This Alibaba Cloud Elastic Desktop Service Privacy Notice for End Users (“Privacy Notice”) applies to your (or “End User”) access and/or use of Alibaba Cloud Elastic Desktop Service (including its mobile app, computer application, and the web client located at wuying.alibabacloud.com, collectively, the “App”) as provided by the Alibaba Cloud entity listed in section 11 (referred to as “we”, “us”, “our”or “Alibaba Cloud” hereinafter). This Privacy Notice explains how we collect, use, and disclose your personal data in relation to the App, in the manner and for any of the purposes set forth in this Privacy Notice. In addition, it will also provide you with more information about the bases upon which we may lawfully collect, use, and/or disclose your personal data, where permitted by applicable law.
In what roles does Alibaba Cloud process End User data?
The App is designed to provide our cloud service customers (i.e., registered users of Alibaba Cloud services and referred to as “Customer”) with the Elastic Desktop Service. Our Customer has engaged us to provide the App to End Users. The Customer may be your employer, for example. When providing our service, we act as:
(a) a processor for our Customer in relation to End User account data processed for account verification and log-in purposes (see section A below) and any other personal data contained in or generated in relation to Customer’s Member Content as defined in the Alibaba Cloud International Website Membership Agreement; and
(b) a controller for limited processing of End User data (see section B below).
A. Alibaba Cloud as a processor of End User data
As a processor of End User account data or for account verification and log-in purposes and any other personal data contained in or generated in relation to Customer’s Member Content, we act solely on our Customer's instructions and in accordance with the terms of the contract we have in place with our Customer. For information on such processing, as well as further information on how our Customer (as a controller) will collect and use personal data in connection with your use of the App and our product, please refer to the Customer’s privacy notice.
B.Alibaba Cloud as a controller of End User data
In relation to processing certain limited categories of personal data for the purposes set out below, we act as a controller of End User data. This Privacy Notice explains such processing of End User data that we carry out as a controller.
Personal data related to Customer’s admin account holders is generated and processed on the Alibaba Cloud product console at www.alibabacloud.com and is subject to Alibaba Cloud International Website Privacy Policy.
Table of Contents
1.What does Alibaba Cloud do?
2.Personal data we collect and process
3.How we use your personal data (our purpose) and our legal basis for processing it
4.Disclosure of personal data
5.Transfer of personal data
6.Security measures
7.Tracking technologies
8.Data retention
9.Your data protection rights
10. Updates to this Privacy Notice
11. Contacting us
12. Addenda
You shall read this Privacy Notice in full to ensure you are informed about our processing of your personal data.
1.What does Alibaba Cloud do?
Alibaba Cloud is a service provider in cloud computing and artificial intelligence and provides the App to our Customer. For more information about Alibaba Cloud, please see the “About Alibaba Cloud” section of our website at https://www.alibabacloud.com/about .
2.Personal data we collect and process
We will collect, use, disclose and/or process the following data of End Users:
Data Description | Source |
Device Data collected from your device , including the device name, device brand, operating system, port number, device SN, device uuid, IDFV, IDFA, Android ID, IMEI, IMSI, MAC, OAID, GAID, BSSID, SSID, MEID and the IP address of the device. | ·Indirectly from you (automatic collection) |
Log Data such as data recording End Users’ activity and interaction with the App, including the network type, carrier used by End User’s device, the language set by End User, access date and time, login status, network connection status, network delay data, and other functional information on the App performance (for example, application version, diagnostics, and crash logs). | ·Indirectly from you (automatic collection) |
Customer Support Communication Data when you contact us for customer support, including any email address, your queries on the product and other relevant materials or documents provided by you. | ·Indirectly from you |
3.How we use your personal data (our purpose) and our legal basis for processing it
We collect, use, disclose and process your personal data for the purposes set out in the table below:
Type of personal data | Purpose/Activity | Lawful basis for processing |
Device data | We use this data to generate device ID for your access to the App, and to carry out analytics and diagnostics for service improvement. | ·Consent (where required under applicable law) ·Otherwise, our legitimate interest to operate and improve our business and services, including managing the security of our IT infrastructure. |
Log Data | We use this data to ensure the normal and secure running of our services and to carry out analytics and diagnostics for service improvement. | ·Consent (where required under applicable law) ·Otherwise, our legitimate interest to operate and improve our business and services, including managing the security of our IT infrastructure. |
Customer Support Communication Data | We use this data to identify your queries and provide you with customer support, and to improve our service offering. | ·Consent (where required under applicable law) ·Otherwise, our legitimate interest to operate and improve our business and services, including managing the security of our IT infrastructure. |
The personal data collected and processed above is necessary for our provision of the App. If you do not provide us with such data, we will not be able to provide the functions of the App to you, including to identify your queries and provide you with customer support.
