Feishu - Privacy Policy

Publish Date: April 15, 2020

Welcome to Feishu products and services (including but not limited to Feishu, Feishu Docs, Feishu Meeting, Feishu Conference Room and other products and services, collectively referred to as this “Platform”).This Platform is a multi-platform office management communication and collaboration tool providing functions of, among others, instant bi/multi-party involved voice SMS, picture, and text message communication service as well as member management, enterprise contacts, Docs, calendar, voice and video calls, video conferencing and emails, as well as interconnection services with other software. Control of the services or operations of this Platform is provided by Beijing Feishu Technology Co., Ltd. (hereinafter referred to as“we”, “us”, or “Feishu Technology”).This Policy sets out the basis on which any Personal Data from you will be processed, collected, used, and disclosed by us when you access or use this Platform.

(1) This Policy applies to the functions, products and services of this Platform itself, but it does not apply to other products or services provided by any third party through this Platform. You shall fully understand the terms of services and privacy policy of third party when you choose to use the third party service. You shall properly protect your Personal Data and provide your Personal Data to third parties only when necessary.

(2) In order to provide you with a high-quality and convenient use experience, we will pre-install some of the apps in the Feishu App Store (hereinafter referred to as "Pre-installed Apps") in this platform. You can click to view the Pre-installed Apps on the Feishu workplace for information. If you choose not to use a Pre-installed App, you can delete such Pre-installed App on the workplace; deleting the Pre-installed Apps will not affect your normal use of the other features/applications of this Platform.

(3) Wuhan Ulpay Technology Co., Ltd., a third party payment company, provides services regarding the “Purse” function of the Platform for you and it will collect and process your Personal Data, and this Platform will not intervene in the processing of your Personal Data in this respect and Feishu Technology may assume no liability for your acts and privacy policy as well as other matters concerned in your use of any third party payment service. You need to confirm and accept the service agreement with Wuhan Ulpay Technology Co., Ltd. when you use the “Purse” function. If you do not confirm and accept such service agreement, you will be unable to use the “Purse” function.

(4) If you use this Platform as a member of a corporate User, then your employer is the controller of (Personal Data related with you provided to us), we are the data processor, collecting and using your information only for providing services to your employer. We will process your Personal Data according to your employer’s requirements. Your employer may have its own privacy statement, and this Policy shall not be taken as a placement of your employer’s privacy statement.

These terms constitute a legally binding agreement between you and us. We hereby specially remind you that you should carefully read and fully understand all provisions of this Agreement, in particular, the provisions on exemption from or relief of our liabilities, limitations on your rights, dispute resolution, and governing law etc.. The provisions on limitations or exemption from liabilities may be in font bold or underlined for reminding a user. A user shall prudently read and select to accept or not to accept this Agreement. If you do not agree to these terms, you shall not access or use this Platform. Please read the following contents carefully to understand how we will deal with your Personal Data as well as our practical method.

I. The Personal Data We Collected within This Platform

If you use this Platform as a member of an corporate User, we will collect and process your Personal Data directly through your employer (e.g. when your employer opens your account) and also collect from you directly and process the same (e.g. during your use of this Platform). If you use this Platform as an individual User, we will collect from you directly and process your Personal Data.

(I) “Personal Data” mean various information recorded electronically or in other forms which can identify, by itself or in combination with other information, a specific natural person or reflect a specific natural person’s activities. For the purpose of this Privacy Policy, Personal Data include personal identification information (such as name), address, contact number, network identity information (including account name and email address), personal common equipment information, and location information.

(II) Personal Data related to you provided by your employer tous. When your employer opensan account for your use of this Platform, your employer will provide us with certain Personal Data related to you, including your user account name, business e-mail address, business telephone number (if any), workplace information as well asyour supervisor. Your employer may provide us with your additional Personal Data, or update your Personal Data provided to us during your use of this Platform.

You understand and agree that, according to your employer’s representations and warranties, your employer has obtained your prior express authorization before providing your Personal Data to us, your Personal Data collected by your employer are limited to a scope that is necessary for achieving the purpose of this Agreement or any other agreement executeed by and between your employer and us, and your employer has fully informed you of the purpose and scope of collection of your Personal Data and the intended use of your Personal Data collected by your employer. If you can not confirm the contents of the present clause, you shall stop using this service immediately and confirm with your employer the aforementioned matters. We will process your Personal Data as a data processor only as required by your employer and we may assume no legal liability for the collection or use by your employer of your Personal Data.

