Last Updated:  November 1, 2023 

Warm welcome to you as our valued supplier! We collect and process certain personal information about you with our finance IT platform and supplier management systems (collectively the “Platform”) to manage our relationship with you. We respect your concerns about privacy and appreciate your trust and confidence in us.

Please note this Privacy Policy only applies to suppliers to Tencent affiliates globally, except the People’s Republic of China (which for the purpose of this Privacy Policy, excludes Hong Kong, Macau and Taiwan) (“PRC”).

 

SUMMARY

Here is a summary of the information contained in this privacy policy ( “Privacy Policy”). This summary is to help you navigate the Privacy Policy and it is not a substitute for reading everything! You can find more detail by clicking ‘More Information’.

What information do we need to be able to provide the Platform?	We will process some information about you (e.g., your business information, and your contact information (such as your name, job title, email, phone number, address) in order to evaluate you as a potential supplier, enter into and administer a contract with you, mange our relationship with you using the Platform, and consider and explore business opportunities with you. We will also assign you a supplier unique ID.  We will also process identification documents (such as your national ID number, insurance and tax information) to verify your legitimacy as a supplier. In order to process payment transactions and record your transaction history, we will also process bank account information and transaction records. If you need to get in touch with us, we will retain some information (such as your email and any screenshots you send us) so that we can review and respond to your concerns.	More Information.
How will we use your information?	We use your information to identify, evaluate, communicate with, and consider you or your organisation as a supplier (such as as part of the procurement process), to onboard you and enter into a contract with you or your organisation, to enable us to manage our business relationships, to operate the Platform, to inform you of or consider or explore future opportunities with you, to facilitate your payment and maintain a record of your transaction history, and to comply with our legal obligations and enforce our legal rights. We do not share your information with any third parties, except where we need to in order to operate the Platform (e.g., use cloud or IT infrastructure providers; use our affiliates around the world to help us to deliver the Platform) or we are instructed to by a court, authority or compelled by law.	More Information.
Who do we share your information with?	We use third parties and work with our affiliates to help us deliver the best possible experience (such as cloud or IT infrastructure services).  All third party service providers providing services for us are prohibited from retaining, using, or disclosing your personal information for any purpose except where strictly necessary for the Platform (i.e., to fulfil the purpose(s) described above). In some cases we may be required by a court or be under a legal obligation (such as a valid search warrant or subpoena) to disclose certain information.	More Information.
Where do we process your information?	Pursuant to our contract with you, we may transfer data outside of the location in which you are based for the purposes described in this Privacy Policy. We have servers for the Platform in Singapore, Germany, the United States, and the PRC. The servers applicable to your use of the Platform will depend upon the Tencent affiliate(s) you or your organisation are contracting with. We also have support, engineering and other teams who may support the Platform, including the Netherlands, the PRC, Singapore and the United States and will have access to your information. For EEA/UK users, transfers between our affiliates and to third parties use applicable safeguards, such as incorporating standard contractual clauses, obtaining your consent first or taking into account adequacy assessments.	More Information.
How long do we keep your information?	Unless otherwise required or permissible by applicable laws, we retain your information for so long as the information is needed to fulfil the purpose for which it was collected (as further described in this Privacy Policy). We then delete or anonymise such data, in accordance with applicable laws.	More Information.
How can I exercise my rights over my information?	Certain jurisdictions offer users specific rights with respect to their information, so you may have a right to access or receive a copy of your data, or to delete your data or restrict or object to our processing of your data.	More Information.
How will we notify you of changes?	Changes to this Privacy Policy will be posted here. We will also notify you of changes in accordance with relevant legal requirements.	More Information.

 

This Privacy Policy explains the when, how and why when it comes to processing of your personal information in connection with the Platform, and sets out your choices and rights in relation to that information. Please read it carefully – it is important for you to understand how we collect and use your information, and how you can control it.

If you do not agree to the processing of your personal information in the way this Privacy Policy describes, please do not provide your information when requested. By providing your personal information to us, you are acknowledging our rules regarding your personal information as described in this Privacy Policy.

This Platform has been developed by Tencent Technology (Shenzhen) Co. Ltd., a member of the Tencent group (“we”, “us”, “our”).

For the purpose of data protection laws, the data controller of your personal information in relation to the Platform is the Tencent entity with which you or your organisation (individually or collectively, as applicable, “you”) are contracting. Please refer to your executed agreement for details of the applicable data controller. 

