Last Updated: November 1, 2023
Warm welcome to you as our valued supplier! We collect and process certain personal information about you with our finance IT platform and supplier management systems (collectively the “Platform”) to manage our relationship with you. We respect your concerns about privacy and appreciate your trust and confidence in us.
What information do we need to be able to provide the Platform?
How will we use your information?
Who do we share your information with?
Where do we process your information?
How long do we keep your information?
How can I exercise my rights over my information?
How will we notify you of changes?
This Platform has been developed by Tencent Technology (Shenzhen) Co. Ltd., a member of the Tencent group (“we”, “us”, “our”).
For the purpose of data protection laws, the data controller of your personal information in relation to the Platform is the Tencent entity with which you or your organisation (individually or collectively, as applicable, “you”) are contracting. Please refer to your executed agreement for details of the applicable data controller.
This Platform is not intended for children. Children must not use the Platform for any purpose.
You must not provide personal information about children during your dealings with us as our supplier or potential supplier for any purpose, except where their parent or guardian has provided consent (to the extent this option is available in your jurisdiction).
By children, we mean users under the age of 18 years old; or in the case of a country where the minimum age for processing personal information differs, such different age. You should in any case refer to the laws in your jurisdiction to ensure you are above the relevant legal minimum age. We do not knowingly collect personal information from children under these ages for any purpose. If you believe that we have personal information of a child without parental/guardian consent, or if you are the parent or guardian of the user and wish to withdraw consent, please contact us.
2. How We Process Your Personal Information
This section provides more detail on the types of personal information we collect from you, and why. For users who live in Brazil, the European Economic Area, Indonesia, Switzerland, Thailand, Türkiye or the United Kingdom (“Relevant Jurisdiction”), it also identifies the legal basis under which we process your data.
Legal Basis (only relevant if you are located in the EEA)
Information you provide to us (either directly or through a third party)
Business information (company name, company registration number, registered address, city, province, post code, business scope, tax information (such as tax certificate and number), business license and certificates, industry, vendor category, currency, organisation code, revenue, business website, business contact information, business status and remarks) (to the extent business information qualifies as personal information)
We use this information to:
We process your personal information to perform the contract we have entered into with you, including to consider and conclude a contract with you, and to administer the business relationship.
It is in our and your legitimate interest to contract and facilitate the provision of goods or services, and to maintain our business relationship with you (including to consider and explore business opportunities with you).
Contact person(s) and management personnel information (Name, job title, email, mobile number, phone number, address, fax number, QQ number, WeChat number, Whatsapp ID or Line ID or any contact information you provide (if you do not have QQ number or WeChat number), country or city where contact person(s) is located (Optional), supported language (Optional) and supplier unique ID
We use this information to:
We process your personal information to perform the contract we have entered into with you, including to consider and conclude a contract with you, and to administer the business relationship.
It is in our and your or your organisation’s legitimate interest to contract and facilitate the provision of goods or services, and to maintain our business relationship with you (including to consider and explore business opportunities with you).
Identification documents (including national ID or passport number, insurance number, tax number)
We use this information to verify the identity of you or your organisation to prevent fraud.
It is in our legitimate interest to verify the legitimacy of our suppliers and protect ourselves against fraud.
Bank account information (account number, holder name, and bank name/country/city), payment remarks
We use this information to process any payment transactions with you and maintain a record of your transaction history.
We process your personal information to perform the contract we have entered into with you, including to administer the business relationship and facilitate the provision of goods or services and payments.
Information generated as part of the Platform
Transaction records (such as invoices, purchase orders, contracts, date and time of payment for services)
We use this information to facilitate your payment and maintain a record of your transaction history.
We process your personal information to perform the contract we have entered into with you, including to administer the business relationship and process transaction records relating to the provision of goods or services and payments.
It is also necessary for us to retain transaction records to comply with applicable legal obligations, including accounting records retention rules.
Supplier unique ID
We generate this information to link you and your Platform data with your profile.
We process your personal information to perform the contract we have entered into with you, including to administer the business relationship.
