JOOX International Website - Privacy Notice

Last Updated: 28 October 2020

References to "our", "us", "we" or "Tencent" within this Privacy Notice are to Tencent (Thailand) Company Limited and its group companies, as applicable.

This Privacy Notice governs the collection and use of personal information by Tencent in connection with your use of the JOOX International website (the "Website").

We are committed to protecting your privacy and ensuring the highest level of security for your personal information. This Privacy Notice explains the types of personal information we collect; how we use that information; who we share it with; how we protect that information; and your legal rights. We are committed to abiding by this Privacy Notice, as well as the requirements of applicable laws, in the operation of our business.

Please read the following carefully as it explains our views and practices regarding your personal information, and how it is handled. If you are a resident of California, please also see our Supplemental California Privacy Policy.

Company Limited of 8 T One Building Sukhumvit Rd, Phra Khanong, Khlong Toei, Bangkok 10110. Our representative in the European Union for the purpose of European Union data protection laws is Tencent International Service Europe B.V., a company registered in the Netherlands, with the registered address at Gustav Mahlerplein 2, 1082 MA, Amsterdam, the Netherlands and can be contacted at eudataprotection@tencent.com. Our data protection officer can be contacted at joox_dpo@tencent.com

From the table of Contents below, please select to skip directly to the different sections of this Privacy Notice to understand our practices and your rights with respect to your information:

How we collect information

Information covered by this Privacy NoticeThis Privacy Notice covers all personal information collected and used by us. In this Privacy Notice, "personal data" or "personal information" means information that (either on its own or in combination with other information held by us) enables you to be identified as an individual or recognised directly or indirectly. This may include your IP address, device type, cookie ID, location and the actions you take on the Website, as well as technical information from the devices you use to access our Website.

Information you provide to usWhen you use our Website, we (and our service providers) may use cookies and other technologies to automatically collect the following information:

- Technical information, including your IP address, cookie ID, your login information, browser type and version, device / browser identifier, location, operating system and platform, page response times and download errors;

- information about your use of the Website, including content or products you viewed or searched for; and

- length of visits to certain pages, page interaction information (such as scrolling, clicks and mouseovers) and methods used to browse away from the page.

To learn more about how we use cookies and how to control which cookies are used, please see our Cookie Policy available at the cookie policy page.

When you contact us, correspond with us, or otherwise provide information to us (e.g., by emailing us) we will process your personal information (e.g., name, email address) so that we can respond to those messages.

How we use personal information

We use the personal information we collect from and about you for a variety of purposes and based on one or more legal justifications, as set out below:

PurposeWe will retain and evaluate information on your recent visits to our website and how you move around different sections of our website for analytics purposes to understand how people use our website so that we can make it more intuitive.

InformationIP address Browser type and version, Device / browser identifier, cookie ID, location, Operating system and platform, page response times, and download errors

Length of visits to certain pages, page interaction information (such as average session duration, scrolling, clicks, and mouseovers) and methods used to browse away from the page

JustificationYour consent. You can withdraw your consent at any time, see Your Rights below.

With whom do we share personal information

The Tencent group operates around the world. Your personal information are intended for Tencent's use, and may be shared with third parties in certain circumstances.

The Website may, from time to time, contain links to and from the websites or applications of our partners, or affiliates. If you follow a link to any of these websites or applications, please note that these websites have their own privacy notices and that we have no control over how they may use your personal information. You should check the privacy notices of third party applications and websites before you submit any personal information to them.

We may share your personal information with the following third party organisations:

Tencent's group of companies.We may share your personal information among our group of companies, including our subsidiaries, in order to administer our services and products, including the Website, and to conduct the activities described in this Privacy Notice.

Our service providers.We use other companies or contractors ("Service Providers") to perform services on our behalf or to assist us with the operation of the Website. We may share personal information with the following categories of Service Provider:

- Infrastructure and IT service providers; and

- website analytics service providers, including Google Analytics.

