FACTORY 42
Landscapes Reimagined
Privacy Policy
Last Updated: 26 APR 2022
1. INTRODUCTION
Background
Factory 42 is an immersive and television content production studio that uses cutting-edge advanced imaging technologies to develop unique multi-sensory experiences for consumers, visitor destinations, broadcasters, brands and artists.
We respect your privacy and we are committed to protecting your personal information. We ask that you read this Privacy Policy carefully as it contains important information on who we are, how and why we collect, store, use and share personal information through your use of our Apps, your rights in relation to your personal information, and on how to contact us and data protection authorities in the event you have a complaint.
It is important that you read this Privacy Policy together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal information about you so that you are fully aware of how and why we are using your data. This Privacy Policy supplements the other notices and is not intended to override them.
What does this Privacy Policy cover?
Our Privacy Policy tells you how we look after, use and share the personal information that we collect from you and also how you can manage your consent; as well as action your rights. Please read this carefully.
When you use any of our Apps, you are agreeing to our Privacy Policy, but you can manage your consent at any time.
Who collects information about you?
Factory 42 Limited (“we”, “us”, “our”, “Factory 42”) collects, uses and is responsible for your personal information. When we do so, we are responsible as a ‘data controller’ of that information.
Our registered office is at New Wing Somerset House, Strand, London, WC2R 1LA.
Our Privacy Lead is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions, including any requests to exercise your legal rights, please contact our Privacy Lead at privacy@factory42.uk
How to complain
We hope that we can resolve any query or concern that you raise about our use of your personal information.
You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).
Changes to the Privacy Policy and your duty to inform us of changes
We keep this Privacy Policy under regular review and may make changes to it from time to time. When we do so, we will inform you by updating this section.
It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.
Links to other websites
Our Apps may include links to third-party websites and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. We encourage you to read the Privacy Policy of every website you visit.
2. THE DATA WE COLLECT ABOUT YOU
When you use our Apps, you may give us information directly (if contacting our support email), and we’ll store that information on our systems and use it for the purposes described in this Privacy Policy.
We gather data related to your activity, in order to better understand how you engage with the software, and to help gauge the effectiveness of the application design. We do not gather any personally identifiable or protected information, just anonymous user-activity information that helps us build a picture of how people use the app.
We gather only the data required for us to effectively evaluate the design and deployment of the application.
How are we managing data privacy and compliance?
To ensure the widest level of consent, all data collection takes place ‘by opt-in consent’, where you explicitly choose to share data with Factory 42. The ability to opt-in is presented to you at first run, and is accessible at any time via the App settings.
You have the ability to ‘opt out’ at any time from within the application under the Settings menu. Once consent is revoked, no further data is shared until you choose to opt in again.
Photos and videos
Our Apps may request permission to use your camera and local storage for the purpose of viewing augmented reality content, capturing photos or recording videos, and saving photos or videos to your device. Any images or videos you capture are only stored locally on your device and will never be transmitted to us or any other third party by any of our Apps.
Contacting us for support
If you choose to contact Factory 42 via landscapesreimagined@factory42.uk, any other Factory 42 email address, by telephone or by post, we may store some or all of the following personal information for a short period if you’ve provided us with it:
-
Name;
-
Address;
-
Email address;
-
Telephone number;
-
Details about use of any of the applications for which we provide support
You may choose whether or not to give some information to us. However, not providing certain information may mean you cannot enjoy all or parts of our Apps.
How do we use your personal information?
Under the GDPR, we must always have a lawful basis for using personal information. This may be because the data is necessary for our performance of a contract with you, because you have consented to our use of your personal information, to meet our legal and regulatory obligations, or because it is in our legitimate business interests to use it. Where we have said that using or keeping your information is “necessary for our legitimate interest”, we have carried out an assessment to ensure this is not unfair to you. Where we have said that we are relying on consent, we will seek consent from the parent or guardian if the user is under the age of 13.
Your personal information may be used for the following purposes:
To provide a requested service or carry out a contract with you:
-
Carrying out our obligations to you, such as delivering any Virtual Content that you have bought.
-
Managing your User Account and respond to your queries.
-
Supplying our support services to you. Your personal details are required in order for us to correspond with you regarding any issues or questions you may have regarding the Apps for which we supply support services.
-
Communicating with you for customer service purposes. This may include responding to emails, calls or written correspondence from you.
