HUAWEI In-App Purchases (hereinafter referred to as "HUAWEI IAP") is a service provided by Aspiegel SE, a subsidiary of Huawei incorporated in Ireland (hereinafter referred to as "we", "us", or "our") that provides you with in-app and web-based payment capabilities and manages your various payment methods.
This Statement describes:
1. What Data Do We Collect About You?
3. How Long Do We Store Your Data?
5. What Are Your Rights and Options?
6. How Do We Safeguard Children?
8. How Do We Update this Statement?
1. What Data Do We Collect About You?
As part of the HUAWEI IAP service, we shall collect and use your personal data only for the purposes stated in this Statement. Personal data refers to any information that enables us to identify you as a user.
We shall collect and process the following data:
•HUAWEI ID account information: such as account identifier, user service token, child account status to prompt the HUAWEI ID parent account to authorize the payment, and user agreement sign-up record.
•Device information: such as device ID (e.g. MEID, UDID or IMEI, depending on your system version), open advertising identifier (OAID), device type, and operating system version.
•Network information: such as IP address, network type, mobile network code (MNC), and mobile country code (MCC).
•Payment information: such as bank card number, bank cardholder's name, bank card expiry date, bank card security code (CVV2), bank card brand, bank card sub brand, issuer country code, mobile phone number, text message (SMS) verification code, carrier ID for mobile payment, order ID, payment method information, PayPal account information (pseudonymized PayPal email address and hashed account ID), purchase history, payment token ID, payment token expiry date, payment results, bank name (data returned from your bank), transaction password, transaction password protection answers, product name, price, currency unit, merchant name, invoice information (first and last name, address, and email address), fingerprint ID, payment certificate, stored credentials information (such as first payment and transaction ID), device fingerprint (device technical information), device fingerprint token (provided by your bank), HUAWEI Gift Card redemption code, HUAWEI Gift Card ID, HUAWEI Points balance, coupon information (coupon ID, coupon code, activity type and list), transaction fraud prevention information, payment campaign sign-up status, and campaign-related participation information.
If you use the web-based payment service, we shall collect and process the following data:
•HUAWEI ID account information: such as account identifier, user service token, and sign-up record of user agreement.
•Browser information: such as .
•Payment information: such as bank card number, bank cardholder's name, bank card expiry date, bank card security code (CVV2), bank card brand, bank card sub brand, issuer country code, mobile phone number, text message (SMS) verification code, purchase history, payment token ID, payment token expiry date, payment results, transaction password, transaction password protection answers, product name, price, currency unit, merchant name, invoice information (first and last name, address, and email address).
To provide you with this service, HUAWEI IAP requires the following permissions: Phone (to access device information and automatically accessing the phone number from the SIM card), Messaging (to automatically obtain SMS verification codes), and Camera (to scan bank cards and gift card codes). You can manage your permissions by going to Settings > Apps & services > Apps > HMS Core > Permissions on your device.
To provide you with the subscription notification feature in the Services, HUAWEI In-App Purchases requires the Notifications permission to provide you with the information notification service during automatic renewal of your subscription. The service availability depends on the features and application scenarios supported by the device. You can manage the aforementioned permission by going to Settings > Apps & services > Apps > HMS Core > Permissions on your device.
2. How Do We Use Your Data?
To provide you with the HUAWEI IAP service and fulfill our contractual obligations, including those under campaign-related agreements, we will use and process your personal data. The data is processed so that you can make payments within apps and on webpages, complete transactions, and manage your bank cards and other payment methods. We also use your data for settlement, identification, customer relationship management, support and communication, software and system updates, billing, refund, agreement management as well as for diagnostics and repair purposes. For information on the processing of your personal data for customer support purposes, please read the .