In the course of providing such services, these Service Providers may have access to your personal information. However, we will only provide our Service Providers with the information that is necessary for them to perform the services. All Service Providers are prohibited from retaining, using, or disclosing your personal information for any purpose other than providing us with their services. We will always use our best efforts to ensure that all the Service Providers we work with will keep your personal information secure.

Regulators, judicial authorities, law enforcement agencies, and other third parties permitted by law.In certain circumstances, we may be required to disclose or share your personal information in order to comply with a legal or regulatory obligation (for example, we may be required to disclose personal information to the police, regulators, government agencies or to judicial or administrative authorities pursuant to a valid legal process such as a subpoena, court order or search warrant). These disclosures may be made with or without your consent, and with or without notice to you. We may also disclose your personal information to third parties where disclosure is both legally permissible and necessary to protect or defend our rights, law enforcement, address issues relating to security or fraud, to enforce our Terms of Service (including investigation or any potential violation thereof) or protect the rights, safety or property of our users, you, a third party or those of the public as required or permitted by law.

Third parties connected with business transfersWe may transfer your personal information to third parties in connection with a reorganisation, restructuring, merger, acquisition or transfer of our business or where we acquire or form a joint venture with any other business, in which case we may disclose your data to any prospective buyer, new owner, or other third party involved in such change to our business, or where will sell or transfer any of our assets, in which case the information we hold about you may be sold as part of those assets and may be transferred to any prospective buyer, new owner, or other third party involved in such sale or transfer provided that the receiving party agrees to treat your personal information in a manner consistent with this Privacy Notice.

Where we store your personal information

The personal information that we collect from you may be transferred to, stored at, and processed at a destination outside the European Economic Area ("EEA"), including the USA, Taiwan, Singapore, Chile and Thailand, depending on the country from which you are accessing the Website.

We will take all steps reasonably necessary to ensure that your personal information is treated securely and in accordance with this Privacy Notice and applicable data protection laws, including, where relevant, entering into EU standard contractual clauses (or equivalent measures) with the party outside the EEA receiving the personal information.

Your choices / your privacy rightsYou have various rights in connection with our processing of your personal information, each of which is explained below. If you wish to exercise one or more of the above rights, please contact Data Protection Officer with your request at joox_dpo@tencent.com, and include your name, email and postal address, as well as your specific request and any other information we may need in order to provide or otherwise process your request.

AccessYou have the right to request a copy of the personal information we are processing about you, which we will provide back to you in electronic form. For your own privacy and security, in our discretion we may require you to prove your identity before providing the requested information.

RectificationYou have the right to have incomplete or inaccurate personal information that we process about you rectified.

DeletionYou have the right to request that we delete personal information that we process about you, except we are not obligated to do so if we need to retain such data in order to comply with a legal obligation or to establish, exercise or defend legal claims.

RestrictionYou have the right to restrict our processing of your personal information where you believe such data to be inaccurate, our processing is unlawful or that we no longer need to process such data for a particular purpose, but where we are not able to delete the data due to a legal or other obligation or because you do not wish for us to delete it. In such case, we would mark stored personal information with the aim of limiting particular processing for particular purposes in accordance with your request, or otherwise restrict its processing.

PortabilityYou have the right to obtain personal information we hold about you, in a structured, electronic format, and to transmit such data to another data controller, where this is (a) personal information which you have provided to us, and (b) if we are processing that data on the basis of your consent (such as for direct marketing communications) or to perform a contract with you (such as to manage your online account).

ObjectionWhere the legal justification for our processing of your personal information is our legitimate interest, you have the right to object to such processing on grounds relating to your particular situation. We will abide by your request unless we have compelling legitimate grounds for the processing which override your interests and rights, or if we need to continue to process the data for the establishment, exercise or defence of a legal claim.

Objection to direct marketingYou have the right to object to your personal information being used for direct marketing purposes at any time, free of charge. If you would like to object to your personal information being used for direct marketing purposes, please contact us at joox_dpo@tencent.com.

