Last Updated: March 2022

Warm welcome to you as our valued supplier! We collect and process certain personal information about you with our finance IT platform (the “Platform”) to manage our relationship with you. We respect your concerns about privacy and appreciate your trust and confidence in us.

Here is a summary of the information contained in this privacy policy ( “Privacy Policy”). This summary is to help you navigate the Privacy Policy and it is not a substitute for reading everything! You can use the hyperlinks below to jump directly to particular sections.

Please note this Privacy Policy only applies to suppliers to Tencent affiliates in Canada, the United Kingdom, the European Union, Singapore and the United States.

What information do we need to provide the Platform?

We will process some information from you (e.g., name and email address) in order to contract with you and manage our relationship with you using this Platform.

How will we use your information?

We use your information to enter into a contract with you or your organisation, to operate the Platform and to facilitate your payment and maintain a record of your transaction history. We do not share your information with any third parties, except where we need to in order to operate the Platform (e.g., use cloud or IT infrastructure providers; use our affiliates around the world to help us to deliver the Platform) or we are instructed to by a court, authority or compelled by law. More Information.

Who do we share your information with?

We use some third parties to help us deliver the best possible experience (e.g., cloud or IT infrastructure services). When we use a third party, we only do this to process or store your information for the purposes described in this Privacy Policy. We also have affiliates around the world who help us deliver the Platform and we may be required by a court or legal obligation to disclose certain information in some circumstances. More Information.

Where do we process your information?

Our servers are located in Germany, the People’s Republic of China (excluding Hong Kong, Taiwan and Macau) (“PRC”), Singapore and the United States. Our support, engineering and other teams are located in our offices around the world (including the Netherlands, the PRC, Canada, Singapore and the United States) and will have access to your information. More Information.

How long do we keep hold of your information?

We generally retain your information in accordance with our retention policy, after which time the data held by us is deleted (as further described in this Privacy Policy), unless otherwise required by applicable laws. More Information.

How can I exercise my rights over my information?

Depending on where you are, you may have certain rights with respect to your information, such as rights of access, to receive a copy of your data, or to delete your data or restrict or object to our processing of your data. More Information.

How to get in touch with us

If you have any questions about anything in this Privacy Policy, or want to exercise any rights you may have, please contact us by email to supplier_dpo@tencent.com. More Information.

How will we notify you of changes?

Changes to this Privacy Policy will be posted here. Please check this page frequently to see if there are any updates or changes to this Privacy Policy. More Information.

Contact Information

Data Controller: Depending on which Tencent entity you or your organisation are contracting with (See the table below for the relevant Tencent entities).

Email: You can contact the data controller at supplier_dpo@tencent.com.

EU Representative: Tencent International Service Europe B.V.  Email: supplier_dpo@tencent.com. 

UK Representative: Image Frame Investment (UK) Limited  Email: supplier_dpo@tencent.com. 

This Privacy Policy explains the when, how and why when it comes to processing of your personal information in connection with the Platform, and sets out your choices and rights in relation to that information. Please read it carefully – it is important for you to understand how we collect and use your information, and how you can control it.

If you do not agree to the processing of your personal information in the way this Privacy Policy describes, please do not provide your information when requested. By providing your personal information to us, you are acknowledging our rules regarding your personal information as described in this Privacy Policy.

This Platform has been developed Tencent Technology (Shenzhen) Co. Ltd., a member of the Tencent group (“we”, “us”, “our”).

For the purpose of data protection laws, the data controller of your personal information in relation to the Platform is the Tencent entity with which you or your organisation are contracting. Please refer to your executed agreement for details of the applicable data controller.

Our representatives in the EU and the UK jurisdictions are as follows:

EU	Tencent International Service Europe B.V.	Gustav Mahlerplein 2, 1082 MA,  Amsterdam, the Netherlands	supplier_dpo@tencent.com
UK	Image Frame Investment (UK) Limited	Suite 1, 3rd Floor 11 - 12 St. James's Square, London, United Kingdom, SW1Y 4LB	supplier_dpo@tencent.com

Please reach out to us if you have any questions or concerns regarding the processing of your personal information: you can contact us anytime at supplier_dpo@tencent.com.

This section describes the different types of personal information we collect from you and how we collect it. If you would like to know more about specific types of data and how we use that data, please see the section entitled “How We Use Your Personal Information” below.

The following is a high level summary of the types of personal information we use:

• You give us information about you when you are first onboarded as a potential supplier of us and we create a profile for you on the Platform, such as your name, email and phone number.
• You also provide information in connection with entering or performing any contract with us, such as a bank account number.

