GB/T 37401-2019Service assurance technical requirement for electronic commerce platform (English PDF)

3.1 Electronic commerce

Commercial activities which are carried out in the form of electronics.

NOTE: Economic activity subjects use modern information technology (including the Internet, mobile network and other information networks) to carry out commercial activities with each other, to fulfill electronization in part or in whole in the key commercial activities such as online communication, signing, payment and so on, including goods trading, service trading, intellectual property trading, etc. [GB/T 31524-2015, Definition 3.1]

3.2 Electronic commerce platform

The total of information network systems which provide match-making and related services for two parties or multiple parties of a transaction in electronic commerce activities. [GB/T 31524-2015, Definition 3.2]

3.3 Electronic commerce subject

The total of information network systems which provide match-making and related services for two parties or multiple parties of a transaction in electronic commerce activities. [GB/T 32873-2016, Definition 3.2]

5.1 Before-transaction requirements

5.1.1 Subject identity authentication

Electronic commerce platform shall have the subject identity authentication function, whose functional requirements shall at least include:

Transaction process assurance Before transaction In transaction After transaction Subject identity authentication Product service assurance Order handling Order payment Logistics distribution After-sale service Fundamental assurance Security assurance Platform environment Data management Operation and maintenance management

a) data acquisition: supporting the functions such as online fill-out and uploading corresponding documentary evidences, to fulfill the acquisition of subject's real information in the process of an electronic commerce transaction. The information acquired shall include but not limited to:

1) subject registration information, including basic information, subject identity information and so on;

2) license information, including the information of relevant administrative licenses or selling authorization licenses which are necessary for selling goods or providing services;

3) contact information, including the information of detailed address, contact telephone, e-mail and so on.

b) Information authentication: providing the functions such as online inquiry, background authentication, and examining the related transaction activity information by means of digital signature, digital certificate, etc.

c) information announcement: by means of image insertion or web page linkage, realizing the announcement of the qualification information such as license information, registration information, in prominent positions.

5.1.2 Product service assurance

5.1.2.1 Product information description

Electronic commerce platform shall have the function of describing the information of products sold clearly, including:

a) the function of product information modelling shall at least include:

1) general information module, supporting the function to describe the information entities such as the basic information, corporate information, contact information and so on of products sold, and the information elements such as product name, brand, place of origin, corporate name, contact telephone, etc.;

2) special information module, supporting the function to describe the characteristic information entities and information elements of products sold.

b) the function established by the product information description methods: supporting the establishment of the related descriptive methods of basic attributes, data types and formats, etc. of product information entities and information elements. For the detailed descriptive methods, refer to the requirements in relevant national standards such as GB/T 32670 and GB/T 33989.

5.1.2.2 Product quality assurance

Electronic commerce platform shall provide the function of online fill-out of documentary information and uploading documentary documents related to product quality assurance, and examine its compliance, legality and authenticity.

5.2 In-transaction requirements

5.2.1 Order handling

Electronic commerce platform shall provide the related function module of order handling such as order placing service, order management, etc., whose requirements shall include but not limited to:

a) the requirements of order placing service function module include:

1) providing specific transaction rules and convenient order placing processes, preferably supporting the functions such as one-key order placing;

2) providing the guidance of the whole process of order placing by means of page reminder, etc.;

3) having the functions such as order confirmation, payment method description and selection, etc. at the key links of the order placing service process;

4) describing the quantity of goods selected, expected delivery time, delivery place, distribution method, order amount details, invoice information, discounting details, which are shown by means of independent pages before confirming order;

5) providing the order detail notification function by means of text message, platform short message, related social communication software, e-mail, etc., to realize the confirmation of ordering and payment;

6) electronic commerce platform can support the distribution method selection function;

7) preferably providing multiple order placing methods, including but not limited to computer end, mobile phone end, etc.

b) the requirements for the order management function module include:

1) supporting the acquisition of information related to payment, delivery, receiving, etc. and realizing the function of order detail tracking;

2) being able to carry out historical order inquiry by setting the conditions such as time and keywords.