Where we have your consent:
-
We may from time to time ask you for your consent for other purposes, which we will explain to you at the time
To meet our legal and regulatory obligations:
-
Dealing with requests from you to exercise your rights under data protection laws.
-
To respond to requests from regulators, courts or government authorities.
Necessary for our legitimate interests:
-
Ensuring our Apps work as intended on your device and as necessary to provide the content or services you request on our Apps.
-
Responding to your inquiries and fulfilling your requests, for example, when you send us questions, suggestions, compliments or complaints, or when you request information about our Apps. We may also take such into account when improving our Apps, products and services.
-
Defending or bringing claims to protect our legal rights and interests, including to enforce our Terms of Service.
Who will you share my personal information with?
We will not share any of your personal information with any third parties for any purpose, subject to one exception:
-
In some limited circumstances, we may be legally required to share certain personal information, which might include yours, if we are involved in legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority.
-
When we need to enforce our Terms of Service, investigate fraud, reduce credit risk, exercise our legal rights or defend against legal claims.
Automated decision making
We do not carry out automated decision making using the information we collect from you.
Change of purpose
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us using the details provided in this Privacy Policy.
If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required and permitted by law.
3. SECURITY AND RETENTION
Keeping your data secure
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business or legal need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
For how long do we keep your personal information?
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.
In relation to personal information made available through email, telephone or postal correspondence, this will be stored for no longer than two years from the point at which reason for the communication has been resolved.
In some circumstances you can ask us to delete your data – please see below.
In some circumstances we may anonymise your personal information (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
International data transfers
