Click to download HUAWEI Health Kit Service Agreement.

The following terms (hereinafter referred to as this "Agreement") constitute a legally binding agreement between you and Huawei regarding the HUAWEI Health Kit Service. It is a supplementary agreement to the Agreement on Use of Huawei APIs signed by and between you and Huawei, which is itself supplementary to the HUAWEI Developers Service Agreement. This Agreement stipulates your legal rights and obligations when using the HUAWEI Health Kit Service. By checking the box next to "I have read and agreed" in the AppGallery Connect agreement pop-up window to agree to all applicable agreements to AppGallery Connect services (including this Agreement), or by checking the box next to "I have read and agreed to HUAWEI Health Kit Service Agreement" below this Agreement, or by using the HUAWEI Health Kit Service under this Agreement, it shall be deemed that you have fully understood and accepted the terms of this Agreement, the HUAWEI Developers Service Agreement, and the Agreement on Use of Huawei APIs as of the date of your such acceptance and use ("Effective Date"). Any and all matters unaccomplished herein shall be subject to the HUAWEI Developers Service Agreement and the Agreement on Use of Huawei APIs. If you do not agree to this Agreement, the HUAWEI Developers Service Agreement, or the Agreement on Use of Huawei APIs, you shall stop using the services under the respective agreement(s).

1. Definition

Unless otherwise specified in this Agreement, the terms in this Agreement shall have the same meaning as those in the HUAWEI Developers Service Agreement and the Agreement on Use of Huawei APIs. Unless otherwise stated, the following terms are defined herein as below:

1.1 HUAWEI Health Kit Service (hereinafter referred to as this "Service") is a health and fitness data platform service that enables you to read and write (collectively referred to as "manage") End-User Data.

1.2 End-User Data means the health and fitness data of End Users, which may include the following data:

• Personal Information, including height and weight, and workout goals.

• Fitness data, including step count, exercise distance and altitude change, speed, calories burnt, activity data, location data, and sports ability indexes (including running ability, training, fatigue, physical fitness, and status indexes).

• Health data, including body fat percentage, BMI, muscle mass, water percentage, visceral fat level, sleep data, heart rate data, stress level, and nutrition data.

• Restricted health data, including heart health data (such as HRV and ECG), blood glucose, blood pressure, oxygen saturation, body temperature, reproductive data, and urinalysis results (including uric acid, nitrite, urobilinogen, bilirubin, and glucose values).

• Event data, including fall down data.

1.3 "EU SCC" means the standard contractual clauses issued by the European Commission by implementing decision 2021/914 of June 4, 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.

1.4 “UK Addendum” means the addendum to the EU SCC issued by the UK Information Commissioner under Section 119A(1) of the UK Data Protection Act 2018 (version B1.0, in force March 21, 2022, as amended, available here: https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf).

2. Rights and Obligations

2.1 Your rights and obligations

(1) You can use the APIs, SDKs, and websites of this Service to manage your End-User Data for users of your services, but you can only use this Service in services developed by you. Huawei has assigned app IDs and app secrets to your services in order to identify your apps. You hereby agree not to share with any third party the app IDs and app secrets assigned to you by the HUAWEI Developers website.

(2) Before you upload any End-User Data to this Service platform, you must warrant that your collection, use, transmission, and processing of such data conforms to all applicable laws, including but not limited to data protection laws.

(3) You hereby undertake to provide legitimate products that work stably and submit authentic and accurate information in order to ensure a good user experience. You are solely liable for any customer complaints, claims, and relevant issues caused by a negative user experience. You shall indemnify and hold Huawei and its affiliates harmless against and from any and all losses incurred by your actions or products. Huawei reserves the right to protect user rights and interests. You are obligated to cooperate with Huawei to settle any queries, disputes, or complaints concerning the functions, usage methods, and data charges of your products.

(4) You hereby undertake not to abuse your access to this Service. Any data you acquire from this Service will not be used for advertising, sponsorships, or other unauthorized purposes, be sold to or shared with any agency or individual, or be used for purposes not consented by you or the End Users. Any data you acquire from this Service should be encrypted for storage to prevent End-User Data leakage.

(5) You should ensure that Huawei understands the usage scenarios for your services so that Huawei can provide targeted solutions for your services.

(6) HUAWEI Health Kit is not intended to be a medical or scientific device, and the accuracy and reliability of the data collected and stored in this Service cannot not be used for medical purposes. You may not use this Service in connection with any product or service that may qualify as a medical or scientific device.