Children

This Platform is not intended for children. You must not provide personal information about children during your dealings with us as our supplier or potential supplier for any purpose, except where their parent or guardian has provided consent (to the extent this option is available in your jurisdiction).

By children, we mean users under the age of 18 years old; or in the case of a country where the minimum age for processing personal information differs, such different age. For users located in certain countries we have listed the relevant minimum age in the table below.

Country in which the user is located	Minimum age of the user
Canada	19
European Economic Area/United Kingdom/Switzerland	16
Singapore	14
United States	16

We do not knowingly collect personal information from children under these ages for any purpose. If you believe that we have personal information of a child under these ages without parental/guardian consent, or if you are the parent or guardian of the user and wish to withdraw consent, please contact us at supplier_dpo@tencent.com and we will delete such information.

This section provides more detail on the types of personal information we collect from you, and why. For users who live in the United Kingdom, the European Economic Area and Switzerland (“Relevant Jurisdiction”), it also identifies the legal basis under which we process your data.

Personal Information	Use	Legal Basis (only relevant if you are located in the EEA)
Name, email, phone number, address, fax number, QQ number, WeChat number, and supplier number	We use this information to enter into and administer any contract with you or your organisation, to operate the Platform, and to facilitate your payment and maintain a record of your transaction history.	It is in our and your or your organisation’s legitimate interest to contract and facilitate the provision of goods or services.
Identification documents (including national ID number, insurance number, tax number)	We use this information to verify the identity of you or your organisation to prevent fraud.	It is in our legitimate interest to verify the legitimacy of our suppliers and protect ourselves against fraud.
Bank account information (account number, holder name, and bank name/country/city), payment remarks	We use this information to process any payment transactions with you and maintain a record of your transaction history.	It is in our and your or your organisation’s legitimate interest to contract and facilitate the provision of goods or services and payments.
Transaction records (such as invoices, purchase orders, contracts, date and time of payment for services)	We use this information to facilitate your payment and maintain a record of your transaction history.	It is our legitimate interest to process transaction records relating to the provision of goods or services and payments. It is also necessary for us to retain transaction records to comply with applicable legal obligations, including accounting records retention rules.

The Tencent group operates around the world. Pursuant to our contract with you, your personal information will be processed on servers that may not be located where you live. No matter where our servers are located, we take appropriate measures to safeguard your rights in accordance with this Privacy Policy. Our servers for this Platform are located in:

• Germany;
• the People’s Republic of China (for the purpose of this Privacy Policy, this term excludes Taiwan, Hong Kong and Macau) (“PRC”); 
• Singapore; and
• the United States.

In addition, our support, engineering and other teams are located in our offices around the world (including the Netherlands, the PRC, Canada, Singapore and the United States) and will have access to your information.

Only where necessary will we share your personal information with third parties. Situations where this occur are:

• Third parties that provide services in support of the Platform, including providers of IT infrastructure, enterprise planning and cloud services that process information identified in this Privacy Policy on their servers. All companies providing services for us are prohibited from retaining, using, or disclosing your personal information for any purpose other than providing us with their services.
• Companies within the Tencent corporate group who process your personal information in order to operate the Platform. All related group companies may only use your personal information in accordance with this Privacy Policy.
• Regulators, judicial authorities and law enforcement agencies, and other third parties for safety, security, or compliance with the law. There are circumstances in which we are legally required to disclose information about you to authorities, such as to comply with a legal obligation or processes, enforce our terms, address issues relating to security or fraud, or protect our users. These disclosures may be made with or without your consent, and with or without notice, in compliance with the terms of valid legal process such as a subpoena, court order, or search warrant. We are usually prohibited from notifying you of any such disclosures by the terms of the legal process. We may seek your consent to disclose information in response to a governmental entity’s request when that governmental entity has not provided the required subpoena, court order, or search warrant. We may also disclose your information to:
  • enforce our terms and conditions and other agreements, including investigation of any potential violation thereof;
  • detect, prevent or otherwise address security, fraud or technical issues; or
  • protect the rights, property or safety of us, our users, a third party or the public as required or permitted by law (exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction).
• A third party that acquires all or substantially all of us or our business. We may also disclose your information to third parties if we either: (a) sell, transfer, merge, consolidate or re-organise any part(s) of our business, or merge with, acquire or form a joint venture with, any other business, in which case we may disclose your data to any prospective buyer, new owner, or other third party involved in such change to our business; or (b) sell or transfer any of our assets, in which case the information we hold about you may be sold as part of those assets and may be transferred to any prospective buyer, new owner, or other third party involved in such sale or transfer.

