At kumu, as part of our commitment to create a safe space, we are working our best to ensure that your privacy is respected and your Personal Data is protected.
Thus, we want you to take a moment and understand what data we obtain about you and our data privacy practices and policies, so you can make an informed decision and exercise meaningful control over your data.
- Kumu is accessible to the general public from anywhere in the world. When you livestream, create a profile, follow a streamer, give virtual gifts, participate in campaigns or post a clip on kumu that are public or intended to be public in nature, individuals that use kumu will access this information and may have the ability to acquire, use, or reveal such information to others. Furthermore, several of our Services (as defined below) are intended to offer others with information on user behavior, such as virtual gifting or a follow to a streamer. We advise you to keep this in mind when using kumu. However, we also provide non-public communication channels on kumu, such as private streaming and chat.
- When you participate in campaigns sponsored by our Business Partners (i.e. any company or individual which transacts business with Kumu, including but not limited to advertisers and merchants), we may share your Personal Data with them in accordance with the terms and conditions of the campaigns. For example, if you participate in DTI (Philippines) registered campaigns of a Business Partner, we may share your information with DTI (Philippines) as part our legal obligation and with the Business Partner as part of our contractual obligation.
- When you purchase products from our Business Partners, we may share your Personal Data with them to fulfill your orders and to third party service providers for the delivery of your ordered products.
- We collect certain Personal Data (e.g. information regarding the device you’re using, IP address, etc.) from you when you use kumu, even if you’re simply browsing livestreams. We use this information to keep the platform safe and to offer you more relevant content, suggested users and advertisements.
- otherwise communicate with us
EXTERNAL PARTY SITES
WHAT PERSONAL DATA DO WE COLLECT – CATEGORIES AND SOURCES
USER-PROVIDED AND AUTOMATICALLY-COLLECTED PERSONAL DATA
We may collect the following categories of Personal Data from you when you [download our app], create an account, stream through our Services, participate in our campaigns and challenges, post klips, use our chat services, purchase coins and share virtual gifts through our Services, contact us (including via social media), participate in our surveys and events, purchase a product in our kumu shop, or otherwise interact with us by using our Services.
USER-PROVIDED PERSONAL DATA
- Personal identifiers. Name, email address, physical address, phone number, [social media account names], registered devices, gender, in-game username (for gaming tournaments and competitions) and age
- Payment Information. Information about billing address and payment method, such as bank account information, credit, debit, or other payment card information
- Transaction Information. Data about purchases and use of services or transactions facilitated by kumu, including purchases made through the Services
- Usage Information. Audio, videos, images, and other information uploaded, viewed ,shared and downloaded on and from the Services; interactions and exchanges with other users (e.g. chat, stream, etc.)
- Government ID Data. We may request a government-issued ID in some instances, such as for verification of your identity, or as required by law
- Other Information You Provide to Us. The content of your kumu correspondence, including exchanges with our customer support (including social media)
- Inferences Drawn From your Data. Inferences we make based upon your interests and viewing preferences
- Usage Data. Data about your activities on and use of our Services, such as app launches inside our Services, browser history, product engagement, IP address or other unique identifiers, and other information regarding your interaction with our Services and our advertisements
- Device Information. Data that can be used to identify your device, such as the device ID, or information about the device, such as the browser type
INFORMATION FROM OTHER SOURCES
kumu may receive Personal Data about you from other individuals, from businesses or third parties acting at your direction, from our Business Partners such as social media platforms with which you interact, and from third parties that work with us to provide our products and services and assist us with security and fraud prevention and improving our Services.