(7) This Service is not available in all countries/regions and its availability in any particular location is not guaranteed. You shall define the scope of use of this Service independently and accept responsibility for complying with any and all applicable laws, including but not limited to any local laws, in particular laws for protecting End-User Data. You are responsible for acquiring all necessary qualifications and obtaining consent from your users as required by local laws.

(8) You can only change the data interconnection range if you submit an application to Huawei at least thirty (30) days in advance and receive the approval of Huawei.

2.2 Huawei's rights and obligations

(1) Huawei will not process End-User Data for any purposes other than making it available for the Huawei Health app and third-party health and fitness apps and services for storage and access based on all agreements applicable to AppGallery Connect services (including this Agreement) and End Users' prior consent. Therefore, you are solely responsible for the subsequent processing of End-User Data obtained from this Service and Huawei will not be liable for any consequences. You hereby acknowledge that to allow End Users to access the End-User Data from your services, obtain a copy of such End-User Data after signing in to their HUAWEI ID, and erase the data by withdrawing their consent, Huawei needs to process the End-User Data to the extent necessary for providing End Users with these functions.

(2) Huawei reserves the right to update the APIs and SDKs of this Service at its own discretion. Huawei follows the principles of software design to ensure compatibility to the greatest extent possible. However, under certain circumstances, you may need to modify or update your apps or services before you can use the updated APIs and SDKs. All costs incurred in such cases shall be borne by you.

(3) If Huawei has reason to believe that you are managing End-User Data through this Service in a way that violates any relevant laws or regulations, or any of the terms of this Agreement, Huawei reserves the right to deny your access to or restrict your use of this Service.

(4) Huawei may collect necessary records about the API invocation while you are using this Service, which includes the API invocation time, user ID, module name, API name, response delay, response result, Health Kit version, app ID, and event ID. The data is only used for service analysis and improvement purposes.

(5) If this Service needs to be suspended for system maintenance or for API, SDK, or website updates, Huawei shall, to the best of its ability, notify you on its website in advance. Huawei does not guarantee to provide this Service without interruptions or delays, and shall not be liable for any losses caused by system maintenance and API, SDK, and website updates.

(6) Huawei reserves the right to remove the HUAWEI Health Kit from your products after this Agreement is terminated. You need to delete or retain user data obtained from the Huawei platform based on users' consent.

(7) Huawei reserves the right to promote your products which have integrated this Service. Huawei reserves the right to make final decisions on product promotions.

3. Privacy

3.1 Huawei processes the End-User Data as a data processor, in accordance with the AppGallery Connect Data Processing Addendum, which is an integral part of this Agreement and the HUAWEI Developers Service Agreement. In addition, Huawei processes End-User Data in Huawei Health app, which you may read from Huawei Health app using the Service, as data controller.

3.2 When you write and/or read End-User Data through the Service, you are conducting it as an independent data controller. When you read End-User Data from Huawei Health app, the reading is considered as a data controller to data controller data disclosure from Huawei to you.

3.3 You shall write and read End-User Data only based on users' explicit authorization.

3.4 You acknowledge that other apps and services may be able to read End-User Data in the Service that originates from your app or service, if authorized by End Users.

3.5 When Aspiegel SE is providing the Service to you, and (i) your app is reading End-User Data, including any data from Huawei Health app, and (ii) you are a data controller established outside European Union/European Economic Area to any country not recognized by the European Union Commission as providing an adequate level of protection for personal data, the EU SCC (controller-to-controller) (Attachment 1) shall be an integral part of this Agreement and apply to you as "data importer" in relation to any such read End-User Data. Similarly, when you write End-User Data, the data may be accessed by other developers that are established outside European Union/European Economic Area to a country not recognized by the European Union Commission as providing an adequate level of protection for personal data. In such a scenario, you shall be considered as a "data exporter" in relation to all End-User Data written by your app or service through the Service. Parties agree that:

• the relevant module of the EU SCC is “MODULE ONE: Transfer controller to controller”;
• in clause 11, the Parties do not choose the optional complaint mechanism;
• in clause 17, the Parties choose Option 1 and the governing law shall be Irish law;
• in clause 18, the Parties choose the courts of Ireland;
• the competent supervisory authority referred to in clause 13 shall be the supervisory authority of Ireland;
• in case of discrepancy with any provision in other Agreements, the EU Standards Contractual Clauses shall prevail.
• The scope and nature of the transfer is further set out in the Section B of Annex I later in this document.

