# PIPL Compliance Assessment Record

## Organisation Details

| Field | Value |
|-------|-------|
| Organisation Name | Zenith Global Logistics (Shanghai) Co., Ltd |
| Unified Social Credit Code | 91310000MA1FL8K29P |
| Registered Address | 18F, Tower A, Lujiazui Financial Centre, Pudong New Area, Shanghai 200120, PRC |
| Industry Sector | International Logistics and Freight Forwarding |
| Assessment Date | 14 March 2026 |
| Personal Information Protection Responsible Person | Li Wei, Director of Information Security |

## CIIO Status Assessment

| Assessment Element | Detail |
|-------------------|--------|
| Sector classification | Transportation (logistics and freight forwarding) |
| CIIO designation status | Under review by Ministry of Transport; current assessment: not designated |
| Data localisation obligation | Not currently applicable (pending CIIO status) |
| CAC security assessment trigger | Yes — exceeded 1M individual threshold and 100K cumulative transfer threshold |

## Cross-Border Transfer Register

| Transfer ID | Data Flow | Destination | Mechanism | Volume | Validity | Next Action |
|------------|-----------|-------------|-----------|--------|----------|-------------|
| CBT-CN-001 | Customer logistics data → EU HQ | Germany | CAC Security Assessment | 150,000+ individuals | Approved until Aug 2026 | Renewal application by Jun 2026 |
| CBT-CN-002 | Employee HR data → Regional HR | Singapore | CAC Security Assessment | 2,500 employees | Approved until Aug 2026 | Renewal application by Jun 2026 |
| CBT-CN-003 | Vendor payment data → Treasury | United Kingdom | Standard Contract (filed) | 800 vendors | Filed May 2025 | Annual review May 2026 |
| CBT-CN-004 | Shipment tracking → API partners | Japan | Contract necessity exemption | 50,000 individuals | Exemption documented | Annual review Mar 2026 |

## Separate Consent Register

| Activity | Trigger Article | Consent Mechanism | Current Status |
|----------|----------------|-------------------|----------------|
| Customer data sharing with logistics partners | Art. 23 | Separate checkbox in customer portal (Chinese) | Active — 95% collection rate |
| Cross-border transfer to EU headquarters | Art. 39 | Dedicated consent form with overseas recipient details | Active — 98% collection rate |
| Employee background checks (sensitive PI) | Art. 29 | Separate written consent form at onboarding | Active — 100% for new hires |
| Driver GPS tracking (location data) | Art. 29 | Separate consent in driver app | Active — 100% for active drivers |
| Financial account processing for payments | Art. 29 | Separate consent during payment setup | Active — 97% collection rate |

## PIPIA Register

| Reference | Activity | Trigger | Date Completed | Retention Until | Next Review |
|-----------|----------|---------|---------------|-----------------|-------------|
| PIPIA-CN-001 | National ID processing for customs | Art. 55(1) — Sensitive PI | 15 Jan 2026 | 15 Jan 2029 | 15 Jan 2027 |
| PIPIA-CN-002 | Financial account processing | Art. 55(1) — Sensitive PI | 10 Feb 2026 | 10 Feb 2029 | 10 Feb 2027 |
| PIPIA-CN-003 | Employee health certificates | Art. 55(1) — Sensitive PI | 1 Dec 2025 | 1 Dec 2028 | 1 Dec 2026 |
| PIPIA-CN-004 | GPS tracking of delivery vehicles | Art. 55(1) — Sensitive PI | 15 Nov 2025 | 15 Nov 2028 | 15 Nov 2026 |
| PIPIA-CN-005 | Customer data cross-border to EU | Art. 55(5) — CBT | 1 Aug 2025 | 1 Aug 2028 | 1 Aug 2026 |
| PIPIA-CN-006 | Automated credit scoring | Art. 55(2) — Automated decisions | 20 Jan 2026 | 20 Jan 2029 | 20 Jan 2027 |
| PIPIA-CN-007 | Data sharing with logistics partners | Art. 55(4) — Sharing with processor | 1 Mar 2025 | 1 Mar 2028 | 1 Mar 2026 |

## Individual Rights Response Log

| Request ID | Date | Right Exercised | Individual | Deadline | Status | Completed |
|-----------|------|-----------------|-----------|----------|--------|-----------|
| PIR-CN-2026-001 | 10 Jan 2026 | Access and copy (Art. 45) | Zhang Wei | 31 Jan 2026 | Completed | 25 Jan 2026 |
| PIR-CN-2026-002 | 15 Jan 2026 | Deletion (Art. 47) | Li Na | 5 Feb 2026 | Completed | 1 Feb 2026 |
| PIR-CN-2026-003 | 1 Feb 2026 | Correction (Art. 46) | Wang Jun | 22 Feb 2026 | Completed | 18 Feb 2026 |
| PIR-CN-2026-004 | 5 Mar 2026 | Automated decision explanation (Art. 24) | Chen Mei | 26 Mar 2026 | In progress | — |

## Compliance Checklist

| Requirement | Article | Status | Evidence |
|------------|---------|--------|----------|
| PRC representative entity designated | Art. 53 | Compliant | Shanghai subsidiary registered |
| PI protection responsible person appointed | Art. 52 | Compliant | Li Wei appointed and disclosed |
| Lawful basis documented for all processing | Art. 13 | Compliant | Processing activity register |
| Separate consent implemented for all triggers | Arts. 23/25/29/39 | Compliant | Consent management platform |
| PIPIA completed for all mandatory triggers | Art. 55 | Compliant | 7 active PIPIAs on file |
| Cross-border transfer mechanisms in place | Art. 38 | Compliant | CAC assessment approved; standard contracts filed |
| Privacy notice in Simplified Chinese | Art. 17 | Compliant | Published on website and app |
| Incident notification procedure (72 hours) | Art. 57 | Compliant | Incident response plan documented |
| Annual PIPL training for PRC employees | Best practice | Compliant | 99% completion rate for 2025 |
| Data retention and deletion procedures | Art. 47 | Compliant | Automated lifecycle management |