(III) Information we collect during your use this Platform. When you use this Platform, we will automatically collect your IP address, other tracking technologies, unique identifier of device, model and settings of hardware, operation system and application functions (e.g., MAC address), and details about your use of our services such as browsing records, time zone, area, language setting, server log (including the access date and time), App crashes as well as other system activities; Cookies (as defined below). You may upload, post, submit, or send messages, chats, documents, calendar information, communications or any other content (hereinafter referred to as“User Content”) to or through this Platform. We collect information in regard to the following: documents shared and edited by you on this Platform, calendars created and edited by you on this Platform, your work status, as well as any other User Content you spread on this Platform. Please see belowfor more details.

1. Location data. When you use this Platform, we will process as authorized by you the information about your location, including location information based on your SIM card, IP address or mobile device location settingsor received by use of GPS (if GPS function is initiated by your mobile device). We will use such information to provide you with relevant location-based services, such as provide you with function for arranging conference room when you use calendar service. If you refuse to provide us with your location, we will not provide you with relevant location-based service, but your normal use of Feishu’s other functions and services will not thus be affected.

.

2. Document service.This Platform’s document function enables you to view and edit a document being viewed simultaneously by numerous persons, add comments to the document and receive “document chats” in real time. When you post the document content and comments, we will collect the information you posted, and display your name, avatar and posted content. Document sharing and editing is linked with Feishu notifications, and can be set according to different user permissions.

3. Calendar service.This Platform’s calendar function enables you to add work status (on a business trip/leave/in a conference) as well as event reminder, subscribe to public agenda or colleague's schedule and send conference invitation. You may choose to accept, reject or hold conference invitation, and such responses will be labeled in the calendar. If you are the controller of a calendar, you can set your calendar privacy as private, public or public within a specific scope. You can subscribe to the calendar(s) of other users but provided that they have consented to the access by you to their calendar(s).

Recommend and represent for you any document that you might be interested in. We probably analysis the content of your documents and your usage habits by using AI technology automatically, to recommend any information you will be interested in and explore better service mode.

4. Cookies. We use cookies and other similar technologies (e.g. web beacons, Flash cookies, etc.) (hereinafter referred to as “Cookies”), so as to enhance your experience using this Platform. When you use Feishu and relevant services, we may use relevant technologies to send one or more Cookie(s) or anonymous identifier(s) to your device, so as to collect and store the information during your access to and use of this product.

Although the majority of web browsers automatically accept Cookies, whether or not to accept specifically is up to you. You have the choice to accept or disable Cookies via consent. You understand and agree that we may store absolutely necessary Cookies which are required for the operation of this Platform, including the Cookies enable you to log into the safe area of this Platform. Cookies stored by us will expire upon your termination of the website session or after 15 days. Storage of the aforementioned absolutely necessary Cookies is an absolutely necessary condition for provision of core services by this Platform. If you do not consent to relevant authorization, you will be unable to use any service of this Platform.

5. Third Party Services Information. If you choose to use our software (including apps from Feishu app store) to integrate with any third party services for your Workspace, the provider of a third party service may share certain information of the users to us. You can check the privacy policy of the third party services to know what data may be shared to us. The information shared to us may include your contact information and any data you may provide to that third party service.

II. How We Use Your Personal Data

We will use your information for the following purposes:

We will take reasonable and feasible measures to avoid collection of the Personal Data unrelated to the scope of purposes stated herein. To use your Personal Data beyond the scope of purposes stated herein and the directly or reasonably related scope, we will notify you and obtain your express consent in advance.

If we stop operating the services of this Platform, we will stop collecting your Personal Data, notify you in the form of announcement [ ] day(s) in advance, and delete or anonymize your Personal Data possessed by us according to applicable laws.

III. How We Share, Transfer, and Publicly Disclose Your Personal Data

(I) Sharing and Transfer of Personal Data

1. We will not share with or transfer to any third party your Personal Data, unless we have obtained your prior authorization or consent, or the Personal Data to be shared or transferred are de-identified data and such third party is unable to re-identify the subject of such data.