HOW KUMU USES YOUR PERSONAL DATA
Kumu processes the following types of Personal Data for the following purposes and in reliance on the following legal bases:
|Type(s) of Personal Data||Purpose(s) for Processing||Legal Bases for Processing|
|To enable enable you to engage with other users|
To allow you to leave comments on content and engage in campaigns or rewards programs
|Personal Identifiers||To communicate with you on service-related issues|
Government ID Data
Other Information You Provide to Us
|To verify your identity and respond to, handle, and process queries, requests, applications, complaints, and feedback from you|
Government ID Data
Other Information You Provide to Us
|To manage your relationship with us including to provide customer support services|
|To process payment or credit transactions|
|Personal Identifiers||To provide you with news, special offers and general information about other goods, services and events||Where required under applicable law, we will ask for and rely on your consent. You can withdraw your consent to the processing at any time but this does not affect the lawfulness of our processing of your personal information based on consent before such withdrawal.|
|Personal Identifiers||To disclose Personal Data of the winners of DTI registered campaigns to Philippines’ Department of Trade and Industry||To comply with a legal obligation.|
|To process your Personal Data in accordance to the regulatory requirements of Anti-Money Laundering Council and Bangko Sentral ng Pilipinas|
|To access, preserve or disclose personal data in response to a request from a regulator, law enforcement, court or others|
|Inferences Drawn From Your Data|
|To improve users’ experience with kumu by providing content recommendations, user suggestions and relevant notification||To pursue our legitimate interests to make your experience of our products and Services efficient and effective|
|Inferences Drawn From Your Data|
|To operate, maintain, improve, provide, create, and develop all of the features, functionality, and Services (new and existing) found on kumu||To pursue our legitimate interests to make your experience of our products and Services efficient and effective|
|To provide and increase safety and security for our websites, products, software, or applications and Services (by preventing, detecting and implementing proper measures against spam, scammers, abuse, misuses of our Services and violation of our rules)||To pursue our legitimate interests to ensure our products and Services are safe and secure and to ensure they are used in accordance with our applicable Terms|
|To investigate and address violations of Terms|
To detect, prevent and combat unlawful behaviour
|To pursue our legitimate interests to ensure our products and Services are safe and secure and to ensure they are used in accordance with our applicable Terms|
|Inferences Drawn From Your Data|
|Data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns||To pursue our legitimate interests to inform and improve our products and Services|
You have a right to object to the processing of your personal information where that processing is carried out for our legitimate interests. Please note however that we may not be able to fulfill this request in all instances. You are able to request a copy of the legitimate interest assessment carried out by us.
Where we need to collect the abovementioned categories of Personal Data by virtue of a legal obligation or in light of a contract entered or to be entered into with you, and you do not provide this Personal Data when requested, we may not be able to comply with our legal obligations, provide you with a service or perform the contract we have or are trying to enter into with you. In such case, we may have to terminate our relationship with you.
KUMU’S SHARING OF PERSONAL DATA
We may share or disclose your Personal Data to the following third parties:
We disclose Personal Data to service providers who work on our behalf, such as those that:
- provide website hosting, maintenance, and security services
- provide specific functionality
- assist kumu in improving the kumu Services and developing new services and features
- fulfill, distribute and process returns of products, orders or contest prizes
- conduct data analysis and report creation
- process payments
- prevent, detect, and investigate fraud or other prohibited actions
Campaigns, Contests and Gaming Tournament partners. When you participate in campaigns, challenges and competitions sponsored by our partners, we may disclose your personal data to them in accordance with the terms and conditions of the said campaign, challenge or competition.
Partner merchants. When you purchase product from our kumu shop, we share your personal data with the shop merchants to fulfill your orders, process payment and delivery, return of your orders.
We may also share aggregated, anonymized data with our Business Partners and advertising clients, such as user segment statistics.
LAW AND PUBLIC INTEREST
We may disclose your Personal Data if we believe it is reasonably necessary to comply with law, regulation, legal process, or governmental requests such as court orders, subpoenas, or warrants in the manner allowed by law.
We may also disclose Personal Data when we believe, in good faith, that disclosure is appropriate or reasonably necessary to protect kumu from fraudulent, abusive, or unlawful uses; to investigate and defend ourselves against third-party claims or allegations; to protect the security or integrity of kumu; or to protect the rights, property, or safety of kumu, our users, or others.
AFFILIATES AND CHANGE OF OWNERSHIP
Your Personal Data may also be transferred as part of a bankruptcy, merger, acquisition, reorganization, or sale of kumu assets if we are involved in such a transaction, including any evaluation of such a transaction.
HOW DOES KUMU OPERATE AND TRANSFER PERSONAL DATA GLOBALLY
Your information, including Personal Data, is processed at kumu’s operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to — and maintained on — computers/servers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction.
HOW LONG KUMU STORES YOUR PERSONAL DATA
We will cease to retain your Personal Data, or remove the means by which the data can be associated with you, as soon as it is reasonable to assume that such retention no longer serves the purpose for which the Personal Data was collected, and is no longer necessary for legal or business purposes.