5.2.2 Order payment

Electronic commerce platform shall ensure the safety and convenience of order payment, its requirements including but not limited to:

a) it shall provide multiple optional payment methods and payment means through all kinds of interfaces;

b) it shall support the access to the payment processes, payment reminders, payment instructions, etc. through the technologies such as image insertion and web page linkage;

c) it shall support the notification function with the methods such as SMS and E-mail at the same time when the payment is completed;

d) it shall preferably support the real-time verification function for the on-line payment processes;

5.3 After-transaction requirements

5.3.1 Logistics distribution

Electronic commerce platform shall provide service guarantee for the logistics distribution of the products sold, its requirements including but not limited to:

a) it shall support the information display function of the whole distribution process of the goods sold in the order page, the content of information including but not limited to delivery information, transportation information, dispatching information, receiving information, etc.;

b) it shall provide the consumers the evaluation function module of logistics distribution services;

c) for those electronic commerce platforms which provide self-operated logistics distribution services, the requirements for them include:

1) the message notification function, which supports sending relevant information, such as delivery, transportation, dispatching, receiving, etc., by means of the technologies, such as E-mail, SMS and telephone;

2) the receiving confirmation function module, which preferably provide a receiving confirmation function combining the on-line and off-line ways.

5.3.2 After-sale services

5.3.2.1 Goods return or replacement service

Electronic commerce platform shall have the goods return or replacement service, its requirements including but not limited to:

a) it shall, in accordance with the instructions for goods return and replacement, clarify the form of returning goods and payment, the time and address of goods handover, the identity of deliveryman, the appearance of goods, the inspection requirements of goods, the extra expenses, etc.;

b) it shall provide package for the transportation of returned or replaced goods;

c) it preferably uses electronic documents to record the appearance and performance of the returned or replaced goods received;

d) it preferably uses electronic documents to keep all kinds of records of the process of goods return or replacement.

5.3.2.2 Dispute handling service

Electronic commerce platform shall provide the dispute handling service, its requirements including but not limited to:

a) it shall, using the technologies such as image insertion and web page linkage, publish, at notable locations on the page of electronic commerce platform, the information such as the dispute handling rules, dispute handling channels and detailed processes;

b) it shall, by means of the information technologies such as SMS, platform SMS, associated social software and E-mail to feedback the dispute complaint information, guarantee that it will confirm the receiving of the dispute complaint information to the consumers within a guaranteed time, and feedback the handling results on a timely basis to the consumers.

6.1 Security guarantee

6.1.1 Information security

The information security guarantee of electronic commerce platform shall be as specified in GB/T 22080, the specific requirements at least including:

a) it shall filter out the contents not conforming to the rules, such as videos, images and words;

b) it shall clarify the transactional information protection principles at notable locations of the website, the content including but not limited to consumer information, information access channels, information protection methods, information use purposes, information use ranges, etc.;

c) it shall allow the consumers to set limits and authorize the use right and use range of their personal information;

d) it preferably provides the details whether personal information is protected, where the protection of the consumers' personal information shall be as specified in GB/Z 28828;

e) electronic commerce platform shall follow their information protection principles in the service processes including payment and distribution;

f) the consumers' information stored by electronic commerce platform shall be processed by encryption. It shall only be used in the transactional process occurring on the electronic commerce platform, and shall be as specified in relevant laws and regulations such as the Cybersecurity Law of the People's Republic of China and the Provisions on Protecting the Personal Information of Telecommunications and Internet Users;

g) the relevant interfaces of electronic commerce platform shall provide the functions form the consumers to change, delete, cancel, etc. their personal information.

6.1.2 Network fundamental security

The network fundamental security of electronic commerce platform shall be as specified in GB/T 20270.

6.1.3 Interface security

The interface of electronic commerce platform shall include the marking-accounting interface, the product purchase-sell-stock circulation interface, the subject identity authentication interface, the logistics distribution interface, the payment service provider interface; their openness shall be as specified in the security requirements for relevant interfaces.

6.2 Platform environmental requirements

The requirements for the environment of electronic commerce platform shall include but not limited to:

a) the design of the machine rooms shall be as specified in GB/T 2887;

b) the operating systems and databases shall meet the requirements for the operation of electronic commerce platform;

c) the backup software shall ensure the completeness of the backup data. it shall support multiple backup methods such as increment, differential, on-line, off-line, etc. as well as multiple checking methods such as byte parity and fast tape scanning. It shall have the management capability of the backup media;

d) it shall use relatively mature network and system monitoring equipment and software, carry out real-time inspection, monitoring, alarming and blocking of the commonly operations of the network and system, and protect from the network attacks;

e) the fire wall shall have good performance, convenient configuration and complete management and condition monitoring means, as specified in GB/T 20281;

f) it shall have anti-virus software which features low footprint, easily deployment and management, and strong virus protection.