If you have any questions about anything in this Privacy Policy, or want to exercise any rights you may have, our contact information can be found here. You can also reach out to our data protection officer at supplier_dpo@tencent.com. We have representatives for data protection purposes listed here. 

1. Children

This Platform is not intended for children. Children must not use the Platform for any purpose.

You must not provide personal information about children during your dealings with us as our supplier or potential supplier for any purpose, except where their parent or guardian has provided consent (to the extent this option is available in your jurisdiction).

By children, we mean users under the age of 18 years old; or in the case of a country where the minimum age for processing personal information differs, such different age. You should in any case refer to the laws in your jurisdiction to ensure you are above the relevant legal minimum age. We do not knowingly collect personal information from children under these ages for any purpose. If you believe that we have personal information of a child without parental/guardian consent, or if you are the parent or guardian of the user and wish to withdraw consent, please contact us.

2. How We Process Your Personal Information

This section provides more detail on the types of personal information we collect from you, and why. For users who live in Brazil, the European Economic Area, Indonesia, Switzerland, Thailand, Türkiye or the United Kingdom (“Relevant Jurisdiction”), it also identifies the legal basis under which we process your data.

Personal Information	Use	Legal Basis (only relevant if you are located in the EEA)
Information you provide to us (either directly or through a third party)
Business information (company name, company registration number, registered address, city, province, post code, business scope, tax information (such as tax certificate and number), business license and certificates, industry, vendor category, currency, organisation code, revenue, business website, business contact information, business status and remarks) (to the extent business information qualifies as personal information)	We use this information to: identify, evaluate, communicate with, and consider you as a supplier, enter into and administer any contract with you,  operate the Platform, and  inform you of, consider, or explore business opportunities with you.	We process your personal information to perform the contract we have entered into with you, including to consider and conclude a contract with you, and to administer the business relationship.    It is in our and your legitimate interest to contract and facilitate the provision of goods or services, and to maintain our business relationship with you (including to consider and explore business opportunities with you).
Contact person(s) and management personnel information (Name, job title, email, mobile number, phone number, address, fax number, QQ number, WeChat number, Whatsapp ID or Line ID or any contact information you provide (if you do not have QQ number or WeChat number), country or city where contact person(s) is located (Optional), supported language (Optional) and supplier unique ID	We use this information to: enter into and administer any contract with you,  operate the Platform,  facilitate your payment and maintain a record of your transaction history, and inform you of, consider, or explore business opportunities with you.	We process your personal information to perform the contract we have entered into with you, including to consider and conclude a contract with you, and to administer the business relationship.    It is in our and your or your organisation’s legitimate interest to contract and facilitate the provision of goods or services, and to maintain our business relationship with you (including to consider and explore business opportunities with you).
Identification documents (including national ID or passport number, insurance number, tax number)	We use this information to verify the identity of you or your organisation to prevent fraud.	It is in our legitimate interest to verify the legitimacy of our suppliers and protect ourselves against fraud.
Bank account information (account number, holder name, and bank name/country/city), payment remarks	We use this information to process any payment transactions with you and maintain a record of your transaction history.	We process your personal information to perform the contract we have entered into with you, including to administer the business relationship and facilitate the provision of goods or services and payments.
Information generated as part of the Platform
Transaction records (such as invoices, purchase orders, contracts, date and time of payment for services)	We use this information to facilitate your payment and maintain a record of your transaction history.	We process your personal information to perform the contract we have entered into with you, including to administer the business relationship and process transaction records relating to the provision of goods or services and payments.    It is also necessary for us to retain transaction records to comply with applicable legal obligations, including accounting records retention rules.
Supplier unique ID	We generate this information to link you and your Platform data with your profile.	We process your personal information to perform the contract we have entered into with you, including to administer the business relationship.

3. How We Store and Share Your Personal Information

Pursuant to our contract with you, we may transfer data outside of the location in which you are based for the purposes described in this Privacy Policy.

We have servers for this Platform are located in:

• Germany;
• the People’s Republic of China (for the purpose of this Privacy Policy, this term excludes Taiwan, Hong Kong and Macau) (“PRC”); 
• Singapore; and
• the United States.

The servers applicable to your use of the Platform will depend upon the Tencent affiliate(s) you are contracting with. 

We also have support, engineering and other teams who may support the Platform, including from the Netherlands, the PRC, Singapore and the United States).

For EEA/UK users, transfers between our affiliates and to third parties use applicable safeguards, such as incorporating standard contractual clauses, obtaining your consent first or taking into account adequacy assessments.

