PRIVACY POLICY

Version date: 7 May 2025

NOTE: We may translate this Privacy Policy into other languages. If there is any difference between the English version and other language versions, then the English version, subject to applicable laws and regulations, shall prevail.

Welcome to HoYoverse!

HoYoverse is headquartered in Singapore as Cognosphere Pte. Ltd. ("we", "our", or "us"), from where we publish and distribute our services around the world. We recognise and value the privacy of people (“you” or user”) who use our services. This privacy policy describes the different ways we may collect, use and share information on, through, or in connection with our services. If you have any questions, please reach out to us as described in “Contact Us” below.

What are our services?

We use the term “our services” to collectively describe any of the products or services that directly link to this privacy policy. These include, for example:

· Gaming products like Genshin Impact, Honkai: Star Rail, Zenless Zone Zero, Honkai Impact 3^rd and Tears of Themis;

· Non-gaming products such as HoYoverse Account, HoYoPlay, HoYoLab and HoYoCreator; and

· Events, activities or any other initiatives where this privacy policy is posted   

Please read this entire privacy policy. You should also carefully review any other agreements that apply to the services you use, and confirm you understand and agree to them, before using those services.

By accessing our websites or otherwise using our services you acknowledge that you have read, understood, and accepted this Privacy Policy. In the case you do not agree with any of the terms of this Privacy Policy, you may immediately stop using our services.

This Privacy Policy informs you of the following information:

1. What Data We Collect and Process

2. Why Do We Collect and Process Your Personal Data

3. Legal Basis of our Data Collection and Processing

4. Advertisements and Your Choices

5. Cookies and Similar Technologies

6. Information Sharing

7. Data Retention

8. Your Rights and Choices

9. Securing Your Data

10. Children’s Protection

11. Changes to Privacy Policy

12. Contact Us

13. Supplemental Terms – Jurisdiction-Specific

1. WHAT DATA WE COLLECT AND PROCESS

Personal data means any information relating to an identified or identifiable natural person, such as full name, email address, contact address, postal code, position data, title, occupation, personal interests, etc.

A. Data We Collect and Process (either directly from users or through a third party)

i. Contact Information and Identifiers / Account Registration Information. When you create an account, we may collect your username, email address, mobile phone number, password, verification code, and Open ID/Union ID, to help you create and manage the account for your use of our services, to provide game login services, and for other purposes set forth in Section 2 and Section 13 of this Privacy Policy.

ii. Service Account Information. We may also collect account information related to our services, such as your nickname, avatar, gender, username, account ID and account level.

iii. Date of birth. Where applicable, you may need to provide us your date of birth for age verification or screening purposes and / or your birthday when you apply for birthday gifts or other benefits available on our services. You may choose to provide us your birthday in your user profile.

iv. Connected Social Media Account Information (Third Party). If you choose to log in to our services via your social media account(s), we may receive your social media account information (including your username or nickname) from third party social media providers (such as Facebook, X, Google Play, Game Center). Such information obtained from third party social media providers will be added to your account information.

v. Personal Profile Information. You can choose to create your personal profiles (where available) in our services by setting a nickname, creating your personal signature, uploading your avatar, social media platform account, number of followers, link to the work, number of likes, Discord Username, type of creator, game character ID, and other information depending on the setup of our services.

vi. Game Data. We process information about in-game services and functions, including your gameplay status, progress, and usage statistics to provide you with feedback and information, and for other purposes set forth in Section 2 and Section 13 of this Privacy Policy.

vii. Chat Data. If you use the chat function that are available in some of our services (e.g. the in-game chat), we may process the communication record and for certain services, we may apply encryption – and in certain services, end-to-end encryption – to protect your data.

viii. Community Forum Information. We will collect content, communications, and other information that you provide when you use our community forum service. This includes content created or shared by you and/or communicated with others, including information contained in or related to the content you provide (such as metadata), such as the date a file was created. It also includes content that you see or use through the functions we provide (such as the photo-taking function, photo upload function, content upload function). The information collected may also include your selected interest tags and preferred language.

ix. User Generated Content.  We process all content generated by users, including information that you post on our services, all feedback you provide to us, information that you post, comment, or follow in any of our content or services.

x. User Service Information. When you seek our technical and/or customer service support and/or exercise any of your legal rights as the data subject, we may collect the information that you provide in communications with our support team.

xi. Survey Information. We will collect your survey responses, if you participate in our surveys.

xii. Activity Participation Information. If you agree to participate in any activities organized by us (such as sweepstakes), we may collect your participation information including your name, UID, email address, mobile phone number, nickname, country/region. Where you win any prizes, you may also need to provide us your mailing address or certain tax information (e.g. social security numbers, etc) for us to send you the prize. Your activity participation information may be added to your account.

xiii. Internet Protocol (IP) Address and Device Data. We may collect data about the platform and device on which your account is used, such as platform type (iOS/Android), device name/model and your IP address.

xiv. Advertising Information. We may collect advertising ID (including Google Advertising ID, IDFA), Device ID (including IDFV, OAID, Android ID) and other select device information, and store this information with your profile to deliver advertising that may be relevant to your interests and track the success of our advertising and marketing programs. Additionally, after taking appropriate technical security measures (such as encryption and hashing) to de-identify or pseudonymise your email address (including email address collected from third party social media providers when you log in via your social media account(s)), we may use your de-identified or pseudonymized email address to track the success of our advertising and marketing programs.

