Annex. Additional Privacy Information Annex. Additional Privacy Information

Annex. Additional Privacy Information

ZEPETO ZEPETO

Annex. Additional Privacy Information for U.S. Users

This Annex is part of and supplements ZEPETO’s Privacy Policy and applies only to ZEPETO users who reside in the United States (“consumers” or “you”).  Please see the ZEPETO Privacy Policy for information for important information about our processing practices.  
This U.S. Annex does not apply to workforce-related personal information collected from employees, job applicants, contractors, or similar individuals. 

 

Article 1 (How We Use Personal Information)
Please see the ZEPETO Privacy Policy for information regarding how we use personal information.

 

Article 2 (Data Subject Rights)
Depending on where you live, you have certain choices regarding your personal information.  Your rights to access, obtain a copy, delete, and correct your personal information are described in the ZEPETO Privacy Policy.  In accordance with local law, these rights also may include the right to know certain information about our processing activities, including
  • the categories of personal information we have collected about you;
  • the categories of sources from which we collected the personal information;
  • the categories of third parties to whom we disclosed that personal information; and
  • the business or commercial purpose for which we collected, shared, or sold the personal information
In addition, you may have the right to withdraw consent to the processing of sensitive data in accordance with local law.  We do not use personal information for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects.
As described in the ZEPETO Privacy Policy, you may exercise these rights via email at z_service_privacy@naverz-corp.com or visit our Support Center.  We will verify your requests by matching the provided information against our records, and we may request additional information or documentation if necessary to confirm your identity.  These rights are not absolute, and we may not be able to respond based on permissible legal considerations, such as if we cannot adequately verify your request. 
You may be entitled to submit a request through an authorized agent or to appeal a refusal to take action on your request. To designate an authorized agent to exercise your rights, we may require written proof that the authorized agent has been authorized to act on your behalf or a copy of the power-of-attorney document granting that right. To appeal a denial of your request, please contact us at z_service_privacy@naverz-corp.com and include the ID of the request that you are appealing.
We will not discriminate against you for exercising your rights, although some of the functionality and features available on the Service may change or no longer be available to you. We will not deny, charge different prices for, or provide a different level or quality of goods or services because you choose to exercise these rights.
 
Article 3 (Right to Opt Out of Processing for Targeted Advertising)
NAVER Z uses advertising networks and other third parties to serve and display advertising on the Services and elsewhere online across different sites and services.  These third parties may use cookies, pixels, software development kits (“SDKs”), and other tracking technologies to collect information about your activities across different apps and services to build a profile of your interests and provide you with relevant advertising (“targeted advertising.”)  Your browser and device may provide you with certain choices.  In addition:
  • You can opt out of receiving some types of ads by managing your preferences at https://optout.aboutads.info/.
  • You can opt out of processing for targeted advertising by clicking the external links below. 
Category
Adjust
Unity Ads
TapJoy
Ironsource
AdMob
To the extent these targeted advertising activities constitute a sale of personal information, you also may have the right to opt out of such sale of personal information in accordance with applicable laws by taking the steps described above.  Some mobile and web browsers transmit "do-not-track" signals. Because of differences in how web browsers incorporate and activate this feature, it is not always clear whether users intend for these signals to be transmitted, or whether they even are aware of them. We currently do not take action in response to these signals.
 
Article 4 (Rights of California and Colorado Residents)
In addition to the information and rights provided above, we provide additional information in this section to California residents in accordance with the California Consumer Privacy Act.
 
Article 4.1 (Information We Collect)
We have collected, used and disclosed for business purposes the following categories of personal information about consumers in the last 12 months:
  • Identifiers: We have collected identifiers such as a real name, alias, postal address, unique personal identifiers (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology; customer number, unique pseudonym, or user alias; telephone number and other forms of persistent or probabilistic identifiers), online identifier, Internet Protocol address, email address, account name, and other similar identifiers.
  • Protected Classifications: We have collected information about characteristics of protected classifications under California or federal law, such as age and gender.
  • Commercial Information: We have collected commercial information, including records of products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies
  • Internet and other electronic network activity information: We have collected information about online activity including, but not limited to, browsing history, search history, and information regarding your interaction with websites, applications or advertisements.
  • Biometric Data: Information that may be considered facial recognition data may be captured when you use relevant features, such as using filters and photo effects and creating personalized avatars.  In addition, we generate inferences based on your images like estimated age and gender to provide you with more suitable filters and better photo effects when the application processes your photos, although these inferences are only maintained on your device.
  • Geolocation Data: We have collected information about the nation and/or U.S. state in which you are located based on your IP address
  • Audio, electronic, visual, and similar information: We have collected sensory information, including audio and images you share with us on the app to, for example, communicate directly with us, or with other users.   By using relevant features of the Services that enable live broadcast or communications, you consent to us and our service providers processing your information and communications. 
  • Inferences: We collect inferences drawn from any of  the information identified above to create a profile about users reflecting their preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes
  • Sensitive Personal Information: We have collected sensitive personal information including information about your account log-in and, financial accounts to facilitate your payment requests on ZEPETO Studio.
We obtain the categories of information described above directly from you, as well as from other sources, such as advertising partners, internet service providers, data analytics providers, operating systems and platforms, social media platforms, and where the information is publicly available.  These categories of personal information have been disclosed to each of the categories of third parties listed in Article 3 of the ZEPETO Privacy Policy.