In addition, we use your personal data for the following purposes based on legitimate interest pursued by us:
•Sales promotion and marketing purposes: for communicating and personalizing our offerings and sales promotions, and for other marketing activities, including awards and loyalty programs. Knowing customers' preferences enables us to target our offers and offer products and services that better meet the needs and desires of our customers, and this involves your account, device, and app usage information such as order information (no payment method details), frequency of payments, and information about your participation in campaigns such as cashback campaigns organized by us. Our digital marketing activities also utilize different third-party advertising services and networks, which allow us to reach you on different platforms (e.g. on social media). When those services provide a custom audience feature, you may be targeted with specific campaigns on third-party platforms based on your HUAWEI ID account information, your purchase behavior (e.g. based on whether you have ever made a payment using IAP or never). The account information is used to associate you with the platforms data to enable us to reach you or exclude you from our marketing campaigns (e.g. a hashed email address or phone number is uploaded to the platform). Your data may be used for creating lookalike audiences as well. You can object to such data processing as described in Section 5.5 below.
•Analytics and development purposes. This enables us to analyze and understand our users' needs and improve the quality and user experience of our current and future services based on information about users' account, device, network, and app usage. We can also create aggregated reports based on user data for general business analysis and performance measurement purposes. You can object to such processing as described in Section 5.5 below.
•To assess the performance of personalized ads shown in specific apps, we will share your OAID and paying status (whether you are a paying or non-paying user) without any other details about your payment information to Petal Ads so it can create aggregated reports showing the number of users who have seen the ads and the number of paying users within that group. The outcome of such processing is aggregated without any personal data that can be linked back to you as a user, and Petal Ads does not use your data for any other purposes. You can object to such data processing as described in Section 5.5 below.
•Information security and fraud prevention purposes, including detecting or preventing various types of misuse of services and payment fraud (to identify fraudulent payment methods or accounts) in order to provide you with secure and reliable services. For the fraud prevention purposes, in addition to processing your data, we receive a blocklist of anonymized IP addresses from a third-party risk assessment company, which we use to assess payment risks and ensure that your payment is safe. We also receive and process your PayPal account email address from PayPal to conduct fraud prevention processing and ensure that such transactions are not fraudulent.
We also process your account identifier, as well as device and network information, to ensure that the device is not rooted and safe to make payments. For more information on such processing, you can check the .
If you agree to the storage when you make your first transaction with your bank card as a payment method, we also process and retain your bank card information (your full name and the bank card number and expiration date), to provide you with easier future access and payments. You can delete information about the bank card as a payment method at any time and the data will be completely erased.
We also process your payment and network information for tax and accounting purposes as required by laws and regulations applicable to us.
3. How Long Do We Store Your Data?
We will retain your personal data for no longer than is necessary for the purposes defined in this Statement.
We will process and retain your data for the duration of the customer relationship. When you delete your HUAWEI ID account, personal data related to your account and associated services, such as the HUAWEI IAP service will be erased. However, we shall retain:
•Your payment and network information for seven (7) years from the date the transaction was made.
•Your subscription information for up to thirty (30) days from the end of your subscription.
•Personal data processed for contract management purposes for up to three (3) years after your HUAWEI ID has been deleted.
•Your payment certificate of authentication for five (5) years, from the date it was generated.
•Personal data used for marketing, analytics, and development purposes for up to twelve (12) months from the date of collection, unless you have objected to such processing.
•Your email address received from PayPal and processed for payment fraud prevention purposes if you make a payment with your PayPal account for up to twelve (12) months from the date the payment using this account was made.
•Data backups and app logs processed to ensure the security of your data and services for up to six (6) months from the date they were created.
•Personal data processed for payment security and fraud prevention purposes for six (6) months to one (1) year from the date the payment was made.
•Information about a bank card processed for payment method management until you delete the card from IAP.
Once the retention period expires, we will delete or anonymize your personal data, unless otherwise required by applicable laws and regulations.
4. How Do We Share Your Data?
We store your data in the data centers located in the European Union (EU)/European Economic Area (EEA).
Our third-party vendors, who provide us with IT (including cloud-based) services, business support, and customer care services, may need to process your information. All such third parties are operating under contract and acting on behalf of us and are located in the EU/EEA.
In order for us to comply with applicable tax and accounting laws and regulations, your order information, including order ID, subscription information (if applicable), product name, purchase amount, currency unit, merchant name, available HUAWEI Points balance, coupon information, and country code will be processed by a Huawei group company operating under contract and acting on behalf of us within the People's Republic of China.