2. We will follow the following principles when sharing your Personal Data:

Authorized Consent Principle: We will not share your Personal Data without your consent unless such Personal Data shared is de-identified and the third party acquiring such Personal Data is unable to re-identify its natural person subject. If the third party uses the Personal Data for a purpose beyond the scope of the original authorized consent, they need to re-obtain your consent.

Legitimacy and Minimum Necessity Principle: The shared Personal Data must have a legitimate purpose and must be limited to that necessary to achieve the purpose.

Security Prudence Principle: We will carefully assess the purpose of the third parties’ use of the shared Personal Data, conduct a comprehensive assessment of the security capabilities of these partners and require them to follow the cooperation legal agreements. We will carry out strict security monitoring of the software tool development package (SDK) and application program interface (API) of the partners for obtaining information to protect data security.

3. Shared Information for Achieving Functions or Services

(1) When you use the functions provided by our related parties or third parties in this Platform, or when the software service providers, smart device providers and system service providers jointly with us to provide services for you, we will share the information necessary to realize the business with these related parties and third parties to recommend and display specific functions or services more suitable for you.

(2) If you are an employee of a corporate User, when the administrator of the corporate User chooses to open, manage and use third-party products or services through this Platform, he will consent on your behalf that we provide your personal basic information (account number, name, avatar, enterprise mobile phone number, enterprise email address, department organizational structure) and basic permissions to the third-party application service providers, otherwise you cannot use such third-party application services. When using third-party application services, the administrators of corporate User need to read and fully understand and comply with the product functions and privacy protection policies of third-party services. If you, as an individual User, choose to open, manage and use third-party products or services through this Platform, you consent that we provide your Personal Data (account number, name, avatar, enterprise mobile phone number, enterprise email address, departmental organizational structure) and basic permissions to the third-party application service providers, otherwise you will not be able to use such third-party application services. When you open and use the third-party application services, you need to read and fully understand and comply with the product functions and privacy protection policies of the third-party services.

(3) Log in and bind products in this Platform: With your consent, when you use your Feishu account to log in to a third-party product or service (including applications in the Feishu App Store) or bind your account to other third-party accounts, we will share your basic information (name, avatar) and other authorized information with the above-mentioned product or service.

(4) Location service provider (Amap). We will provide your de-identified location data to the Location service provider (Amap), so as to provide you with more precise location in the calendar function.

(5) Affiliates. We undertake not to share your Personal Data with any Affiliates under unnecessary circumstances, excluding necessary circumstances: we may provide you with the service you need only after sharing your information. However, for the purpose of providing you with better relevnat services, we may store, transfer, and process your Personal Data using more sophisticated tools, including Toutiao Cloud provided by Toutiao and relevant function plug-ins, provided by Affiliates based on the purposes of using your Personal Data under this Platform.

(6) Other auxiliary processing program supporters. You understand and agree that we need to cooperate with relevant processing program supporter so as to provide you with core business functions of this Platform. Therefore, we may share with the processing program supporter your Personal Data collected by us as authorized by you provided, however, that such sharing of information will follow proper, legal, and necessary principles. We will send to you a separate notice stating the scope and type of your Personal Data to be shared with relevant processing program supporter and such notice constitutes a valid part of this Agreement.

We will only share with third parties the information necessary for achieving the purposes stated herein and you understand and authorize such information sharing by us. If it is necessary to use your Personal Data beyond the scope of purposes stated herein for business needs of a third party, such third partywill required to re-obtain your consent.

Prior to the cooperation with a third party, we will make commercially reasonable efforts to test the security capability of such third party, evaluate whether it is proper, legal, and necessary to share relevant information with such third party, execute a confidentiality agreement with such third party, carry out technical monitoring against the inquiry activities by such third party, and urge such third party to abide by laws, regulations, rules and the confidentiality and security measures specified in the agreement in case that such third party uses the user information.

2. Transfer of Personal Data in the case of merger, acquisition, or asset transfer

We probably conduct merger, acquisition, or asset transfer as our businesses develop continuously, and your Personal Data may thus be transferred. In case of any aforementioned change, we will continue protecting, or require the transferee of your Personal Data to continue protecting your Personal Data according to relevant laws and regulations as well as the security standards no less stricter than those of this Policy. Or else, we will require the transferee of your Personal Data to re-obtain your authorization or consent.