xv. Payment data. If you choose to make purchase(s) with your account, we may need to collect your payment data and purchase history in order to maintain your transaction history record and process your purchase(s) and related activity, which may include your name, bank/debit/credit card number, card expiration date, billing address (country, city, postal code, address), CVV, the data concerning transaction date, transaction order number, currency, cost, payment channel, and product(s) purchased.

xvi. PayPal account. Where available in our services, we will store your PayPal account information and display it as a selectable payment option so that you can use it for subsequent payments.

xvii. Inferences.  We may make certain inferences, such as your preferences and interests, drawn from any of the information we collect.

xviii. Other Information Subject to Specific Notice. For some websites, apps, or services provided by us, we may collect additional information beyond the above listed information. We will develop individual privacy notices to inform you how we process your personal data when you use that specific service. Such individual privacy notices will prevail in terms of the personal data processed for those individual services.

B. Data We Automatically Collect

i. Device-related data. This includes data such as online ID, Advertising ID and/or device ID, device name, device type/model, MAC address, browser type, IP address, IMEI data, CPU data, OS version and language, time zone, screen DPI, device resolution, device mode/status, device and browser settings and configurations, memory data, and graphics card model.

ii. Cookies data. Information collected through cookies and similar technologies.

iii. Data related to bugs, errors, crashes and diagnosis. This includes registration/login time, game version, UID, stack trace, crash reports, and abnormal process data.

iv. Security related data. This includes installed app names, system startup time, app install and update time, request and referral URLs, and system activity details, game-related plug-in and runtime data, network status and information, and data related to external plugin programs.

v. Services interaction and/or usage data. This includes the pages and other content you view, the URL of the website from which you came to our sites, any content you post, the dates and times of your visits, the types of content you search for, view, or interact with, the features you use, the actions you take, the people or accounts you interact with, and when, how often, and for how long.

vi. Information about your interactions with others. We also capture and use the content, communications, and information you provide when you interact with others as a fan or contact.

vii. Data shared with us by third parties. This includes (i) data we receive from third-party applications when you link them to our services, such as when you make a third-party login via Facebook, X, Google, or Apple, and (ii) third-party data for message push, security assurance, and statistical analysis purposes.

Note: In specific cases, we may collect other personal data apart from the categories stated herein based on your consent or other legal bases. When this occurs, we will, where required under applicable laws, provide more information about any change to the way or purpose of our collection or processing which are different from or not clarified in the details in this Privacy Policy.

In order to better provide you with a complete gaming experience, we may merge our collected personal data with data from third-party contractors in order to update your profile (e.g. the information of your connected third-party accounts), perform market analysis, and/or otherwise as set forth in Section 2 and Section 13 of this Privacy Policy, with your prior consent or where we have other legal grounds permissible under applicable laws.

When you use or interact with third-party services that may be available on our services, such as third-party social media widgets, share buttons, and/or login mechanisms, this Privacy Policy does not and will not extend to such services/features, which will be subject to the respective third-party privacy policies.

C. Sources of Personal Data  

We have collected personal data from different sources and in various ways, including the following categories of sources:

·    You/Your Devices: You or your devices directly.

·    Users: Other users of our services.

·    Affiliates.

·    Service Providers.

·    Advertising Networks.

·    Analytics Providers.

·    OS/Platform Provider: Operating systems and platforms.

·    Social Networks.

·    Business partners.

·    Publicly accessible sources.

·    Inferences: Data we infer or generate about users from other data we collect.

2. WHY WE COLLECT AND PROCESS YOUR PERSONAL DATA

In order to provide our services to you, we collect and process your personal data for one or multiple purposes described below and/or in Section 13, including to:

i. facilitate your use and access to, or to restrict your use or access to, our services;

ii. allow you to create accounts that enables you to manage your account and personal profile;

iii. to facilitate our age verification process;

iv. to facilitate your download of our games including any related troubleshooting;

v. provide you the services required by you and perform our contractual obligations with  you;

vi. analyze and manage our services for system administration, user service, security, fraud-detection, checking the authenticity of an account owner, archival and/or backup purposes;

vii. correct bugs or errors, improve our services and respond to customer desires and preferences, including language and location customization, personalized support and instructions, and other responses;

viii. develop new services or products and improve the user experience;

ix. verify and confirm payment, ensure payment security, maintain transaction history record and resolving subsequent payment disputes;

x. deliver advertising that may be relevant to your interests and track the success of our advertising and marketing programs;

xi. communicate with users (including by sending text messages and/or push notifications) and take action against violations;

xii. personalize your experience;

xiii. provide you with customer service support;

xiv. create contact with other users of our services;

xv. facilitate your participation in creator events;

xvi. keep you up to date with the latest product announcements, and provide other information pertaining to our services;

xvii. provide software verification, upgrades and administration, notify of special events;

xviii. participate in our surveys, events or activities;

xix. prevent malicious content information in order to ensure a harmonious and healthy online environment in our services;

xx. to prevent certain words in your signature, nickname, or chat data from offending or distressing others within our services;

