Click to download Agreement on Use of Huawei APIs.

Thank you for using Huawei's APIs, associated services and software (collectively referred to as "APIs"). The following terms and conditions (the "Agreement") constitute a legally binding agreement between you and Huawei. By clicking the "I Agree" button (or any other similar button) below this Agreement, or by accessing or using any of the APIs, you shall be deemed to have fully understood and accepted this Agreement. Additional terms (including but not limited to terms in the accompanying documentation like the EU Standard Contractual Clauses and any applicable policies and guidelines) may apply to you, depending on the specific APIs you used. Said additional terms will be available with the relevant APIs, and become an integral part of this Agreement if you use those APIs (this Agreement and said additional terms are collectively referred to as the "APIs Agreements").

The APIs Agreements are supplementary agreements to the HUAWEI Developers Service Agreement between you and Huawei, and together with the latter govern your use of the APIs as a Huawei Developer. If you use the APIs as an interface to, or in conjunction with other Huawei products or services, then the terms for those other products or services shall also apply.

Any matters not addressed herein shall be subject to the HUAWEI Developers Service Agreement. In the event of any conflict between the APIs Agreements and the HUAWEI Developers Service Agreement, the APIs Agreements shall prevail with respect to any matters concerning your use of the APIs.

Definitions

Capitalized terms not defined in this Agreement shall have the same meanings ascribed to them in the HUAWEI Developers Service Agreement. The following terms shall have the following meanings when used in the APIs Agreements.

1.1 "APIs" means Huawei's APIs, associated services and software (including but not limited to APIs, SDKs and kits). APIs are managed by Huawei and/or its Affiliates; certain APIs are managed by AppTouch Providers when such APIs (as set forth here and may be updated from time to time) are integrated in your API Clients distributed via Huawei AppTouch platforms. APIs fall under the scope of "Huawei Services" as defined in the HUAWEI Developers Service Agreement.

1.2 "API Client(s)": as defined in Clause 3.1. API Client(s) fall under the scope of "Products" as defined in the HUAWEI Developers Service Agreement.

1.3 "Data Controller" means any natural persons, body corporates, public institutions, government agencies, or other organizations that, by themselves or with other entities, determine the purposes and means of processing Personal Data.

1.4 " AppTouch Provider" means the entity that operates HUAWEI AppTouch.

1.5 "Data Processor" means any natural persons, body corporates, public institutions, government agencies, or other organizations that process Personal Data for and on behalf of a Data Controller.

1.6 “EEA” means the European Economic Area, consisting of the Member States of the European Union and Iceland, Liechtenstein and Norway.

1.7 “EU Standard Contractual Clauses” mean the contractual clauses issued by the European Commission by implementing decision 2021/914 of 4th of June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.

1.8 “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

1.9 "Huawei", "we", "our" or "us" means the signing entity determined in accordance with Clause 9 herein which provides services to you under the APIs Agreements.

1.10 "Huawei AppTouch" or "AppTouch" means the distribution platforms (a) for which Huawei cooperates with third parties, including but not limited to telecom carriers, in operations and branding, (b) developed and for which technical support is provided by Huawei, and (c) that allow Developers to showcase and distribute Products, such as apps and games, to End Users, in order to increase exposure, traffic, monetization opportunities, and users for the Products. The HUAWEI AppTouch list is set forth here. Huawei may update the list from time to time upon prior notice to you. If you have any comments or questions about the distribution of your Products on HUAWEI AppTouch, you may contact Huawei through your account manager at Huawei or via apptouch@huawei.com. Huawei will respect your choice..

1.11 “Parties” means you and Huawei (see definition above).

1.12 “Personal Data” means any information relating to an identified or identifiable natural person in so far as it is processed under this Agreement.

1.13 “Third Country” means a country that is neither part of the EEA nor has been declared adequate by a decision of the European Commission according to the mechanism lined out in Article 45 GDPR.

1.14 “UK Addendum” means the addendum to the Standard Contractual Clauses issued by the UK Information Commissioner under Section 119A(1) of the UK Data Protection Act 2018 (version B1.0, in force March 21, 2022, as amended, available here: https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf).

Using Our APIs

2.1 License to You

Subject to the terms and conditions of the APIs Agreements, Huawei grants you a limited, revocable, non-exclusive, non-transferable, and non-sublicensable license to integrate, copy, and use the APIs in your API Clients.

2.2 Your End Users

You shall require your End Users to comply with (and not knowingly enable them to violate) applicable laws, regulations, and the APIs Agreements.

2.3 Compliance with Laws, Third-Party Rights, and Other Agreements with Huawei

You shall comply with any and all applicable laws, regulations, and third-party rights (including but not limited to laws regarding the import or export of data or software, privacy, and local laws). You may not use the APIs to encourage or promote illegal activities or violation of third-party rights. You may not violate any other agreements you made with Huawei or its Affiliates as a Huawei Developer (collectively "Huawei Agreements").

2.4 Permitted Access

You shall only access (or attempt to access) an API by the means described in the documentation of that API. If Huawei assigns you developer credentials (for example, passwords, keys, and client IDs), you shall use them with the applicable APIs. You may not misrepresent or mask either your identity or your API Client's identity when using the APIs or your Developer Account.

2.5 API Limitations

Huawei may set and enforce limits on your use of the APIs (for example, limiting the number of API requests that you may make or the number of End Users you may serve), in our sole discretion. You agree to, and will not attempt to circumvent, such limitations.

2.6 Open Source Software

Some of the software required by or included in our APIs may be offered under an open source license. Open source software licenses constitute separate written agreements. For certain APIs, open source software is listed in the documentation of the APIs. To the limited extent the open source software license expressly supersedes the APIs Agreements, the open source license instead sets forth your agreement with Huawei for the applicable open source software.

2.7 Feedback

If you provide feedback or suggestions about our APIs, then we may use such information without liability to you.

2.8 Non-Exclusivity

The terms of the APIs Agreements are non-exclusive. You shall acknowledge that Huawei may develop products or services that may compete with your API Client or any other products or services.

2.9 Charging Standards and Payment Policies

The charging standards and payment policies of a given API (if any) will be subject to relevant information provided with that API on the Website.

