Privacy Policy

Privacy Policy

Last Updated: April 7, 2020

Welcome to FaceU (the “Platform”). The Platform is provided and controlled by Bytedance Pte. Ltd. (“we” or “us”). We are committed to protecting and respecting your privacy. This policy sets out the basis on which any information we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your information and how we will treat it. By accessing or using our Platform, services, applications, products and content (collectively, the “Services”), you are accepting and consenting to the practices described in this policy. Capitalized terms that are not defined in this policy have the meaning given to them in the Terms of Service.

1. The types of information we collect

We may collect and use the following information about you:

· Location information we collect about you. With your consent, we may collect your location via Global Positioning System (GPS) data. If you do not wish to share your precise location with us, you can switch off location services via the settings on your mobile device.

· Technical information we collect about you. We automatically collect certain information from you when you access or use the Services, including unique device identifiers, IP address, mobile carrier, time zone setting, mobile phone area, language option, mobile or device model, device manufacturer, operating system, network (e.g., 4G, 5G, wifi), camera parameters, CPU and/or GPU information and information regarding your use of the Platform.

· Behavioral information we collect about you. We also collect information regarding your use of the Services, e.g., photo shooting acts, shooting scenes, filter selection, filter preference.

2. How we use your information

We will use the information in the following ways:

We may use your information to:

· personalize the content you receive and provide you with tailored content (e.g., location and other stickers, filters, emojis) that may be of interest to you;

· notify you about changes to our Services;

· provide you with user support;

· enforce our terms, conditions and policies;

· market to you; and

· communicate with you.

As it is in our legitimate interests to be responsive to you and to ensure the proper functioning of our products and organization, we may use your information to:

· improve the Platform and to ensure content from the Platform is presented in the most effective manner for you and your device;

· administer the Platform and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;

· allow you to participate in interactive features of the Platform, when you choose to do so;

· keep the Platform safe and secure; and

· develop our Platform and conduct product development.

3. How we share your information

We may make available or otherwise share information about you with selected third parties in or outside your country, including with:

· our suppliers and subcontractors who help us run the Platform;

· data analytics, crash analytics, marketing analytics, and search engine providers that assist us in the improvement and optimization of the Platform.

We may share your information with any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, or companies that we control, are controlled or under common control, and our service providers and strategic business partners, in each case in or outside your country, for the purposes set out above, to assist in the improvement and optimization of the Platform, or for our internal business purposes.

We may share your information with law enforcement agencies, public authorities or other organizations if legally required to do so, or if we have a good faith belief that such use is reasonably necessary to:

· comply with legal obligation, process or request;

· enforce our Terms of Service and other agreements, policies, and standards, including investigation of any potential violation thereof;

· detect, prevent or otherwise address security, fraud or technical issues; or

· protect the rights, property or safety of us, our users, a third party or the public as required or permitted by law (including exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction).

We may also disclose your information to third parties:

· in the event that we sell or buy any business or assets in which case we may disclose your information to the prospective seller or buyer of such business or assets; or

· if we sell, buy, merge, are acquired by, or partner with other companies or businesses, or sell some or all of our assets. In such transactions, user information may be among the transferred assets.

We do not share or store your face data.

4. Where we store your information

The information that we collect from you may be transferred to, and stored at, a destination outside of your country, specifically to Singapore. It may also be processed by staff, for example senior data engineers, operating outside your country who work for us, for one of our suppliers or one of our business partners. By submitting your information, you agree to this transfer, storing or processing. We will take reasonable steps to secure your information and treat it in accordance with this policy.

5. Third party websites and links

Our Platform may integrate with third-party applications or software or contain links to other online platforms or services operated by third parties. We do not control and this policy does not apply to such other online applications, software, platforms or services and are not responsible for their content, their privacy policies, or their use of your personal information.

6. The security of your information

We will take reasonable steps to secure your information and treat it in accordance with this policy. We have appropriate technical and organizational measures to ensure a level of security appropriate to the risk of varying likelihood and severity for the rights and freedoms of you and other users. We maintain these technical and organizational measures and will amend them from time to time to improve the overall security of our systems. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your information, we cannot guarantee the security of your information transmitted through the Platform; any transmission is at your own risk. We do not guarantee that our Services will be secure or free from bugs or viruses, and we cannot guarantee that there will be no possibility of loss of cybersecurity during or post your use of our Services. You are responsible for configuring your information technology, computer programmes and platform to access our Services. You should use your own virus protection software.