(II) Public Disclosure of Personal Data

We will not publicly disclose your data without your consent. However, we may, in accordance with the type of Personal Data and way of disclosure as required, disclose your Personal Data to an administrative and enforcing authority or judicial authority if disclosure of you Personal Data is required by requirements of relevant laws, regulations, rules, other regulatory documents or compulsory administrative enforcement or judicial requirements. When receiving the request for disclosure, we will require the presentation of corresponding legal certificate and we will only provide the data to law enforcement department or judicial organ with legal authority for special investigation on legal basis, in accordance with relevant laws and regulations. To the extent permitted by laws or regulations, the documents disclosed by us will all be protected by encryption measures.

You understand that we may share, transfer, and publicly disclose your Personal Data according to laws, regulations, and national standards without your authorization or consent under following circumstances:

(1) Sharing, transfer, or public disclosure of those Personal Data is directly related to national security or national defense security;

(2) Sharing, transfer, or public disclosure of those Personal Data is directly related to public security, public health, or significant public interests;

(3) Sharing, transfer, or public disclosure of those Personal Data is directly related to criminal investigation, prosecution, judgment, or execution of judgment and so forth;

(4) Sharing, transfer, or public disclosure of those Personal Data is for protecting significant lawful rights and interests, such as life and property, of you or other individual but it is difficult to obtain principal consent on such sharing, transfer, or public disclosure, unless otherwise prohibited expressly by laws or regulations;

(5) Those Personal Data have been made public by yourself; or

(6) Those Personal Data have been collected from the lawfully and publicly disclosed data, such as lawful news reports, government-publicized information and other channels.

According to the provisions of laws, sharing or transfer of de-identified Personal Data which cannot be restored by the receiving party and of which the subject of Personal Data cannot be identified by the receiving party is not outward sharing, transfer, or public disclosure of Personal Data, and we may process such Personal Data without notifying you or obtaining your consent separately.

IV. Where We Store Your Personal Data

(I) Location of storage

Your personal information collected and generated in the course of our operation within the territory of the People’s Republic of China will be stored in the territory of the People’s Republic of China in accordance with the provisions of applicable laws and regulations. At present, we will not transmit such information abroad. Where there is any need for such transmission, we will abide by the applicable regulations of relevant country or ask for your consent.

(II) Period of retention

During the period when you use this Platform, we will continuously protect your Personal Data for a period as necessary for providing you with our services. After you terminate the use of this Platform, we will delete or anonymize your Personal Data, unless the retention of specific information is otherwise stipulated by laws or regulations. If we stop operating the services of this Platform, we will delete or anonymize your Personal Data possessed by us according to applicable laws within a reasonable period.

V. How We Protect the Security of Your Personal Data

(I) We attach great importance to the security of your Personal Data. At present, Feishu has passed the assessment of national information security level (Level III) and been filed therewith, as well as certification of international authorized information security management system (ISO 27001). We have set up data security rules and regulations and implemented safety technical measures, so as to prevent your Personal Data from being accessed or modified without authorization, avoiding damage or loss of data. We adopt encryption techniques, such as Transport Layer Security Protocol and the like, for our network services, so as to ensure the security of your data in the process of network transmission.

(II) We adopt strict control over the data processing authority to avoid illegal use of data; we strengthen the security of Personal Data in the process of use by data desensitization means such as de-identification with mosaics and so forth; we store your Personal Data in an encrypted manner using the encryption techniques adopted widely in the industry, and isolate your Personal Data by data isolation techniques. For example, we have encrypted all data and information stored in our servers or on your terminal devices. We have been adopting and implementing such technical measures and organization and management methods all the while, and we may modify and improve the same from time to time so as to improve the overall security of the system.

(III) Although we have taken the abovementioned reasonable measures, and have abided by the standards required by relevant laws and regulations, you understand that, due to technical limitation and various potential malicious methods, it is impossible to maintain completely secure all the time in the internet industry even though one's ability is exhausted to enhance security measures. We will try our best to ensure the security of your Personal Data provided by you to us. You know and understand that any problem may occur in the system or communications network used by your access to our services due to any factor beyond our control. Therefore, we strongly suggest you take active measures, including but not limited to using complicated password, regularly changing the password, and avoiding disclosure of your Personal Data such as your account password and so forth to any other person, so as to protect the security of your Personal Data.