Your API Clients

3.1 API Clients

The APIs are designed to help you enhance your websites and applications ("API Client(s)"). You agree that Huawei may monitor the use of the APIs to ensure quality, improve products and services, and verify your compliance with the APIs Agreements. This monitoring may include Huawei's access to and use of your API Client, for example, identifying security issues that may affect Huawei or its users. You may not interfere with this monitoring. Huawei may use any technical means to overcome such interference. Huawei may suspend access to the APIs by you or your API Client without notice if we reasonably believe that you are in violation of the APIs Agreements.

3.2 Security

You shall make commercially reasonable efforts to protect user information collected by your API Client, including Personal Data, from unauthorized access or use. The protection standards shall be higher than or equal to Huawei's privacy protection standards. You shall promptly report to your End Users any unauthorized access or use of such information to the extent required by applicable laws.

3.3 Ownership

Huawei does not acquire ownership in your API Client, and by using our APIs, you do not acquire ownership of any rights in our APIs or the content that is accessed through our APIs.

Prohibitions and Confidentiality

4.1 API Prohibitions

When using the APIs, you may not (or allow those acting on your behalf to) violate the HUAWEI Developers Service Agreement, and you may not:

a. sublicense an API for use by any third party. Consequently, you may not create an API Client that functions substantially the same as the APIs and offer it for use by third parties.

b. perform an action with the intent of introducing to Huawei products and services any viruses, worms, defects, Trojan horses, malware, or any items of a destructive nature.

c. reverse engineer or attempt to extract the source code from any API or any related software, except to the extent that this restriction is expressly prohibited by applicable laws.

d. use the APIs for any activities where the use or failure of the APIs could lead to death, personal injury, or environmental damage (such as the operation of air traffic control, or life support systems).

e. remove, obscure, or alter any terms of the APIs Agreements or any links to or notices of those terms.

4.2 Confidential Matters

a. Developer credentials (such as passwords, keys, and client IDs) are intended to be used by you and identify your API Client. You shall keep your credentials confidential and secure and take all reasonably necessary measures to prevent and discourage other API Clients from using your credentials. Developer credentials may not be embedded in open source projects.

b. Our communications to you and our APIs may contain Huawei's Confidential Information or AppTouch Providers' Confidential Information, as applicable. If you receive such Confidential Information, you may not disclose it to any third parties without prior express consent in writing by Huawei or relevant AppTouch Providers (as applicable). This clause 4.2.b shall survive the termination of the APIs Agreements.

Content

5.1 Content Accessible Through Our APIs

Our APIs contain some third-party content in various forms (such as text, maps, images, videos, audio, or software) for which we are not responsible, but we may review content from time to time to determine whether it is illegal or violates our policies or the APIs Agreements, and we may remove or refuse to display content. Huawei is not responsible for the accuracy, reliability and the views expressed on any third-party content. You understand that the APIs provide content interfaces only. You may determine whether to use the content within your control. Huawei shall not be liable for any and all losses and liabilities caused by third-party content.

Content accessible through our APIs may be subject to intellectual property rights, and, if so, you may not use it unless you are licensed to do so by the owner of that content or are otherwise permitted by law. Your access to the content provided by the APIs may be restricted, limited, or filtered in accordance with applicable laws, regulations, and policies.

5.2 Submission of Content

Some of our APIs allow the submission of content. Huawei does not acquire any ownership of any intellectual property rights in the content that you submit to our APIs through your API Client, unless otherwise specified in the APIs Agreements. For the sole purpose of enabling Huawei to provide, secure, and improve the APIs (including the related service(s)) and only in accordance with the applicable Huawei privacy policies, you hereby grant to Huawei a perpetual, irrevocable, worldwide, sublicensable, royalty-free and non-exclusive license to use the content submitted, posted, or displayed to or from the APIs through your API Client. When you submit content to our APIs through your API Client, you also represent and warrant that you have all the necessary rights (including the necessary rights from your End Users) required to grant us the license for use of said content for the purposes of the APIs Agreements.

5.3 Retrieval of Content

When a user's non-public content is obtained through the APIs, you may not expose that content to any other users or third parties without appropriate legal base (such as explicit opt-in consent from that user if applicable).

5.4 Prohibitions on Content

Unless expressly permitted by the content owner or by applicable law, you may not, and may not permit your End Users or others acting on your behalf to, perform the following operations with the content returned from the APIs:

a. scrape data, build databases, or otherwise create permanent copies of such content, or keep cached copies longer than permitted by the cache header;

b. copy, translate, modify, and create derivative work of, sell, lease, lend, convey, distribute, publicly display, or sublicense to any third party;

c. misrepresent the source or ownership; or

d. remove, obscure, or alter any copyright, trademark, or other proprietary rights notices; or falsify or delete any author attributions, legal notices, or other labels of the origin or source of materials

Privacy Protection

6.1 Personal Data Generated during End User's Use of Products and Services of Huawei or within AppTouch:

a. Upon prior authorization of an End User, or upon other applicable legal basis of Personal Data processing, your corresponding API Client, when integrated following APIs, may obtain relevant Personal Data generated during the use by such End User of products and services provided by Huawei, or otherwise generated during the use of products and services provided within AppTouch as follows:

(i) Account API: your API Client can obtain relevant account data such as End User's name, and avatar, to allow the login;

(ii) In-App Purchase API: your API Client can obtain relevant transaction information, such as order ID, and order details to finalize the purchase;

(iii) Game Service API: your API Client can obtain relevant player's stats, rankings and achievements. You must not display the Game service data of an End User to other End Users without said End User's authorization;

(iv) AppGallery Connect API: If you provide services for Huawei Developers and help them use the services of AppGallery Connect, your API Client can obtain the data of the Huawei Developers in AppGallery Connect, such as information about their HUAWEI ID, team account, contact information, credentials, device commissioning, projects, apps, operational reports, products, and game service configurations;

(v) Location API: When you are using the location services provided by Huawei in connection with your Products, we may share location information of End Users (such as longitude and latitude as well as the accuracy information) with you. When using our location services, you shall further comply with the terms of the HUAWEI Location Service Agreement.

b. By using relevant APIs in accordance with Clause 6.1.a herein, you are the Data Controller of the Personal Data of corresponding End User your API Client obtained from Huawei or AppTouch Providers (as applicable) as referred to in Clause 6.1.a. For clarity's sake, when your API Clients are distributed via any platform of AppTouch, the relevant AppTouch Provider is the Data Controller of Personal Data processed for the provision of services of such AppTouch, and Huawei is the data processor of such data. You and Huawei, or you and said AppTouch Provider, are independent Data Controllers. Each Party shall observe any and all applicable privacy laws and regulations.

