HeyTap Privacy Notice

Last updated: September 30, 2024

About this update: We updated the company name from BRAVO UNICORN PTE. LTD. to HEYTAP PTE. LTD., and the registered address has been changed to 138 Market Street #15-03 Capitagreen, Singapore 048946.

Thank you for choosing HeyTap.

HEYTAP PTE. LTD. ("we", "us", or "our") is committed to protecting your rights and privacy. We developed this Privacy Notice to explain how we collect, use, disclose, transmit, and/or store your personal information when you create or use your HeyTap Account. Before using our HeyTap products (or services), please read this Privacy Notice carefully to understand our privacy practices.

HEYTAP PTE. LTD. is the Data Controller as defined in the General Data Protection Regulation (GDPR). This means that we can determine the purposes for which we collect and process your personal information and we are obliged to comply with the relevant GDPR terms.

This Privacy Notice is divided into the following sections:

• 1. Definitions


• 2. How We Collect and Use Your Personal Information


• 3. How Long We Retain Your Personal Information


• 4. How We Disclose Your Personal Information


• 5. How We Protect Your Personal Information


• 6. Your Rights to Your Personal Information


• 7. How We Process Children's Personal Information


• 8. Third-Party Service Providers and Their Services


• 9. How Your Personal Information Is Transferred Across Borders


• 10. How This Privacy Notice Is Updated


• 11. Contact Us

• 1. Definitions

Affiliate: A company that is associated with us and has the same shareholding structure or controlling party as us.




Third party: A company that does not have the same shareholding structure or controlling party as us, or a natural person that has no relation with us. A third party can be a for-profit or non-profit company or a natural person other than you or us.




Personal information (or personal data): Any information that is recorded electronically or otherwise and can be used alone or in combination with other information to identify a specific natural person.




• 2. How We Collect and Use Your Personal Information

We collect personal information to operate more efficiently and provide you with the best possible experience. We collect personal information about you in three primary ways: (1) directly from you; (2) automatically from your use of our HeyTap products; and/or (3) from third parties.




The information we collect depends on the context of your interactions with us and the choices you make, including your privacy settings and the HeyTap products and features you use.



• 2.1 Personal information we collect


• (1) Information directly provided by you to us



The services we provide require you to provide certain personal information directly to us. For example:




When creating a HeyTap Account or completing your account details, you will be asked to provide information such as your name, date of birth, phone number, email address, display name, password, profile picture, and contacts for manual account recovery.




We may request and collect your personal information on other occasions, such as when you participate in our lucky draws or competitions, promotional or marketing activities (organized by us either alone or jointly with our partners), surveys, user forums, or blogs. The information you provide will help us design and improve our products, personalize your shopping experience, and provide you with purchase suggestions. To better understand your needs, we may match the personal information you provide with that we obtained from relevant third parties.



• (2) Information about you automatically obtained from your use of HeyTap products



In addition to the information you provide directly to us, we may automatically obtain information about you from your use of our software on your device or by other means. For example, we may collect the following information:



• a. Device-related information, such as the device name, device model, region and language settings, device ID (e.g. IMEI), device hardware information and status, device usage habits, IP address, operating system version, and system settings.


• b. Log information, such as the time and duration of the use of a service, search terms entered through a service, and the error log of your device. When the system has an error or a crash, the error or crash log will contain information such as your phone number, email address, Facebook account ID, and more. This is the result of the Android system settings. Nevertheless, we have put in place appropriate security measures to ensure that this information is only used for error log analysis rather than authentication or other purposes.
  
• c. Location information, such as the GPS signal of your device or information about the nearby Wi-Fi access points.


• d. We may also collect other personal information relating to your use of our services, such as the versions of the apps you use, information about the websites you visit, and information about your interactions with the content we provide.



Please note that we may collaborate with third-party service providers to provide or improve our services mentioned above. Such third-party service providers will not use the above-mentioned information for any other purposes.



• (3) Information about you obtained from third parties



To the extent permitted by law, we may obtain data about you from public or commercial sources and combine it with other information received from you or relevant to you.