To the extent that the data protection laws of the UK apply to the transfer of personal data under this Agreement, the Parties execute the UK Addendum which is incorporated into this Agreement and applies to transfers of personal data outside the UK (except for cases where such data is transferred to a country within the EU/EEA or to another country recognized as adequate in terms of level of data protection by the UK). Part 1 of the UK Addendum is completed as follows: (i) in Table 1, the “Exporter” is Huawei and you are the “Importer”, their details are set forth in this Agreement; (ii) in Table 2, the first option is selected and the “Approved EU SCCs” are the EU SCC referred to in Section 3.5 above; (iii) in Table 3, the information is as provided in Annex I (A and B) and Annex II to the “Approved EU SCCs” (as set out in Attachment 1 of this Agreement); and (iv) in Table 4, the “Exporter” can terminate the UK Addendum.

3.6 If your signing entity under the HUAWEI Developers Service Agreement is Huawei Services (Hong Kong) Co., Limited and distribution area of your API client is not Russia, and your data receiving servers are located outside of Singapore, you shall conform to the Data Transfer Agreement as provided in Attachment 2, which applies to such personal data disclosures from Huawei Services (Hong Kong) Co., Limited to you.

3.7 You shall have a publicly stated privacy policy in compliance with applicable laws and regulations. The privacy policy shall be displayed prominently in your app or service. You must disclose clearly how End-User Data will be used as a consequence of End User giving consent on your app.

3.8 You warrant and undertake to ensure that Personal Data of End Users are only collected and used for the limited purpose which is deemed to be necessary and processed lawfully in accordance with applicable laws, and only retained for the minimum necessary period. Personal Data in your possession shall be kept safe and secure from any actual or potential abuse.

4. Termination of This Agreement

4.1 If either Party terminates the HUAWEI Developers Service Agreement or the Agreement on Use of Huawei APIs, this Agreement shall automatically terminate on the same day.

4.2 You may terminate this Agreement by disabling this Service for all your apps.

4.3 If Huawei decides to discontinue this Service or make major changes to it, Huawei reserves the right to terminate this Agreement after informing you in advance.

4.4 Termination of this Agreement does not entail automatic termination of the HUAWEI Developers Service Agreement and the Agreement on Use of Huawei APIs, signed by and between you and Huawei.

5. Distribution Area and Signing Huawei Entity

You acknowledge and agree that the provisions regarding the distribution area and the signing Huawei entity under this Agreement shall be subject to the Clause of "Contracting Entity" in the Agreement on Use of Huawei APIs.

6. Governing Law and Dispute Resolution

You acknowledge and agree that the provisions regarding the governing law and dispute resolution under this Agreement shall be subject to the Clause of "Governing Law and Dispute Resolution" in the HUAWEI Developers Service Agreement.

Attachment 1

STANDARD CONTRACTUAL CLAUSES

Controller to Controller

This Attachment 1 shall incorporate the EU SCC (Module one, transfer: controller to controller), as further specified above in section 3.5, and as set out here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=en .

APPENDIX

ANNEX I

A.   LIST OF PARTIES

Data exporter(s): 

Name: Aspiegel SE

Address: 3rd Floor, Mespil Court, Mespil Road, Ballsbridge, Dublin 4, D04 E516, Ireland

Contact person’s name, position and contact details: Joerg Thomas, Director, DPO Office, dpo@huawei.com

Activities relevant to the data transferred under these Clauses: Detailed in Annex I B

Signature and date: ___________________________________________________

Role (controller/processor): controller

Data importer(s): 

Name: Developer who signed the Agreement on Use of Huawei APIs

Name: your name or, as the case may be, the name of the company you represent

Address: your place of business or, as the case may be, the place of business of the company you represent.

Contact person’s name, position and contact details: our contact details and information as you have provided them in context of the Agreement and you Developer account

Activities relevant to the data transferred under these Clauses: Detailed in Annex I B

Signature and date: ___________________________________________________

Role (controller/processor): controller

B.   DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred

End-User's who have authorized reading and writing of their health and fitness data via Health Kit service.

Categories of personal data transferred

End-User Data as defined in Agreement.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

End-User's health and fittness data.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

After End-User has authorized data sharing between apps, the transfer is continuous in nature.

Nature of the processing

Data sharing between fitness and health apps.