c. Further, in accordance with Clause 9 herein:

(i) if

(1) you are contracting the APIs Agreements with Aspiegel SE, and you are located in a Third Country, or

(2) Personal Data is transferred between relevant AppTouch Provider established in EEA and you (as applicable), when you are located in a Third Country,

then Huawei and you, or relevant AppTouch Provider and you (as applicable), shall comply with the EU Standard Contractual Clauses provided in Attachment A for export and import of such Personal Data. The Parties shall be deemed to have executed the EU Standard Contractual Clauses, according to the process described in the preamble of this Agreement, such that:

• the relevant module of the EU Standard Contractual Clauses is “MODULE ONE: “Transfer controller to controller”;
• Huawei (or the relevant AppTouch Provider, as applicable) is the “data exporter” and You are the “data importer” referred to in the EU Standard Contractual Clauses;
• in clause 7, the Parties choose to include the “docking clause”;
• in clause 11, the Parties do not choose the optional complaint mechanism;
• in clause 17, the Parties choose Option 1 and the governing law shall be Irish law;
• in clause 18, the Parties choose the courts of Ireland;
• the competent supervisory authority referred to in clause 13 shall be the supervisory authority of Ireland; and
• in case of discrepancy with any provision in the APIs Agreements, the EU Standard Contractual Clauses shall prevail.
• The scope and nature of the transfer depends on the API used and is further set out in the Section B of Annex I later in this document.

To the extent that the data protection laws of the UK apply to the transfer of personal data under this Agreement, the Parties execute the UK Addendum which is incorporated into this Agreement and applies to transfers of personal data outside the UK (except for cases where such data is transferred to a country within the EU/EEA or to another country recognized as adequate in terms of level of data protection by the UK). Part 1 of the UK Addendum is completed as follows: (i) in Table 1, the “Exporter” is Huawei and you are the “Importer”, their details are set forth in this Agreement; (ii) in Table 2, the first option is selected and the “Approved EU SCCs” are the Standard Contractual Clauses referred to in Section 6.1(c)(i) above; (iii) in Table 3, the information is as provided in Annex I (A and B) and Annex II to the “Approved EU SCCs” (as set out in Attachment of this Agreement); and (iv) in Table 4, the “Exporter” can terminate the UK Addendum.

(ii) if you are contracting the APIs Agreements with Huawei Services (Hong Kong) Co., Limited, and your Business Area is not Russia, and your servers to receive such data are located outside of Singapore, then Huawei and you, or relevant AppTouch Provider and you (as applicable), shall comply with the Data Transfer Agreement as provided in Attachment B for export and import of such Personal Data.

(iii) if you are contracting the APIs Agreements with Shenzhen Huawei Siray Technologies Co., Ltd, and your Business Area is Russia, and your servers to receive such data are located outside of Russia, then Huawei and you, or relevant AppTouch Provider and you (as applicable), shall comply with the Data Transfer Agreement in Compliance with Russian Legislation as provided in Attachment C for export and import of such Personal Data.

6.2 Personal Data Generated during the Use of API Client by End User

In relation to services provided by Huawei, where you are collecting End Users' Personal Data directly from End Users as a Data Controller, Huawei processes such Personal Data as your data processor in accordance with the AppGallery Connect Data Processing Addendum, which is an integral part of the APIs Agreements.

6.3 You shall select your data processing location when you are using some services as a Data Controller, so that Huawei may process the data of your API Client and End Users at the location that you selected. You shall ensure that the data processing location that you selected complies with any and all applicable laws and regulations of the place where you and your End Users are located.

6.4 Protection of End Users' Personal Data

You warrant and undertake to protect Personal Data of your End Users. When integrating and using the APIs, you shall comply with all applicable privacy laws and regulations including those applying to Personal Data and when required by applicable laws, obtain the prior consent (or have other valid legal basis) of your End Users for the collection and processing of their data, including for using cookies, trackers or similar technologies. You shall provide and adhere to a conspicuous privacy policy for your End Users that clearly and accurately describes what End User information you will collect and how you will use and share such information (including for advertising) with Huawei and third parties.

You warrant and undertake to ensure that Personal Data of End Users are only collected and used for the limited purpose which is deemed to be necessary and processed lawfully in accordance with applicable laws, and only retained for the minimum necessary period. Personal Data in your possession shall be kept safe and secure from any actual or potential abuses.

Termination

7.1 Termination

a. Upon termination of the HUAWEI Developers Service Agreement by either Party, the APIs Agreements shall terminate automatically on the same day. However, termination of the APIs Agreements by either Party will not result in the termination of the HUAWEI Developers Service Agreement.

b. You may stop using our APIs at any time with or without notice. If you desire to terminate the APIs Agreements, you shall provide Huawei with prior written notice and cease your use of the applicable APIs. Huawei reserves the right to terminate the APIs Agreements for a given API or all APIs with you or discontinue the APIs or any portion or feature thereof or your access thereto for any reason and at any time without liability or other obligation to you.

7.2 Your Obligations after Termination

Upon any termination of the APIs Agreements or discontinuation of your access to an API, you shall immediately stop using that API, and delete any cached or stored content that was permitted by the cache header under Clause 5 herein. Huawei may independently communicate with any account owner whose account(s) is/are associated with your API Client and developer credentials to provide notice of the termination of your right to use an API.

7.3 Surviving Provisions

When the APIs Agreements come to an end, those terms that by their nature are intended to continue indefinitely will continue to apply, including but not limited to Clauses 4.2, 5, 7, and 8 herein.

Liability for our APIs

8.1 Limitation of our Liability

To the fullest extent permitted by law:

• Huawei Parties (including AppTouch Providers) shall not be responsible for lost profits, revenues, or data; financial losses; or indirect, special, consequential, exemplary, or punitive damages.
• Huawei shall not be liable for any losses (direct or indirect) or damages arising out of or relate to your use of the APIs.
• You understand and agree that said Huawei Parties shall not be liable for any failure to save, modify, delete, or store your information and data generated by your API Clients, or any third-party information.
• In all cases, said Huawei Parties shall not be liable for any expense, loss, or damage that is not reasonably foreseeable.