7. Data retention

We will delete your information upon request. Unless we have received your request to delete your information, we will use the following criteria to determine the period for which we will keep your information:

· our contractual obligations and rights in relation to the information involved;

· legal obligations under applicable laws and regulations to retain data for a certain period of time;

· statute of limitations under applicable laws;

· our legitimate business purposes; and

· disputes or potential disputes.

After you have terminated your use of our Services, we may store your information in an aggregated and anonymized format until it is no longer necessary to serve our lawful purposes of collecting such information. Notwithstanding the foregoing, we may still retain any personal information as reasonably necessary to comply with our legal obligations, allow us to resolve and litigate disputes, and to enforce our agreements.

8. Information relating to children

The Platform is not directed at children under the age of 13. Users under the relevant age are not allowed to use the Platform. If we become aware that personal information has been collected from a person under the relevant age, we will delete the user’s information. If you believe that we may have information about or collected from a child under the relevant age, please contact us at the address at faceu_business@bytedance.com.

9. Complaints

In the event that you wish to make a complaint about how we process your personal information, please contact us in the first instance at the email address at the end of this policy and we will endeavor to deal with your request as soon as possible. This is without prejudice to your right to launch a claim with your information protection authority or follow the dispute process.

10. Changes

We will use commercially reasonable efforts to generally notify all users of any material changes to this policy, such as through a notice on our Platform, however, you should look at this policy regularly to check for such changes. We will also update the “Last Updated” date at the top of this policy, which reflects the effective date of such policy. Your continued access to or use of the Services after the date of the updated policy constitutes your acceptance of the updated policy. If you do not agree to the updated policy, you must stop accessing or using the Services.

11. Contact

Questions, comments and requests regarding this policy are welcomed and should be addressed to:

Bytedance Pte. Ltd.

Email Address: faceu_business@bytedance.com

SUPPLEMENTAL TERMS – JURISDICTION-SPECIFIC

In the event of a conflict between the provisions of the Supplemental Terms – Jurisdiction-Specific that are relevant to your jurisdiction from which you access or use the Services, and the rest of the policy, the relevant jurisdictions’ Supplemental Terms – Jurisdiction-Specific will supersede and control.

Brazil. If you are using our Services in Brazil, the following additional terms apply and in the event of any conflict between the following additional terms and the provisions of the main body of this Privacy Policy, the following terms shall prevail:

· Exercise of data protection rights. Brazilian law provides certain rights to individuals with regard to their personal data. Thus, we seek to ensure transparency and access controls in order to allow users to benefit from the mentioned rights.

We will respond and/or fulfill your requests for the exercise of your rights below, according to the applicable law and when applicable, to the Brazilian General Data Protection Law - LGPD, once it comes into force:

a. confirmation of whether your data are being processed;

b. access to your data;

c. correction of incomplete, inaccurate or outdated data;

d. anonymization, blocking or erasure of data;

e. portability of personal data to a third party;

f. object to the processing of personal data;

g. information of public and private entities with which we shared data;

h. information about the possibility to refuse providing personal data and the respective consequences, when applicable;

i. withdrawal of your consent.

· Verifying your identity. For your safety and to allow us to make sure that we do not disclose any of your personal data to unauthorized third parties, in order to verify your identity and guarantee the adequate exercise of your rights, we may request specific information and/or documents from you before we can properly respond to a request received concerning your data. All data and documents received from you in the process of responding to your requests will be used for the strict purposes of analyzing your request, authenticating your identity, and finally responding to your request.

· Limitations to your rights. In certain situations, we may have legitimate reasons not to comply with some of your requests. For instance, we may choose not to disclose certain information to you when a disclosure could adversely impact our business whenever there is a risk of violation to our trade secrets or intellectual property rights. In addition, we may refrain from complying with a request for erasure when the maintenance of your data is required for complying with legal or regulatory obligations or when such maintenance is required to protect our rights and interests in case a dispute arises. Whenever this is the case and we are unable to comply with a request you make, we will let you know the reasons why we cannot fulfill your request.

In case of doubt about your privacy, your rights or how to exercise them, please contact us through the form "Contact". If you have any questions about the processing of your personal data, we would like to clarify them.

· International Transfer of Data. We share your personal data globally with companies of our business group to carry out the activities specified in this Policy. We may also subcontract the processing of data involved in the Services or share your personal data with third parties located in other countries. Your personal data may therefore be subject to privacy laws other than those applicable in your country.

Whenever we transfer your personal data to third parties located in other countries, we will ensure that these companies comply with applicable data protection laws and we will take all measures that are reasonably necessary to ensure the existence of adequate safeguards to protect your personal data and to ensure that are processed safely.

