact channels.
Where self-service account closure is not yet available, users may submit requests through the official contact email published on the KBH Global website.
17.1 Treatment of the account after closure
Once account closure is complete, the platform should no longer allow normal login to that account or continued use of services requiring that account identity.
Public profiles and account information no longer needed for public display should cease to be public or be handled appropriately.
17.2 Previously published content
Account closure does not necessarily mean that all posts, replies and business discussions previously published by the user must immediately be removed from every public discussion.
Depending on the nature of the content, discussion integrity, other users’ reasonable rights and interests, the user’s request and applicable law, the platform may:
1) Delete the content;
2) Anonymize the content;
3) Display the author as a closed account or in another form that no longer directly identifies the original user;
4) Retain the content on a restricted basis where there is a lawful ground for retention.
Content involving the user’s personal information, privacy or a legal requirement for deletion should be handled according to the circumstances.
17.3 Data retained for lawful or reasonably necessary purposes
After account closure, the following data may be retained where there is a lawful and necessary retention purpose:
1) K Coin and order records;
2) Platform benefit records;
3) Security logs;
4) Serious violation records;
5) Fraud investigation records;
6) Reporting and appeal records;
7) Intellectual property complaints;
8) Evidence of legal disputes;
9) Other records required by law.
For data retained solely for these purposes, the platform should restrict use for purposes unrelated to the reason for retention.
17.4 Personal information in backups
After a user requests deletion, the data may not immediately be removed from every existing backup copy.
During the normal backup lifecycle, the information may remain in backups with restricted access.
Except for security recovery, disaster recovery or other lawful and necessary purposes, the platform should not reuse data deleted from normal operational systems following a valid deletion request.
The relevant backups should gradually expire or be overwritten through the normal backup cycle.
18. Users’ personal information rights
Depending on their location, applicable law and the particular processing activity, users may have some or all of the following rights:
1) To understand how the platform processes their personal information;
2) To request access to their personal information;
3) To request a copy of their personal information;
4) To request correction or completion of inaccurate or incomplete information;
5) To request deletion of personal information where applicable conditions are met;
6) To request restriction of processing where applicable conditions are met;
7) To object to certain processing, including processing based on legitimate interests, where applicable conditions are met;
8) To withdraw consent for processing based on consent;
9) To request data portability under the conditions set by applicable law;
10) To request human review of certain automated processing or significant decisions;
11) To complain to a legally competent data protection or regulatory authority;
12) Other rights granted by applicable law.
These rights do not all apply absolutely in every circumstance.
For example, the platform may lawfully continue to retain some information to meet legal obligations, protect others’ rights, maintain security, handle disputes or keep necessary accounting records.
18.1 How to make a request
Users may submit personal information requests through the official contact email published on the KBH Global website.
A request should specify:
1) The account concerned;
2) The right the user wishes to exercise;
3) The specific matter the user wants the platform to address;
4) Other reasonably necessary explanations.
To prevent others from impersonating a user to delete, obtain or alter data, the platform may use identity verification measures proportionate to the risk of the request.
The platform should not unnecessarily require excessive identity documentation to handle an ordinary privacy request.
18.2 Handling requests
KBH Global will handle user requests within a reasonable period, taking applicable law and request complexity into account.
If the platform cannot lawfully satisfy a request in full, it may explain the main reasons to the user.
Where applicable law specifies response deadlines, appeal mechanisms or other procedural requirements, those requirements will apply.
19. Withdrawing consent
For personal information processing genuinely based on user consent, users may withdraw consent through the means provided by the platform.
Withdrawal does not affect processing already carried out on the basis of valid consent before withdrawal.
Withdrawing a particular consent may prevent continued provision of specific optional features that depend on that processing.
Not all KBH Global data processing is based on user consent.
For example, providing services requested by users, maintaining account security, meeting legal obligations, and addressing fraud and security risks may rely on other bases described in section 2 and provided for by the law actually applicable.
20. Personal information security
KBH Global will adopt reasonable technical and organizational measures to protect personal information, taking account of the platform’s scale, the nature of the data, processing purposes and actual risks.
Measures may include:
1) Access controls;
2) Authentication;
3) Necessary password or key protection;
4) Data minimization;
5) Logging and monitoring of irregularities;
6) Backups and disaster recovery;
7) Security updates and vulnerability fixes;
8) Restrictions on unnecessary internal access;
9) Reasonable security and contractual management of third-party service providers;
10) Other safeguards proportionate to actual risks.
The internet and information systems are never absolutely secure.
KBH Global does not promise that every system will be free of attacks, failures or data loss in all circumstances, but will adopt safeguards appropriate to actual risks under applicable law and reasonable security standards.