xxi. ensure security and stable operations;

xxii. provide a fair gaming environment, including prevent cheating;

xxiii. improve the functionality and quality of our services;

xxiv. fulfill our obligations under applicable laws and regulations, respond to requests of government authorities;

xxv. establish, exercise, or defend legal claims;

xxvi. analyze, profile, segment, merge and/or update all collected data (regardless of an aggregated or individualized manner) for the purposes of improving service quality and providing a better experience;

xxvii. protect the integrity, information safety, and financial security of our services or users, comply with legal obligations, and enforce compliance with the Terms of Service or other restrictions placed on your use of our services;

xxviii. to conduct user research;

xxix. track your process across our websites and applications to verify that you are not a bot and to optimize our services; and/or

xxx. for any other purposes for which we provide specific notice at the time the information is collected.

For the purposes mentioned above, our affiliates may be commissioned to process your information, provided that such affiliates comply with the terms in this Privacy Policy. “Affiliates” in this Privacy Policy means an entity that directly or indirectly controls, is controlled by, or is under common control with COGNOSPHERE PTE. LTD.

3. LEGAL BASIS OF OUR DATA COLLECTION AND PROCESSING

We are required to disclose the legal basis for processing your data under certain applicable laws, including the GDPR. To the extent that such laws apply to you, we rely on the following legal bases to collect and process your personal data:

i. Necessary for us to comply with our service agreement.

ii. Conducted with your consent, especially when legally required (you may email us at privacy@hoyoverse.com at any time to withdraw your consent).

iii. Necessary for us to carry out our legally stipulated obligations.

iv. Necessary for us to protect your important rights and the important rights of others (unless there is a conflict of interest between these rights and your rights).

v. Necessary for our legitimate interests and those of third parties, including our rights to provide innovative, direct marketing, and secure services to our users.

4. ADVERTISEMENTS AND YOUR CHOICES

For the purpose of providing personalized advertisements, you acknowledge and agree that we may collect and process your data to:

i. deliver, target and improve our advertising; and/or

ii. improve advertising and other marketing and promotional activities.

We, or where allowed under applicable law, our authorized contractors may deliver advertisements, marketing or promotional communications. If you do not wish to receive such information, you may request that we or our contractors remove your data from the contact list.

Pertaining to the advertisements, marketing or promotional communications, you may be able to opt-out of receiving such communications in accordance with the instructions contained in the communication, such as email, online communication channels, or other contact methods provided by us. For example, you may opt-out the out-of-game push notifications on mobile applications by checking the settings and turning off the "allow notifications" (iOS/Android).

5. COOKIES AND SIMILAR TECHNOLOGIES

In order to measure the effectiveness of our services, we may use cookies, which are small text files for added functionality or for tracking site usage. We may use cookies and/or authorize a third-party’s tracking-utility, from time to time, to (a) log your IP address in determining the path that users take on our sites and identifying repeat users of our sites, (b) collect the websites or sources that linked or referred you to our services, (c) collect technical data about the devices and software you use to access our services, the operating system of your devices, and other similar technical data and/or (d) collect personal data about your online activities over time and across different websites or online services. If you do not wish to accept cookies or want to be notified of when they are placed, you may set your web browser to do so, if your browser permits.

We use the cookies, web beacons and similar technologies to personalize your experiences on our services and for various other purposes, including:

i. remembering you: to help us identify you as a registered user and keep the preferences or data that you have previously provided;

ii. analyzing how you use our services: to help us understand what visitors (including users) are doing on our services, or what pages or sections are most popular, and to tell if you have opened or acted upon our email messages or newsletters;

iii. deliver advertising: to help us provide you with advertising that we believe is relevant to you or of interest to you, on the basis of the data you provide; and/or

iv. other related functions or purposes mentioned in Section 2 and Section 13.

We or our authorized contractors may also use cookies and similar technologies to provide and personalize services, prevent fraud and fulfil other purposes mentioned above. Our cookie policy can be found on https://www.hoyoverse.com/en-us/legal/cookies. Please note you may be able to disable cookies in your browser settings, or, depending on your jurisdiction, through our cookie settings but if you do so some parts of our services may then not function properly.

6. INFORMATION SHARING

We may share your information with our subsidiaries or Affiliates for the purposes indicated in Section 2 and Section 13 of this Policy. In addition, we may share your information with other parties in the following situations. You acknowledge that you have foreseen the occurrence of such disclosure when you provide your personal data.

A. Other In-Game Users of Our Services

Other users may, for example, in a group challenge, access your in-game activities in the process of such group challenge. Other users may also see your displayed data (including your nickname, UID, achievements, levels, and other character information) and read the messages you have posted on or through our services. You acknowledge and agree that our services may also include message boards, communities, forums, and/or other chat areas, where users may exchange ideas or communicate with other users, and that any data you post to any communication area is publicly viewable. We strongly recommend that all users avoid posting personal or sensitive data at any time on or through our services.

B. Other users of our community forum service(s)

i.     Publicly shared information, social engagement and profile visibility

Other users may be able to see data you display or read information in posts created by you through our community forum service(s). You confirm that such services may also include message boards, communities, and/or other chat areas where users may exchange ideas or communicate with each other. You further confirm that public information published by you can be seen by anyone (including users without an account), whether it be within or outside of our products. We strongly recommend that all users always avoid posting personal data.