8.2 Indemnification

Unless prohibited by applicable laws, you shall defend and indemnify said Huawei Parties and Huawei's users from and against any and all liabilities, damages, losses, costs, fees (including legal fees), and expenses relating to any allegation or third-party legal affairs to the extent arising from your violation of your representations, warranties, covenants, and undertakings in the HUAWEI Developers Service Agreement and/or the APIs Agreements, as well as the following:

a. your or your End Users' misuse or illegal use of the APIs;

b. your violation or your End Users' violation of the APIs Agreements;

c. any content or data imported into or used with the APIs by you, those acting on your behalf, or your End Users;

d. your violation of your privacy compliance and cyber security obligations to any third party.

8.3 Procedure for Handling

You understand and agree that Huawei has the right to check for your violations upon its reasonable judgment. You irrevocably accept the results and evidence of any violations (including but not limited to the electronic evidence collected by Huawei and/or its Affiliates through technical means) regarding your use of the APIs. The actions that Huawei takes against your violations in accordance with the APIs Agreements shall not exempt you from the legal liabilities that you shall bear in accordance with the APIs Agreements as well as applicable laws and regulations

If Huawei suspects you to have been in breach of the APIs Agreements, you shall at Huawei's request provide information and/or evidence to explain your suspected breach. If you fail to do so, or if Huawei reasonably believes that you are in breach of the APIs Agreements, Huawei may take one or more of the following measures:

a. block, remove, and/or delete data, algorithms, models, and/or information, or disconnect links;

b. require you to replace and/or modify the content in violation immediately;

c. restrict, suspend, or terminate your use of relevant APIs and/or your Account (including but not limited to suspending some or all of relevant services, and stopping the provision of relevant resources);

d. take other reasonable measures that Huawei deems appropriate.

Contracting Entity

9.1 The Parties hereby acknowledge and agree that, for and only for the Huawei Services in relation to APIs under the APIs Agreements, the content of Clause 14.1 (Distribution Area and Signing Huawei Entity) of the HUAWEI Developers Service Agreement shall be replaced with following content:

"14.1 You may select the countries and/or regions ("Business Area") to display and/or distribute your Products on Huawei Platforms when you use Huawei Services. If you have not displayed and/or distributed your Products when you use Huawei Services, the country or region that you registered in your identity verification profile shall be deemed as your Business Area. However, if you are required to select on a Huawei Platform a storage location of data generated in the use of a Huawei Service integrated in your Product, the storage location you selected shall be deemed as your Business Area in relation to the use of such Huawei Service."

9.2 For the avoidance of doubt, the original Clause 14 of the HUAWEI Developers Service Agreement shall remain unchanged for and still govern any Huawei Services other than those in relation to APIs which are provided under the APIs Agreements.

Governing Law and Dispute Resolution

Please refer to the Clause headed "Governing Law and Dispute Resolution" of the HUAWEI Developers Service Agreement.

Attachment A: EU Standard Contractual Clauses

Standard contractual clauses for the transfer of personal data from the EEA to Third Countries (controller to controller transfers)

This Attachment A shall incorporate the EU Standard Contractual Clauses (Module one, transfer: controller to controller), as further specified above in section 6.1(c)(i), and as set out here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=en

ANNEX I

A.   LIST OF PARTIES

Data exporter(s): 

Name: shall be Aspiegel SE, or the relevant AppTouch Provider listed here (as applicable)

Address: shall be the address of Aspiegel SE (1F, Simmonscourt House, Ballsbridge, Dublin, D04 W9H6, Ireland) or the address of relevant AppTouch Provider, as listed here (as applicable)

Contact person’s name, position and contact details: Joerg Thomas, Director, DPO Office dpo@huawei.com

Activities relevant to the data transferred under these Clauses: provision of the different APIs and the related services provided to the data importer by the data exporter, in particular the processing of Personal Data based on the APIs described under clause 6.1.a of the API’s Agreement.

Signature and date:

Role: Controller

Data importer(s):

Name: your name or, as the case may be, the name of the company you represent

Address: your place of business or, as the case may be, the place of business of the company you represent

Contact person’s name, position and contact details: your contact details and information as you have provided them in context of the AGC services and registration of your Developer account

Activities relevant to the data transferred under these Clauses: use of the different APIs and the related services provided to the data importer by the data exporter, in particular the processing of Personal Data based on the APIs described under clause 6.1.a of the API’s Agreement.

Signature and date:

Role: Controller

B. DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred:

• Data subjects of the data exporter who have signed both the AppGallery and IAP user agreements (or other similar agreements in case the data subject is using the services of AppTouch Provider) and made in-app purchases;
• Data subjects of the data exporter who have signed both the AppGallery and IAP user agreements (or other similar agreements in case the data subject is using the services of AppTouch Provider) and have an active subscription within the importer service.
• Data subjects of the data exporter who have authorized the importer to access their account information (including in relation to the services provided by AppTouch Providers).
• Data subjects of the data exporter who have signed the AppGallery user agreement (or similar agreement in case the data exporter is AppTouch Provider), enabled the Game Service feature and authorized the disclosure to the importer.
• Data subjects of the data exporter who have authorized the importer to access AppGallery Connect information.
• Data subjects of the data exporter who have signed the Agreement on Use of Huawei APIs and authorized the disclosure to the importer.
• Data subjects of the data exporter who have authorized the data exporter to disclose and the data importer to access their location information in relation to the applications or services provided by the data importer.

Categories of personal data transferred:

• Payment information except bank card information, such as the order number, amount, subscription information (subscription ID), and currency (including also in relation to services of AppTouch Providers)
• HUAWEI ID or AppTouch account information (as applicable)
• Game Service data, such as player ID, rankings, achievements, purchases, player stats(including also in relation to services of AppTouch Providers)
• AppGallery Connect data, such as information about HUAWEI ID, team account, contact information, credentials, device commissioning, projects, apps, operational reports, products, and game service configurations.
• Data subject's location (the precision of the GNSS coordinate and relevant location data).
• Geo fence information (regarding whether a user has entered, left, or stayed in a geo fence and related information).

Sensitive data transferred and applied restrictions or safeguards:

N/A

The frequency of the transfer:

The data transfers are triggered by use of the services by the data subjects, in particular by certain action taken by the data subject (such as making an In-App purchase in services of Huawei or AppTouch Providers or logging in with Huawei ID account or AppTouch account information) and may also happen on a continuous basis if e.g. the data subject has enabled some feature (such as enabling location services for the product of the Customer).

Nature of the processing

The data is transferred through the API channels to Customer to enable the provision of the relevant features and services.