HOW KUMU SECURES YOUR PERSONAL DATA
To safeguard your Personal Data from unauthorized access, collection, use, disclosure, copying, modification, disposal or similar risks, we have put in place reasonable and appropriate administrative, physical and technical measures.
You should be aware, however, that no method of transmission over the Internet or method of electronic storage is completely secure. Data security incidents and breaches can occur due to a variety of factors that cannot reasonably be prevented; therefore, our safeguards may not always be adequate to prevent all breaches of security.
YOUR PRIVACY RIGHTS AND MANAGING YOUR PERSONAL DATA
California residents may have specific rights with respect to the Personal Data we collect. Click [here] for additional information about California residents’ rights and disclosures of our privacy practices as required under applicable California law.
We generally rely on Personal Data provided by you (or your authorized representative). In order to ensure that your Personal Data is current, complete and accurate, please update us if there are changes to your Personal Data.
Subject to certain restrictions and limitations, you have certain rights in respect of your Personal Data. In particular, you have the following rights:
- Right to access – to receive a copy of your Personal Data. We will have to adequately verify your identity before any action can be taken;
- Right to rectification – to request for amendments to be made to your Personal Data where this is inaccurate or incorrect;
- Right to restriction – to ask that we restrict or suppress the processing of your Personal Data which means that whilst we are permitted to store the Personal Data we cannot otherwise process it;
- Right to erasure – to request for the deletion of your Personal Data that we hold. However, we may not always be able to delete your Personal Data for legal and regulatory reasons;
- Right to object – to object to the processing of your Personal Data which we carry out in reliance on our legitimate interests. In such instances, we will investigate to see if there is compelling reason for processing to continue. You cannot object to the processing which is a legal obligation or where we must process your Personal Data to satisfy a contract to which you are a party. Also, you can object to marketing communications at any time;
- Right to withdraw you consent – to withdraw your consent to the processing of your Personal Data at any time (where kumu is processing your personal information based on your consent). Please note that withdrawing your consent may prevent us from further providing all or part of our Services to you but does not affect the lawfulness of our processing of your Personal Data based on such consent before the withdrawal;
- Right to data portability – to receive certain Personal Data that you have provided to us, in a machine-readable form and/or that we transmit it to a third party with your express authorisation; and
- Right to lodge a complaint –to complain to the relevant supervisory authority if your privacy rights are violated, or if you have suffered as a result of unlawful processing of your Personal Data.
We may ask you for identifying information and attempt to match it to information that we maintain about you. If we can’t verify your identity or authority to make the request, and confirm the Personal Data belongs to you, we won’t be able to complete your request. We will notify you to inform you of this. You do not need to create an account with us to make a verifiable request. Personal data submitted in a verifiable request will only be used to confirm the requestor’s identity or permission to make the request.
If you would like to exercise your rights, please contact the Data Protection Officer using the contact details below.
To the extent permitted under applicable data protection laws, we may charge a reasonable fee for an access request to cover our administrative costs of providing the information in certain situations. If so, we will inform you of the fee before we proceed with your request.
We will respond to your request as soon as reasonably possible and within thirty (30) calendar days. Should we not be able to respond to your request within thirty (30) days after receiving your request and where we are permitted to do so under applicable data protection laws, we will inform you in writing within thirty (30) days of the time by which we will be able to respond to your request.
ADDITIONAL INFORMATION OR ASSISTANCE
To protect your privacy and implement security, we will take reasonable steps to verify your identity before granting your request. We reserve the right to charge an appropriate fee for complying with your request where allowed by applicable law. There may be situations where we cannot grant your request especially if it jeopardizes the privacy of others, is frivolous or vexatious, or would be extremely impractical.
kumu recognizes and values the importance of protecting the privacy of children, which we define as anyone under the age of thirteen. Our Services are not intended for or directed to children under the age of thirteen, and anyone under the age of thirteen are not permitted to use kumu. If we discover that we are processing data for such users (under the age of 13), we shall take reasonable steps to guarantee that their records are erased and data processing is ceased. Please inform us if you suspect we have Personal Data about or acquired from a child under the age of 13.
You must also be of legal age in your country to consent to the processing of your Personal Data (in some countries we may allow your parent or guardian to do so on your behalf).
We are committed to ensuring that our communications are accessible to people with disabilities. To make accessibility-related requests or report barriers, please contact us at firstname.lastname@example.org.