Security of Your Personal Information

We are committed to maintaining the privacy and integrity of your personal information no matter where it is stored. We have information security and access policies that limit access to our systems and technology, and we protect data through the use of technological protection measures such as encryption.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will implement and maintain reasonable measures to protect your personal information, we cannot guarantee the security of the information transmitted through the Platform or otherwise via the Internet; any transmission is at your own risk.

Personal Information	Retention Policy
Name, email, phone number, address, fax number, QQ number, WeChat number and supplier number	Stored for 1 year from the end of our contract with you or your organisation and then deleted, or deleted within 30 days of a valid and lawful request from you for the erasure of such data.
Identification documents (including national ID number, insurance number, tax number)	Stored for 1 year from the end of our contract with you or your organisation and then deleted, or deleted within 30 days of a valid and lawful request from you for the erasure of such data.
Bank account information, payment remarks	Stored for 1 year from the end of our contract with you or your organisation and then deleted, or deleted within 30 days of a valid and lawful request from you for the erasure of such data.
Transaction records (such as invoices, purchase orders, contracts, date and time of payment for services and which may, if necessary, include abovementioned types of personal data)	Stored for 1 year from the end of our contract with you, and then for the duration of any retention periods for which such data must be retained in order to comply with our legal obligations (in particular, accounting records retention rules).

If we are required to retain your information beyond the retention periods set out above, for example to comply with applicable laws, we will store it separately from other types of personal information.

Some jurisdictions’ laws grant specific rights to users of the Platform, which are set out in this section.

This section entitled “Your Rights” applies to users that are located in the European Economic Area (including the United Kingdom) and Switzerland. If you are located in a territory outside of these jurisdictions, please refer to the Supplemental Jurisdiction-Specific Terms for an overview of your rights and how these can be exercised.

The sub-section entitled “Erasure” also applies to users that are located in Canada.

The sub-section entitled “Access” and “Correction” also apply to users that are located in Canada and Singapore.

You have certain rights in relation to the personal information we hold about you, depending on where you are located. Some of these only apply in certain circumstances (as set out in more detail below). We must respond to a request by you to exercise those rights without undue delay and at least within one month (though this may be extended by a further two months in certain circumstances). To exercise any of your rights, please contact us at supplier_dpo@tencent.com.

Access

You have the right to access personal information we hold about you, how we use it, and who we share it with. You can access the personal information you have made available as part of your self-service account by logging into your account (if applicable). If you believe we hold any other personal information about you, please contact us at supplier_dpo@tencent.com.

Portability

You have the right to receive a copy of certain personal information we process about you. This comprises any personal information we process on the basis of your consent or pursuant to our contract with you (e.g., your email address), as described above in the section “How We Use Your Personal Information”. You have the right to receive this information in a structured, commonly used and machine-readable format. You also have the right to request that we transfer that personal information to another party, with certain exceptions. We will provide further information to you about this if you make such a request.

If you wish for us to transfer such personal information to a third party, please ensure you detail that party in your request. Note that we can only do so where it is technically feasible. Please note that we may not be able to provide you with personal information if providing it would interfere with another’s rights (for example, where providing the personal information we hold about you would reveal information about another person or our trade secrets or intellectual property).

Correction

You have the right to correct any of your personal information we hold that is inaccurate. You can access the personal information we hold about you by logging into your Platform account (if applicable). If you believe we hold any other personal information about you and that information is inaccurate, please contact us at supplier_dpo@tencent.com. 

Erasure

You can delete your account, or remove certain personal information, by logging into your self-service account (if applicable). If there is any other personal information you believe we process that you would like us to erase, please contact us at supplier_dpo@tencent.com.

We may need to retain personal information if there are valid grounds under data protection laws for us to do so (for example, for the defence of legal claims or freedom of expression) but we will let you know if that is the case. Where you have requested that we erase personal information that has been made available publicly on the Platform and there are grounds for erasure, we will use reasonable steps to try to tell others that are displaying the personal information or providing links to the personal information to erase it too.

Restriction of Processing to Storage Only

You have a right to require us to stop processing the personal information we hold about you other than for storage purposes in certain circumstances. Please note, however, that if we stop processing the personal information, we may use it again if there are valid grounds under data protection laws for us to do so (for example, for the defence of legal claims or for another’s protection). As above, where we agree to stop processing the personal information, we will try to tell any third party to whom we have disclosed the relevant personal information so that they can stop processing it too.

Objection

You have the right to object to our processing of your personal information. We will consider your request in other circumstances as detailed below by contacting us at supplier_dpo@tencent.com.

To the extent provided by applicable laws and regulations, you may withdraw any consent you previously provided to us for certain processing activities by contacting us at supplier_dpo@tencent.com. Where consent is required to process your personal information, if you do not consent to the processing or if you withdraw your consent we may not be able to deliver the expected service.