4.Disclosure of your personal data
We disclose your personal data (i.e. device data, log data, and customer support communication data) to the following categories of recipients:
(a) our Customer, who has engaged us to provide the App to End Users.
(b) our group companies in the Alibaba Group and/or their designated service providers, who provide data processing services necessary to provide you with our services (for example, to support the delivery of, provide functionality on, or help to enhance the security of our App, or who otherwise process personal data for purposes described in this Privacy Notice).
(c) third party service providers and partners who provide data processing services to us as necessary to provide you with our services (to support the delivery of, provide functionality on, or help to enhance the security of our App), or who otherwise process personal data for purposes described in this Privacy Notice.
(d) third party services when you use third party services linked through our App, your personal data will be collected by the provider of such services. Please note that when you use third party services, their own terms and privacy notices will govern your use of their services;
(e) any competent law enforcement body, regulatory, government agency, court or other third party (such as our professional advisers) where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights or so a third party can defend theirs, or (iii) to protect your vital interests or those of any other person;
(f) a buyer or transferee (and related third parties, such as its agents and advisers) in connection with any actual or proposed purchase, merger or acquisition of any part of our business, bankruptcy, sale of any or all of our company assets, or other change of ownership or control, provided that we inform the buyer it must use your personal data only for the purposes disclosed in this Privacy Notice; or
(g) any other person with your consent to the disclosure.
5.International data transfers
In some cases, where your personal data is transferred to another Alibaba Group company or third parties (as explained in section 4), it is processed in countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country (and, in some cases, may not be as protective).
Specifically, our App servers are located in Singapore, and our group companies and their designated service providers are in Singapore and China. This means that when we collect your personal data, we will process it in any of these countries.
We strive to take appropriate safeguards to ensure that your personal data will remain protected in accordance with this Privacy Notice and applicable laws. For example, per GDPR Art.46, we implement measures such as entering into written agreements including standard contractual clauses and other data protection agreements with recipients.
If you are located in the EEA or the UK, standard contractual clauses entered into by the Alibaba Group companies and with our third party service providers and partners can be provided on request.Please note that some sensitive commercial information will be redacted from the standard contractual clauses.
6.Security measures
We use appropriate technical and organisational measures to protect the personal data that we collect and process about you.These measures are designed to provide a level of security appropriate to the risk of processing. Specific measures we use include encrypting your personal data in transit and at rest; using an industry standard framework as part of any Information Security programme; employing advance malware protections; implementation of other reasonable security defences (including vulnerability management, access management and recovery/resilience measures).
Nevertheless, no data transmission over the internet or any wireless network can be guaranteed to be perfectly secure. As a result, while we try to protect your personal data, we cannot guarantee the security of any personal data you transmit to us and you do so at your own risk. We cannot and do not guarantee security in connection with your use of the App. Where you have created an account with us that uses a unique password to enable you to access our App, it is your responsibility to keep this password secure and confidential.
7.Tracking technologies
We and our partners use “cookies” and/or similar technologies, such as web beacons and javascript, to store specific information about you and track your visits to the App (located at wuying.alibabacloud.com). We may also use “cookies” to store specific information about your use of the App as part of its features and to facilitate or enhance your user experience of the relevant service. A “cookie” is a small amount of data that is sent to your browser and stored on your device. A cookie can be sent to your device only if you access the App using a device. If you do not de-activate or erase the cookie, each time you use the same device to access the App, our web servers will be notified of your visit to the App and in turn we may have knowledge of your visit and the pattern of your usage.