It is important to note that when you choose to share content on public social media platforms, or you access these third party product services through our services' portals, the information you share on these platforms becomes public and accessible to a wider audience. Please exercise caution and ensure that you have read and agree to the privacy policy presented by the relevant third platforms and that the content you choose to share is consistent with your privacy preferences. This Privacy Policy does not, and will not, extend to such features that are subject to the respective third party's privacy policies.

ii.   Content about you that is shared or forwarded by others

People who can see your activity on our community forum service(s) have the option to share it with others in and outside of our products. For example, when you publish or share a post, other users can download, screenshot, or forward it to others within and outside of our products, or share such content on other social networks such as Facebook and X.

C. Competent Authorities

We may provide a certain portion of your personal data to governmental authorities as so requested according to applicable laws and regulations, or where it is in the public interest to do so.

Other than where we are required by applicable laws and regulations, we reserve the right to disclose your personal data in the cases if we, in our good faith, believe that disclosing such data is necessary to identify, contact, or bring legal action against you, if we reasonably believe that (a) you are violating any other agreement(s) between you and us, such as the Terms of Service, this Privacy Policy, or otherwise damage us; (b) you are infringing third-parties’ rights and interests (including but not limited to intellectual property rights); and/or (c) it is necessary to prevent fraud or other illegal activities.

D. Merger, Acquisition, Reorganization, Bankruptcy, New Owner

In the event of a merger, acquisition, reorganization, bankruptcy, or other similar event, we will make an announcement in advance, disclose the details of the event and information about the successor, and transfer your personal data to our successor entity in accordance with applicable laws. 

In addition, we may, in accordance with applicable laws, transfer your information to third parties:

i. in the event that we sell or buy any business or assets, in which case we may disclose your information to the prospective seller or buyer of such business or assets; or

ii. if we or substantially all of our assets are acquired by a third party, in which case user information will be one of the transferred assets.

E. Service Providers

We may work with the following types of third party service providers to help us provide services and functionalities to you:

i. Social networking portals (who may be considered our partners in some countries) who provide login and/or content-sharing service to and in our services;

ii. Logistics service providers who provide shipping services such as delivering physical prizes to users;

iii. Information communication service providers who provide SMS-messaging services;

iv. Payment service providers who provide payment services, such as assisting us in operating services, facilitating users’ payment, and maintaining a record of the users’ transaction history;

v. Advertising service contractors who provide marketing and advertising activities, including showing you ads that we think may interest you, conducting the programs, tracking the success, and analyzing the effect thereof; and

vi. Other contractors, if any, for the purpose of providing our services to you.

Additionally, such service providers may use cookies, web beacons, and/or other tracking technologies to collect or receive data about you. For example, users purchasing and/or subscribing to products or services will be required to provide additional data to third-party payment service providers, such as a valid credit card number and its expiration date. Such third-party payment service providers may collect, process, and retain your data to process payments and resolve subsequent payment disputes and inquiries. We may also receive, process and store the provided information from you and/or such third-party payment service providers to confirm payment, record purchase history, and/or protect our legitimate interest when resolving subsequent payment disputes and inquiries.

Notwithstanding the foregoing, for some of our services, if you make any payments in using these services, your payment details are fully handled by the relevant payment service provider, and we do not receive and/or process any of your actual payment details such as card number or security code. In these cases, we only keep the data concerning transaction date, currency, cost, and product(s) purchased.

F. Business Partners

Our services occasionally runs collaborations and special events with our business partners. These events may be run locally or globally, online or offline. If you participate in these special events, your personal data may be shared with these business partners in order to carry out the event, delivery of any prizes, to follow up on any events which you had opted in for, etc.

When specific third parties are involved in collecting data and information, please refer directly to their privacy policies on their official websites and learn more about their data processing practices.

7. DATA RETENTION

We will keep your data only for as long as your account is active or only for as needed to provide you the game services unless deleted in accordance with your request or where we are required to do so under applicable law. The locations of servers for our services include one or a combination of the following locations:

·    United States

·    European Union

·    Singapore

·    Japan

You acknowledge and agree that your data will be collected and processed on our servers which may not be located in your country/region of residence and can be accessed by our support, engineering and/or our affiliates around the world. No matter where our servers are located, we will make great efforts to take the appropriate safeguards to guarantee your rights in conformity with this Privacy Policy and any applicable laws and regulations.

Where necessary for the purposes mentioned in Section 2 and 13 of this policy, we may transfer your personal data to other parties, including those in Section 6 of this policy, which may involve the cross border transfer of data to other countries. In doing so, we will ensure that your personal data receives the appropriate level of protection in compliance with the applicable laws and regulations.

In the case you request to remove or delete your personal data, please note that we will continue to retain your data as long as necessary for applicable laws and regulations, such as to comply with our legal obligations, resolve disputes, and/or enforce the agreements between you and us. Please note that the removal or deletion of any of your data may result in the termination of some of our applicable services.

Where required by law, we will only store your information as long as necessary to fulfil the purposes for which the information is collected and processed or where the applicable laws and regulations provide for longer storage and retention period. Upon the expiration of such period, your personal data will be deleted, blocked or anonymized, as provided by and in accordance with applicable laws and regulations.