Withdrawing consentIf you have consented to our processing of your personal information, you have the right to withdraw your consent at any time, free of charge. If you would like to withdraw consent, including if you would like to opt out of receiving marketing correspondence from us, please contact us at joox_dpo@tencent.com. or for marketing follow the unsubscribe instructions located in the email (as relevant). Please understand that if you opt out of receiving promotional correspondence from us, we may still contact you in connection with your online account, relationship, activities, transactions and communications with us. Additionally, if you do request that we stop sharing your personal information with third parties for their direct marketing purposes, it is also prudent you opt out from or contact that third party directly.

Make a ComplaintYou have the right to lodge a complaint with the local data protection authority if you believe that we have not complied with applicable data protection laws.

If you are based in, or the issue relates to, the UK, the Information Commissioner’s Office can be contacted as follows:

If you are based or the issue you would like to complain about took place elsewhere in the European Economic Area (EEA), please click here for a list of local data protection authorities in the countries within the EEA in which we operate.

For how long do we keep your personal information

We will only retain your personal information for as long as it is necessary for the purpose for which that data was collected and to the extent permitted by applicable laws. When we no longer need to use your information, we will remove it from our systems and records and / or take steps to promptly anonymise it so that you can no longer be identified from it (unless we need to keep your information to comply with legal or regulatory obligations to which we are subject).

You can request that we delete some or all of your information but we may be entitled to refuse this request in certain limited circumstances, for example if: (a) we have a legal or regulatory obligation to retain your information; or (b) we require it to provide a service that you would still like us to provide to you.

Security

We have implemented technical and organisational security measures in an effort to safeguard personal information in our custody and control. Such measures we have implemented include, limiting access to personal information only to employees and authorised Service Providers who need to know such information for the purposes described in this Privacy Notice, as well as other technical, administrative and physical safeguards.

While we endeavour to always protect the Website and our systems, sites, operations and information against unauthorised access, use, modification and disclosure, due to the inherent nature of the internet as an open global communications vehicle and other risk factors, we cannot guarantee that any information, during transmission or while stored on our systems, will be absolutely safe from intrusion by others, such as hackers.

To provide you with increased security, certain personal information stored in your online account is only accessible via your username and password. You are responsible for maintaining the confidentiality of your online account credentials, and we strongly recommend that you do not disclose your online account username or password to anyone. We will never ask you for your password in any unsolicited communication. Please notify us immediately (see Contact Us section below) of any unauthorised use of your online account credentials or any other suspected breach of security.

Children

We do not knowingly collect personal information from individuals under the age of sixteen (16) without first obtaining verifiable parental consent.

If you are under the age of 16 you should not provide information to us. If we become aware that an individual under 16 has provided personal information to us without verifiable parental consent, we will remove such personal information from our files.

If you believe that we have personal information of a child under age of 16 without parental/guardian consent, or if you are the parent or guardian of the user and wish to withdraw consent, please contact us at joox_dpo@tencent.com and we will delete such information.

Changes to this Privacy Notice

We reserve the right to change our Privacy Notice from time to time. If we change our Privacy Notice we will post an alert on the Website.

Contact us

If you have any questions about this Privacy Notice and/or about the privacy policies and practices of our service providers, please contact us at joox_dpo@tencent.com.

Supplemental California Privacy Policy

Last Updated: 28 October 2020

In this Supplemental California Privacy Policy, we disclose information about our data processing practices as required by the California Consumer Privacy Act of 2018 (“CCPA”). We address these disclosures to residents of the State of California only. This Supplemental California Privacy Policy does not reflect our collection, use or disclosure of California residents’ personal information where an exception under the CCPA applies.

A. Right to Know about Personal Information Collected, Disclosed or SoldYou have the right to request that we disclose what personal information we collect, use, disclose and sell about you specifically (“right to know”). To submit a request to exercise the right to know, please submit an email request to joox_dpo@tencent.com and include “California Request to Know" in the subject line. Please specify in your request the details you would like to know, including any specific pieces of personal information you would like to access.