Only where necessary will we share your personal information with third parties. Situations where this occur are:

• Third parties that provide services in support of the Platform, including providers of IT infrastructure, enterprise planning and cloud services that process information identified in this Privacy Policy on their servers. All third-party service providers providing services for us are prohibited from retaining, using, or disclosing your personal information for any purpose, except where strictly necessary for the Platform (i.e., for the purpose(s) described above).
• Companies within the Tencent corporate group who process your personal information solely for the purpose of providing the Platform to you. All such group companies may only use your personal information in accordance with this Privacy Policy.
• Regulators, judicial authorities and law enforcement agencies, and other third parties for safety, security, or compliance with the law. There are circumstances in which we may be legally required to disclose information about you, such as to comply with a legal obligation or processes. In complying with the terms of valid legal process, such as a subpoena, or search warrant, unfortunately we may not be able to seek your consent to or notify you in advance of such disclosure. 
• Third parties to ensure safety, security, or compliance with laws: We may disclose your information to:
  • enforce our terms and conditions and other agreements, including investigation of any potential violation thereof;
  • detect, prevent or otherwise address security, fraud or technical issues; or
  • protect the rights, property or safety of us, our users, a third party or the public as required or permitted by law (such as exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction).
• A third party that acquires all or substantially all of us or our business. We may also disclose your information to third parties if we either: (a) sell, transfer, merge, consolidate or re-organise any part(s) of our business, or merge with, acquire or form a joint venture with, any other business, in which case we may disclose your data to any prospective buyer, new owner, or other third party involved in such change to our business; or (b) sell or transfer any of our assets, in which case the information we hold about you may be sold as part of those assets and may be transferred to any prospective buyer, new owner, or other third party involved in such sale or transfer.

4. The Security of Your Personal Information

We have information security and access policies that limit access to our systems and technology, and we protect data through the use of technological protection measures such as encryption.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will implement and maintain reasonable measures to protect your personal information, we cannot guarantee the security of the information transmitted through the Platform or otherwise via the Internet; any transmission is at your own risk.

5. Data Retention

We do not keep your data for longer than is necessary to fulfil the relevant purpose described above unless we are required or permitted to do so under law. If we retain your information beyond the retention periods set out below, for example to comply with applicable laws, we will store it separately from other types of personal information. 

For further details on how long we keep your data, please refer to the time periods set out below (subject to any statutory obligation to keep personal data for a longer period, or where we may need your personal data for a longer period in case of a legal claim or to fulfil other legal, accounting or reporting requirements): 

Personal Information	Retention Policy
Business information Contact person(s) and management personnel information Identification documents	Onboarded suppliers: Stored for the duration of the business relationship with you (i.e., the term of the contract with you until any legal claims under the contract expire).   Suppliers that have not been onboarded, or onboarded suppliers whose contract term with us has ended: Stored for as long as we maintain our business relationship with you (including to consider and explore business opportunities with you) and/or as necessary for our and your legitimate interests. If you do not want us to retain your personal data for consideration for other opportunities, or want us to update it, please email us at supplier_dpo@tencent.com. Please note, however, that we may retain some information if required by law or as necessary to protect ourselves from legal claims.
Bank account information Transaction records	Stored for as long as we maintain our business relationship with you (including to consider and explore business opportunities with you) and/or as necessary for our and your legitimate interests, and/or as otherwise necessary for legal, regulatory or compliance purposes.

6. Your Rights

Some jurisdictions’ laws grant specific rights to users of the Platform. Please refer to the Supplemental Jurisdiction-Specific Terms, or the applicable laws in your jurisdiction, for an overview of specific rights that apply to persons subject to data protection laws in the listed jurisdictions and how these can be exercised.

You may have certain rights in relation to the personal information we hold about you. Some of these only apply in certain circumstances (as set out in more detail below). You can exercise some of these rights directly by accessing and updating the information in your account (if applicable). If you believe we hold any other personal information about you, please contact us.

Access

You may have the right to access personal information we hold about you, how we use it, and who we share it with. You can access the personal information you have made available as part of your self-service account by logging into your account (if applicable).

Portability

You may have the right to receive a copy of certain personal information we process about you. For example, in certain jurisdictions this can comprise personal information we process on the basis of your consent or pursuant to our contract with you (e.g., your email address), as described above in the section “How We Process Your Personal Information”. We will provide further information to you about transferring this data if you make such a request.

Correction

You may have the right to correct personal information we hold that is inaccurate. You can access the personal information we hold about you by logging into your Platform account (if applicable). 