Purpose(s) of the data transfer and further processing

Enable End-Users to read and write health and fittness data between different apps based on their authorization.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

Determined by each app separately. End-User may stop the data sharing at any point.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

N/A

C.   COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance with Clause 13

Irish Data Protection Commission

ANNEX II

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

• Implement Information Security and Privacy Protection policies and procedures for critical assets and business processes in accordance with relevant laws, regulations and aligned to industry standards like ISO27001 or NIST Cyber Security Framework.
• Regularly assess security controls and risks in your information system(s) to determine if the controls are effective in their application, particularly following major changes, security incidents or data breaches. Provide independent assurance (i.e. external audit with industry standard accreditation like ISO27001 or internal audit) of processes and products.
• Ability to ensure the ongoing confidentiality, integrity, availability and resilience of Personal Data and systems and services that process the Personal Data.
• Manage supplier relationships including security requirements, SLAs, outsourcing agreements for contracts being used as part of the service provision including data processing agreements in place with the sub-processors you use to deliver the services or products in accordance with the GDPR.
• Perform appropriate background checks on personnel (employees, contractors and third party users) before hiring, when needed and legally permitted.
• All relevant personnel should be adequately and regularly trained on security and privacy protection. Developers and Content Providers with access to sensitive data are adequately trained to understand their data protection responsibilities.
• Manage access to protect personal data and systems or services that process and store personal data from unauthorized access following separation of duties and least privilege principles. Access controls should include identity management, authentication of users incorporating a strong password policy, authorization, accountability, network segregation, regular access reviews (i.e. rights and privileges) and access revocation where access is no longer necessary. Higher data classification access requires Multi-Factor Authentication.
• Implement a strong password policy by enforcing the use of sufficiently complex combinations of characters and numbers, length, enforcing periodic password renewal, restrictions on password reuse, ensure passwords are encrypted and incorporate multi-factor where possible.
• Establish, protect, and maintain the integrity of your network, platforms and services by taking steps to detect and prevent successful security incidents like DDoS, viruses, code injections or other malware that can alter the functionality of the systems, or confidentiality, integrity or availability of information and systems, through industry best practice security controls like malware protection, DDoS protection, IDS/IPS, firewalls, vulnerability scanning, patch management.
• Ensure network and information systems and services are subject to regular security testing (e.g. penetration testing, vulnerability scanning, static and dynamic application security testing), including for major upgrades, to identify vulnerabilities that could expose your service to increased risk of malicious intrusion, modification, and unauthorized access to sensitive data.
• Implement a patch management process to ensure updates are performed on systems with critical and high risk vulnerabilities addressed immediately, with all other system flaws, weaknesses or deficiencies identified, reported and remediated in a timely manner.
• Antivirus software must be loaded and operational on all systems processing personal data. Other malware detection techniques should be used where possible (e.g., email scanning, file system scanning, internet traffic scanning, etc.).
• Assets are inventoried, classified and updated when changes occur (i.e. new systems/software introduced, systems decommissioned).
• Establish change and configuration management procedures for key network and information systems to manage configuration securely.
• Implement network and information systems security event logging and monitoring for the offered service using Security Operations Center (SOC), Security Information and Event Management (SIEM), agents to report anomalous behavior at both network and host level.
• Protect logs against modification or tampering.
• Protect the service infrastructure from unauthorized software being installed.
• Ability to restore the availability and access to the Personal Data in a timely manner in the event of a physical or technical incident (i.e. security incidents and/or data breaches) through effective detection, response and reporting capabilities.
• Provide continuity for the services offered, ability to recover from data loss, protection against compromise, provision of appropriate failover, necessary data retention and an effective data backup policy.
• Use pseudonymisation and encryption to protect the confidentiality of personal data and other sensitive data while in transit or at rest. Encryption should meet industry standard requirements like NIST FIPS 140.
• Ensure personal data removal, deletion and sanitization measures meet appropriate levels of security.
• Service software is developed in a secure way through secure coding practices, following industry best practices (i.e. OWASP Top 10, Secure Coding Standards) including vulnerability analysis.
• Ensure perimeter and internal network protection, maintain physical or logical separation between the perimeter network and internal networks containing personal data. Development and test environments are secured and separated from live production environments.
• Ensure physical security of locations at which personal data is processed including reasonable steps to protect against unauthorized access.
• Devices used for handling Personal Data should not permit data to be written to removable media or to have data read from same nor should they allow printing of Personal data to an unauthorized printer. Such devices should have password protected screensavers implemented and be locked as a matter of course when the user leaves the workstation.
• All important and confidential documentation is removed from the desk and locked away when items are not in use or an employee leaves his/her workstation
• Remote access to network and information systems is secured through VPN connection while using devices that have been adequately secured against compromise (e.g. through the use of antivirus software and patching devices with available security fixes); and
• Any mobile devices such as laptops, tablets and phones that are used for processing should have either full disk encryption or folder/file level encryption covering the location of the Personal Data.