Generally, we use cookies to identify you and enable us to i) access your registration information so you do not have to re-enter it; ii) gather statistical information about usage by users; iii) research visiting patterns and help target advertisements based on user interests; iv) assist our partners to track user visits to the App and process orders; v) track progress and participation in promotions; and iv) facilitate your use of the App which may involve the use of cookies. We partner with third parties to manage our advertising on other sites. Our third-party partners may use cookies and/or similar technologies in order to provide you advertising based upon your browsing activities and interests. If you wish to opt out of interest-based advertising click here, or if located in the EEA or the UK click here. Please note you will continue to receive generic ads.
You can determine if and how a cookie will be accepted by configuring the browser which is installed in the computer you are using to access the App. If you choose, you can change those configurations. You may be able to change your browser preferences or settings to reject all cookies, or choose to consent each time a cookie is sent. If you reject all cookies by choosing the cookie-disabling function in your browser, you may be required to re-enter information on the App more often and certain features of the App may be unavailable.
To manage Flash cookies, please click here.
By accessing and using the App, and by accepting the cookies, you consent to the storage of cookies on your devices. You also consent to the access of such cookies by us and by our partners mentioned above.
8.Period of retention and processing of personal data
We retain the personal data we collect from you where we have an ongoing legitimate need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements). In certain circumstances, we will need to keep your information for legal reasons after your account has been deleted. The specific retention periods depend on the nature of the information and why it is collected and processed and the nature of the legal requirement. We keep your information when we have a legal obligation to do so (for example if a court order is received about our Customer’s account, we would retain your data for longer than the usual retention period when an account is deleted); or to deal with requests and complaints and for litigation or regulatory matters (for example we would retained your information if there was an ongoing legal claim and the information was relevant to the claim. This information would be retained until the legal claim had been concluded).
When we have no ongoing legitimate need or legal reason to process your personal data, we will either delete it in a secure manner that would prevent further processing, unauthorized access or disclosure to any other party or the public or prejudice your interest or anonymise it or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible.
9.Your data protection rights
Depending on the jurisdiction in which you are residing, you may have the right to request access to your personal data held by us (or on our behalf) and to request update, correction or deletion of such personal data. Additionally, upon request, we will provide you with information about whether we hold your personal data. You may contact us at intlcompliance@service.aliyun.comto request access, correction or deletion of your personal data (depending on the jurisdiction in which you are residing).
You may also have supplemental rights under applicable law in relation to your personal data. For example, if you are an EEA or UK user, you can object to processing of your personal data, ask us to restrict processing of your personal data, and request portability of your data by contacting us at intlcompliance@service.aliyun.comor submit your request by clicking here. Furthermore, if we have collected and processed your personal data with your consent, then you can withdraw your consent at any time by using the contact details provided under the “Contacting us” heading below. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data conducted in reliance on lawful processing grounds other than consent. You have the right to complain to a supervisory authority about our collection and use of your personal data. For more information, please contact your local supervisory authority. Contact details for supervisory authorities in Europe are available here and for the UK here. Certain supervisory authorities will require that you exhaust our own internal complaints process before looking into your complaint.
We will respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.
In cases where we act as a processor, we have no direct relationship with the individuals whose personal data we process. If you would like to access, correct, amend, or delete your personal data where we process as a processor, you should direct your query to our Customer (the data controller). However, if you are unable to do so, you may send your request in writing to the relevant contact and address provided under section 11 “Contacting us” heading below, and we may assist with forwarding your request to our Customer.
10.Changes to this Privacy Notice
We may update this Privacy Notice from time to time in response to changing legal, regulatory, technical or business developments.When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make. To the maximum extent permissible under applicable law, you agree to be bound by the prevailing terms of the Privacy Notice as modified from time to time. Please check back regularly for updated information on the handling of your personal data.
You can see when this Privacy Notice was last updated by checking the “last updated” date displayed at the top of this Privacy Notice.
