Privacy Policy

Privacy Policy

Last Updated: June 13, 2022

Welcome to Ulike (the “Platform”). The Platform is provided and controlled by Bytedance Pte. Ltd. (“we” or “us”). We are committed to protecting and respecting your privacy. This policy sets out the basis on which any information we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your information and how we will treat it. By accessing or using our Platform, services, applications, products and content (collectively, the “Services”), you are accepting and consenting to the practices described in this policy. Capitalized terms that are not defined in this policy have the meaning given to them in the Terms of Service.

1. The types of information we collect

We may collect and use the following information about you:

· Technical information we collect about you. We automatically collect certain information from you when you access or use the Services, including unique device identifiers, IP address, mobile carrier, time zone setting, country and region, mobile country code, mobile phone area, language option, mobile or device model, device manufacturer, operating system, network (e.g., 4G, 5G, wifi), camera parameters, CPU and/or GPU information and information regarding your use of the Platform.We also automatically collect data about device performance, errors, and crashes and collect other technical data used for measuring diagnostics.

· Behavioral information we collect about you. We also collect information regarding your use of the Services, e.g., photo shooting acts, shooting scenes, filter selection, filter preference.

· If you use the ultra-clear function, we will temporarily upload your photo to our servers in order to process the photo and apply the ultra-clear effect. After completion, we will immediately delete the photo from our servers.

· Information in communications and correspondence you send us such as information you send us for user support.

2. How we use your information

We will use the information in the following ways:

We may use your information to:

· fulfill requests for products, services, Platform functionality, support and information for internal operations, including troubleshooting, data analysis, testing, research, statistical, and survey purposes and to solicit your feedback;

· personalize the content you receive and provide you with tailored content (e.g., stickers, filters, emojis) that may be of interest to you;

· notify you about changes to our Services;

· provide you with user support;

· enforce our terms, conditions and policies;

· market to you;

· communicate with you;

· understand how you use the Platform, including across your devices;

· make suggestions and provide a customized ad experience; and

· measure and understand the effectiveness of the advertising we serve to you and others.

As it is in our legitimate interests to be responsive to you and to ensure the proper functioning of our products and organization, we may use your information to:

· improve the Platform and to ensure content from the Platform is presented in the most effective manner for you and your device;

· administer the Platform and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;

· allow you to participate in interactive features of the Platform, when you choose to do so;

· keep the Platform safe and secure; and

· develop our Platform and conduct product development.

3. How we share your information

We may make available or otherwise share information about you with selected third parties in or outside your country, including with:

· our suppliers and subcontractors who help us run the Platform;

· payment providers in connection with our paid VIP subscription service, such as Apple and Google;

· data analytics, crash analytics, marketing analytics, advertising, and search engine providers that assist us in the improvement and optimization of the Platform.

We may share your information with any member of our corporate group, which means our affiliates, subsidiaries, our ultimate holding company and its subsidiaries, or companies that we control, are controlled or under common control, and our service providers and strategic business partners, in each case in or outside your country, for the purposes set out above, to assist in the improvement and optimization of the Platform, or for our internal business purposes.

We may share your information with law enforcement agencies, public authorities or other organizations if legally required to do so, or if we have a good faith belief that such use is reasonably necessary to:

· comply with legal obligation, process or request;

· enforce our Terms of Service and other agreements, policies, and standards, including investigation of any potential violation thereof;

· detect, prevent or otherwise address security, fraud or technical issues; or

· protect the rights, property or safety of us, our users, a third party or the public as required or permitted by law (including exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction).

We may also disclose your information to third parties:

· in the event that we sell or buy any business or assets in which case we may disclose your information to the prospective seller or buyer of such business or assets; or

· if we sell, buy, merge, are acquired by, or partner with other companies or businesses, or sell some or all of our assets. In such transactions, user information may be among the transferred assets.

4. Where we store your information

The information that we collect from you may be transferred to, and stored at, a destination outside of your country, specifically to Singapore. It may also be processed by staff, for example senior data engineers, operating outside your country who work for us, for one of our suppliers or one of our business partners. By submitting your information, you agree to this transfer, storing or processing. We will take reasonable steps to secure your information and treat it in accordance with this policy.