3. How We Store and Share Your Personal Information
We have servers for this Platform are located in:
- Singapore; and
- the United States.
The servers applicable to your use of the Platform will depend upon the Tencent affiliate(s) you are contracting with.
We also have support, engineering and other teams who may support the Platform, including from the Netherlands, the PRC, Singapore and the United States).
For EEA/UK users, transfers between our affiliates and to third parties use applicable safeguards, such as incorporating standard contractual clauses, obtaining your consent first or taking into account adequacy assessments.
Only where necessary will we share your personal information with third parties. Situations where this occur are:
- Regulators, judicial authorities and law enforcement agencies, and other third parties for safety, security, or compliance with the law. There are circumstances in which we may be legally required to disclose information about you, such as to comply with a legal obligation or processes. In complying with the terms of valid legal process, such as a subpoena, or search warrant, unfortunately we may not be able to seek your consent to or notify you in advance of such disclosure.
- Third parties to ensure safety, security, or compliance with laws: We may disclose your information to:
- enforce our terms and conditions and other agreements, including investigation of any potential violation thereof;
- detect, prevent or otherwise address security, fraud or technical issues; or
- protect the rights, property or safety of us, our users, a third party or the public as required or permitted by law (such as exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction).
- A third party that acquires all or substantially all of us or our business. We may also disclose your information to third parties if we either: (a) sell, transfer, merge, consolidate or re-organise any part(s) of our business, or merge with, acquire or form a joint venture with, any other business, in which case we may disclose your data to any prospective buyer, new owner, or other third party involved in such change to our business; or (b) sell or transfer any of our assets, in which case the information we hold about you may be sold as part of those assets and may be transferred to any prospective buyer, new owner, or other third party involved in such sale or transfer.
4. The Security of Your Personal Information
We have information security and access policies that limit access to our systems and technology, and we protect data through the use of technological protection measures such as encryption.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will implement and maintain reasonable measures to protect your personal information, we cannot guarantee the security of the information transmitted through the Platform or otherwise via the Internet; any transmission is at your own risk.
5. Data Retention
We do not keep your data for longer than is necessary to fulfil the relevant purpose described above unless we are required or permitted to do so under law. If we retain your information beyond the retention periods set out below, for example to comply with applicable laws, we will store it separately from other types of personal information.
For further details on how long we keep your data, please refer to the time periods set out below (subject to any statutory obligation to keep personal data for a longer period, or where we may need your personal data for a longer period in case of a legal claim or to fulfil other legal, accounting or reporting requirements):
Contact person(s) and management personnel information
Onboarded suppliers: Stored for the duration of the business relationship with you (i.e., the term of the contract with you until any legal claims under the contract expire).
Suppliers that have not been onboarded, or onboarded suppliers whose contract term with us has ended: Stored for as long as we maintain our business relationship with you (including to consider and explore business opportunities with you) and/or as necessary for our and your legitimate interests.
If you do not want us to retain your personal data for consideration for other opportunities, or want us to update it, please email us at firstname.lastname@example.org. Please note, however, that we may retain some information if required by law or as necessary to protect ourselves from legal claims.
Bank account information
Stored for as long as we maintain our business relationship with you (including to consider and explore business opportunities with you) and/or as necessary for our and your legitimate interests, and/or as otherwise necessary for legal, regulatory or compliance purposes.
6. Your Rights
Some jurisdictions’ laws grant specific rights to users of the Platform. Please refer to the Supplemental Jurisdiction-Specific Terms, or the applicable laws in your jurisdiction, for an overview of specific rights that apply to persons subject to data protection laws in the listed jurisdictions and how these can be exercised.
You may have certain rights in relation to the personal information we hold about you. Some of these only apply in certain circumstances (as set out in more detail below). You can exercise some of these rights directly by accessing and updating the information in your account (if applicable). If you believe we hold any other personal information about you, please contact us.
You may have the right to access personal information we hold about you, how we use it, and who we share it with. You can access the personal information you have made available as part of your self-service account by logging into your account (if applicable).