Where possible, we try to only process your information within the UK and European Economic Area (EEA). If we or any third party transfers your information outside of the UK or EEA, we always require that appropriate safeguards are in place to protect the information when it is processed.
4. YOUR LEGAL RIGHTS
Under certain circumstances, you have rights under data protection laws in relation to your personal information. These include rights to:
-
Object to processing of your personal information where we are relying on legitimate interests as the legal basis of our processing your personal information, or where we use your personal information for direct marketing purposes. If we have compelling legal grounds to carry on processing your personal information, we will be able to continue to do so.
-
Request access to your personal information (commonly known as a “data subject access request”) and to certain other supplementary information that this Privacy Policy is already designed to address.
-
Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected.
-
Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have successfully exercised your right to object to processing (see below).
-
Object to decisions being taken by automated means which produce legal effects concerning you or significantly affect you.
-
Request restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
-
Request the transfer of your personal information to you or to a third party. We will provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
-
Withdraw consent at any time where we are relying on consent to process your personal information.
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
If you would like to exercise any of these rights, please email our Privacy Lead at privacy@factory42.uk and let us have enough information to identify you.
Factory 42中国个人信息保护政策(PIPL)
出版日期：2022年5月20日
最新更新：2022年4月26日
生效日期：2022年5月20日
背景
Factory 42是一个沉浸式电视内容制作工作室，使用尖端先进的成像技术为游客目的地、广播公司、品牌和艺术家开发独特的多感官体验。
我们尊重您的隐私，并致力保护您的个人数据。我们要求您仔细阅读本隐私须知，因为其载有重要资料，包括我们是谁，我们如何及为什么通过您使用的本网站收集、储存、使用及分享个人数据或有关我们所提供的服务、您对个人数据的权利以及如有投诉，如何联络我们及数据保护机构。
为了保护您的个人信息，Factory 42（“我们”）根据中华人民共和国（“中国”，就本政策而言，不包括香港特别行政区、澳门特别行政区及台湾）适用的数据保护及相关法律，包括但不限于中国网络安全法、中国数据安全法及中国个人信息保护法，制定个人信息保护政策（“政策”）。本政策将向您解释我们如何收集、使用、管理和保护您的个人信息。
本政策适用于我们通过我们的网站、移动应用程序、小程序和任何其他随着技术发展而出现的形式提供的服务。
在使用我们的服务之前，您应该阅读并理解本政策的全部内容。我们将对您的权利至关重要的条款加粗，以提请您注意此类条款。如果您对本政策有任何疑问，请通过本政策底部的联系方式与我们联系。
请点击下面的相关标题，了解更多关于这些领域的信息。
1 我们收集哪些个人信息以及如何使用这些信息
2 我们如何委托处理、分享、转让和披露您的个人信息
3 我们如何保护您的个人信息
4 您的个人信息在哪里托管和处理
5 我们将保留您的个人信息多久
6 您对您的个人信息有什么权利
7 我们如何收集和处理14岁以下未成年人的个人信息
8 如何更新此政策
9 如何联系我们
1 我们收集哪些个人信息以及如何使用这些信息
1.1 原则
我们只按照合法、正当、必要和诚信的原则收集履行业务职能所需的个人信息。
1.2 敏感个人信息