5. Third party websites and links

Our Platform may integrate with third-party applications or software or contain links to other online platforms or services operated by third parties. We do not control and this policy does not apply to such other online applications, software, platforms or services and are not responsible for their content, their privacy policies, or their use of your personal information.

6. The security of your information

We will take reasonable steps to secure your information and treat it in accordance with this policy. We have appropriate technical and organizational measures to ensure a level of security appropriate to the risk of varying likelihood and severity for the rights and freedoms of you and other users. We maintain these technical and organizational measures and will amend them from time to time to improve the overall security of our systems. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your information, we cannot guarantee the security of your information transmitted through the Platform; any transmission is at your own risk. We do not guarantee that our Services will be secure or free from bugs or viruses, and we cannot guarantee that there will be no possibility of loss of cybersecurity during or post your use of our Services. You are responsible for configuring your information technology, computer programmes and platform to access our Services. You should use your own virus protection software.

7. Data retention

We will delete your information upon request. Unless we have received your request to delete your information, we will use the following criteria to determine the period for which we will keep your information:

· our contractual obligations and rights in relation to the information involved;

· legal obligations under applicable laws and regulations to retain data for a certain period of time;

· statute of limitations under applicable laws;

· our legitimate business purposes; and

· disputes or potential disputes.

After you have terminated your use of our Services, we may store your information in an aggregated and anonymized format until it is no longer necessary to serve our lawful purposes of collecting such information. Notwithstanding the foregoing, we may still retain any personal information as reasonably necessary to comply with our legal obligations, allow us to resolve and litigate disputes, and to enforce our agreements.

8. Information relating to children

The Platform is not directed at children under the age of 13. Users under the relevant age are not allowed to use the Platform. If we become aware that personal information has been collected from a person under the relevant age, we will delete the user’s information. If you believe that we may have information about or collected from a child under the relevant age, please contact us at the address at ulike_mkt_bd@bytedance.com.

9. Complaints

In the event that you wish to make a complaint about how we process your personal information, please contact us in the first instance at the email address at the end of this policy and we will endeavor to deal with your request as soon as possible. This is without prejudice to your right to launch a claim with your information protection authority or follow the dispute process.

10. Changes

We will use commercially reasonable efforts to generally notify all users of any material changes to this policy, such as through a notice on our Platform, however, you should look at this policy regularly to check for such changes. We will also update the “Last Updated” date at the top of this policy, which reflects the effective date of such policy. Your continued access to or use of the Services after the date of the updated policy constitutes your acceptance of the updated policy. If you do not agree to the updated policy, you must stop accessing or using the Services.

11. Contact

Questions, comments and requests regarding this policy are welcomed and should be addressed to:

Bytedance Pte. Ltd.

Email Address: ulike_mkt_bd@bytedance.com

SUPPLEMENTAL TERMS – JURISDICTION-SPECIFIC

In the event of a conflict between the provisions of the Supplemental Terms – Jurisdiction-Specific that are relevant to your jurisdiction from which you access or use the Services, and the rest of the policy, the relevant jurisdictions’ Supplemental Terms – Jurisdiction-Specific will supersede and control.

Brazil. If you are using our Services in Brazil, the following additional terms apply and in the event of any conflict between the following additional terms and the provisions of the main body of this Privacy Policy, the following terms shall prevail:

· Exercise of data protection rights. Brazilian law provides certain rights to individuals with regard to their personal data. Thus, we seek to ensure transparency and access controls in order to allow users to benefit from the mentioned rights.

We will respond and/or fulfill your requests for the exercise of your rights below, according to the applicable law and when applicable, to the Brazilian General Data Protection Law - LGPD, once it comes into force:

a. confirmation of whether your data are being processed;

b. access to your data;

c. correction of incomplete, inaccurate or outdated data;

d. anonymization, blocking or erasure of data;

e. portability of personal data to a third party;

f. object to the processing of personal data;

g. information of public and private entities with which we shared data;

h. information about the possibility to refuse providing personal data and the respective consequences, when applicable;

i. withdrawal of your consent.