8. YOUR RIGHTS AND CHOICES

Subject to the applicable laws and regulations, you may have the following data protection rights as a user of our services and to withdraw your consent. You also have the right to complain to the local authorities.

To exercise any applicable rights below or to exercise any other statutory data subject rights you may enjoy under applicable laws and regulations, you may contact us using the contact details under the “Contact Us” heading below.

To protect the security of your account and your personal data, we may ask you to provide certain additional information before we respond to your requests. Under some circumstances, we may refuse to comply with your request as permitted by applicable laws and regulations. We may also charge a reasonable fee for complying with your request in accordance with applicable law (e.g. if your request is clearly repetitive or excessive).

(1) Right to Know about Personal Data Collected or Disclosed

You may have the right to access your personal data that we hold about you, such as (i) information whether your personal data is collected or disclosed, (ii) categories of your personal data which has been collected or disclosed, (iii) categories of sources from which your personal data is collected, and (iv) business or commercial purpose for collecting or disclosing your personal data (if any). You may have the right to require us to provide a duplicate of your processed personal data, subject to submitting a verifiable request to us using the contact information in section “Contact Us” below. You may also be able to exercise the right to access some of your personal data through the privacy setting available in the services (e.g. profile/personal page or privacy dashboard), where applicable.

(2) Right to Rectify / Right to Correct

If we process your personal data, we endeavour to ensure by implementing suitable measures that your personal data is accurate and up to date for the purposes for which it was collected. If your personal data is inaccurate or incomplete, you may have the right to request for rectification of your inaccurate personal data according to applicable laws and regulations and you may be able to modify the information in the privacy setting of the services (if available).

(3) Right to Request Deletion of Personal Data

You may have the right to request the deletion of your personal data, if the purpose(s) for processing as stated in Section 2 and Section 13 of this Privacy Policy does not exist anymore, or if there is another legal ground for its deletion, subject to submitting a verifiable request to the contact details under the “Contact Us” below.

You acknowledge and agree that as a result of deleting your account, you will lose access to game-related services, including the account information, subscriptions and game-related information linked to such account, and lose the possibility to access other services through the account.

(4) Right to Opt-out of Marketing Communications

You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing messages we send you.

(5) Right to Complain

You may have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority where applicable.

(6) Right to Withdraw Your Consent

If we have collected and processed your personal data based on your consent, you can withdraw your consent in accordance with applicable laws. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the processing of your personal data conducted in reliance on lawful processing grounds other than consent. In many circumstances, we need to use your personal data in order for us to provide you with our services which you require. If you do not provide us with the required personal data, or if you withdraw your consent to our use and/or disclosure of your personal data for these purposes, it may not be possible for us to continue to serve you or provide you with the services that you require.

9. SECURING YOUR DATA

We endeavour to take reasonable measures to prevent unauthorized access to or improper use of your personal data, such as organizational controls, technical protection, and other protection measures.

Unfortunately, the transmission of information via the internet is not completely secure. While we strive to protect your personal data, we also remind you to be aware of hacking, cyber-attacks, and other risks on the Internet.

Therefore, we strongly urge you to take every possible precaution to protect your personal data when using our services, including but not limited to changing your passwords from time to time, using a combination of letters and numbers when creating passwords, using a secure browser and/or taking other possible security measures.

Please be aware that advertisers or websites with links to and/or from our websites may collect personal data about you. This Privacy Policy does not apply to such third party services, and cannot control the activities of, those other advertisers or websites. We highly recommend that you read the privacy policy of such third-party websites which you may be directed to before providing any personal data.

10. CHILDREN’S PROTECTION

We are designing our services to be welcoming to users of all ages around the world. This means that we collect age information from users, and some of our services will provide a different experience based on what we know about the age of a user and where they live. The information below is for parents and guardians to understand our privacy practices with respect to children (under 13 or the age of consent under local laws, whichever is higher).

(1) Countries where we operate an Age-Gate

In certain countries, such as the United States, we may be required by law to operate an age-gate, where, when a user indicates that they are a child, we do not collect or process their personal data until they are no longer a child as defined above or until their parent or guardian provides consent and/or enables access to particular features. In these circumstances, the personal data we collect may include:

· Date of birth and country to determine age and apply appropriate settings

· Parent or guardian email address to provide notice and seek consent (which is deleted if the parent does not respond within 14 days)

· Persistent identifiers like IP address, UIDs, necessary website tracking technologies, and device identifiers in order to provide and maintain our services (including analytics to improve them), protect the security and integrity of users and ensure legal and regulatory compliance.

For clarity, the data indicated above (including persistent identifiers) will be collected and processed prior to obtaining parent or guardian consent, for the purposes stated and to support internal operations, for example, to trigger the age-gate and other internal operational purposes.

Notice, Consent, and Parental Controls

We collect a parent or guardian email address from a child player to send the parent or guardian an email notice that the child has initiated account creation, and informs them about how verifiable parental consent works. This notice also lets them review our privacy practices, provide consent for their child to create an account, and set up parental controls. Please note that parents/guardians must complete our parent verification process to provide consent for a child to set up an account.