Purpose(s) of the data transfer and further processing

•Allow the settlement between data exporter and Developer.

•Allow the management of an active subscription to the data importer service.

•Allow the data subjects to log in on the importer application with their respective accounts and enable importer to provide account functionalities relying on access to data subject's account related information (e.g. access security events for maintaining account security, access basic profile information and address information to create and maintain user profile information, etc.).

•Allow the data subjects to use the Game Service features available on the importer application. Additionally, to allow the importer to improve its service when authorized by the data subjects.

•Allow the data subjects to log in on the importer application with their respective account and enable importer to provide functionalities relying on access to data subject's AppGallery Connect related information (e.g. managing project information, developing and testing apps, submitting applications to be released, viewing operation reports, managing product information, and managing game service configurations, etc.).

•Allow the data importer to provide location-based services and features for the data subjects within the applications or services of the data importer.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

In accordance with the privacy policies and data retention practices of the data importer, subject to the applicable data protection laws.

C.   COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance with Clause 13:

As set out in Section 6 above.

ANNEX II

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

The following measures are the minimum required to be implemented by the data importer on the transferred Personal Data:

• Implement Information Security and Privacy Protection policies and procedures for critical assets and business processes in accordance with relevant laws, regulations and aligned to industry standards like ISO27001 or NIST Cyber Security Framework.
• Regularly assess security controls and risks in your information system(s) to determine if the controls are effective in their application, particularly following major changes, security incidents or data breaches.
• Ability to ensure the ongoing confidentiality, integrity, availability and resilience of Personal Data and systems and services that process the Personal Data.
• Manage supplier relationships including security requirements, SLAs, outsourcing agreements for contracts being used as part of the service provision including data processing agreements in place with the sub-processors you use to deliver the services or products in accordance with the GDPR.
• Perform appropriate background checks on personnel (employees, contractors and third party users) before hiring, when needed and legally permitted.
• All relevant personnel should be adequately and regularly trained on security and privacy protection.
• Manage access to protect personal data and systems or services that process and store personal data from unauthorized access following separation of duties and least privilege principles. Access controls should include identity management, authentication of users incorporating a strong password policy, authorization, accountability, network segregation, regular access reviews (i.e. rights and privileges) and access revocation where access is no longer necessary.
• Implement a strong password policy by enforcing the use of sufficiently complex combinations of characters and numbers, length, enforcing periodic password renewal, restrictions on password reuse, ensure passwords are encrypted and incorporate multi-factor where possible.
• Establish, protect, and maintain the integrity of your network, platforms and services by taking steps to detect and prevent successful security incidents like DDoS, viruses, code injections or other malware that can alter the functionality of the systems, or confidentiality, integrity or availability of information and systems, through industry best practice security controls like malware protection, DDoS protection, IDS/IPS, firewalls, vulnerability scanning, patch management.
• Ensure network and information systems and services are subject to regular security testing (e.g. penetration testing, vulnerability scanning, static and dynamic application security testing), including for major upgrades, to identify vulnerabilities that could expose your service to increased risk of malicious intrusion, modification, and unauthorized access to sensitive data.
• Implement a patch management process to ensure updates are performed on systems with critical and high risk vulnerabilities addressed immediately, with all other system flaws, weaknesses or deficiencies identified, reported and remediated in a timely manner.
• Antivirus software must be loaded and operational on all systems processing personal data. Other malware detection techniques should be used where possible (e.g., email scanning, file system scanning, internet traffic scanning, etc.).
• Assets are inventoried, classified and updated when changes occur (i.e. new systems/software introduced, systems decommissioned).
• Establish change and configuration management procedures for key network and information systems to manage configuration securely.
• Implement network and information systems security event logging and monitoring for the offered service using Security Operations Center (SOC), Security Information and Event Management (SIEM), agents to report anomalous behavior at both network and host level.
• Protect logs against modification or tampering.
• Protect the service infrastructure from unauthorized software being installed.
• Ability to restore the availability and access to the Personal Data in a timely manner in the event of a physical or technical incident (i.e. security incidents and/or data breaches) through effective detection, response and reporting capabilities.
• Provide continuity for the services offered, ability to recover from data loss, protection against compromise, provision of appropriate failover, necessary data retention and an effective data backup policy.
• Use pseudonymisation and encryption to protect the confidentiality of personal data and other sensitive data while in transit or at rest. Encryption should meet industry standard requirements like NIST FIPS 140.
• Ensure personal data removal, deletion and sanitization measures meet appropriate levels of security.
• Service software is developed in a secure way through secure coding practices, following industry best practices (i.e. OWASP Top 10, Secure Coding Standards) including vulnerability analysis.
• Ensure perimeter and internal network protection, maintain physical or logical separation between the perimeter network and internal networks containing personal data. Development and test environments are secured and separated from live production environments.
• Ensure physical security of locations at which personal data is processed including reasonable steps to protect against unauthorized access.
• Devices used for handling Personal Data should not permit data to be written to removable media or to have data read from same nor should they allow printing of Personal data to an unauthorized printer. Such devices should have password protected screensavers implemented and be locked as a matter of course when the user leaves the workstation.
• All important and confidential documentation is removed from the desk and locked away when items are not in use or an employee leaves his/her workstation; and
• Remote access to network and information systems is secured through VPN connection while using devices that have been adequately secured against compromise (e.g. through the use of antivirus software and patching devices with available security fixes)

Attachment B: Data Transfer Agreement

Standard contractual clauses for the transfer of personal data from Singapore to third countries (controller to controller transfers)

This Agreement is made and entered into

Between

Name of data exporting organization: Huawei Services (Hong Kong) Co., Limited ("Huawei")

Address: Room 03, 9/F, Tower 6, the Gateway, No. 9 Canton Road, Tsim Sha Tsui, Kowloon, Hong Kong.

Company registration number: 1451551

and/or relevant AppTouch Provider outside both EU/EEA and Russia

hereinafter "data exporter"

And

Developer who signed the Agreement on Use of Huawei APIs with Huawei and part of the Agreement

hereinafter "data importer"

each a "party"; together "the parties".