· Verifying your identity. For your safety and to allow us to make sure that we do not disclose any of your personal data to unauthorized third parties, in order to verify your identity and guarantee the adequate exercise of your rights, we may request specific information and/or documents from you before we can properly respond to a request received concerning your data. All data and documents received from you in the process of responding to your requests will be used for the strict purposes of analyzing your request, authenticating your identity, and finally responding to your request.

· Limitations to your rights. In certain situations, we may have legitimate reasons not to comply with some of your requests. For instance, we may choose not to disclose certain information to you when a disclosure could adversely impact our business whenever there is a risk of violation to our trade secrets or intellectual property rights. In addition, we may refrain from complying with a request for erasure when the maintenance of your data is required for complying with legal or regulatory obligations or when such maintenance is required to protect our rights and interests in case a dispute arises. Whenever this is the case and we are unable to comply with a request you make, we will let you know the reasons why we cannot fulfill your request.

In case of doubt about your privacy, your rights or how to exercise them, please contact us through the form "Contact". If you have any questions about the processing of your personal data, we would like to clarify them.

· International Transfer of Data. We share your personal data globally with companies of our business group to carry out the activities specified in this Policy. We may also subcontract the processing of data involved in the Services or share your personal data with third parties located in other countries. Your personal data may therefore be subject to privacy laws other than those applicable in your country.

Whenever we transfer your personal data to third parties located in other countries, we will ensure that these companies comply with applicable data protection laws and we will take all measures that are reasonably necessary to ensure the existence of adequate safeguards to protect your personal data and to ensure that are processed safely.

· Parental and Guardian Consent. If required by Brazilian data protection laws, (i) if you are over the age of 16 but under the age of 18, you can only use and register for an account with the assistance of your parent or legal guardian and you declare and represent that you had such assistance to use the Services and to agree to the Policy; (ii) if you are over the age of 13 but under the age of 16, you can only use and register for an account with the representation of your parent or legal guardian, and you must obtain the consent from your parent or legal guardian to the use of the Services and acceptance of this Privacy Policy.

· Language. The Policy may have been prepared in the English language and in the Portuguese language. If you are a user located in Brazil, you shall refer to the Portuguese version, which shall prevail.

· DPO. If you wish to contact the Data Protection Officer, please contact us: dpobrasil@bytedance.com

South Korea. If you are using our Services in South Korea, the following additional terms apply:

· Use of User Information

Further to Section 2 above, for users in South Korea, we currently do not use your information for marketing purposes and will obtain your consent to process your information for marketing purposes.

· Entrustment and/or Overseas Transfer of User Information

Further to Sections 3 and 4 above, we entrust your data to our affiliates, cloud storage providers, IT service providers, and data centers, some of whom are located abroad, subject to your consents or notifications to you, if applicable. The list of entities can be found here. The entities receiving and processing your data are committed to using and storing user information in compliance with domestic and international regulations and to taking all available physical and technical measures to protect user information.

· Disclosure of User Information

Notwithstanding Section 3 above, we will disclose your information to the prospective seller or buyer of our business or assets only upon your consent, and we will provide you with advance notice of the data transfer pursuant to applicable Korean laws, if your information is transferred to another entity upon our sale to, merger with, acquisition by or joint partnership with other companies or businesses, of all or some of our assets and/or business.

· Data Retention

We destroy user information whose purposes of collection as consented to by you have been achieved, or whose periods of and use, to which you consented or which were provided in this privacy policy have expired; provided, however, we will continue to store user information for the following statutorily-prescribed periods, where applicable, including, but not limited to:

– Act on Consumer Protection in Electronic Commerce:

a. Records on your cancellation of an order, your payment on a purchased item, and our supply of a good/service: 5 years

b. Records on the handling of consumer complaints or disputes: 3 years

c. Records on advertisements and labels: 6 months

– Protection of Communications Secrets Act

a. Records on your visits to our Platform: 3 months

Upon expiry of the retention period, we destroy user information in a manner that renders it unrestorable by the relevant department. In addition, we may either destroy or store and manage separately your information from other users’ information and will not use or provide your personal information to other parties unless required by law, in the event you do not use our Platform for more than one year. We will notify you at least 30 days prior to destroying or separately storing your personal information of the following:

– If we destroy your information, the fact your information will be destroyed, the date of destruction, and type of information that will be destroyed

– If we store and manage your information separately, the fact your information will be stored and managed separately, the date of separate storage, and the types of information that will be stored and managed separately

· Security of Your Information

We work hard to protect our Platform and our users from unauthorized access to unauthorized alternation, disclosure or destruction of information we hold. To this end, we have in place technological, organizational, and physical safeguards, including internal policy for data protection, limiting the access to user information on a need-to-know basis and controlling access to facilities where user information is processed. We will not hold you liable for any damages that you incur as a result of our failure to comply with applicable laws.