6.3 Data management requirements

The requirements for the data management of electronic commerce platform shall include but not limited to:

a) it shall, in accordance with the data storage protection requirements, select a corresponding encryption method to protect the data stored by the platform;

b) it shall test the completeness of the significant business and management data by means of the deployment of a detection system, etc., and take necessary recovery measures when completeness errors are detected;

c) it shall, in accordance with relevant laws, regulations and standards to handle and protect the sensitive information, e.g. the data involving personal privacy, etc.;

d) it shall carry out the data backup work regularly, the specific methods including but not limited to:

1) it shall make backups by means of full backup, incremental backup or differential backup;

2) it shall determine the backup cycle in accordance with the flow and significance of the business and management data;

3) the data backup content shall include but not limited to the basic information of a page, the personal information of the consumers, the transactional information, and the business and management information.

e) for data recovery, it shall be as specified in GB/T 20988.

6.4 Requirements for operation, maintenance and management

6.4.1 Management mechanism construction

Electronic commerce platform shall establish a management mechanism for the operation and maintenance of the platform, including but not limited to:

a) it shall establish a related mechanism to provide the comprehensive management of operation and maintenance for the objects, including electronic commerce platform, application system, services, resources, etc., and the specific measures shall be as specified in GB/T 28827.1;

b) it supports using the technologies, such as telephone, SMS, platform SMS, associated social communication software and E-mail, and establish an informationalized receiving mechanism of the relevant requests and records for the users of electronic commerce platform;

c) it shall classify the services requested by the users of the platform in terms of the whole process links and fundamental guarantee of transactions, and establish a classified handling mechanism;

d) the supervision service handles the process of relevant matters, and establish a corresponding supervisory handling mechanism;

e) it shall support using the technologies, such as telephone, SMS, platform SMS, associated social communication software and E-mail, call back to know about the handling and implementation of the requests received, and establish a call-back feedback mechanism;

f) it shall use the methods, such as reporting, alarming, statistical analysis and tracing of complaints, and establish a complaint management mechanism;

g) it shall clarify the requirements for the management and technology in terms of operating procedures, emergency response, routine maintenance, custody of software and hardware files, information privacy, access management, etc., and establish a security mechanism;

h) electronic commerce service providers shall provide an evaluation system to evaluate the quality of services.

6.4.2 Personnel requirements

Electronic commerce platform shall establish a corresponding operation, maintenance and management mechanism; provide staff in terms of technology, services, management, etc., the number of personnel as required by the actual business requirements; the requirements shall include but not limited to:

a) they shall abide by the national laws and regulations as well as all the rules and regulations and professional ethics required for their posts;

b) they shall have the security secrecy consciousness and have the emergency response capabilities;

c) they shall master the professional knowledge required for their posts.

6.4.3 Requirements for posts and training

Electronic commerce platform shall clarify the responsibilities of all posts, and provide training for relevant staff at different posts. The specific requirements include but not limited to:

a) it shall establish the posts such as after-sale service, operation and maintenance management, and security and secrecy, which are responsible for the guarantee of the overall operation of the services of electronic commerce platform;

b) it shall, in accordance with the details of different posts, organize relevant staff to participate in pre-job and on-job training in order to meet the requirements for the post skills and qualities;

c) the newly-recruited and temporary employees shall take up their work after they pass the training.

Bibliography [1] GB/T 31524-2015, Specification of operations and technology for electronic commerce platform [2] GB/T 32670-2016, Information description of product for electronic commerce transaction - Clothing [3] GB/T 32873-2016, Specification for basic information of electronic commerce subject [4] GB/T 33989-2017, Information description of product for electronic commerce transaction - Tourism service [5] Information description of product for electronic commerce transaction--Tourism service (Order No. 53 of the President of the People's Republic of China)

[6] Provisions on Protecting the Personal Information of Telecommunications and Internet Users (Order No. 24 of the Ministry of Industry and Information Technology of the People's Republic of China) […]