• 2.2 How we use your personal information


• (1) We may process your personal information for the purposes stated in this Privacy Notice relying on any of the following lawful bases:


• a. We have obtained your express consent in advance (you may withdraw your consent at any time);


• b. The processing is necessary for us to enter into a contract with you or perform a contract entered into by you concerning our products and/or services;


• c. The processing is necessary for us to perform our legal obligations;


• d. Disclosing your personal information is necessary for the purposes of the legitimate interests pursued by us or a third party. We will process your personal information on this lawful basis only after balancing our or the third party's interests against your privacy rights.



Specifically, we may process your personal information for the following purposes:



• To provide you with services or improve the services. The personal information collected by us will be used to provide our products and services to you, handle your orders, or perform any contract entered into between you and us so as to ensure the functionality and security of our products and services, verify your identity, and prevent and investigate fraud or other improper uses.


• To provide customer support. We use the collected data to diagnose your device problems, repair your device, and provide you with other customer care and support services. We will also use the data to improve our products or analyze the efficiency of our business operations. However, we will not use such data to track your location.


• To conduct promotional activities. We may use your personal information to let you participate in the lucky draws, competitions, or other similar promotional activities held by us.


• (2) We will strictly comply with this Privacy Notice and its updates made from time to time (we will provide you with notice before the updates take effect). Your personal information will only be used for the purposes stated in this Privacy Notice.


• (3) If we intend to use your personal information for any purpose not stated in this Privacy Notice, we will obtain your prior consent. If we intend to use your personal information that is collected for a specific purpose for any other purpose, we will also obtain your prior consent.


• (4) We do not make automated decisions through algorithms or profiling. If some of our services are subject to automated decision-making in the future, we will inform you in advance so that you can exercise the relevant right as a data subject according to Section 6.9.



• 3. How Long We Retain Your Personal Information

The personal information collected by us will be retained for the minimum period needed to fulfill the purposes for which it is collected as described in this Privacy Notice unless a longer retention period is required by law. When the minimum or required retention period expires, we will delete or anonymize your personal information.




• 4. How We Disclose Your Personal Information

We may, from time to time, share certain personal information with our affiliates and strategic partners that work with us to provide products or services for the purpose of providing the products or services you request.



• (1) Sharing with our affiliates: We may share your personal information with our affiliates. We will only share the necessary personal information for the purposes stated in this Privacy Notice. If we or our affiliates intend to change the purpose for which your personal information is used and processed, we will obtain your authorization or consent again. For example, to ensure the uniqueness of your HeyTap Account and allow you to use services provided worldwide based on your account, we will store your phone number, email, username, account's SSOID and OpenID, and other information simultaneously on our servers and data centers deployed around the world after processing such information by means of hashing. These servers and data centers are operated by us and our affiliates and provide relevant services for your HeyTap Account based on the contract entered into between you and us.


• (2) Sharing with our authorized partners: Some of our services will be provided by our authorized partners only for the purposes stated in this Privacy Notice. We may share some of your personal information with our partners to provide you with better services and an improved user experience. These third-party service providers may use your personal data to provide you with customer support services. When we are in the process of a merger, acquisition, or bankruptcy liquidation, and if such a process requires the transfer of your personal information, we will require the new company or organization that holds your personal information to continue to be bound by this Privacy Notice; otherwise, we will require this company or organization to obtain your authorization or consent again.



We will share your personal information only for legitimate, necessary, specific, and explicit purposes, and we will only share the personal information that is necessary for the provision of the required services. Our partners will not use your personal information for any other purpose.




Where we are required to perform our legal obligations, we may disclose your information. For example, where we comply with subpoenas or other legal procedures, litigations, or the mandatory requirements of government authorities, we may disclose your personal information if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to government requests.




• 5. How We Protect Your Personal Information

5.1 We adopt technical and organizational measures that are reasonable and actionable to protect the security of the information collected in connection with our services. However, please note that although we take reasonable measures to protect your information, no websites, internet transfers, computer systems, or Wi-Fi connections are absolutely secure.