You may contact our Data Protection Officer if you have any inquiries or feedback on our Personal Data protection policies and procedures, or if you wish to make any request, in the following manner:
Data Protection Officer email@example.com, 6F Robinsons Cybergate Tower 3, Pioneer St., Mandaluyong City, Philippines.
ADDITIONAL DISCLOSURES FOR CERTAIN JURISDICTIONS
CALIFORNIA PRIVACY NOTICE
Categories of Personal Data We Collect and Have Collected in the Past 12 Months – Sources and Categories
In the 12 months preceding the date of this California Notice, we may have collected your Personal Data when you download our app, create an account, stream through our Services, participate in our campaigns and challenges, post klips, use our chat services, purchase coins and share virtual gifts through our Services, contact us (including via social media), participate in our surveys and events, purchase a product in our kumu shop, or otherwise interact with us by using our Services. We will continue to collect Personal Data from the same sources.
In the twelve (12) months prior to the date of this Notice, we have collected, and will continue to collect, the following categories of Personal Data:
- Personal Identifiers: Name, physical address, phone number, unique personal identifier, IP address, device ID, email address, in-game username, account name and password, [social media account names], governmental ID information
- Financial information: Bank account information, credit, debit, or other payment card information
- Protected class information: Gender, age range
- Commercial information: Records of products or Services purchased or consumed
- Internet or other electronic network activity: Data about your activities on and use of our Services, app launches inside our Services, browser history, search history, and product engagement, information regarding your interaction with our Services and our advertisements, device and browser type
- Audio and visual information: Audio, videos, images, and other information uploaded, viewed ,shared and downloaded on and from the Services; interactions and exchanges with other users (e.g., chat, stream)
- Inferences drawn from any of the Personal Data identified above.
Purposes for Collection of Personal Data
We use your Personal Data for the following purposes to provide Services to you; to perform our obligations in the course of or in connection with our Services requested by you; to allow you to leave comments on content and engage in campaigns or rewards programs; to verify your identity and respond to, handle, and process queries, requests, applications, complaints, and feedback from you; to process payment or credit transactions; to provide you with news, special offers and general information about our Services.
We also use your Personal Data to comply with any applicable laws, regulations, codes of practice, guidelines, or rules, or to assist in law enforcement and investigations conducted by any governmental and/or regulatory authority. This includes, but is not limited to, as applicable, disclosure of Personal Data of the winners of DTI registered campaigns to Philippines’ Department of Trade and Industry, and processing your Personal Data in accordance to the regulatory requirements of Anti-Money Laundering Council and Bangko Sentral ng Pilipinas.
Additionally, we use Personal Data to monitor or improve our Services; for internal business analysis; to prevent fraud, activities that violate our Terms of Service or that are illegal; and to protect our rights and the rights and safety of our users or others.
Categories of Personal Data Disclosed for Business Purpose in Past 12 Months
|Categories of Consumers’ Personal Data||Categories of Third Parties With Which We Shared Personal Data for a Business Purpose|
|Personal Identifiers: Name, physical address, phone number, unique personal identifier, IP address, device ID, email address, in-game username, account name and password, [social media account names], governmental ID information||Service providers that||assist us in operating, analyzing, and displaying content on our website; provide analytics information; advertise or market our products; provide website hosting, webcast and teleconference services; provide legal and accounting services.|
|Financial information: Bank account information, credit, debit, or other payment card information||Service providers that provide payment processing services|
|Commercial information:||Records of products or Services purchased or consumed||Service providers that assist kumu in improving the kumu Services and developing new services and features; fulfill and/or distribute orders or contest prizes; and conduct data analysis and report creation|
|Internet or other electronic network activity:||Data about your activities on and use of our Services, app launches inside our Services, browser history, search history, and product engagement, information regarding your interaction with our Services and our advertisements, device and browser type||Service providers that provide data security services and cloud-based data storage; host our website and assist with other IT-related functions; advertise and market our products; and provide analytics information|
Additional Information About How We May Disclose Personal Data
We may also disclose your Personal Data as required or permitted by law, to comply with a subpoena or similar legal process or government request, or when we believe in good faith that disclosure is legally required or otherwise necessary to protect our rights and property or the rights, property or safety of others, including to law enforcement agencies, and judicial and regulatory authorities. We may also share your Personal Data with third parties to help detect and protect against fraud or data security vulnerabilities. And we may transfer your Personal Data to a third party in the event of an actual or contemplated sale, merger, reorganization of our entity or other restructuring.