11.Contacting us
If you have any questions or concerns about our use of your personal data, please contact us using the following details:
European Economic Area (EEA)
For individuals in the EEA, and/or in relation to processing conducted by or on behalf of Alibaba (Netherlands) B.V., please contact:
Attention: Data Protection Officer
c/o Herengracht 448, 1017 CA Amsterdam, the Netherlands
E-mail address: DPO_Intl@alibabacloud.com
For individuals in the EEA, Alibaba (Netherlands) B.V. is the relevant "data controller"for the purposes of EEA data protection law.
United Kingdom and Europe (outside the EEA)
For individuals in the UK or in Europe (but outside the EEA), and/or in relation to processing conducted by or on behalf of Alibaba.com (Europe) Limited, please contact:
Attention: Data Protection Officer
c/o Alibaba.com (Europe) Limited, 8th floor, Millbank Tower, 21-24 Millbank, London SW1P 4QP, United Kingdom
E-mail address: DPO_Intl@alibabacloud.com
For individuals in the UK or Europe (but outside the EEA), Alibaba.com (Europe) Limited is the relevant "data controller".
Outside the EEA, UK and Europe
In all other cases, please contact:
Attention: Data Protection Officer/Alibaba Cloud (Singapore) Private Limited, c/o 26/F, Tower One, Times Square, 1 Matheson Street, Causeway Bay, Hong Kong.
E-mail address: DPO_Intl@alibabacloud.com
In addition to the addresses listed above, if you have a privacy or data use concern which has not been addressed to your satisfaction, you may contact our third party dispute resolution provider (free of charge) here.
This Privacy Notice also contains links to third party websites. If you experience difficulties using these links, please contact us at intlcompliance@service.aliyun.com, or click here to submit your request
In case we act as a controller for processing your personal data, the data controller of your personal data is
(a) Alibaba Cloud (Singapore) Private Limited if you are a resident in or have indicated from your using of the App through your End User account, that you are located in any jurisdiction outside of the United States of America, Europe, India, or Malaysia;
(b) Alibaba Cloud US LLC if you are a resident in or have indicated from your using of the App through your End User account, that you are located in the United States of America;
(c) Alibaba.com (Europe) Limited if you are a resident in or have indicated from your using of the App through your End User account, that you are located in the United Kingdom, Switzerland, or any other jurisdiction in Europe but outside the European Economic Area;
(d) Alibaba (Netherlands) B.V. if you are a resident in or have indicated from your using of the App through your End User account, that you are located in any member state within the European Economic Area;
(e) Alibaba Cloud (India) LLP if you are a resident or have indicated from your using of the App through your End User account, that you are located in India.
(f) Alibaba Cloud (Malaysia) Sdn. Bhd. if you are a resident or have indicated from your using of the App through your End User account, that you are located in Malaysia.
12.Addenda
CALIFORNIA ADDENDUM
This addendum supplements the information contained in the Privacy Notice by providing additional information about our personal data processing practices relating to individual residents of the state of California in the United States.
California categories of personal data
California law requires we provide disclosures to you about what personal data we collect by reference to the enumerated categories of personal data set forth within California law. To address this obligation, we have identified the relevant enumerated California personal data category for the personal data described in section 2 “Personal data we collect and process” of the Privacy Notice below:
(a) Identifiers, such as email address and device identifiers (including device uuid, IDFV, IDFA, Android ID, IMEI, IMSI, MAC, OAID, GAID, BSSID, SSID, MEID and IP address).
(b) Geolocation Data, such as your approximate location based on your IP address.
(c) Internet / network information, such as log data.
(d) Other Personal Data, such as your queries on the product and other relevant materials or documents provided by you when you contact us for customer support.
(e) Inferences, such as predictions about you and your interests and preferences based on the other personal data we collect and the interactions we have with you. We do not collect or process any personal data about End Users in our capacity as controller that may be classified as “sensitive” under California privacy law.
Personal data disclosures, sales and targeted advertising
We do not sell information, although we do disclose or make available the categories of personal data we collect to the categories of recipients set forth in section 4 “Disclosure of your personal data” and section 7 “Tracking technologies” of the Privacy Notice.
Please note we do not sell the personal data of individuals we know to be less than 16 years of age or share such information for targeted advertising purposes.