5.2 We use safeguards that meet industry standards to protect the personal information provided by you from unauthorized access, disclosure, use, or alteration, or from damage or loss. We take all reasonable and actionable measures to protect your personal information, including:



• (1) We will de-identify your personal data to mitigate the risk that other organizations or individuals may identify you based on that information. We use mainstream security means such as SSL to encrypt many of our services. We regularly review our practices regarding information collection, storage, and processing (including physical security measures) to protect our systems from unauthorized access or alteration.


• (2) We strictly control access to personal information and only allow our employees and the personnel of authorized service providers to access personal information on a need-to-know basis in order for them to help us process such information. Such employees and personnel are subject to strict contractual confidentiality obligations. If they fail to perform these obligations, they may be held legally liable or their relationship with us may be terminated.


• (3) The security of your information is very important to us. Therefore, we will continue our efforts to protect the security of your personal information and implement safeguards, such as encrypting stored data and using end-to-end encryption during transmission, to protect your information from unauthorized access, use, or disclosure. In addition, certain encrypted data is inaccessible to anyone other than the user.


• (4) When transmitting and storing special categories of personal information about you, we will use security measures such as encryption. When storing your personal biometric information, we will take technical measures to process it, such as only storing a summary of such information.



5.3 In the event of any security breach of your personal information, we will act in accordance with applicable laws and regulations.




• 6. Your Rights to Your Personal Information

We respect your rights to your personal information. The following describes your rights under the law and explains how we will protect your rights. Please note that for security reasons, we may first verify your identity before handling your request.



• 6.1 Right to be informed: We inform you of how we process your personal information by publishing this Privacy Notice. We are committed to staying transparent about how we use your personal information.


• 6.2 Right of access: You can go to the relevant product or service page to directly query or access your personal information, such as going to "Settings - HeyTap Account" to sign in to your account to access relevant personal information about you. If you encounter any problem when exercising your right to access, please contact us at https://brand.heytap.com/en/privacy-feedback.html.


• 6.3 Right to rectification: If you find that any of your personal information processed by us is inaccurate or incomplete, you have the right to request that we correct or complete it. You can go to https://id.heytap.com/static/userdata_index.html to sign in to your account and correct your personal information directly, or you can contact us at https://brand.heytap.com/en/privacy-feedback.html to request information correction.


• 6.4 Right to erasure: You can request the erasure of your personal data if we lack a lawful basis to continue to process and retain it. You can go to https://id.heytap.com/static/userdata_index.html to sign in to your account and delete your personal information directly, or you can contact us at https://brand.heytap.com/en/privacy-feedback.html to request information deletion.


• 6.5 Right to restrict processing: You have the right to request that we restrict the processing of your personal data. Upon your request, we will only retain or process the necessary personal information to ensure that we will be able to honor such requests from you at later times. You can go to https://id.heytap.com/static/userdata_index.html to sign in to your account and exercise this right, or you can contact us at https://brand.heytap.com/en/privacy-feedback.html to request the exercise of this right.


• 6.6 Right to data portability: To the extent permitted by laws and regulations, you have the right to get a copy of your personal data in a structured, commonly used, and machine-readable format. For example, if you decide to use a new service provider, this right allows you to request that we securely transfer a copy of your personal information from our IT system to the new service provider's IT system. You can go to https://id.heytap.com/static/userdata_index.html to sign in to your account and exercise this right, or you can contact us at https://brand.heytap.com/en/privacy-feedback.html to request the exercise of this right.


• 6.7 Right to object: You have the right to object to our processing of your personal data even if the processing is for the protection of our legitimate interests, for the exercise of official authority, or for the purposes of direct marketing (including data aggregation) or profiling. You can go to https://id.heytap.com/static/userdata_index.html to sign in to your account and exercise this right, or you can contact us at https://brand.heytap.com/en/privacy-feedback.html to request the exercise of this right.


• 6.8 Right to withdraw consent: If you have given consent to our processing of your personal information but later changed your mind, you have the right to withdraw your consent at any time. Once you withdraw your consent, we will stop processing your personal information immediately. You can go to https://id.heytap.com/static/userdata_index.html to sign in to your account and exercise this right, or you can contact us at https://brand.heytap.com/en/privacy-feedback.html to request the exercise of this right.


