Statement About HUAWEI In-App-Purchase and Privacy

HUAWEI In-App Purchases (hereinafter referred to as "HUAWEI IAP") is a service provided by Aspiegel Limited, a subsidiary of Huawei incorporated in Ireland (hereinafter referred to as "we", "us", or "our") that provides you with in-app payment capabilities and manages your various payment methods.

This Statement describes:

1. What Data do We Collect About You?

2. How do We Use Your Data?

3. How Long do We Store Your Data?

4. Do We Share Your Data?

5. What are Your Rights and Options?

6. How to Contact Us?

7. How do We Update this Statement?

1. What Data do We Collect About You?

As part of the HUAWEI IAP service, we shall collect and use your personal data only for the purposes stated in this Statement. Personal data refers to any information that enables us to identify you as a user.

We shall collect and process the following data:

HUAWEI ID account information: such as account identifier, user service token, and sign up record of user agreement.

Device information: such as device ID (e.g. MEID, UDID or IMEI, depending on your system version), device type, and operating system version.

Network information: such as IP address, network type, mobile network code (MNC), and mobile country code (MCC).

Payment information: such as bank card number, bank cardholder's name, bank card expiry date, bank card security code (CVV2), bank card brand, bank card sub brand, issuer country code, mobile phone number, text message (SMS) verification code, carrier ID for mobile payment, order ID, payment method information, PayPal pseudonymous account name, purchase history, payment token ID, payment token expiry date, payment results, transaction password, transaction password protection answers, product name, price, currency unit, merchant name, invoice information (first and last name, address, and email), fingerprint ID, payment certificate, stored credentials information (such as first payment and transaction ID), device fingerprint (device technical information), device fingerprint token (provided by your bank), HUAWEI Gift Card redemption code, HUAWEI Gift Card ID, and HUAWEI Points balance.

To provide you with this service, HUAWEI IAP requires your permissions to access your device to obtain the necessary information. You can manage the permissions in the settings screen on your device.

2. How do We Use Your Data?

To provide you with the HUAWEI IAP service and fulfill the contractual obligations, we will use and process your personal data. The data is processed so that you can make payments within apps, complete transactions, and manage your bank cards and other payment methods. We also use your data for settlement, identification, customer relationship management, support and communication, software and system updates, billing, refund, agreement management as well as for diagnostics and repair purposes.

In addition, we use your personal data for the following purposes based on legitimate interest pursued by us:

Communicating about our offerings, sales promotion and marketing purposes, including awards and loyalty programs, as well as for creating aggregated target groups for marketing. Knowing customers' preferences enables us to target our offers and offer products and services that better meet the needs and desires of our customers. You can object to such data processing as described in Section 5.5 below.

Analytical and development purposes. This also enables us to understand our users' needs and improve the quality and user experience of our current and future services and offers. You can object to such processing as described in Section 5.5 below.

Information security and fraud prevention purposes, including detecting or preventing various types of misuse of services and payment fraud in order to provide you with secure and reliable services.

For the fraud prevention purposes, in addition to your data, we receive lists of black-listed anonymized IP addresses from a third-party risk assessment agency, which we use to assess payment risk and ensure that your payment is safe.

We also process your payment and network information for tax and accounting purposes as required by laws and regulations applicable to us.

3. How Long do We Store Your Data?

We will retain your personal data for no longer than is necessary for the purposes defined in this Statement.

We will process and retain your data for the duration of the customer relationship. When you delete your HUAWEI ID account, personal data related to your account and associated services, such as the HUAWEI IAP service will be erased. However, we shall retain:

Your payment and network information for seven (7) years from the date the transaction was made.

Your subscription information for up to thirty (30) days from the end of your subscription.

Personal data processed for customer relationship management such as data subject requests, complaints, and customer interaction records for up to six (6) years from the last interaction.

Personal data processed for contract management purposes up to three (3) years after your HUAWEI ID has been deleted.

Your payment certificate of authentication for five (5) years, from the date it was generated.

Personal data used for analytical and development purposes for up to twelve (12) months from the date of collection, unless you have objected to such processing.

Data backups and app log processed to ensure the security of your data and services for up to six (6) months from the date they were created.

Payment information used for fraud prevention purposes for up to thirty (30) days from the date of collection.

Once the retention period expires, we will delete or anonymize your personal data, unless otherwise required by applicable laws and regulations.

4. Do We Share Your Data?

We store your data in the data centers located in the European Union (EU)/European Economic Area (EEA).

In order for us to comply with applicable tax and accounting laws and regulations, your order information, including order ID, subscription information (if applicable), product name, purchase amount, currency unit, merchant name, available HUAWEI Points balance, and country code will be processed by a Huawei group company operating under contract and acting on behalf of us within the People's Republic of China.

In order to complete the transactions, your payment method information (such as bank card information), order information, email address, device identifier, IP address, and HUAWEI ID account identifier, will be processed by a payment service provider operating under contract and acting on behalf of us within the EU. The transaction related processing may require the access to your data by our payment service provider's subsidiaries in the UK, USA, China, Mexico, Brazil, Singapore, and Australia.