We use Kids Web Services (KWS), for user age verification purposes. You can learn more about KWS in the KWS Privacy Policy.

When a parent or guardian gives permission for a child to set up an account, parental controls are enabled automatically. Parental controls can then be accessed using a PIN code, let you change choices about particular features made during the permission flow, and further customize your child’s experience. You can learn more about our parental controls here.

Once a parent has authorized an account for their child, the privacy practices described elsewhere in this Privacy Policy generally apply, but child users may not have access to all content or features (because of our parental controls in place). Depending on the parental control settings, the child player may be restricted in terms of payment access and community access such as social features and content sharing, among other features.

A parent may revoke consent to the collection of their child’s data at any time by contacting us using the contact details under “Contact Us” below. If a parent does not consent or later revokes consent, we will delete the child’s account and its associated information within 14 days of the response or revocation of consent.  If a parent does not respond to this request for consent within the prescribed period, we will delete the parent and the child’s data (including their HoYoverse account), if they already have one, within 14 days of the initial request.

For the avoidance of doubt, in certain countries such as the United States, we are required to delete accounts of children under the age of 13 unless a parent or guardian provides verifiable consent, and any child’s data or account that is deleted as a result of the foregoing is permanent, irrecoverable, and cannot be restored notwithstanding that the child subsequently reaches the age of 13. For other countries where the legally applicable age is higher, the higher age will apply. 

Child and Parent Privacy Rights

Child users and their parents/guardians can exercise their individual privacy rights as described in Section 8 above and Section 13 below. Parental controls enable parents and guardians to change the choices made about their child’s use of particular features like community access. Parents/Guardians can also review the child’s personal information held by us and delete their child’s account (which deletes the personal information and stops further collection). To exercise these rights, please see the “Contact Us” section below

(2) Countries where we do not operate an Age-Gate

In countries where we do not operate an age-gate, under certain laws, users under the age of 13 (or other age thresholds as stipulated under local laws) may not be allowed to use our services or require parental or guardian consent. If you are 13 and above but are considered a minor in your country, under certain laws, you must have your parent or legal guardian read through this Privacy Policy with you and you represent that you have obtained the permission or consent of your parent or guardian to use our services.

Information to Parents and Legal Guardians

If you are a parent or legal guardian of a minor in a country where we do not operate an age-gate, please make sure that you have read this Privacy Policy before allowing your children to create their own accounts or to use our services. You agree that you will be subject to this Privacy Policy and be responsible for your children’s activities while using our services. You agree to supervise your children’s use of our services and make sure that your children only view the contents that are age appropriate to your children.

Notwithstanding the foregoing, we recognize that we have a special obligation to protect children in regard to the collection and processing of personal data. We strongly urge parents and guardians to instruct their children never to disclose or give out their personal data when using our services without the prior permission of their parent or guardian. If you are a parent or guardian and have any concern regarding your child’s use of our services, please contact us using the contact details under “Contact Us” below.

11. CHANGES TO PRIVACY POLICY

We may occasionally update this Privacy Policy including to align with changes in our services or processes or comply with updated laws and regulations. We encourage you to check this Privacy Policy for updates periodically. Where necessary or required under law, we will notify you of any updated terms to obtain your consent again or allow you to exercise your rights. If you have any questions or concerns about our privacy practices, please reach out to us using the details provided in the "Contact Us" section below.

Your continued use of our services shows that you acknowledge how we will collect, handle, and use your personal data according to the revised Privacy Policy.

12. CONTACT US

If you have any requests, concerns, questions about us, this Privacy Policy or how we process your personal data, or you want to make any complaints or want to exercise your data subject rights, please contact us as soon as possible by emailing our Data Protection Office at privacy@hoyoverse.com, or via the address below:

Company name: COGNOSPHERE PTE. LTD.

Address: 1 One-North Crescent, #06-01/02, Singapore (138538)

13. SUPPLEMENTAL TERMS – JURISDICTION-SPECIFIC

(1) Additional Information for US Residents

(a) General

Why We Collect and Process Your Personal Data

In order to provide our services to you, we collect and process the following categories of personal data described in more detail in Section 1, for one or multiple purposes described below, and for any other purposes for which we provide specific notice at the time the information is collected.

Data Retention

Where your data is required to be deleted in accordance with your request or where we are legally required to do so under applicable law or otherwise, we may retain certain personal information where permitted or required under law. For example, we may retain persistent identifiers such as device ID, device FP, IP address and other device information that was collected prior to obtaining verifiable parental consent, for the purpose of supporting internal operations.

Your Rights and Choices

If you submit a request to us and you receive a response from us informing you that we have declined your request, in whole or in part, where provided by applicable law, you may appeal that decision by submitting your appeal using the contact method described in Section 12 of this Privacy Policy.

Right to Opt-out of Targeted Advertising and Data “Sales”

Some privacy laws define “sale” broadly to include some of the data disclosures described in Section 6 above – in particular certain sharing with third party providers for targeted advertising purposes. To opt-out from targeted advertising and any related data “sales,” you have several options.

You can use browser or device-level controls as follows:

· Cookie controls. Please see our Cookie Policy (https://www.hoyoverse.com/en-us/legal/cookies) for details on how you can control cookies. Note that if you choose to refuse or delete cookies, this could affect certain features, settings and preferences controlled by those cookies including advertising preferences which may be deleted and may need to be recreated.