• 6.9 Right not to be subjected to automated decision-making: You have the right not to be subjected to automated decision-making (including profiling). If automated decisions have significantly damaged your legitimate rights and interests, you can go to https://id.heytap.com/static/userdata_index.html to sign in to your account and ask us to give an explanation, or you can contact us at https://brand.heytap.com/en/privacy-feedback.html. We will respond in a timely manner and take appropriate measures to eliminate the impact.


• 6.10 Right to complain: You have the right to lodge a complaint with the national data protection authority in your country about the ways we process your personal information. We will respond to your complaint as soon as possible. In general, we will respond within one month following the receipt of your complaint. (If the complaint is overly complex or requires large amounts of personal information, we may extend this time limit by two months when necessary or permitted by law. In such cases, we will notify you of the reason for the extension within a month of receiving your complaint.) If you are not satisfied with our response, you can file a lawsuit with the supervisory authority in your jurisdiction.



• 7. How We Process Children's Personal Information

7.1 Our products, websites, and services are primarily targeted at adults. Children are not allowed to create their own accounts. Please note that we treat anyone under the age of 18 (or under the minimum age of full legal capacity in the jurisdiction concerned) as a child.




7.2 If we find that we have collected children's personal information, we will try to delete such information at the earliest possible time.




• 8. Third-Party Service Providers and Their Services

8.1 Our websites, products, apps, and services may contain links to third-party websites, products, or services. You can choose whether to access or use any website, product, or service provided by a third party.




8.2 We have no control over third-party privacy and data protection policies, as such third parties are not bound by this Privacy Notice. Before submitting personal information to third parties, please refer to their privacy policies.




• 9. How Your Personal Information Is Transferred Across Borders

We will determine your location based on the registered location you selected when creating your account.



• 9.1 In principle, personal information generated and collected in the European Union (EU) will be stored within the territory of the EU. However, to allow you to use our account services globally and ensure the uniqueness and security of your account, we will, in compliance with the contract entered into between you and us, store the authentication information used for account creation and sign-in (including phone number, email address, username, account's SSOID and OpenID, and more) simultaneously on our servers and data centers deployed around the world after processing such information by means of hashing. In addition, when you use your account outside the EU or the European Economic Area (EEA), we, or our affiliates outside the EEA, may process the aforementioned information through our servers or data centers outside the EEA.


• 9.2 Where your personal information is transferred to a country or region outside the EEA, we will take necessary security measures. For example, we will ensure that:


• (1) The recipient is located in a country that the European Commission has, subject to its Adequacy Decision, recognized as providing an adequate level of protection of personal information;


• (2) The recipient has signed a contract under the "Model Contractual Clauses" approved by the European Commission, obliging them to protect your personal data; or


• (3) In the absence of appropriate safeguards, we will ask for your express consent to cross-border transfers, in addition to using techniques, such as encryption or de-identification, to protect your personal information.



To learn more about our safeguards for transferring your personal information to a country or region outside the EEA, please contact us at https://brand.heytap.com/en/privacy-feedback.html.




• 10. How This Privacy Notice Is Updated

We reserve the right to update or revise this Privacy Notice from time to time. We will send you notice of changes by means we deem appropriate. If you have provided us with your email address, we will notify you of the changes (or seek your consent to the changes if you are a resident of Indonesia) by email before the changes enter into force. If you have not provided your email address, we will publish a notice on our website or send a push notification to your device.




• 11. Contact Us

If you have any questions or concerns about this Privacy Notice or our privacy practices, please contact us using the information below:




HEYTAP PTE. LTD.




Address: 138 Market Street #15-03 Capitagreen, Singapore 048946




Data Subject Rights Platform: https://brand.heytap.com/en/privacy-feedback.html




If you are located in Europe, you can contact our EU representative OROPE Germany GmbH using the email or postal address below:




Email: privacy@heytap.com




Postal address: Graf-Adolf-Platz 15, 40213, Düsseldorf, Germany