Definitions

For the purposes of the clauses:

(a) "individual", "personal data", "processing" shall have the same meaning as in Personal Data Protection Act (No. 26 of 2012) of Singapore;

(b) "Data Exporter" shall mean the organization who transfers the personal data;

(c) "Data Importer" shall mean the organization who agrees to receive in a country or territory outside Singapore the personal data transferred to it by or on behalf of the Data Exporter for processing in accordance with the terms of theses clauses;

(d) "Data Subject" shall mean the Data Subject that is particularly described in Annex B herein below;

(e) "clauses" shall mean these contractual clauses, which are a free-standing document that does not incorporate commercial business terms established by the parties under separate commercial arrangements.

(f) "PDPA" shall mean the Personal Data Protection Act (No. 26 of 2012) of Singapore.

The details of the transfer (as well as the personal data covered) are specified in Annex B, which forms an integral part of the clauses.

I. Obligations of the Data Exporter

The Data Exporter warrants and undertakes that:

(a) The personal data has been collected, processed and transferred in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the country where the Data Exporter is established).

(b) It has used reasonable efforts to determine that the Data Importer is able to satisfy its legal obligations under these clauses.

(c) It will provide the Data Importer, when so requested, with copies of relevant data protection laws or references or any requirements set out in any advisory or other guidelines issued from time to time by Personal Data Protection Commission of Singapore ("PDPC") to them (where relevant, and not including legal advice).

(d) It will respond to enquiries from Data Subjects and the authority concerning processing of the personal data by the Data Importer, unless the parties have agreed that the Data Importer will so respond, in which case the Data Exporter will still respond to the extent reasonably possible and with the information reasonably available to it if the Data Importer is unwilling or unable to respond. Responses will be made within a reasonable time.

(e) It will make available, upon request, a copy of the clauses to Data Subjects who are third-party beneficiaries under clause III, unless the clauses contain confidential information, in which case it may remove such information. Where information is removed, the Data Exporter shall inform Data Subjects in writing of the reason for removal and of their right to draw the removal to the attention of the authority. However, the Data Exporter shall abide by a decision of the authority regarding access to the full text of the clauses by Data Subjects, as long as Data Subjects have agreed to respect the confidentiality of the confidential information removed. The Data Exporter shall also provide a copy of the clauses to the authority where required.

II. Obligations of the Data Importer

The Data Importer warrants and undertakes that:

(a) It will have in place appropriate technical and organizational measures to provide a standard of protection, which is comparable to the protection required by the PDPA and any requirements set out in any advisory or other guidelines issued from time to time by the PDPC, to the personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, and which provide a level of security appropriate to the risk represented by the processing and the nature of the data to be protected.

(b) It will have in place procedures so that any third party it authorizes to have access to the personal data, including processors, will respect and maintain the confidentiality and security of the personal data. Any person acting under the authority of the Data Importer, including a data processor shall be obligated to process the personal data only on instructions from the Data Importer. This provision does not apply to persons authorized or required by law or regulation to have access to the personal data.

(c) It has no reason to believe, at the time of entering into these clauses, in the existence of any local laws that would have a substantial adverse effect on the guarantees provided for under these clauses, and it will inform the Data Exporter if it becomes aware of any such laws.

(d) It will process the personal data for purposes described in Annex B, and has the legal authority to give the warranties and fulfill the undertakings set out in these clauses.

(e) It will identify to the Data Exporter a contact point within its organization authorized to respond to enquiries concerning processing of the personal data, and will cooperate in good faith with the Data Exporter, the Data Subject and the authority concerning all such enquiries within a reasonable time. In case of legal dissolution of the Data Exporter, or if the parties have so agreed, the Data Importer will assume responsibility for compliance with the provisions of clause I(e).

(f) At the request of the Data Exporter, it will provide the Data Exporter with evidence of financial resources sufficient to fulfill its responsibilities under clause III (which may include insurance coverage).

(g) Upon reasonable request of the Data Exporter, it will submit its data processing facilities, data files and documentation needed for processing to reviewing, auditing and/or certifying by the Data Exporter (or any independent or impartial inspection agents or auditors, selected by the Data Exporter and not reasonably objected to by the Data Importer) to ascertain compliance with the warranties and undertakings in these clauses, with reasonable notice and during regular business hours. The request will be subject to any necessary consent or approval from a regulatory or supervisory authority within the country of the Data Importer, which consent or approval the Data Importer will attempt to obtain in a timely fashion.

(h) It will process the personal data, in accordance with:

(i) The data protection laws of Singapore, and the relevant regulations, provisions or other requirements issued by PDPC; and

(ii) The data processing principles set forth in Annex A.

(i) It will not disclose or transfer the personal data to a third-party organization located outside Singapore unless with prior consent of the Data Exporter on the transfer and

(1) The third-party organization processes the personal data in accordance with requirements prescribed under PDPA finding that the third-party organization provides a standard of protection to personal data so transferred that is comparable to the protection under PDPA;

(2) Data subjects have been given the opportunity to object, after having been informed of the purposes of the transfer, the categories of recipients and the fact that the countries to which data is exported may have different data protection standards.

III. Liability and third party rights

(a) The Data Importer shall be liable to the Data Exporter for damages it causes by any breach of these clauses. Liability as between the parties is including but not limited to actual damage suffered and penalties imposed by government or local authority. The Data Importer shall be liable to Data Subjects for damages it causes by any breach of third party rights under these clauses. This does not affect the liability of the Data Exporter under its data protection law.

(b) The parties agree that a Data Subject shall have the right to enforce as a third-party beneficiary this clause and clauses I(b), I(d), I(e), II(a), II(d), II(e), II(h), II(i), III(a), V, VI(d) and VII against the Data Importer or the Data Exporter, for their respective breach of their contractual obligations, with regard to his personal data, and accept jurisdiction for this purpose in the Data Exporter's country of establishment. In cases involving allegations of breach by the Data Importer, the Data Subject must first request the Data Exporter to take appropriate action to enforce his rights against the Data Importer, if the Data Exporter does not take such action within a reasonable period (which under normal circumstances would be one month), the Data Subject may then enforce his rights against the Data Importer directly. A Data Subject is entitled to proceed directly against a Data Exporter that has failed to use reasonable efforts to determine that the Data Importer is able to satisfy its legal obligations under these clauses (the Data Exporter shall have the burden to prove that it took reasonable efforts).

IV. Law applicable to the clauses

These clauses shall be governed by the laws of Singapore.

V. Resolution of disputes with Data Subjects or the authority

(a) In the event of a dispute or claim brought by a Data Subject or the authority concerning the processing of the personal data against either or both of the parties, the parties will inform each other about any such disputes or claims, and will cooperate with a view to settling them amicably in a timely fashion.