Attachment 2

Data Transfer Agreement

Standard contractual clauses for the transfer of personal data from Singapore to third countries (controller to controller transfers)

This Agreement is made and entered

Between

Name of data exporting organization: Huawei Services (Hong Kong) Co., Limited ("Huawei")

Address: Room 03, 9/F, Tower 6, the Gateway, No. 9 Canton Road, Tsim Sha Tsui,Kowloon, Hong Kong.

Company registration number: 1451551

hereinafter "data exporter"

And

Developer who signed the Agreement on Use of Huawei APIs with Huawei and part of the Agreement

hereinafter "data importer"

each a "party"; together "the parties".

Definitions

For the purposes of the clauses:

(a) "individual", "personal data", "processing" shall have the same meaning as in Personal Data Protection Act (No. 26 of 2012) of Singapore;

(b) "Data Exporter" shall mean the organization who transfers the personal data;

(c) "Data Importer" shall mean the organization who agrees to receive in a country or territory outside Singapore the personal data transferred to it by or on behalf of the Data Exporter for processing in accordance with the terms of theses clauses;

(d) "Data Subject" shall mean the Data Subject that is particularly described in Annex B herein below;

(e) "clauses" shall mean these contractual clauses, which are a free-standing document that does not incorporate commercial business terms established by the parties under separate commercial arrangements.

(f) "PDPA" shall mean the Personal Data Protection Act (No. 26 of 2012) of Singapore.

The details of the transfer (as well as the personal data covered) are specified in Annex B, which forms an integral part of the clauses.

I. Obligations of the Data Exporter

The Data Exporter warrants and undertakes that:

(a) The personal data has been collected, processed and transferred in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the country where the Data Exporter is established).

(b) It has used reasonable efforts to determine that the Data Importer is able to satisfy its legal obligations under these clauses.

(c) It will provide the Data Importer, when so requested, with copies of relevant data protection laws or references or any requirements set out in any advisory or other guidelines issued from time to time by Personal Data Protection Commission of Singapore ("PDPC") to them (where relevant, and not including legal advice).

(d) It will respond to enquiries from Data Subjects and the authority concerning processing of the personal data by the Data Importer, unless the parties have agreed that the Data Importer will so respond, in which case the Data Exporter will still respond to the extent reasonably possible and with the information reasonably available to it if the Data Importer is unwilling or unable to respond. Responses will be made within a reasonable time.

(e) It will make available, upon request, a copy of the clauses to Data Subjects who are third-party beneficiaries under clause III, unless the clauses contain confidential information, in which case it may remove such information. Where information is removed, the Data Exporter shall inform Data Subjects in writing of the reason for removal and of their right to draw the removal to the attention of the authority. However, the Data Exporter shall abide by a decision of the authority regarding access to the full text of the clauses by Data Subjects, as long as Data Subjects have agreed to respect the confidentiality of the confidential information removed. The Data Exporter shall also provide a copy of the clauses to the authority where required.

II. Obligations of the Data Importer

The Data Importer warrants and undertakes that:

(a) It will have in place appropriate technical and organizational measures to provide a standard of protection, that is comparable to the protection required by the PDPA and any requirements set out in any advisory or other guidelines issued from time to time by the PDPC, to the personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, and which provide a level of security appropriate to the risk represented by the processing and the nature of the data to be protected.

(b) It will have in place procedures so that any third party it authorizes to have access to the personal data, including processors, will respect and maintain the confidentiality and security of the personal data. Any person acting under the authority of the Data Importer, including a data processor shall be obligated to process the personal data only on instructions from the Data Importer. This provision does not apply to persons authorized or required by law or regulation to have access to the personal data.

(c) It has no reason to believe, at the time of entering into these clauses, in the existence of any local laws that would have a substantial adverse effect on the guarantees provided for under these clauses, and it will inform the Data Exporter if it becomes aware of any such laws.

(d) It will process the personal data for purposes described in Annex B, and has the legal authority to give the warranties and fulfill the undertakings set out in these clauses.

(e) It will identify to the Data Exporter a contact point within its organization authorized to respond to enquiries concerning of the personal data, and will cooperate in good faith with the Data Exporter, the Data Subject and the authority concerning all such enquiries within a reasonable time. In case of legal dissolution of the Data Exporter, or if the parties have so agreed, the Data Importer will assume responsibility for compliance with the provisions of clause I(e).