您知道并理解我们为您提供的一些服务可能依赖于对您敏感的个人信息的处理，这些信息将以粗体标记以提请您注意。我们只在适用的数据保护法律允许或要求的情况下处理敏感的个人信息。我们会采用下文所述的安全措施，严格保护这些信息，因此，您的敏感个人信息不应以对您的个人权利造成负面影响的方式处理（例如损害您的名誉、身心健康、人身或财产安全）。我们将通过弹出窗口或单独网页提示您并征求您的单独同意。
1.3 您在使用我们的服务时自愿提供的个人信息
1.3.1 当您通过我们的客户服务中心联络我们寻求帮助时，我们可能会记录您与我们的沟通内容（包括帐户信息、查询、您提供的证明有关事实的信息或您提供的联络信息），以帮助您解决问题和提高我们的服务质量。
1.3.2 如果我们在上述情况范围之外获取您的个人信息，我们将向您提供我们收集的关于您的个人信息的完整解释，并再次征求您的同意，除非适用的数据保护法律另有规定。
1.4 当您使用我们的服务时，我们收集的信息
当您使用某些业务功能时，我们将请求以下权限来访问个人信息。当您使用相应的业务功能时，您将看到一个弹出警告，询问您是否要授权该功能。如果您不授权，您将无法使用相应的功能。您可以选择关闭部分或全部这些权限。请注意，我们访问的第三方SDK也可能请求或使用某些权限。
1.5 Cookies
通过我们服务中使用的某些技术，我们还根据我们的Cookies通知收集关于您的其他信息。有关收集此类个人信息的更多细节，请参阅我们的Cookies通知https://www.factory42.uk/cookie-policy。
1.6 获得同意的例外情况
根据适用的数据保护法律，在下列任何情况下，我们有权未经您的同意处理（包括收集、使用、委托处理、共享、转让和公开披露）您的个人信息：
1.6.1 依照法律制定的劳动法规和订立的集体合同，为订立或者履行当事人的合同或者进行人力资源管理所必需的处理；
1.6.2 处理是履行法定职责或者法定义务所必需的；
1.6.3 为应对突发公共卫生事件或者在紧急情况下保护自然人的生命、健康或者财产安全所必需的处理；
1.6.4 个人信息处理在合理范围内为公共利益实施新闻报道、舆论监督等此类活动；
1.6.5 对个人公开或以其他方式公开的个人信息，在合理范围内并依照个人信息保护法进行处理；或
1.6.6 法律、行政法规规定的其他情形。
2 我们如何委托处理、分享、转让和披露您的个人信息
2.1 委托处理
我们服务的某些业务功能由外部供应商提供。我们将与我们委托处理个人信息的公司、组织和个人签署严格的保密协议，这些协议将约束他们按照我们的要求、本政策和其他相关的保密和安全措施处理个人信息。
2.2 共享
某些服务由第三方（包括我们的联属公司）提供。因此，我们可能会与第三方分享您的个人信息，以便他们为您提供相关服务。
为了Landscapes Reimagined应用程序的目的，数据共享将与以下其中之一或全部共享：
上海博物馆https://www.shanghaimuseum.net/mu/frontend/pg/m/en/display/index
诺丁汉https://www.nottingham.ac.uk/
Unity https://unity.com/
Apple https://www.apple.com/
对于与我们共享个人信息的第三方，我们将评估其收集的合法性、正当性和必要性，调查其数据安全环境并要求其按照本政策和适用的数据保护法律处理个人信息。
我们可能会为本隐私须知所述目的，与以下类别的第三方分享及披露您的个人数据：
供应商、顾问和服务提供商：我们使用多个供应商、顾问和服务提供商（我们的“供应商”），他们代表我们履行职能和/或帮助我们提供服务，如基于云的软件和托管供应商、电子邮件营销提供商、电子邮件服务提供商和网络分析提供商。
专业顾问：我们使用专业顾问（作为处理者或控制者），包括律师、银行家、审计师和保险公司，他们提供法律、银行、会计和保险服务。
业务转移：我们可能与我们选择出售、转让或合并部分业务或资产的第三方共享个人数据。或者，我们可能寻求收购其他业务或与其合并。如果我们的业务发生变化，新所有者可能会使用您的个人数据，与本隐私须知所列的方式相同。
遵守法律：我们可能会被要求按规定分享一些个人数据，以遵守法律。
针对中国境外用户的Factory 42隐私政策可在以下网站查询：https://www.factory42.uk/privacy-policy
2.3 转移
除下列情况外，我们不会将您的个人信息转让给任何公司、机构或个人：
2.3.1 明示同意转让：在获得您的明示同意后，我们将把您的个人信息转让给其他方；或
2.3.2 当由于合并、分立、解散、破产或其他原因而转让个人信息时，我们将通知您收件人的姓名和联系方式，并要求收件人按照本政策的约定处理您的个人信息。如果收件人改变原处理目的、方式或者处理个人信息类别，应当依法重新征得您的同意。
2.4 公开披露
我们只会在下列情况下公开披露您的个人信息：
2.4.1 在我们获得您的另行同意后；或
2.4.2 法定披露：根据适用的数据保护法律或主管当局的要求，我们可能会公开披露您的个人信息。
3 我们如何保护您的个人信息
3.1 安全和隐私控制
我们采用安全和隐私控制措施来保护您的个人信息，并遵守适用的数据保护法。我们将防止未经授权的访问、披露、使用、修改、损坏或丢失您的信息
3.2 我们尽量减少收集您的个人信息
我们会作出合理的努力，以确保所收集的个人信息是达到本政策所述目的所必需的最低限度的信息。
3.3 无法保证完整安全性
我们将尽最大努力确保或保证您提供给我们的任何个人信息的安全。但是，您应该知道，通过互联网发送的个人信息是不可能保证绝对安全的。如果由于我们的物理、技术或管理保护设施损坏而导致您的个人信息被未经授权访问、披露、篡改或损坏，从而对您的合法权益造成不利影响，我们将承担相应的法律责任。
3.4 个人信息安全事件
在不幸发生个人信息安全事件的情况下，我们将依法依规及时向您通报此次安全事件的基本情况（包括涉及的个人信息类别）及可能造成的影响、我们已经采取或拟采取的应对措施、对您的自我防范和化解风险建议、我们对您的补救措施等。我们将通过电子邮件、传真、电话等方式向您通报此类信息，当难以单独通知各个人信息主体时，我们将妥善有效地发布公告。