· Parental and Guardian Consent. If required by Brazilian data protection laws, (i) if you are over the age of 16 but under the age of 18, you can only use and register for an account with the assistance of your parent or legal guardian and you declare and represent that you had such assistance to use the Services and to agree to the Policy; (ii) if you are over the age of 13 but under the age of 16, you can only use and register for an account with the representation of your parent or legal guardian, and you must obtain the consent from your parent or legal guardian to the use of the Services and acceptance of this Privacy Policy.

· Language. The Policy may have been prepared in the English language and in the Portuguese language. If you are a user located in Brazil, you shall refer to the Portuguese version, which shall prevail.

United States. If you are using our Services in the United States, the following additional terms apply:

· California Privacy Rights

If you are a California resident, under California law you may request certain information about our disclosure of personal information to third parties for their own direct marketing purposes during the preceding calendar year. This request is free and may be made once a year.

Your browser may offer you a “Do Not Track” option, which allows you to signal to operators of websites and web applications and services (including behavioral advertising services) that you do not wish such operators to track certain of your online activities over time and/or across different websites. Our products do not support Do Not Track requests at this time.

Vietnam. If you are using our Services in Vietnam, the following additional terms apply:

· Parental and Guardian Consent. Subject to section entitled “8. Information relating to children”, we may collect and use data of users under the age of 16 as contemplated under this policy. If you are under the age of 16, you declare that your parent or legal guardian has consented to our Terms of Service and this policy and you had the consent of your parent or legal guardian to use the Services.

· Data Security Notice to Users under 16. Although we will do our best to protect your information, we cannot guarantee the security of your information (including any information collected by us and any information provided and/or updated by you when using the Services) transmitted through the Platform; any transmission is at your own risk. Please see further information under the section entitled “6. The security of your information” above.

· Your Rights

o Marketing. You have the right to ask us not to process your personal data for email or text marketing purposes. We will usually inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your data. You can also exercise the right at any time by contacting us at faceu_business@bytedance.com.

o Data Rights. You have the right to access personal data we hold about you, to rectify any personal data held about you that is inaccurate, to update and change any personal data held about you and to request the deletion of personal data held about you. You can exercise your rights by contacting us at faceu_business@bytedance.com.

Thailand. If you are using our Services in Thailand, the following additional terms apply:

· Parental and Guardian Consent. Subject to section entitled “8. Information relating to children”, we may collect and use data of users under the age of 20 as contemplated under this policy. If you are under the age of 20, you declare that your parent or legal guardian has consented to our Terms of Service and this policy and you had the consent of your parent or legal guardian to use the Services.

· Your Rights

o Data Rights. You have the right to access personal data we hold about you, right to revise any personal data held about you that is inaccurate, right to data portability, right to object or suspend the storage, use or disclosure of personal data held about you, right to be forgotten and the right to withdraw your consent under this policy. You can exercise your rights by contacting us at faceu_business@bytedance.com.

Indonesia. If you are using our Services in Indonesia, the following additional terms apply and in the event of any conflict between the following additional terms and the provisions of the main body of this Privacy Policy, the following terms shall prevail.

· Parental and Guardian Consent. If you are under the age of 21, you declare that you had the consent of your parent or legal guardian to use the Services.

· Data Rights. You have the right to access personal data in our Platform from time to time.

· Notification. In the event of we fail to maintain the confidentiality of your personal data in our Platform, we will notify you immediately through the contact information provided by you.

· Language. This policy is written in the English language and Indonesian language. In the event of any inconsistency or different interpretation between the English text and Indonesian text, the relevant Indonesian text shall be deemed to be automatically amended to conform with and to make the relevant Indonesian text consistent with the relevant English text. Each party acknowledges that it has read this policy and understands its content and that this policy has been entered into freely and without duress. You acknowledge that you fully understand the language and the content of this policy and you agree that you will not use the provisions under Law No. 24 of 2009 of the Republic of Indonesia on Flag, Language, Coat of Arms and National Anthem to invalidate this policy.

· Change to the terms. The following terms shall apply with priority over “Changes” above: “we may amend this policy from time to time to the extent that is permitted by the applicable laws. In the event we amend this policy, we will notify you of the effective date of the changes through (i) a notice to be posted on the landing page of our website or the splash screen of our mobile app or (ii) the contact information you provided to us. If you fail to explicitly express your objection to the amended policy even though we notified you that your failure to do so within the above advance notification period will be considered as an acceptance of the changes, you will be considered to have agreed to the new policy.”