· Information Relating to Children

The Platform is not directed at children under the age of 14 in Korea.

· User Rights

Users have the right to access user information we hold about them, to rectify any user information held about them that is inaccurate, to request the deletion of user information about them, and the right to request the suspension of the processing of their information. Users may exercise their rights by contacting us at ulike_mkt_bd@bytedance.com.

United States. If you are using our Services in the United States, the following additional terms apply:

· California Privacy Rights

If you are a California resident, under California law you may request certain information about our disclosure of personal information to third parties for their own direct marketing purposes during the preceding calendar year. This request is free and may be made once a year.

Your browser may offer you a “Do Not Track” option, which allows you to signal to operators of websites and web applications and services (including behavioral advertising services) that you do not wish such operators to track certain of your online activities over time and/or across different websites. Our products do not support Do Not Track requests at this time.

Vietnam. If you are using our Services in Vietnam, the following additional terms apply:

· Parental and Guardian Consent. Subject to section entitled “8. Information relating to children”, we may collect and use data of users under the age of 16 as contemplated under this policy. If you are under the age of 16, you declare that your parent or legal guardian has consented to our Terms of Service and this policy and you had the consent of your parent or legal guardian to use the Services.

· Data Security Notice to Users under 16. Although we will do our best to protect your information, we cannot guarantee the security of your information (including any information collected by us and any information provided and/or updated by you when using the Services) transmitted through the Platform; any transmission is at your own risk. Please see further information under the section entitled “6. The security of your information” above.

· Your Rights

o Marketing. You have the right to ask us not to process your personal data for email or text marketing purposes. We will usually inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your data. You can also exercise the right at any time by contacting us at ulike_mkt_bd@bytedance.com.

o Data Rights. You have the right to access personal data we hold about you, to rectify any personal data held about you that is inaccurate, to update and change any personal data held about you and to request the deletion of personal data held about you. You can exercise your rights by contacting us at support@ulike.mobi.

Thailand. If you are using our Services in Thailand, the following additional terms apply:

· Parental and Guardian Consent. Subject to section entitled “8. Information relating to children”, we may collect and use data of users under the age of 20 as contemplated under this policy. If you are under the age of 20, you declare that your parent or legal guardian has consented to our Terms of Service and this policy and you had the consent of your parent or legal guardian to use the Services.

· Your Rights

o Data Rights. You have the right to access personal data we hold about you, right to revise any personal data held about you that is inaccurate, right to data portability, right to object or suspend the storage, use or disclosure of personal data held about you, right to be forgotten and the right to withdraw your consent under this policy. You can exercise your rights by contacting us at support@ulike.mobi.

Indonesia. If you are using our Services in Indonesia, the following additional terms apply and in the event of any conflict between the following additional terms and the provisions of the main body of this Privacy Policy, the following terms shall prevail.

· Parental and Guardian Consent. If you are under the age of 21, you declare that you had the consent of your parent or legal guardian to use the Services.

· Data Rights. You have the right to access personal data in our Platform from time to time.

· Notification. In the event of we fail to maintain the confidentiality of your personal data in our Platform, we will notify you immediately through the contact information provided by you.

· Language. This policy is written in the English language and Indonesian language. In the event of any inconsistency or different interpretation between the English text and Indonesian text, the relevant Indonesian text shall be deemed to be automatically amended to conform with and to make the relevant Indonesian text consistent with the relevant English text. Each party acknowledges that it has read this policy and understands its content and that this policy has been entered into freely and without duress. You acknowledge that you fully understand the language and the content of this policy and you agree that you will not use the provisions under Law No. 24 of 2009 of the Republic of Indonesia on Flag, Language, Coat of Arms and National Anthem to invalidate this policy.