(b) The parties agree to respond to any generally available non-binding mediation procedure initiated by a Data Subject or by the authority. If they do participate in the proceedings, the parties may elect to do so remotely (such as by telephone or other electronic means). The parties also agree to consider participating in any other arbitration, mediation or other dispute resolution proceedings developed for data protection disputes.

(c) Each party shall abide by a decision of a competent court of Singapore or of the authority which is final and against which no further appeal is possible.

VI. Termination

(a) In the event that the Data Importer is in breach of its obligations under these clauses, then the Data Exporter may temporarily suspend the transfer of personal data to the Data Importer until the breach is repaired or the contract is terminated.

(b) In the event that:

(i) The transfer of personal data to the Data Importer has been temporarily suspended by the Data Exporter for longer than one month pursuant to paragraph (a);

(ii) Compliance by the Data Importer with theses clauses would put it in breach of its legal or regulatory obligations in the country of import;

(iii) The Data Importer is in substantial or persistent breach of any warranties or undertakings given by it under these clauses;

(iv) A final decision against which no further appeal is possible of a competent court of Singapore or of the authority rules that there has been a breach of the clauses by the Data Importer or the Data Exporter; or

(v) A petition is presented for the administration or winding up of the Data Importer, whether in its personal or business capacity, which petition is not dismissed within the applicable period for such dismissal under applicable law; a winding up order is made; a receiver is appointed over any of its assets; a trustee in bankruptcy is appointed, if the Data Importer is an individual; a company voluntary arrangement is commenced by it; or any equivalent event in any jurisdiction occurs then the Data Exporter, without prejudice to any other rights which it may have against the Data Importer, shall be entitled to terminate these clauses, in which case the authority shall be informed where required. In cases covered by (i), (ii), or (iv) above the Data Importer may also terminate these clauses.

(c) Either party may terminate these clauses if (i) any Commission positive adequacy decision under Singapore PDPA 2012 (or any superseding text) is issued in relation to the country (or a sector thereof) to which the data is transferred and processed by the Data Importer, or any superseding text becomes directly applicable in such country.

(d) The parties agree that the termination of these clauses at any time, in any circumstances and for whatever reason (except for termination under clause VI(c)) does not exempt them from the obligations and/or conditions under the clauses as regards the processing of the personal data transferred.

VII. Variation of these clauses

The parties may not modify these clauses except to update any information in Annex B, in which case they will inform the authority where required. This does not preclude the parties from adding additional commercial clauses where required.

VIII. Description of the Transfer

The details of the transfer and of the personal data are specified in Annex B. The parties agree that Annex B may contain confidential business information which they will not disclose to third parties, except as required by law or in response to a competent regulatory or government agency, or as required under Clause I(e). The parties may execute additional annexes to cover additional transfers, which will be submitted to the authority where required. Annex B may, in the alternative, be drafted to cover multiple transfers.

ANNEX A to the Data Transfer Agreement

DATA PROCESSING PRINCIPLES

1. Purpose limitation: Personal data may be processed and subsequently used or further communicated only for purposes described in Annex B or subsequently authorized by the Data Subject.

2. Data quality and proportionality: Personal data must be accurate and, where necessary, kept up to date. The personal data must be adequate, relevant and not excessive in relation to the purposes for which they are transferred and further processed.

3. Transparency: Data subjects must be provided with information necessary to ensure fair processing (such as information about the purposes of processing and about the transfer), unless such information has already been given by the Data Exporter.

4. Security and confidentiality: Technical and organizational security measures must be taken by the organization that are appropriate to the risks, such as against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, presented by the processing. Any person acting under the authority of the organization, including a processor, must not process the data except on instructions from the Data Exporter.

5. Rights of access, correction and objection: As provided under the PDPA, Data Subjects must, whether directly or via a third party, be provided with the personal information about them that an organization holds, except for requests which are manifestly abusive, based on unreasonable intervals or their number or repetitive or systematic nature, or for which access need not be granted under the law of the country of the Data Exporter. Provided that the authority has given its prior approval, access need also not be granted when doing so would be likely to seriously harm the interests of the Data Importer or other organizations dealing with the Data Importer and such interests are not overridden by the interests for fundamental rights and freedoms of the Data Subject. The sources of the personal data need not be identified when this is not possible by reasonable efforts, or where the rights of persons other than the individual would be violated. Data subjects must be able to have the personal information about the rectified, amended where it is inaccurate or processed against these principles. If there are compelling grounds to doubt the legitimacy of the request, the organization may require further justifications before proceeding to rectification, amendment. Notification of any rectification, amendment to third parties to whom the data has been disclosed need not be made when this involves a disproportionate effort. A Data Subject must also be able to object to the processing of the personal data relating to him if there are compelling legitimate grounds relating to his particular situation.

6. Data used for marketing purposes: Where data is processed for the purposes of direct marketing, effective procedures should exist allowing the Data Subject at any time to "opt-out" from having his data used for such purposes.

7. Automated decisions: For purposes hereof "automated decision" shall mean a decision by the Data Exporter or the Data Importer which produces legal effects concerning a Data Subject or significantly affects a Data Subject and which is based solely on automated processing of personal data intended to evaluate certain personal aspects relating to him, such as his performance at work, creditworthiness, reliability, conduct, etc. The Data Importer shall not make any automated decisions concerning Data Subjects, except when:

(a) (i) such decisions are made by the Data Importer in entering into or performing a contract with the Data Subject, and

(ii) the Data Subject is given an opportunity to discuss the results of a relevant automated decision with a representative of the parties making such decision or otherwise to make representations to that parties.

Or

(b) Where otherwise provided by the law of the Data Exporter.

ANNEX B to the Data Transfer Agreement

DESCRIPTION OF THE TRANSFER

Data subjects

The personal data transferred concern the following categories of data subjects:

•Data subjects of the data exporter who have signed both the AppGallery and IAP user agreements and made in-app purchases;

•Data subjects of the data exporter who have signed both the AppGallery and IAP user agreements and have an active subscription within the importer service.

•Data subjects of the data exporter who have authorized the importer to access their respective account information.

•Data subjects of the data exporter who have signed the AppGallery user agreement, enabled the Game Service feature and authorized the disclosure to the importer.

•Data subjects of the data exporter who have authorized the importer to access AppGallery Connect information.