You may have the right to receive a copy of certain personal information we process about you. For example, in certain jurisdictions this can comprise personal information we process on the basis of your consent or pursuant to our contract with you (e.g., your email address), as described above in the section “How We Process Your Personal Information”. We will provide further information to you about transferring this data if you make such a request.
You may have the right to correct personal information we hold that is inaccurate. You can access the personal information we hold about you by logging into your Platform account (if applicable).
You may be able to delete your account, or remove certain personal information, by logging into your self-service account (if applicable). We may need to retain personal information if there are valid grounds under data protection laws for us to do so (for example, for the defence of legal claims or freedom of expression) but we will let you know if that is the case. Where you have requested that we erase personal information that has been made available publicly on the Platform and there are grounds for erasure, we will use reasonable steps to try to tell others that are displaying the personal information or providing links to the personal information to erase it too.
Restriction of Processing to Storage Only
You may have a right to require that we stop processing the personal information we hold about you (other than for storage purposes in certain circumstances). Please note, however, that if we stop processing the personal information, we may use it again if there are valid grounds under data protection laws for us to do so (for example, for the defence of legal claims or for another’s protection). Where we agree to stop processing the personal information, we will take steps to tell any third party to whom we have disclosed the relevant personal information so that they can stop processing it too.
You may have the right to object to our processing of your personal information. If you wish to do so, please contact us at email@example.com or using the contact details set out below, and we will consider your request.
To the extent provided by applicable laws and regulations, you may withdraw consent you previously provided to us for certain processing activities by contacting us at firstname.lastname@example.org. Where consent is required to process your personal information, if you do not consent to the processing or if you withdraw your consent we may not be able to deliver the expected service. Please note that the right to withdraw consent is only available if the legal basis for processing information is consent.
We may from time to time send you announcements when we consider it necessary to do so (for example, when we temporarily suspend access to the Platform for maintenance, or security, privacy or administrative-related communications). These are essential system and service-related announcements and you are not able to opt-out of these notifications, which are not promotional in nature.
Please get in touch with us if you have any questions. You can reach us in the first instance at:
Tencent International Privacy & Data Protection Centre
[30 Raffles Place #19-01
We will endeavor to deal with your request as soon as possible. This is without prejudice to any right you may have to launch a claim with a data protection authority in the region in which you live or work where you think we have infringed data protection laws.
Our Representatives in Certain Jurisdictions
Tencent International Service Europe B.V.
Gustav Mahlerplein 2, 1082 MA, Amsterdam, the Netherlands
Image Frame Investment (UK) Limited
Suite 1, 3rd Floor 11 - 12 St. James's Square, London, United Kingdom, SW1Y 4LB
SUPPLEMENTAL TERMS – JURISDICTION SPECIFIC
If you are located in Canada and wish to obtain written information about our policies and practices with respect to our service providers located outside Canada, you may contact us at email@example.com. Our privacy experts who monitor this email address are also able to answer any questions users may have about the collection, use, disclosure or storage of personal information by our service providers.
Instructions for the processing of your personal data after your death
You have the right to provide us with general or specific instructions for the retention, deletion, and communication of your personal data after your death. The specific instructions are only valid for the processing activities mentioned therein and the processing of these instructions is subject to your specific consent. You may amend or revoke your instructions at any time.
You may designate a person responsible for the implementation of your instructions. This person will be informed of your instructions, in the event of your death, and be entitled to request their implementation from us. In the absence of designation or, unless otherwise provided for, in the event of the death of the designated person, their heirs will have the right to be informed of your instructions and to request their implementation from us.
When you wish to make such instructions, please contact us as set out in Section 7 (Contact).
By clicking “accept”, you consent to the cross-border transfer of your information to any country where we have databases or affiliates and, in particular, the locations specified in Section 3 (How We Store and Share Your Personal Information).
You have the right to access your personal information, how we use it, and who we share it with. You have the right to correct any of your personal information that is inaccurate.