 

Article 4.2 (Sale and Sharing of Personal Information)
NAVER Z uses advertising networks to show interest-based advertising in their apps. During the 12-month period prior to the effective date of this Annex, the following categories of personal information may have been shared for cross-context behavioral advertising and/or sold using our Services:
  • Identifiers such as a real name, alias, unique personal identifier (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology; customer number, unique pseudonym, or user alias; telephone number and other forms of persistent or probabilistic identifiers), online identifier, internet protocol address, email address, account name, and other similar identifiers.
  • Internet and other electronic network activity information, including, but not limited to, your interaction with websites, applications or advertisements.
  • Inferences drawn from any of the information identified above to create a profile about you reflecting your preferences and characteristics predispositions, behavior, and attitudes.
We do not knowingly share for cross-context behavioral advertising or sell the personal information of minors under 16 years of age.  As noted above, if you wish to opt-out of sale and sharing of your personal information, to exercise that right, click the each external link above. 

 

Annex. Additional Privacy Information for European Economic Area (EEA), United Kingdom (UK) and Switzerland Users

This Annex is part of and  supplements ZEPETO’s Privacy Policy and applies only to ZEPETO users residing in the territory of European Economic Area (EEA), United Kingdom (UK) and Switzerland.  In the event of a conflict between the terms of the Privacy Policy and this Annex, this Annex will prevail in relation to the processing of data relating to users in the EEA, UK or Switzerland.

 

Article 1 (How the Company Uses Information and the Types of Information Collected) 

The Company processes information provided directly/indirectly by user for the following purposes:

  • Purpose : Provision of the Company’s services, as per your request
    • Categories of Personal Data
      • Identification and contact details;
      • Account information;
      • Social media account information (where you have linked your social media account to your ZEPETO account);
      • Registration history;
      • Purchase information.
    • Legal Basis : Contractual necessity
  • Purpose : Provision of personalized functions and contents, such as targeted advertising services, analytics, or similar services, and monitoring your interactions with such features
    • Categories of Personal Data
      • Identification and contact details;
      • Account information;
      • Survey information;
      • Service usage information;
      • Device and log information;
      • Information related to your online activities on connected devices;
      • Payment information.
    • Legal Basis : Our legitimate interests to provide personalized services and analyze our services OR your consent where required by law.
  • Purpose : Development, delivery, testing and improvement of the Company’s services, conducting internal research for product development, and undertaking activities to verify or maintain the quality or safety of the service
    • Categories of Personal Data
      • Identification and contact details;
      • Account information;
      • Survey information;
      • Service usage information;
      • Device and log information;
      • Information related to your online activities on connected devices;
      • Payment information.
    • Legal Basis : Our legitimate interests to improve our services OR your consent where required by law.
  • Purpose : Payment processing for purchases and paid services
    • Categories of Personal Data
      • Identification and contact details;
      • Purchase information;
    • Legal Basis : Contractual necessity
  • Purpose : Processing payments requested on ZEPETO Studio
    • Categories of Personal Data
      • Identification and contact details;
      • Payment information
    • Legal Basis : Contractual necessity
  • Purpose : Promoting the Company’s goods or services, through emails or in-app notifications (push notifications, etc.) according to users’ communication settings 
    • Categories of Personal Data
      • Identification and contact details
    • Legal Basis : Our legitimate interests to promote our products and services OR your consent where required by law.
  • Purpose : Provision of prizes or awards to event winners or participants
    • Categories of Personal Data
      • Identification and contact details;
      • Account information;
      • Social media account information (where relevant to the event);
      • Event information.
    • Legal Basis : Contractual necessity
  • Purpose : User identification and authentication to enable use of specific services
    • Categories of Personal Data
      • Identification and contact details;
      • Account information;
      • Social media account information (where you have linked your social media account to your ZEPETO account).
    • Legal Basis : Contractual necessity
  • Purpose : Provision of information about our services you request
    • Categories of Personal Data
      • Identification and contact details;
      • Customer service information.
    • Legal Basis : Contractual necessity
  • Purpose : Response to your inquiries and provision of important notices to you
    • Categories of Personal Data
      • Identification and contact details;
      • Account information;
      • Social media account information (where you have linked your social media account to your ZEPETO account);
      • Customer service information.
    • Legal Basis : Depending on your inquiry or on the notice, contractual necessity OR our legitimate interests to grow our customer base or to defend our business in case of complaints
  • Purpose : Protection, identification and prevention related to fraud and other unlawful conducts, complaint and various liabilities
    • Categories of Personal Data
      • Identification and contact details;
      • Account information;
      • Social media account information (where you have linked your social media account to your ZEPETO account);
      • Service usage information;
      • Device and log information.
    • Legal Basis : Our legitimate interests to secure our services OR compliance with applicable laws
  • Purpose : Compliance with and enforcement of applicable industrial standards and company policies
    • Categories of Personal Data
      • Identification and contact details;
      • Account information;
      • Social media account information (where you have linked your social media account to your ZEPETO account);
      • Service usage information;
      • Device and log information.
    • Legal Basis : Our legitimate interests to conduct our business in accordance with appropriate standards (including to secure our services) 
  • Purpose : Protection of the Company’s legal rights and interests
    • Categories of Personal Data
      • Any category of personal data identified in the Privacy Policy, as necessary to achieve this purpose.
    • Legal Basis : Our legitimate interests to protect our rights and interests 
  • Purpose : Response to requests from government or legal authority
    • Categories of Personal Data
      • Any category of personal data identified in the Privacy Policy, as necessary to achieve this purpose.
    • Legal Basis : Compliance with an applicable legal requirement to cooperate with the relevant government or legal authority
  • Purpose : Compliance with applicable laws and regulations in each country (e.g. tax laws)
    • Categories of Personal Data
      • Any category of personal data identified in the Privacy Policy, as necessary to achieve this purpose.
    • Legal Basis : Compliance with an applicable legal requirement
  • Purpose : Additional purposes when you provide consent to process your information for those specific purposes
    • Categories of Personal Data
      • Any category of personal data identified in the Privacy Policy, as necessary to achieve this purpose.
    • Legal Basis : Your consent