Users should also protect their account passwords, verification codes and login devices, and remain alert to phishing, scams and other account security risks.
21. Personal information security incidents
If a breach, unauthorized access, loss, alteration or other security incident involving personal information occurs, KBH Global will take reasonable measures according to the nature and risks of the incident.
These may include:
1) Investigating the incident;
2) Containing its impact;
3) Fixing vulnerabilities;
4) Restricting further access;
5) Preserving necessary incident records;
6) Assessing potential effects on users;
7) Reporting to regulators under applicable law;
8) Notifying affected users where required by applicable law;
9) Taking other necessary remedial measures.
Countries and regions may have different conditions and deadlines for notification of data security incidents.
This Policy therefore does not promise notification of every security incident within a single fixed global number of hours.
Where applicable law specifies notification requirements, KBH Global will comply with those legally applicable requirements.
22. Minors
As a general rule, KBH Global provides account services only to users aged 18 or older.
The platform does not seek to actively collect minors’ personal information.
If the platform has reasonable grounds to confirm that an account is used by someone under 18, it may restrict or terminate the account under the Terms of Use and Community Rules, and handle the related personal information under applicable law.
Parents, guardians or other relevant persons who believe a minor has provided personal information to KBH Global may contact the platform through its official contact email.
The platform will handle such requests according to the circumstances, identity verification and applicable law.
23. This Policy does not require users to disclose sensitive details publicly
Descriptions of identity verification, reporting, appeals, business exchanges or other processing in this Policy do not mean users must publicly disclose:
1) National identity document numbers;
2) Passport numbers;
3) Home addresses;
4) Bank accounts;
5) Private telephone numbers;
6) Account passwords;
7) Verification codes;
8) Other sensitive personal information unrelated to public business exchanges.
Users should not unnecessarily publish this information in public posts, replies or business profiles.
If the platform finds that such information could create a clear safety or privacy risk, it may restrict or remove the content under the Community Rules.
24. No sale of personal information
KBH Global does not base its business model on selling users’ personal information.
KBH Global will not sell users’ personal information to data brokers or other third parties merely because users register, post or use community features.
If future changes to the platform’s data processing model could materially affect the meaning of this section, the platform should update its privacy explanations and take the necessary measures under applicable law before implementing them.
This section does not affect:
1) Engaging service providers to process necessary data for KBH services;
2) Users voluntarily publishing business contact details;
3) Legally required disclosures;
4) Corporate restructuring, succession of services or other legally permitted circumstances with appropriate safeguards.
These circumstances should neither be deliberately presented as a “sale of personal information” nor used to evade legally applicable data protection obligations by invoking this section.
25. Policy updates
KBH Global may, in response to:
1) Changes to platform features;
2) Changes to actual data processing;
3) Changes in third-party service providers;
4) Security and governance needs;
5) Changes in laws and regulations;
6) Other reasonable reasons;
update this Privacy Policy.
Updates limited to wording corrections, translation improvements or adjustments to processing explanations that do not materially affect users’ rights may be made directly.
For significant changes that may materially affect users’ personal information rights and interests, the platform may notify users through on-site notices, their registered email, page notices or other reasonable means.
If new processing legally requires consent, separate consent or other specific authorization, the platform should take the appropriate measures under applicable law before beginning that processing.
26. Language versions
KBH Global may provide this Privacy Policy in English, Simplified Chinese, Traditional Chinese, Vietnamese, French and Arabic.
The platform should make reasonable efforts to ensure that language versions, in terms of:
1) Data categories;
2) Processing purposes;
3) Legal bases;
4) User rights;
5) Third-party processing;
6) Data retention;
7) Cross-border processing;
8) Security responsibilities;
convey the same meaning.
If translation creates inconsistencies between language versions, the English version may be used as an interpretive reference to the extent permitted by applicable law.
This does not exclude or restrict rights users have under mandatory personal information or data protection laws that legally apply.
27. Contact us
Users with questions about this Privacy Policy, personal information processing or their personal information rights may contact the platform through the official contact email published on the KBH Global website.
This channel may be used for:
1) Access requests;
2) Correction requests;
3) Deletion requests;
4) Account closure requests;
5) Withdrawal of relevant consent;
6) Objections to processing based on legitimate interests;
7) Privacy complaints;
8) Data security issues;
9) Personal information issues arising in reporting or appeals;
10) Other legally applicable personal information requests.
To protect accounts and personal information, KBH Global may conduct reasonable identity verification before handling high-risk requests.
If this Privacy Policy conflicts with mandatory personal information or data protection provisions that must apply by law, those mandatory provisions prevail.