We will only share your data under the following circumstances:

When you make payment with your bank card, your payment information will be disclosed to your bank (card issuer) to complete the transaction.

When you make payment through a third-party app, your order information, including order ID, and subscription information (if applicable) will be disclosed to the third-party app, whose server may be located outside of EU/EEA, to complete the purchase (including recurring purchase, if applicable) and allow the settlement between us and the third-party app.

When you make a payment with your bank card, we will disclose your bank card information, stored credentials information, device identifier, and email to WORLDPAY (UK) LIMITED, WORLDPAY LIMITED, and WORLDPAY AP LTD ("WORLDPAY"), our payment service providers in the United Kingdom, in order to verify your bank card information with the card issuer (your bank) and prevent fraud.

When you link your phone number and/or make a mobile payment through your available mobile balance, we will disclose your phone number, country code, carrier ID, and order information (including order number, merchant name, product name, price, and currency unit) to your carrier in order to complete the purchase. If the transaction is made through our billing partner, BOKU PAYMENTS INC (hereinafter referred to as "BOKU") in the United States, the preceding information will also be disclosed accordingly.

When you make a payment with your PayPal account, we will disclose your order information (order ID, amount, purchased product, currency) to PayPal S.A.R.L. in Luxembourg to complete the purchase. All transaction-related information will be subject to the Privacy Statement for PayPal services.

When required in response to a legal process or request from a competent authority according to applicable laws or in connection with a legal proceeding or process.

When required as part of a merger, acquisition, sale of assets (such as service agreements) or transition of service to a Huawei group entity or another company.

When transferring and disclosing your IAP data outside the EU/EEA, where the local law may not provide the same level of protection as in the EU/EEA, we shall comply with applicable legal requirements for providing adequate safeguards to such transfer by incorporating the EU Commission's Model contracts for the transfer of personal data to third countries. If you want to obtain a copy of the actual signed standard data protection model clauses, please contact us.

5. What are Your Rights and Options?

You have the following rights and options:

5.1 Access your data

You can request information and a copy of personal data that we have collected and stored about you in relation to HUAWEI IAP by going to Settings > HUAWEI ID > Privacy center > Request your data, on your device.

For additional access requests, please contact us.

5.2 Rectify your data

In order to keep your data up-to-date and accurate, you can access and modify your data by going to Settings > HUAWEI ID > Payment and purchases, on your device.

5.3 Port your data

You can port the personal data that you have provided to us in relation to HUAWEI IAP in a commonly used machine readable format by going to Settings > HUAWEI ID > Privacy center > Request your data, on your device.

5.4 Erase your data

You may at any time:

Remove your bank cards, mobile payment phone number, unlink your PayPal account, and delete your purchase history by going to Settings > HUAWEI ID > Payment and purchases, on your device.

Delete your HUAWEI ID. This will erase your personal data associated with your HUAWEI ID, including your personal data in relation to HUAWEI IAP.

Object to the processing of your personal data, as described in Section 5.5. If your objection is valid, and we no longer have legal basis to continue the processing, we will erase the data in scope of a valid objection.

Contact us if you think the processing of your personal data is unlawful and your data should be erased.

We will erase or anonymize your personal data without undue delay when necessary based on your aforementioned actions and in accordance with the retention periods as described in Section 3.

5.5 Object to processing

If you want to object to the processing of your data for analytics and marketing purposes, please contact us.

When making the request, please specify the scope of the request and provide us with your email address or phone number that you used to log in to your HUAWEI ID.

We will contact you to verify your identity in order to proceed with your request.

5.6 Restrict processing

If you want to restrict the processing of your personal data, please contact us. You have the right to restrict the processing of your data under the following circumstances:

Your data is unlawfully processed but you do not want to erase it.

You have a legal claim that you need to establish, exercise and defend, and you requested us to keep your data when we would not keep it otherwise.

Your request for objection is pending our verification.

You have contested the accuracy of your personal data and the accuracy of your data is pending our verification.

When making the request, please specify the scope and the grounds for the request and provide us with your email address or phone number that you used to log in to your HUAWEI ID.

We will contact you to verify your identity in order to proceed with your request.

6. How to Contact Us?

You can find guidance on how to exercise your data subject's rights in Section 5. If you have any questions, comments, or suggestions on your rights as a data subject or the processing of your personal data by us or if you want to contact our Data Protection Officer, please contact us.

Our headquarters' address: Aspiegel Limited, 1F, Simmonscourt House, Ballsbridge, Dublin, D04 W9H6, Ireland. Registration number 561134.

If you believe that we do not process your personal data in accordance with this Statement or the applicable data protection laws, you can lodge a complaint with your data protection authority, or the Data Protection Commissioner in Ireland.

7. How do We Update this Statement?

We encourage you to regularly check for the latest version of this Statement from the app settings as we may change it from time to time. If we make material changes to this Statement, we will notify you using an appropriate method, such as through a notification dialog box, notification message on your device, email, etc., depending on the nature of the change.

Latest update: November 2019