Announcements

We may from time to time send you announcements when we consider it necessary to do so (for example, when we temporarily suspend access to the Platform for maintenance, or security, privacy or administrative-related communications). You may not opt-out of these service-related announcements, which are not promotional in nature.

Questions, comments and requests regarding this Privacy Policy are welcomed and should be addressed to supplier_dpo@tencent.com.

In the event that you wish to make a complaint about how we process your personal information, please contact us in the first instance at supplier_dpo@tencent.com and we will endeavour to deal with your request as soon as possible. This is without prejudice to your right to launch a claim with the data protection authority in the country in which you live or work where you think we have infringed data protection laws.

If we make any changes to this Privacy Policy we will post the updated Privacy Policy here. Please check this page frequently to see if there are any updates or changes to this Privacy Policy.

 

SUPPLEMENTAL TERMS FOR USERS LOCATED IN CERTAIN JURISDICTIONS

Some jurisdictions’ laws contain additional terms for users of the Platform, which are set out in this section.

If you are a user located in one of the jurisdictions below, the terms set out below under the name of your jurisdiction apply to you in addition to the terms set out in our Privacy Policy above.

California

This section applies to California residents covered by the California Consumer Privacy Act of 2018 (“CCPA”).

Collection and Disclosure of Personal Information

Over the past 12 months, we have collected and disclosed the following categories of personal information from you:

• Identifiers, such as your name, phone number, email address, address and national ID number. This information is collected directly from you.
• Commercial information about any transactions within the Platform such as bank account information. This information is collected directly from you.
• We collect your personal information for the following purposes:
• To enter into a contract with you or your organisation and to provide the Platform.
• To facilitate your payment and to maintain a record of your transaction history.
• For additional information about what each type of personal information is used for, see this chart in the main portion of the Privacy Policy.
• We disclose personal information to the following types of entities:
• Other companies within the Tencent group who process your personal information in order to operate the Platform.
• Other companies that provide services on our behalf in support of the Platform and who are prohibited by contract from retaining, using, or disclosing personal information for any purpose other than for providing their services to us.
• Regulators,  judicial authorities and law enforcement agencies.
• Entities that acquire all or substantially all of our business.

In the past 12 months, we have not sold Personal Information of California residents within the meaning of “sold” in the CCPA.

Rights under the CCPA

If you are a California resident, you have the right to:

• Request we disclose to you free of charge the following information covering the 12 months preceding your request:
  • the categories of personal information about you that we collected;
  • the categories of sources from which the personal information was collected;
  • the purpose for collecting personal information about you;
  • the categories of third parties to whom we disclosed personal information about you and the categories of personal information that was disclosed (if applicable) and the purpose for disclosing the personal information about you; and
  • the specific pieces of personal information we collected about you;
• Request we delete personal information we collected from you, unless CCPA recognizes an exception; and
• Be free from unlawful discrimination for exercising your rights including providing a different level or quality of services or denying goods or services to you when you exercise your rights under the CCPA.  

We aim to fulfil all verified requests within 45 days pursuant to the CCPA. If necessary, extensions for an additional 45 days will be accompanied by an explanation for the delay.

How to Exercise Your Rights

First, you may wish to log into your account (if applicable) and manage your data from there. If you are a California resident to whom the CCPA applies, you may exercise your rights, if any, regarding other data by contacting us at supplier_dpo@tencent.com.

Canada 

If you are located in Canada and wish to obtain written information about our policies and practices with respect to our service providers located outside Canada, you may contact us at supplier_dpo@tencent.com. Our privacy experts who monitor this email address are also able to answer any questions users may have about the collection, use, disclosure or storage of personal information by our service providers. 

Where we use service providers who might have access to your personal information, we require them to have privacy and security standards that are comparable to ours. We use contracts and other measures with our service providers to maintain the confidentiality and security of your personal information and to prevent it from being used for any purpose other than as provided in this Privacy Policy.

France

Your Rights

Instructions for the processing of your personal data after your death

You have the right to provide us with general or specific instructions for the retention, deletion, and communication of your personal data after your death.

The specific instructions are only valid for the processing activities mentioned therein and the processing of these instructions is subject to your specific consent.

You may amend or revoke your instructions at any time.

You may designate a person responsible for the implementation of your instructions. This person will be informed of your instructions, in the event of your death, and be entitled to request their implementation from us. In the absence of designation or, unless otherwise provided for, in the event of the death of the designated person, their heirs will have the right to be informed of your instructions and to request their implementation from us.

When you wish to make such instructions, please contact us at supplier_dpo@tencent.com.

Singapore

Our designated data protection officer for the purposes of compliance with the Personal Data Protection Act 2012 can be contacted at supplier_dpo@tencent.com.