In order to complete the transactions, your payment method information (such as bank card information), order information, device identifier, IP address, HUAWEI ID account identifier, and email address will be processed by a payment service provider operating under contract and acting on behalf of us within the EU. The transaction related processing may require the access to your data by our payment service provider's subsidiaries in the UK, USA, China, Mexico, Brazil, Singapore, and Australia.
When our digital marketing activities utilize different third-party advertising platforms' custom audience features, we may target you by uploading your HUAWEI ID account information (e.g. a hashed email address or phone number) to such platform. We may also use third-party tracking platforms, which collect data about how users interact with our ads for ads attribution analysis and effect evaluation purposes. Such third parties are operating under contract and acting on behalf of us and include data transfers to partners located in the US.
We will only share your data under the following circumstances:
•When you make payment with your bank card, your payment information will be disclosed to your bank (card issuer) to complete the transaction.
•When you make a payment through a third-party app using any payment method including coupons, your order information, including the order ID and subscription information (if applicable), will be disclosed to the third-party app, whose server may be located outside of EU/EEA, to complete the purchase (including recurring purchase, if applicable) and allow the settlement between us and the third-party app.
•When you make a payment with your bank card in certain countries, we will disclose your bank card information, stored credentials information, device identifier, and email address to WorldPay B.V. ("WorldPay"), our payment service provider in the Netherlands, in order to verify your bank card information with the card issuer (your bank) and prevent fraud.
•When you link your phone number and/or make a mobile payment through your available mobile balance, we will disclose your phone number, country code, carrier ID, and order information (including order number, merchant name, product name, price, and currency unit) to your carrier in order to complete the purchase. If the transaction is made through our billing partner, BOKU PAYMENTS INC (hereinafter referred to as "BOKU") in the United States, the preceding information will also be disclosed accordingly.
•When you make a payment with your PayPal account, we will disclose your order information (order ID, amount, purchased product, currency) to PayPal S.A.R.L. in Luxembourg to complete the purchase. All transaction-related information will be subject to the .
•When you make a payment by bank transfer, we will disclose your order information (order ID, amount, and vendor), IP address, and hashed HUAWEI ID account identifier to your bank transfer service provider in your country, such as PayU in Poland, Giropay in Germany, Sofort in Germany, Switzerland, and Austria, and iDeal in Netherlands.
•We may disclose your data when required in response to a legal process or request from a competent authority according to applicable laws or in connection with a legal proceeding or process. In the case of the users in Canada, this means that the personal data transferred, processed and stored outside of Canada may be available to government authorities under lawful orders and laws applicable there.
•We may share your data in individual instances with external auditors, legal advisors, or other professional advisors, where necessary in the course of the services that they render to us.
•Your data may also be disclosed as part of a merger, acquisition, sale of assets (such as service agreements), or transfer of services to a Huawei group entity or another company.
When transferring and disclosing your IAP data outside the EU/EEA, where the local law may not provide the same level of protection as in the EU/EEA, we shall comply with applicable legal requirements for providing adequate safeguards to such transfers by incorporating the European Commission's . If you want to obtain a copy of the actual signed SCC, please contact us.
5. What Are Your Rights and Options?
You have the following rights and options:
5.1 Access your data
You can request information and a copy of personal data that we have collected and stored about you in relation to HUAWEI IAP by going to Settings > HUAWEI ID > Privacy center > Manage Your Data > Request your data on your device.
If you are using this service on a non-Huawei device, open the Aspiegel app you make payment within, such as AppGallery or Video, and go to Me > HUAWEI ID > Privacy center > Manage Your Data > Request your data.
For additional access requests, please contact us.
5.2 Rectify your data
In order to keep your data up-to-date and accurate, you can access and modify your data by going to Settings > HUAWEI ID > Payment and purchases on your device.
If you are using this service on a non-Huawei device, open the Aspiegel app you make payment within, such as AppGallery or Video, and go to Me > HUAWEI ID > Payment and purchases.
5.3 Port your data
You can port the personal data that you have provided to us in relation to HUAWEI IAP in a commonly-used, machine-readable format by going to Settings > HUAWEI ID > Privacy center > Manage Your Data > Request your data on your device.