 

Article 2 (International Transfer of Information)

As mentioned in Article 4 of the Privacy Policy, your use of the Service may involve the transfer, storage, and processing of your personal information to/in recipient in countries outside of your country of residence  (“third countries”). Such countries may potentially be located worldwide and include, without limitation, the United States, Japan, and Republic of Korea . We will take appropriate measures, in compliance with applicable law, to ensure that your personal information remains protected. Such measures include, if the recipient is located in a country that does not provide for an adequate level of protection of personal information (see sentence on third countries that are recognized as “adequate” below), , the use of the European Commission Standard Contractual Clauses and, where applicable, the UK Addendum and the adaptations required for Switzerland to  such clauses  to safeguard the transfer of personal data to third countries. We may occasionally  rely  on your explicit consent instead. Additionally, the European Commission, the Swiss Federal Council and the UK Government recognize, as applicable, that certain third countries ensure an adequate level of protection for personal information — this is known as “adequacy ” .   To request more information about our international data transfers or obtain a copy of the contractual agreements or other safeguards in place, please contact us via e-mail z_service_privacy@naverz-corp.com

 

Article 3 (Your Rights) 

In accordance with applicable laws, you may have the right to request access to, rectification of, erasure, deletion and/or destruction, of and portability of your personal data, and to object to or request restriction of the processing or disclosure to third parties of your personal data.  Where we are processing your personal data based on your consent, you have the right to withdraw this consent at any time without affecting the lawfulness of the processing based on consent before its withdrawal.

You also have the right to lodge a complaint with your supervisory authority. 

Where French data protection law is applicable, you also have the right to set guidelines for the retention and communication of your personal information after your death.

You can exercise your rights by contacting us using the contact details under Article 4 below.

 

Article 4 (European Data Protection Representative and Data Protection Officer (DPO))

- For the purpose of this Annex, the data controller is Naver Z Corporation, whose contact details are included under Article 9 of the Main Privacy Policy.  
- For users residing in the EU/EEA: You can contact us by sending an email to our European data protection representative at the following address: eu_representative@navercorp.com
- You can also contact us by sending an email to our Data Protection Officer (DPO) at the following address: NZ_DPO@naverz-corp.com 

 

Article 5 Updates

This Annex is an annex to and part of the ZEPETO Privacy Policy and may be updated by us in accordance with Article 10 of the ZEPETO Privacy Policy. This Annex is effective from 11.15. 2023.

 

Annex. Additional Privacy Information for European Economic Area (EEA), United Kingdom (UK) and Switzerland Users