· Do Not Track. Some browsers include a "Do Not Track" (DNT) setting that can send a signal to the websites you visit indicating you do not wish to be tracked. Our websites do not respond to browser DNT signals. Instead, you can use the range of other tools to control data collection and use, including the advertising controls described above.

· Mobile advertising ID controls. iOS and Android operating systems provide options to limit tracking and/or reset the advertising IDs.

· Email web beacon controls. Most email clients have settings that allow you to prevent the automatic downloading of images, including web beacons, and the automatic connection to the web servers that host those images

These choices are specific to the device or browser you are using. If you access our services from other devices or browsers, take these actions from those devices or browsers to ensure your choices apply to the data collected when you use them.

(b) Additional terms for California Residents

California Consumer Privacy Act. The CCPA requires us to provide our users who reside in California with the additional notice below. For the purposes of this notice, Personal Information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, or as otherwise defined by the California Consumer Privacy Act of 2018 (California Civil Code §§ 1798.100 to 1798.199) and its implementing regulations, as amended or superseded from time to time (“CCPA”).

Personal Information does not include information that is:

· Lawfully made available from government records.

· Deidentified or aggregated.

· Otherwise excluded from the scope of the CCPA.

We collect and disclose the categories of personal information as set out in Section 13(1)(a) above, for the business purposes also set out in Section 13(1)(a).

If you are a California resident, and the processing of personal information about you is subject to the CCPA, you have certain rights with respect to that information:

· Notice at Collection. At or before the time of collection, you have a right to receive notice of our practices, including the categories of personal information and sensitive personal information to be collected [Section 1], the purposes for which such information is collected or used [Section 2], whether such information is sold or shared, and how long such information is retained [Section 7]. You can find those details in this Privacy Policy by referring to this and the above-referenced sections.

· Right to Know. The right to request a copy of the personal information that we have collected about you in the prior 12 months. You also have a right to request additional information about our collection, use, disclosure, or sale of such personal information. Note that we have provided much of this information in this Privacy Policy. You may make such a “request to know” as described in Section 8(1) of this Privacy Policy.

· Rights to Request Correction or Deletion. You also have rights to request that we correct inaccurate personal information and that we delete personal information under certain circumstances, subject to a number of exceptions. To make a request to correct or delete, please do so using our game/non-game account information functionality or email us using the contact information in Section 12 of this Privacy Policy.

· Right to Opt-Out / “Do Not Sell or Share My Personal Information”. You have a right to opt-out from future “sales” or “sharing” of personal information as those terms are defined by the CCPA.

Note that the CCPA defines “sell,” “share,” and “personal information” very broadly, and some of our data disclosures described in this Privacy Policy may be considered a “sale” or “sharing” under those definitions. In particular, we let advertising and analytics providers collect identifiers (IP addresses, cookie IDs, and mobile IDs), activity data (browsing, clicks, app usage), and device data through our sites and apps when you use our online services, but do not “sell” or “share” any other types of personal information. If you do not wish for us or our partners to “sell” or “share” personal information relating to your visits to our sites for advertising purposes, you can make your request by emailing us using the contact information in Section 12 of this Privacy Policy. If you opt-out using these choices, we will not disclose or make available such personal information in ways that are considered a “sale” or “sharing” under the CCPA. However, we will continue to make available to our partners (acting as our service providers) some personal information to help us perform advertising-related functions. Further, using these choices will not opt you out of the use of previously “sold” or “shared” personal information or stop all interest-based advertising.

We do not knowingly sell the personal information of minors under 16 years of age.

· Right to Limit Use and Disclosure of Sensitive Personal Information. You have a right to limit our use of sensitive personal information for any purposes other than to provide the services or goods you request or as otherwise permitted by law. Note that we do not use sensitive personal information for any such additional purposes.

You may designate, in writing or through a power of attorney, an authorized agent to make requests on your behalf to exercise your rights under the CCPA. Before accepting such a request from an agent, we will require the agent to provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us.

Further, to provide, correct, or delete specific pieces of personal information we will need to verify your identity to the degree of certainty required by law. We will verify your request through common market practices, including by asking you to send it from the email address associated with your account or requiring you to provide information necessary to verify your account.

You have the right not to receive discriminatory treatment for the exercise of your CCPA privacy rights, subject to certain limitations.

Additionally, under California Civil Code section 1798.83, also known as the “Shine the Light” law, California residents who have provided personal information to a business with which the individual has established a business relationship for personal, family, or household purposes (“California Customers”) may request information about whether the business has disclosed personal information to any third parties for the third parties’ direct marketing purposes.

Please be aware that we do not disclose personal information to any third parties for their direct marketing purposes as defined by this law.

California Customers may request further information about our compliance with this law by emailing the address provided in the "Contact Us" section above. Please note that businesses are required to respond to one request per California Customer each year and may not be required to respond to requests made by means other than through the designated email address.

California residents under the age of 18 who are registered users of online sites, services, or applications have a right under California Business and Professions Code section 22581 to remove, or request and obtain removal of, content or information they have publicly posted. To remove content or information you have publicly posted, or to request that we remove such content or information, please send us a detailed description of the specific content or information you wish to have removed using the details provided in the "Contact Us" section above. Please be aware that your request does not guarantee complete or comprehensive removal of content or information posted online and that the law may not permit or require removal in certain circumstances.