If you are using this service on a non-Huawei device, open the Aspiegel app you make payment within, such as AppGallery or Video, and go to Me > HUAWEI ID > Privacy center > Manage Your Data > Request your data.
5.4 Erase your data
You may at any time:
•Remove your bank cards or mobile payment phone number, unlink your PayPal account, and delete your purchase history by going to Settings > HUAWEI ID > Payment and purchases on your device. Or if you are using this service on a non-Huawei device, open the Aspiegel app you make payment within, such as AppGallery or Video, and go to Me > HUAWEI ID > Payment and purchases.
•Delete your HUAWEI ID. This will erase your personal data associated with your HUAWEI ID, including your personal data in relation to HUAWEI IAP.
•Object to the processing of your personal data, as described in Section 5.5. If your objection is valid, and we no longer have legal basis to continue the processing, we will erase the data in scope of a valid objection.
•Contact us if you think the processing of your personal data is unlawful and your data should be erased.
We will erase or anonymize your personal data without undue delay when necessary based on your aforementioned actions and in accordance with the retention periods as described in Section 3.
5.5 Object to processing
You can object to the processing of your data for personalizing our offers and sales promotions for you by going to device Settings > HUAWEI ID > Payments and purchases > Settings > Advanced settings and disabling Personalized promotions.
You can object to the processing of your data for improving the quality and user experience of our current and future services by going to device Settings > HUAWEI ID > Payments and purchases > Settings > Advanced settings and disabling Service improvement.
If you do not want your OAID to be shared by HUAWEI IAP to Petal Ads, you can replace the OAID advertising identifier with a non-unique value of all zeroes by objecting to processing as instructed in Section 5.4 of the .
If you have other objection requests, please contact us.
When making the request, please specify the scope of the request and provide us with your email address or phone number that you used to log in to your HUAWEI ID.
We will contact you to verify your identity in order to proceed with your request.
5.6 Restrict processing
If you want to restrict the processing of your personal data, please contact us. You have the right to restrict the processing of your data under the following circumstances:
•Your data is unlawfully processed but you do not want to erase it.
•You have a legal claim that you need to establish, exercise and defend, and you requested us to keep your data when we would not keep it otherwise.
•Your request for objection is pending our verification.
•You have contested the accuracy of your personal data and the accuracy of your data is pending our verification.
When making the request, please specify the scope and the grounds for the request and provide us with your email address or phone number that you used to log in to your HUAWEI ID.
We will contact you to verify your identity in order to proceed with your request.
6. How Do We Safeguard Children?
Children are allowed to use IAP by logging in with their HUAWEI ID child account ("child account") created by their parent or guardian. When a user logs in with a child account, and as result is identified as a child user, IAP provides different safeguards to ensure age-appropriate data processing and content:
•In order to protect children from any harm caused by advertising, we do not use or allow others to use children as a specific target group for behavioral or other marketing activities. In addition, we never send electronic direct marketing messages to child account users.
•Personalized recommendation features, which include content personalization based on the user search and usage history, are not available to child accounts.
You as a parent or guardian can set up the child mode on your device so that IAP can provide similar protection as under the child account in the logged-in mode.
7. How to Contact Us?
You can find guidance on how to exercise your data subject's rights in Section 5. If you have any questions, comments, or suggestions on your rights as a data subject or the processing of your personal data by us or if you want to contact our Data Protection Officer, please .
Our headquarters' address: Aspiegel SE, 3rd Floor, Mespil Court, Mespil Road, Ballsbridge, Dublin 4, D04 E516, Ireland. Registration number 561134.
If you believe that we do not process your personal data in accordance with this Statement or the applicable data protection laws, you can lodge a complaint with the data protection authority in your country/region, or the Data Protection Commissioner in Ireland.
8. How Do We Update this Statement?
We encourage you to regularly check for the latest version of this Statement from the app settings as we may change it from time to time. If we make material changes to this Statement, we will notify you using an appropriate method, such as through a notification dialog box, notification message on your device, email, etc., depending on the nature of the change.