Erasure

You may be able to delete your account, or remove certain personal information, by logging into your self-service account (if applicable). We may need to retain personal information if there are valid grounds under data protection laws for us to do so (for example, for the defence of legal claims or freedom of expression) but we will let you know if that is the case. Where you have requested that we erase personal information that has been made available publicly on the Platform and there are grounds for erasure, we will use reasonable steps to try to tell others that are displaying the personal information or providing links to the personal information to erase it too.

Restriction of Processing to Storage Only

You may have a right to require that we stop processing the personal information we hold about you (other than for storage purposes in certain circumstances). Please note, however, that if we stop processing the personal information, we may use it again if there are valid grounds under data protection laws for us to do so (for example, for the defence of legal claims or for another’s protection). Where we agree to stop processing the personal information, we will take steps to tell any third party to whom we have disclosed the relevant personal information so that they can stop processing it too.

Objection

You may have the right to object to our processing of your personal information. If you wish to do so, please contact us at supplier_dpo@tencent.com or using the contact details set out below, and we will consider your request.

Consent withdrawal 

To the extent provided by applicable laws and regulations, you may withdraw consent you previously provided to us for certain processing activities by contacting us at supplier_dpo@tencent.com. Where consent is required to process your personal information, if you do not consent to the processing or if you withdraw your consent we may not be able to deliver the expected service. Please note that the right to withdraw consent is only available if the legal basis for processing information is consent.

Announcements

We may from time to time send you announcements when we consider it necessary to do so (for example, when we temporarily suspend access to the Platform for maintenance, or security, privacy or administrative-related communications). These are essential system and service-related announcements and you are not able to opt-out of these notifications, which are not promotional in nature.

7. Contact

Please get in touch with us if you have any questions. You can reach us in the first instance at:

Email: supplier_dpo@tencent.com.

Mailing Address: 

Tencent International Privacy & Data Protection Centre

[30 Raffles Place #19-01

Singapore

048622]

We will endeavor to deal with your request as soon as possible. This is without prejudice to any right you may have to launch a claim with a data protection authority in the region in which you live or work where you think we have infringed data protection laws.

8. Changes

If we make any changes to this Privacy Policy we will post the updated Privacy Policy here and notify you in accordance with relevant legal requirements.

9. Language

Except as otherwise prescribed by law, in the event of any discrepancy or inconsistency between the English version and local language version of this Privacy Policy, the English version shall prevail.

 

Our Representatives in Certain Jurisdictions 

Jurisdiction	Representative	Address	Contact details
EU	Tencent International Service Europe B.V.	Gustav Mahlerplein 2, 1082 MA,  Amsterdam, the Netherlands	supplier_dpo@tencent.com
UK	Image Frame Investment (UK) Limited	Suite 1, 3rd Floor 11 - 12 St. James's Square, London, United Kingdom, SW1Y 4LB	supplier_dpo@tencent.com

 

SUPPLEMENTAL TERMS – JURISDICTION SPECIFIC

Some jurisdictions’ laws contain additional terms for users of the Platform, which are set out in this section. If you are a user located in one of the jurisdictions below, the terms set out below under the name of your jurisdiction apply to you in addition to the terms set out in our Privacy Policy above.

 

Canada 

If you are located in Canada and wish to obtain written information about our policies and practices with respect to our service providers located outside Canada, you may contact us at supplier_dpo@tencent.com. Our privacy experts who monitor this email address are also able to answer any questions users may have about the collection, use, disclosure or storage of personal information by our service providers. 

Where we use service providers who might have access to your personal information, we require them to have privacy and security standards that are comparable to ours. We use contracts and other measures with our service providers to maintain the confidentiality and security of your personal information and to prevent it from being used for any purpose other than as provided in this Privacy Policy.

 

France

Your Rights

Instructions for the processing of your personal data after your death

You have the right to provide us with general or specific instructions for the retention, deletion, and communication of your personal data after your death. The specific instructions are only valid for the processing activities mentioned therein and the processing of these instructions is subject to your specific consent. You may amend or revoke your instructions at any time.

You may designate a person responsible for the implementation of your instructions. This person will be informed of your instructions, in the event of your death, and be entitled to request their implementation from us. In the absence of designation or, unless otherwise provided for, in the event of the death of the designated person, their heirs will have the right to be informed of your instructions and to request their implementation from us.

When you wish to make such instructions, please contact us as set out in Section 7 (Contact).

 

Singapore

By clicking “accept”, you consent to the cross-border transfer of your information to any country where we have databases or affiliates and, in particular, the locations specified in Section 3 (How We Store and Share Your Personal Information).