•Data subjects of the data exporter who have signed the Agreement on Use of Huawei APIs and authorized the disclosure to the importer.

•Data subjects of the data exporter who have authorized the data exporter to disclose and the data importer to access their location information in relation to the applications or services provided by the data importer.

Purposes of the transfer(s)

The transfer is made for the following purposes:

•Allow the settlement between Exporter and Developer.

•Allow the management of an active subscription to the importer service.

•Allow the data subjects to log in on the importer application with their respective accounts and enable importer to provide account functionalities relying on access to data subject's account related information (e.g. access security events for maintaining account security, access basic profile information and address information to create and maintain user profile information, etc.).

•Allow the data subjects to use the Game Service features available on the importer application. Additionally, to allow the importer to improve its service when authorized by the data subjects.

•Allow the data subjects to log in on the importer application with their respective accounts and enable importer to provide functionalities relying on access to data subject's AppGallery Connect related information (e.g. managing project information, developing and testing apps, submitting applications to be released, viewing operation reports, managing product information, and managing game service configurations, etc.).

•Allow the data importer to provide location-based services and features for the data subjects within the applications or services of the data importer.

Categories of data

The personal data transferred concern the following categories of data:

•Payment information except bank card information, such as the order number, amount, subscription information (subscription ID), and currency.

•HUAWEI ID or relevant AppTouch account information (as applicable).

•Game Service data, such as player ID, rankings, achievements, purchases, player stats.

•AppGallery Connect data, such as information about HUAWEI ID, team account, contact information, credentials, device commissioning, projects, apps, operational reports, products, and game service configurations.

•Data subject's location (the precision of the GNSS coordinate and relevant location data).

•Geo fence features (regarding whether a user has entered, left, or stayed in a geo fence and relevant information).

Recipients

The personal data transferred may be disclosed only to the following recipients or categories of recipients:

•Data importer

Sensitive data (if appropriate)

The personal data transferred concern the following categories of sensitive data:

N/A

Data protection registration information of data exporter (where applicable)

N/A

Additional useful information (storage limits and other relevant information)

Contact points for data protection enquiries

Data importer Data exporter

Place Data Protection Contact here Huawei: privacy_hshk@huawei.com

AppTouch Provider: AppTouch Provider DPO

Attachment C: Data Transfer Agreement in Compliance with Russian Legislation

This Agreement is made and entered into

between

Name of data exporting organization

Shenzhen Huawei Siray Technologies Co., Ltd (

Room 501, Building A1 No. 1 Jingyue Road, Jiulongshan Community Fucheng Subdistrict, Longhua District Shenzhen, Guangdong China) ("Huawei")

and/or relevant AppTouch Provider in Russia

hereinafter "data exporter"

And

Developer who signed the Agreement on Use of Huawei APIs with Huawei and part of the Agreement, hereinafter "data importer",

each a "party" and together "the parties".

Each of the parties is a personal data operator, including personal data processed as part of the fulfillment of obligations provided within the Agreement on Use of Huawei APIs.

For the purposes of the Agreement, personal data refers to information that is in accordance with the legislation of the Russian Federation, to be transferred by data exporter to data importer and includes the following data:

•Payment information except bank card information, such as the order number, amount, subscription information (subscription ID), and currency.

•HUAWEI ID or AppTouch account information (as applicable).

•Game Service data, such as player ID, rankings, achievements, purchases, player stats.

•AppGallery Connect data, such as information about HUAWEI ID, team account, contact information, credentials, device commissioning, projects, apps, operational reports, products, and game service configurations.

•Data subject's location (the precision of the GNSS coordinate and relevant location data).

•Geo fence features (regarding whether a user has entered, left, or stayed in a geo fence and relevant information).

The personal data transferred concern the following categories of data subjects:

•Data subjects who have signed both the AppGallery and IAP user agreements and made in-app purchases;

•Data subjects who have signed both the AppGallery and IAP user agreements and have an active subscription within service of data importer.

•Data subjects who have authorized data importer to access their respective account information.

•Data subjects who have signed the AppGallery user agreement, enabled the Game Service feature and authorized the disclosure to data importer.

•Data subjects who have authorized data importer to access AppGallery Connect information.

•Data subjects who have signed the Agreement on Use of Huawei APIs and authorized the disclosure to data importer.

The transfer is made for the following purposes:

•Allow the settlement between data exporter and Developer.

•Allow the management of an active subscription to data importer's service.

•Allow the data subjects to log in on data importer's application with their respective accounts and enable data importer to provide account functionalities relying on access to data subject's account related information (e.g. access security events for maintaining account security, access basic profile information and address information to create and maintain user profile information, etc.).

•Allow the data subjects to use the Game Service features available on data importer's application. Additionally, to allow data importer to improve its service when authorized by the data subjects.

•Allow the data subjects to log in on data importer's application with their respective accounts and enable data importer to provide functionalities relying on access to data subject's AppGallery Connect related information (e.g. managing project information, developing and testing apps, submitting applications to be released, viewing operation reports, managing product information, and managing game service configurations, etc.).

•Allow the data importer to provide location-based services and features for the data subjects within the applications or services of the data importer.

The transfer of personal data is not considered by the Parties as an instruction to process personal data.

Each of the parties shall ensure the confidentiality of personal data received within the framework of the Agreement, compliance with the requirements for personal data processing established by Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" and regulatory acts adopted in its execution, and shall be responsible for taking all necessary legal, organizational and technical measures to protect personal data from unauthorized or accidental access to them, destruction, modification, blocking, copying, dissemination of personal data as well as other illegal actions such data.

The party that provides personal data shall be responsible for the legality and accuracy of provided data to other party for the purpose of executing the Agreement, as well as for obtaining the consent of the data subjects to transfer their personal data to the other party in the manner prescribed by the legislation of the Russian Federation personal data.

The party that received personal data from the other party does not assume the obligation to inform the data subjects whose personal data has been transferred about the beginning of their processing, since the party that transfers personal data must bear the obligation to inform the data subjects accordingly.

The party receiving personal data has the right to engage in processing the received personal data of third parties for the purpose of executing the Agreement in the necessary volume only if the other party provides confirmation of receipt of the relevant consent from the personal data subject. In any case, a party is obliged, upon the request of the other party, to provide information about third parties who were provided with personal data or who had access to them: their full and abbreviated names, address of the location (place of registration and residence), information about which particular personal data what particular subjects and for what purposes were transferred to third parties.