同时，我们也会按照适用的数据保护法律，主动报告个人信息安全事件的处理情况。
我们将制定应急预案，以在发生个人信息安全事件时立即启动，防止此类安全事件造成更严重的影响和后果。
4 您的个人信息托管处理所在地
原则上，我们在中国收集的个人信息将储存在中国境内。
然而，我们也提供基于我们全球资源和服务器的产品或服务。也就是说，在您的同意下，您的信息可能被转移到中国以外的司法管辖区或从中国以外的司法管辖区访问。
上述司法管辖区可能有不同的数据保护法标准，甚至没有相关法律。在此情况下，我们将采取适当措施，确保您的个人信息享有与在中国相同的保护水平。例如，我们会要求您另行同意（如法律规定）跨境转移您的个人信息，在跨境转移数据之前采取数据去标识化和其他安全措施。
5 您的个人信息保留时长
我们将只保留您的个人信息，只保存期限为本政策所述目的所需的时间，以及适用的数据保护法所要求的时间。在法定保存期后，我们将删除或匿名化处理您的个人信息。
6 您对个人信息的权利范围
我们尽最大努力保护您的个人信息权利。例如，您有权要求我们访问您的信息、对其处理作出决定、限制或反对处理、复制或转移您的信息、纠正其中的错误以及删除您的个人信息，但须遵守适用的数据保护法所规定的限制。您也有权要求我们解释个人信息处理规则。
6.1 访问、修改、复制和删除您的个人信息
6.1.1 在您完成帐户注册后，您可以随时访问、修改和复制您的个人信息。
6.1.2 您可以要求我们删除您的个人信息，如果：
(i) 我们对个人信息的处理违反了适用的数据保护法律；
(ii) 我们对个人信息的处理违反了与您的约定；
(iii) 如果我们终止经营和服务，或您撤回同意；
(iv) 处理的目的已经实现或不能实现，或者该等信息对于实现处理的目的不再是必要的；
(v) 保管期限已满的；或
(vi) 适用法律要求的其他情形。
6.1.3 如果我们决定回应您的删除请求，我们也将尽可能通知从我们处获取您个人信息的第三方，并要求他们及时删除，除非适用的数据保护法律另有规定或这些第三方已获得您的独立同意。
6.1.4 对于难以在网站、应用程序或其他界面直接访问、修改、复制或删除，或行使其他权利的个人信息，可通过本政策底部的联系方式与我们联系。
6.2 撤回同意
某些特定的业务功能依赖于您的个人信息和功能权限。您可以通过关闭相应的业务功能来撤回此类同意。您撤回同意后，我们无法继续为您提供相应功能，也不会处理您相应的个人信息。但是，您撤回同意的决定不会影响我们以前的个人信息处理。请明白撤回同意是不可恢复的操作。
鉴于我们的统一账户系统，一旦您撤回同意，我们将删除所有有关您同意的信息，除非法律法规另有规定。您无法通过撤回的同意取得有关服务。
6.3 回应您的要求
6.3.1 为确保安全，我们将在核实您的身份后15个工作日内处理您的请求。我们可能会拒绝不合理重复、需要太多技术方法（例如需要开发新系统或从根本上改变现行做法）、给他人权益带来风险或非常不切实际的请求。在下列任何情况下，我们可能无法回应您的要求：
(i) 与我们履行法律法规义务有关的；
(ii) 直接关系国家安全、国防安全的；
(iii) 直接关系公共安全、公共卫生和重大公共利益的；
(iv) 与刑事侦查、起诉、审判和执行判决直接相关的；
(v) 我们有充分的证据表明您有主观恶意或者滥用权利的行为；
(vi) 为保护您或他人的生命、财产及其他重大合法权益，难以取得本人授权同意的；
(vii) 回应您的请求会对您、他人和组织的合法权益造成严重损害；
(viii) 涉及商业机密。
6.3.2 如果我们终止服务或操作，我们将至少提前15天通知您，并在终止服务或操作后删除或匿名化处理您的个人信息。
7 我们如何收集和处理14岁以下未成年人的个人信息
7.1 我们不会故意向儿童收集个人信息。我们不针对儿童提供服务。如果您未满14岁，请不要在任何时候或以任何方式使用我们的服务。
7.2 如果父母或法定监护人意识到他或她的孩子在未经适当同意的情况下向我们提供了个人信息，请通过本政策底部的联系方式与我们联系。
7.3 如果我们确认用户是未成年人并向我们提供了个人信息，我们将从我们的数据库中删除这些个人信息。
8 如何更新此政策
8.1 本政策可能会更新。未经您的同意，我们不会减少您在本政策下的任何权利。我们将在此页面发布对本政策的任何更改。
8.2 如有重大更改，我们会通过[电邮、弹出式窗口或适用数据保护法例所要求的其他方式]通知您，并解释政策更改的详情，并可能再次征求您的同意。
8.3 本政策的主要变化包括但不限于：
8.3.1 服务模式的重大改变，例如处理个人信息的目的、处理的个人信息的类别，以及个人信息的用途；
8.3.2 我们在所有权结构、组织结构方面发生的重大变化，例如由于业务调整、合并、分立、解散或破产而导致的所有者变更。
8.3.3 个人信息公开披露、共享、转让的主要对象的变更；
8.3.4 个人信息处理所涉及的权利及行使这些权利的方式的变化；
8.3.5 我们的个人信息保护责任部门、联系人、投诉渠道的变更；
8.3.6 当个人信息影响评估报告表明存在高风险时。
8.4 我们也会将此政策的旧版本存档，供您参考。
8.5 我们鼓励您不时审阅本通知。
9 联系方式
9.1 如果您对此政策有任何疑问、意见或建议，请通过以下途径与我们联系：
9.1.1 电子邮件：webmaster@shanghai-museum.org
9.1.2 通信地址：
Li Zhi
Information and Technology Center
Shanghai Museum
No. 201 Ren Min Da Dao,
Shanghai 200003,
P.R.China
中国上海市人民大道201号
上海博物馆信息中心 邮编200003
李智（收）
我们将尽快审查您的反馈，并将在[15]个工作日内回复您。
9.2 如果您对我们的回复不满意，特别是我们对个人信息的处理损害了您的合法权益，您可以通过以下外部渠道寻求解决：