(IV) In case of any incident endangering network security, we will take corresponding remedial measures according to emergency response plan for internet security incident. If our physical facilities or technical safeguard measures are damaged, thus your Personal Data are disclosed, provided illegally, or misused, causing damage to your lawful rights and interests, we will bear corresponding liabilities in strict accordance with provisions of laws.

(V) After we know or are informed of any security incident of Personal Data in which your Personal Data is disclosed, provided illegally, or misused, we will notify you of the following within ten (10) days as required by laws and regulations: basic information about the security incident, possible influence of the security incident, the measures we have taken or will take, our suggestions on your possible preventive measures and risk reduction, and the remedial measures we may take for you and so forth. Relevant situations about the security incident will be sent to you by push notification at this Platform. If it is difficult to notify each subject of Personal Data of relevant situations about the security incident, we will publish an announcement in reasonable and effective manner. In addition, we will report our treatment of the security incident of Personal Data to the competent regulatory authorities as required thereby.

VI. Your Rights

(I) How to Access and Correct Your Personal Data

1. Access Personal Data. To access avatar, name, work status, department, immediate supervisor, email address, or mobile phone number, you may click the personal avatar at the top left corner of Feishu.

2. If you are an employee of a corporate User, you may submit an application for data correction to your employer, and the administrator of corporate user will handle the application.

(II) How to Cancel Your Account

If you are an employee of a corporate User, you may submit an application for deleting your personal account to your employer, and the administrator of corporate user will handle the application. If you are an individual User, you can submit your online cancellation application through this Platform.

VII. Changes

We will use reasonable commercial efforts to generally notify all users of any material change in this Policy, such as through a notice on this Platform, however, you should look at this Policy regularly to check for relevant changes. We will also update the “Updated Date” and the “Effective Date” at the top of this Policy. Your continued access to or use of this Platform after the date of the updated Policy shall be deemed as your acceptance of the updated Policy. If you do not agree to the updated Policy, you must stop accessing or using this Platform.

VIII. Contact

Questions, comments and requests regarding this Policy are welcomed and shall be sent tocontact@feishu.cn. Generally, we will give you a reply within fifteen days following receipt of your relevant information and verification of your identity.

IX. Provisions on Minors

If you are a minor under eighteen years old, you shall read and agree on this Privacy Policy jointly with your parent or any other guardian and under the guardianship and guide thereof, before you use the services of this Platform.

We will protect minors’ Personal Data according to relevant laws and regulations of the State, and will collect, use, store, share, transfer, or disclose a minor’s Personal Data only to the extent permitted by law or agreed expressly by a parent or any other guardian of such minor or where it is necessary to protect such minor. If we find that we have collected a minor’s Personal Data without the verifiable prior consent of such minor’s parent, we will try to delete relevant data as soon as possible.

If you are a guardian of a minor, you may contact us via the contact information published in this Privacy Policy in the event that you have any questions concerning the Personal Data of the minor under your guardianship.

X. Miscellaneous

(I) This Privacy Policy only applies to your use of the services of this Platform within the territory of Mainland China (only for the purpose of these terms, excluding Hong Kong, Macao, and Taiwan). There may be multilingual versions of this Privacy Policy. If there is any inconsistency or conflict between the terms of each language version, the Chinese version shall prevail.

(II) The headings herein are inserted for convenience and ease of reading only, and in no way affect the meaning or interpretation of any provision hereof.

(III) Definitions of following terms used herein

1. “Affiliate”: means an entity that is controlled by, controls, or is under common control with Feishu Technology. As used herein, “control” means the power of an entity to direct major business acts or activities of another entity, the formation of the power may be based on stock, voting right, or any other relationship generally deemed as having directing power or significant influence.

2. “De-identification” or “de-identified”: means that the Personal Data are technically processed so that their subject cannot be identified without using additional information.

3. “Anonymization”, “Anonymized”, or “Anonymize”: means the process in which the Personal Data are technically processed so that their subject cannot be identified, and the Anonymized Personal Data cannot be restored.

(IV) The copyright of this Policy is owned by us, and we have the rights to interpret and modify this Policy to the extent permitted by law.