An authorized agent may submit an access or deletion request on your behalf by sending a written authorization signed by you using the contact information in the “Contact Us” section. We may still require you to directly verify your identity and confirm that you provided the authorized agent permission to submit the request

(2)  Additional Information for the EEA and UK residents

If you are in the European Economic Area (EEA) or the United Kingdom (UK), the following additional information applies to you in addition to the Privacy Policy set out above.

Data Subject Rights

In addition to the information set out in the "Your rights and choices" section in the Privacy Policy above, you have the right to:

· ask us to restrict the processing of your personal data,

· data portability,

· to object to the processing of personal data.

Legal basis for processing your personal data

Our legal basis for collecting and using the information described in section 1 for the purposes in section 2 of our Privacy Policy above is:

· To establish and perform our contract with you (i.e. our Terms of Service) and to provide our services;

· For our or our partners’ legitimate interests, where those interests are not overridden by your data protection interests of fundamental rights and freedoms, e.g. to protect our legal rights, to pursue or defend legal claims, to improve our services;

· Consent, where obtained separately;

· For compliance with our legal obligations under applicable laws and regulations;

· To protect our or your vital interests or those of another person (for example, another player), e.g. against fraud and violations of our terms;

· While we typically do not collect sensitive or special category personal information, where we do this, it will be on the grounds of explicit consent or other applicable lawful basis.

Where we rely on a legitimate interest for the processing of your data, we have performed a legitimate interest assessment to determine whether your interests outweigh our interests in the processing taking place. You can obtain more information about this balancing test by using the contact details under ‘Contact Us’.

If you have questions, need further information about the legal bases for processing your personal information, or want to withdraw your consent, please see section 12 “Contact Us” in the Privacy Policy above.

Cross-border data transfer

As a global company, we may transfer your personal data to our affiliates, third party service providers and partners that operate around the world, which are located in countries other than the country in which you are resident (e.g. Singapore). These countries may have data protection laws that are different to the laws of your country.

Where we transfer your personal information to countries and territories outside of the European Economic Area and the UK, which have been formally recognised as providing an adequate level of protection for personal information, we rely on the relevant “adequacy decisions” from the European Commission, where applicable.

Where the transfer is not subject to an adequacy decision, we have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Privacy Policy. The safeguards we use are the European Commission’s Standard Contractual Clauses as issued on 4 June 2021, including the UK Addendum, and/or the UK International Data Transfer Agreement permitted under Article 46 of the UK GDPR. This is how transfers of personal information between us and other companies will be safeguarded. All companies are required to protect personal information that they process from Europe in accordance with European Union data protection law. Transferred personal information includes basic information such as your name or contact information such as your email address.

Children's Notice

Our services are not marketed to, or intended for, children. Children for the purposes of our services are (a) under the age of 13 years old or, if older (b) between 13 and 18 years old but under the age at which they can give valid digital consent to processing of their personal information under applicable data privacy laws. We strive to follow the different minimum age guidelines set by the laws of individual regions when determining the age that children can access certain features of our services.

Children are not permitted to use our services, and we do not knowingly collect any personal information from children. Though our services are not intended for children as the primary audience, we may collect age information before allowing a user to proceed for certain services. If we learn that we have inadvertently gathered personal information about a child that is not subject to an exemption under applicable privacy law, we will take measures to promptly remove that information from our records.

Data Protection Supervisory Authority

To lodge a complaint with your national or regional data protection supervisory authority, please contact the competent authority.

(3) Additional Information for Residents of Japan

If you are located in Japan, please see the information below with regard to international data transfers as described in Section 7 (Data Retention), in accordance with Article 28(2) of the Japanese Act on the Protection of Personal Information.

(a) the name of the countries where the data recipients are located (headquartered)

Singapore

(b) the personal information protection systems of such foreign countries

See the link below: https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/#gaikoku

(c) the measures to be taken by the data recipients

We will ensure that third parties in foreign countries to which we transfer your personal data take all measures corresponding to the eight principles of the OECD privacy guidelines.

(4) Additional Information for residents of South Korea

If you are in South Korea, the following additional information applies to you in addition to the Privacy Policy set out above.

Destruction of Your Personal Data

If we determine that your personal data is no longer needed, we will destroy it under the supervision of our chief privacy officer and in accordance with applicable law and the Privacy Policy. Personal data in the form of electronic files will be securely deleted using technical methods to prevent recovery and reproduction, and printouts will be destroyed by shredding or incineration.

Data Subjects Rights

In addition to the information set out in the "Your rights and choices" section in the Privacy Policy above, you have the following rights:

(a)    Right to Request the Suspension of Processing

You may have the right to request the suspension of processing of your personal data that we have collected and processed. However, such a request may be denied under applicable laws or regulations.

In many circumstances, we need to process your personal data in order to provide you with the services you require. If you do not provide the necessary personal data, or if you request the suspension of its processing for these purposes, we may be unable to continue providing you with the services you require.

Location of Servers

The servers for the services we provide are located as follows:

COGNOSPHERE PTE. LTD.