You have the right to access your personal information, how we use it, and who we share it with. You have the right to correct any of your personal information that is inaccurate. 

Our designated data protection officer for the purposes of compliance with the Personal Data Protection Act 2012 can be contacted as set out in Section 7 (Contact).

 

United States

For purposes of this section, “personal information” and “sensitive personal information” have the meanings given in the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) (“CCPA”), and respectively include the terms “personal data” and “sensitive data” as defined in the Colorado Privacy Act (“CPA”), the Connecticut Act Concerning Personal Data Privacy and Online Monitoring (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”) and the Virginia Consumer Data Protection Act (“VCDPA”),  (collectively, “US State Laws”). The terms do not include information excluded from the scope of US State Laws.

 

Collection and Disclosure of Personal Information

Over the past 12 months, we have collected and disclosed for a business purpose the following categories of personal information, including sensitive personal information (denoted by *), from or about you or your device:

• Identifiers, such as your name, phone number, email address, address and national ID number. This information is collected directly from you.
• Personal information categories listed in the California Customer Records statute, including information covered by other categories such as your address and phone number. This information is collected directly from you.
• Commercial information about any transactions within the Platform such bank account information. This information is collected directly from you. 
• Geolocation information such as your region location when provide your contact information. This information is collected directly from you.
• Passport number*, when we verify your identity for fraud prevention purposes. 

 

We collect and disclose your personal information, including sensitive personal information, for the following purposes:

• To enter into a contract with you or your organisation and to provide the Platform.
• To consider and explore business opportunities with you.
• To facilitate your payment and to maintain a record of your transaction history. 
• For security and verification purposes, including to prevent and detect fraudulent activity.

 

For additional information about what each type of personal information is used for, see Section 2 (How We Process Your Personal Information).

 

We disclose each of the categories of personal information that we collect as described in Section 3 (How We Store and Share Your Personal Information). 

 

In the past 12 months, we have not sold or shared personal information of California residents within the meaning of “sold” and “share”  in the CCPA. And we have no knowledge of any sale or sharing of personal information of users under 16 years of age. 

 

In addition, we do not use or disclose sensitive personal information for purposes other than to perform the services reasonably expected by an average consumer who requests those services or as otherwise permitted by US State Laws. 

 

Retention of Your Personal Information

The retention period varies among the different categories of data collected.  For detailed information about the retention period for any specific category of data, see this chart in the main portion of the Privacy Policy.  

 

Rights under US State Laws:

Depending on where you live, you may have some or all of the rights listed below in relation to information that we have collected about you. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. 

 

• Right to Access/Know. Request we confirm whether we process information about you and give you access to that information. You may also request to receive that information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another business without impediment. If you are a California resident, you may request the following information about our collection, use and disclosure of your information:
  • the categories of personal information about you that we collected;
  • the categories of sources from which the personal information was collected;
  • the business or commercial purposes for collecting personal information about you;
  • the categories of third parties to whom we disclosed personal information about you and the categories of personal information that was disclosed (if applicable) and the purpose for disclosing the personal information about you; and
  • the specific pieces of personal information we collected about you;
• Request to Delete. Request we delete personal information we collected about you; 
• Request to Correct. Request we correct inaccurate personal information that we maintain about you; 
• and
• Right to Non-Discrimination. Be free from unlawful discrimination for exercising your rights including providing a different level or quality of services or denying goods or services to you when you exercise your rights under the US State Laws.   

 

How to Exercise Your Rights

First, you may wish to log into your account (if applicable) and manage your data from there. Depending on where you live, you may also exercise your rights, if any, regarding other data by contacting us as specified in Section 7 (Contact). We may take steps to verify your identity before complying with your request to protect your privacy and security, and may decline your request if we are unable to verify your identity.  To verify your identity, we may need the following information from you: your first name, last name, address, phone number, date of birth and email address.   

 

Depending on where you live, you may exercise these rights yourself or you may also designate an authorized agent to make these requests on your behalf.  In order for us to process the request, you must provide the authorized agent with signed written permission.  We reserve the request to require the agent to verify their own identity and to confirm directly with you that you have provided the authorized agent permission to submit the request.

 

In addition, where applicable, we will provide you with more information about our appeal process. When you submit a request or launch an appeal, we will limit our collection of your information to only what is necessary to securely fulfil your request or process your appeal. We will not require you or your authorized agent to pay a fee for the verification of your request or appeal.

 

Questions

If you have questions or concerns regarding this Privacy Policy, please contact us as set out in Section 7 (Contact).