European Economic Area. If you are a user having your usual residence in the European Economic Area, the following additional terms apply:

1. The following sentence in the first paragraph shall not apply: By accessing or using our Platform, services, applications, products and content (collectively, the “Services”), you are accepting and consenting to the practices described in this policy.

2. Your rights when we process your Personal Data. You have the following rights if the legal conditions of such rights are met. You may exercise them at any time.

· Right of access: You have the right at any time to demand information on if we are processing your Personal Data.

· Right of rectification: You have the right to demand of us to correct and/or complete your personal data if your personal data processed is incorrect or incomplete.

· Right of erasure: You may demand your personal data to be deleted if (i) the personal data concerning you is no longer necessary for the purposes for which they were collected or otherwise processed; (ii) you revoke your consent to the processing and there is no other legal basis for the processing; (iii) your personal data have been processed illegally; (iv) the deletion of your personal data is necessary to fulfil a legal obligation under Union law or the law of the Member States to which we are subject.

· Right to restriction of processing: You may request to restrict the processing of your personal data if (i) you deny the accuracy of the personal data for a period of time that enables us to verify the accuracy of the personal data; (ii) the processing is unlawful and you refuse to delete the personal data and instead request the restriction of the use of the personal data; (iii) we no longer need your personal data for the purposes of processing, but you need them to assert, exercise or defend legal claims.

· Right to data portability: You have the right to obtain your personal data in a structured, commonly used and machine-readable format. You have the right to transmit your data to another Controller. Where technically feasible, you have the right to have your data transmitted directly from us to another Controller.

· Right to object: You have the right to object to the processing of your personal data for certain processing purposes. If we process your data on the basis of a legitimate interest (pursuant to Art. 6 para. 1 lit. f GDPR), you have the right to object to this processing at any time for reasons arising from your particular situation. Such reasons exist in particular if they give special weight to your interests and therefore outweigh our interests.

· If your Personal Data is processed in order to carry out direct advertising, you have the right to object at any time to the processing of Personal Data for the purpose of such advertising.

· Right to lodge a complaint with the supervisory authority: You have the right to address the supervisory authority for any questions or complaints.

3. Instead of Section 2 the following shall apply:

We will use the information we collect about you in the following ways:

· In accordance with, and to perform our contract with you, we will use your information to:

o personalize the content you receive and provide you with tailored content (e.g., stickers, filters, emojis) that may be of interest to you;

o notify you about changes to our Services;

o provide you with user support;

o enforce our terms, conditions and policies;

o communicate with you.

· In order to comply with our legal obligations, we use your data to help us detect abuse, fraud and illegal activity on the Platform.

· In accordance with our legitimate interests to provide an effective and dynamic Platform, we will use your information to:

o improve the Platform and to ensure content from the Platform is presented in the most effective manner for you and your device;

o administer the Platform and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;

o allow you to participate in interactive features of the Platform;

o keep the Platform safe and secure;

o to ensure that you are old enough to use our Platform; and

o develop our Platform and conduct product development.

· With your consent, we will use your information to:

o provide you with location-based services (where those services are available in your jurisdiction and you choose to share your precise location with us).

4. Instead of Section 4 the following shall apply:

The personal data that we collect from you will be transferred to, and stored at, a destination outside of the European Economic Area ("EEA"). Where we transfer your personal data to countries outside the EEA, we do so under the Commission’s model contracts for the transfer of personal data to third countries (i.e. standard contractual clauses) pursuant to 2004/915/EC or 2010/87/EU (as appropriate). For a copy of these Standard Contractual Clauses, please contact us at ulike_mkt_bd@bytedance.com.

5. Instead of Section 6 the following shall apply:

We take steps to ensure that your information is treated securely and in accordance with this policy. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, for example, by encryption, we cannot guarantee the security of your information transmitted via the Platform; any transmission is at your own risk.

We have appropriate technical and organizational measures to ensure a level of security appropriate to the risk of varying likelihood and severity for the rights and freedoms of you and other users. We maintain these technical and organizational measures and will amend them from time to time to improve the overall security of our systems.