Rights Regarding Personal Data
Your Right To Request Disclosure of Information We Collect and Share About You
We are committed to ensuring that you know what Personal Data we collect. To that end, you can ask us for any or all of following types of information regarding the Personal Data we have collected about you in the 12 months prior to our receipt of your request:
- Specific pieces of Personal Data we have collected about you;
- Categories of Personal Data we have collected about you;
- Categories of sources from which such Personal Data was collected;
- Categories of Personal Data that the business sold or disclosed for a business purpose about the consumer;
- Categories of third parties to whom the Personal Data was sold or disclosed for a business purpose; and
- The business or commercial purpose for collecting or selling your Personal Data.
Your Right To Request Deletion of Personal Data We Have Collected About You
Upon your request, we will delete the Personal Data we have collected about you, except for situations where the CCPA authorizes us to retain specific information, including when it is necessary for us to provide you with a good or service that you requested; perform a contract we entered into with you; maintain the functionality or security of our systems; or comply with or exercise rights provided by the law. The law also permits us to retain specific information for our exclusively internal use, but only in ways that are compatible with the context in which you provided the information to us or that are reasonably aligned with your expectations based on your relationship with us. We will act on your deletion request within the timeframes set forth below.
Your Right to Ask Us Not to Sell Personal Data We Have Collected About You
You can direct us not to sell your Personal Data by submitting an opt-out request through our Data Request Form , or by contacting us. We will act on your request within the timeframes set forth below.
Exercising Your Rights and How We Will Respond
To exercise any of the rights above, or to ask a question, contact us, complete and submit our Data Request Form or use the contact details set out at the end of this California Notice .
For requests for access or deletion, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know.
For requests to stop the sale of your Personal Data, we will comply no later than 15 business days after receipt of your request.
We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why.
Verification of Identity – Access or Deletion Requests
We will ask you for identifying information and attempt to match it to information that we maintain about you.
If we are unable to verify your identity with the degree of certainty required, we will not be able to respond to your request. We will notify you to explain the basis of the denial.
Ensuring Veracity of Opt-Out Requests
If we have a good-faith, reasonable belief that a request to opt-out of the sale of Personal Data is fraudulent, we may deny the request. Should this occur, we will inform you and explain why we believe the request is fraudulent.
You may designate an agent to submit requests on your behalf. The agent must be a natural person or a business entity that is registered with the California Secretary of State.
If you would like to designate an agent to act on your behalf, you and the agent will need to comply with our verification process:
- Requests to Know or Delete Personal Data: If the agent submits requests to access, know or delete your Personal Data, the agent will need to provide us with your signed permission indicating the agent has been authorized to submit the opt-out request on your behalf. We will also require that you verify your identity directly with us or confirm with us that you provided the agent with permission to submit the request.
- Requests to Opt Out of Sale: If the agent submits a request to opt out of the sale of your Personal Data, the agent will need to provide us with your signed permission indicating the agent has been authorized to submit the opt-out request on your behalf.
Please note that this subsection does not apply when an agent is authorized to act on your behalf pursuant to a valid power of attorney. Any such requests will be processed in accordance with California law pertaining to powers of attorney.
Requests for Household Information
There may be some types of Personal Data that can be associated with a household (a group of people living together in a single dwelling). Requests for access or deletion of household Personal Data must be made by each member of the household. To the extent we collect household information and requests are made pertaining specifically to such information, before responding to a request, we will verify the identity of each member of the household using the verification criteria explained above and will also verify that each household member is currently a member of the household.
No discrimination for exercise of CCPA rights
We will not discriminate against you for exercising any of your CCPA rights. Unless the CCPA allows it, we will not deny your use of our services.
California “Shine the Light” disclosure
In certain circumstances under the California “Shine the Light” law, residents of California have the right to opt out of the sharing of certain categories of Personal Data (as defined in the Shine the Light statute) with third parties for their direct marketing purposes. kumu does not share your Personal Data to third parties for the purpose of direct marketing.
Do Not Track
Some browsers have a “do not track” feature that lets you tell websites that you do not want to have your online activities tracked. At this time, our websites do not respond to browsers’ do not track signals.
For questions about our U.S. state data privacy practices, including about how to exercise your data access rights under California law, please contact us at firstname.lastname@example.org