Our designated data protection officer for the purposes of compliance with the Personal Data Protection Act 2012 can be contacted as set out in Section 7 (Contact).
For purposes of this section, “personal information” and “sensitive personal information” have the meanings given in the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) (“CCPA”), and respectively include the terms “personal data” and “sensitive data” as defined in the Colorado Privacy Act (“CPA”), the Connecticut Act Concerning Personal Data Privacy and Online Monitoring (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”) and the Virginia Consumer Data Protection Act (“VCDPA”), (collectively, “US State Laws”). The terms do not include information excluded from the scope of US State Laws.
Collection and Disclosure of Personal Information
Over the past 12 months, we have collected and disclosed for a business purpose the following categories of personal information, including sensitive personal information (denoted by *), from or about you or your device:
- Identifiers, such as your name, phone number, email address, address and national ID number. This information is collected directly from you.
- Personal information categories listed in the California Customer Records statute, including information covered by other categories such as your address and phone number. This information is collected directly from you.
- Commercial information about any transactions within the Platform such bank account information. This information is collected directly from you.
- Geolocation information such as your region location when provide your contact information. This information is collected directly from you.
- Passport number*, when we verify your identity for fraud prevention purposes.
We collect and disclose your personal information, including sensitive personal information, for the following purposes:
- To enter into a contract with you or your organisation and to provide the Platform.
- To consider and explore business opportunities with you.
- To facilitate your payment and to maintain a record of your transaction history.
- For security and verification purposes, including to prevent and detect fraudulent activity.
For additional information about what each type of personal information is used for, see Section 2 (How We Process Your Personal Information).
We disclose each of the categories of personal information that we collect as described in Section 3 (How We Store and Share Your Personal Information).
In the past 12 months, we have not sold or shared personal information of California residents within the meaning of “sold” and “share” in the CCPA. And we have no knowledge of any sale or sharing of personal information of users under 16 years of age.
In addition, we do not use or disclose sensitive personal information for purposes other than to perform the services reasonably expected by an average consumer who requests those services or as otherwise permitted by US State Laws.
Retention of Your Personal Information
Rights under US State Laws:
Depending on where you live, you may have some or all of the rights listed below in relation to information that we have collected about you. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law.
- Right to Access/Know. Request we confirm whether we process information about you and give you access to that information. You may also request to receive that information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another business without impediment. If you are a California resident, you may request the following information about our collection, use and disclosure of your information:
- the categories of personal information about you that we collected;
- the categories of sources from which the personal information was collected;
- the business or commercial purposes for collecting personal information about you;
- the categories of third parties to whom we disclosed personal information about you and the categories of personal information that was disclosed (if applicable) and the purpose for disclosing the personal information about you; and
- the specific pieces of personal information we collected about you;
- Request to Delete. Request we delete personal information we collected about you;
- Request to Correct. Request we correct inaccurate personal information that we maintain about you;
- Right to Non-Discrimination. Be free from unlawful discrimination for exercising your rights including providing a different level or quality of services or denying goods or services to you when you exercise your rights under the US State Laws.
How to Exercise Your Rights
First, you may wish to log into your account (if applicable) and manage your data from there. Depending on where you live, you may also exercise your rights, if any, regarding other data by contacting us as specified in Section 7 (Contact). We may take steps to verify your identity before complying with your request to protect your privacy and security, and may decline your request if we are unable to verify your identity. To verify your identity, we may need the following information from you: your first name, last name, address, phone number, date of birth and email address.
Depending on where you live, you may exercise these rights yourself or you may also designate an authorized agent to make these requests on your behalf. In order for us to process the request, you must provide the authorized agent with signed written permission. We reserve the request to require the agent to verify their own identity and to confirm directly with you that you have provided the authorized agent permission to submit the request.
In addition, where applicable, we will provide you with more information about our appeal process. When you submit a request or launch an appeal, we will limit our collection of your information to only what is necessary to securely fulfil your request or process your appeal. We will not require you or your authorized agent to pay a fee for the verification of your request or appeal.