We will ask that you provide certain information to verify your identity. The information that we ask you to provide to verify your identity will depend on your prior interactions with us and the sensitivity of the personal information at issue. We will respond to your request in accordance with the CCPA. If we deny your request, we will explain why.

B. Our Personal Information Handling Practices over the Past 12 MonthsWe have set out below categories of personal information we have collected about California residents in the preceding 12 months. For each category of personal information we have collected, we have included the reference to the enumerated category or categories of personal information in California Civil Code § 1798.140(o)(1) that most closely describe such personal information.

Category of personal informationCorresponding reference to category of personal information under CCPA definition of personal information (Cal. Civ. Code § 1798.140(o)(1))
IP address(A) Identifiers such as IP address
Browser type and version(F) Internet or other electronic network activity information
Device / browser identifier(A) Identifiers such as unique personal identifiers
Cookie identifier(A) Identifiers such as unique personal identifiers
Location(G) Geolocation data
Operating system and platform(F) Internet or other electronic network activity information
Page response times, download errors, length of visits to certain pages, page interaction information (such as average session duration, scrolling, clicks, and mouseovers) and methods used to browse away from the page(F) Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website, application, or advertisement

We collect such information from you or your device. We use your personal information for the purposes set forth in the section of our Privacy Notice entitled “How we use personal information.”

In the past 12 months, we disclosed the above categories of personal information to our affiliated and unaffiliated service providers, and potentially other parties (such as in connection with legal compliance purposes or business transfers), as described in the section of our Privacy Notice entitled “With whom do we share personal information.” If you direct us to share your personal information with other specified third parties, we may disclose information about you with these third parties for the purposes described in your directions.

We do not sell, and in the preceding 12 months did not sell, California residents’ personal information. We do not have actual knowledge that we sell the personal information of minors under 16 years of age.

C. Right to Request Deletion of Personal InformationYou have a right to request the deletion of personal information that we collect or maintain about you. To submit a request to delete personal information, please submit an email request to joox_dpo@tencent.com or via the “Contact Us” page on our website and include “California Request to Delete” in the subject line. Please specify in your request the personal information about you that you would like to have deleted, which can be all of your personal information as required by the CCPA.

We will ask that you provide certain information to verify your identity. The information that we ask you to provide to verify your identity will depend on your prior interactions with us and the sensitivity of the personal information at issue. Once confirmed, we will respond to your request in accordance with the CCPA. If we deny your request, we will explain why.

D. Right to Non-Discrimination for the Exercise of CCPA RightsYou may not be discriminated against because you exercise any of your rights under the CCPA in violation of California Civil Code § 1798.125.

E. Right to Opt-Out of the Sale of Personal InformationYou have the right to opt-out of the sale of your personal information by a business. We do not sell your personal information.

F. Authorized AgentYou can designate an authorized agent to make a request under the CCPA on your behalf if:
- The authorized agent is a natural person or a business entity registered with the Secretary of State of California; and
- You sign a written declaration that you authorize the authorized agent to act on your behalf.

If you use an authorized agent to submit a request to exercise your right to know or your right to request deletion, please have the authorized agent take the following steps in addition to the steps described in subsections A and C above;
- Mail a notarized copy of your written declaration authorizing the authorized agent to act on your behalf to 8 T One Building Sukhumvit Rd, Phra Khanong, Khlong Toei, Bangkok 10110 (we will reimburse you for the costs of notarizing the declaration and mailing it to us if you provide a receipt showing the costs paid and they are reasonable); and
- Provide any information we request from you to verify your identity and that you provided the authorized agent permission to submit a request under the CCPA on your behalf. The information that we ask you to provide to verify your identity will depend on your prior interactions with us and the sensitivity of the personal information at issue.

If you provide an authorized agent with power of attorney pursuant to Probate Code sections 4000 to 4465, it may not be necessary to perform these steps, and we will respond to any request from such authorized agent in accordance with the CCPA.