Deidentified information
We may at times receive, or process personal data to create, deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual or household. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.
Your additional U.S. privacy choices
Subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following rights, in addition to those listed in section 9 “Your data protection rights section” of the Privacy Notice:
(a) Right to Know: The right to confirm whether we are processing personal data about you and to obtain certain personalized details about the personal data we have collected about you;
(b) Right to Opt-Out of Targeted Advertising: The right to direct us not to share personal data for certain targeted advertising purposes; and
(c) Right to Opt-Out of Sales: The right to direct us not to sell personal data to third parties.
You also have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise the above rights.
Submitting privacy rights requests
Please submit your request by sending us an email to intlcompliance@service.aliyun.com.
To exercise your right to opt-out as it relates to the use of cookies and related technologies that involve the sale of personal data or the use of personal data for targeted advertising purposes, please click the “COOKIE PREFERENCES” tag in the footer of the website at alibabacloud.com and adjust your preferences accordingly. Lastly, you may follow the other steps set forth in section 7 “Tracking technologies” section of the Privacy Notice to further exercise control over tracking technologies.
Once we receive your request to exercise certain rights, we may verify it by requesting information sufficient to confirm your identity, including by asking you to verify information about your use of the App. In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity or locate your information in our systems, or where you are not a resident of California.
Submitting Authorized Agent Requests
In certain circumstances, you are permitted to use an authorized agent to submit requests on your behalf through the designated methods set forth above where we can verify the authorized agent’s authority to act on your behalf. In order to verify the authorized agent’s authority, we generally require evidence of either (i) a valid power of attorney or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement of authorization for the request. Depending on the evidence provided and your state of residency, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request.
PHILIPPINES ADDENDUM
This addendum supplements the information contained in the Privacy Notice by providing additional information about our personal data processing practices relating to Philippine data subjects.
Rights of data subjects
In addition to those listed in section 9 “Your data protection rights section” of the Privacy Notice, you also have the following rights under Republic Act No. 10173 of the Data Privacy Act of 2012:
(a) Right to be informed whether your personal data shall be, are being, or have been processed and to be furnished with information enumerated under Section 16(b) of Republic Act No. 10173;
(b) Right to object to the processing of your personal data (in which case, you may have to cease using our services);
(c) Right to suspend, withdraw or order the blocking, removal or destruction of personal data upon discovery and substantial proof that the personal data are incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes or are no longer necessary for the purposes for which they were collected.
(d) Right to be indemnified for any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal data;
(e) Right to request portability of your personal data; and
(f) Right to obtain a copy of your personal data, which has been stored in electronic or structured format.
If you believe that your right as a data subject has been violated, you may also file a complaint with the Philippine National Privacy Commission.
Contact Information of Data Protection Officer
If you have any questions regarding this Privacy Notice or want to exercise any of your rights as provided in this Privacy Notice or pursuant to Republic Act No. 10173 and its implementing rules and regulations, any relevant issuance of the Philippine National Privacy Commission, and other privacy laws and regulations in the Philippines (as may be amended from time to time), you may reach us through our Data Protection Officer whose contact details are provided below:
Attention: DPO
Address: Alibaba Cloud (Singapore) Private Limited, Legal Department,
c/o 51 Bras Basah Road, #03-06 Lazada One, Singapore 189554
E-mail address: DPO_Intl@alibabacloud.com
THAILAND ADDENDUM
This addendum supplements the information contained in the Privacy Notice by providing additional information about our personal data processing practices relating to End User who access and/or use of the App in Thailand.
As the data subject, you have the rights in relation to your personal data, subject to the rules, methods and conditions under the Thai Personal Data Protection Act B.E. 2562 (2019) (“PDPA”). In addition to the data protection rights in section 9 above, you also have the right to request us to provide copy of personal data related to you, or to request the disclosure of the acquisition of the personal data obtained without your consent. You may also request that we anonymize your personal data in certain circumstances prescribed under the PDPA.
If there is reason to believe that we are in breach of the PDPA, you have the right to lodge a complaint to the expert committee appointed by the personal data protection committee in accordance with the rules and methods prescribed under the PDPA.