(f) At the request of the Data Exporter, it will provide the Data Exporter with evidence of financial resources sufficient to fulfill its responsibilities under clause III (which may include insurance coverage).

(g) Upon reasonable request of the Data Exporter, it will submit its data processing facilities, data files and documentation needed for processing to reviewing, auditing and /or certifying by the Data Exporter (or any independent or impartial inspection agents or auditors, selected by the Data Exporter and not reasonably objected to by the Data Importer) to ascertain compliance with the warranties and undertakings in these clauses, with reasonable notice and during regular business hours. The request will be subject to any necessary consent or approval from a regulatory or supervisory authority within the country of the Data Importer, which consent or approval the Data Importer will attempt to obtain in a timely fashion.

(h) It will process the personal data, in accordance with:

1. The data protection laws of Singapore, and the relevant regulations, provisions or
2. other requirements issued by PDPC; and

The data processing principles set forth in Annex A. It will not disclose or transfer the personal data to a third-party organization located outside Singapore unless with prior consent of the Data Exporter on the transfer and

(i)The third-party organization processes the personal data in accordance with requirements prescribed under PDPA finding that the third-party organization provides a standard of protection to personal data so transferred that is comparable to the protection under PDPA;

(j) Data subjects have been given the opportunity to object, after having been informed of the purposes of the transfer, the categories of recipients and the fact that the countries to which data is exported may have different data protection standards.

III. Liability and third party rights

(a) The Data Importer shall be liable to the Data Exporter for damages it causes by any breach of these clauses. Liability as between the parties is including but not limited to actual damage suffered and penalties imposed by government or local authority. The Data Importer shall be liable to Data Subjects for damages it causes by any breach of third party rights under these clauses. This does not affect the liability of the Data Exporter under its data protection law.

(b) The parties agree that a Data Subject shall have the right to enforce as a third-party beneficiary this clause and clauses I(b), I(d), I(e), II(a), II(d), II(e), II(h), II(i), III(a), V, VI(d) and VII against the Data Importer or the Data Exporter, for their respective breach of their contractual obligations, with regard to his personal data, and accept jurisdiction for this purpose in the Data Exporter's country of establishment. In cases involving allegations of breach by the Data Importer, the Data Subject must first request the Data Exporter to take appropriate action to enforce his rights against the Data Importer, if the Data Exporter does not take such action within a reasonable period (which under normal circumstances would be one month), the Data Subject may then enforce his rights against the Data Importer directly. A Data Subject is entitled to proceed directly against a Data Exporter that has failed to use reasonable efforts to determine that the Data Importer is able to satisfy its legal obligations under these clauses (the Data Exporter shall have the burden to prove that it took reasonable efforts).

IV. Law applicable to the clauses

These clauses shall be governed by the law of the Singapore.

V. Resolution of disputes with Data Subjects or the authority

(a) In the event of a dispute or claim brought by a Data Subject or the authority concerning the processing of the personal data against either or both of the parties, the parties will inform each other about any such disputes or claims, and will cooperate with a view to settling them amicably in a timely fashion.

(b) The parties agree to respond to any generally available non-binding mediation procedure initiated by a Data Subject or by the authority. If they do participate in the proceedings, the parties may elect to do so remotely (such as by telephone or other electronic means). The parties also agree to consider participating in any other arbitration, mediation or other dispute resolution proceedings developed for data protection disputes.

(c) Each party shall abide by a decision of a competent court of Singapore or of the authority which is final and against which no further appeal is possible.

VI. Termination

(a) In the event that the Data Importer is in breach of its obligations under these clauses, then the Data Exporter may temporarily suspend the transfer of personal data to the Data Importer until the breach is repaired or the contract is terminated.

(b) In the event that:

1. The transfer of personal data to the Data Importer has been temporarily suspended by the Data Exporter for longer than one month pursuant to paragraph (a);
2. Compliance by the Data Importer with theses clauses would put it in breach of its legal or regulatory obligations in the country of import;
3. The Data Importer is in substantial or persistent breach of any warranties or undertakings given by it under these clauses;
4. A final decision against which no further appeal is possible of a competent court of Singapore or of the authority rules that there has been a breach of the clauses by the Data Importer or the Data Exporter; or
5. A petition is presented for the administration or winding up of the Data Importer, whether in its personal or business capacity, which petition is not dismissed within the applicable period for such dismissal under applicable law; a winding up order is made; a receiver is appointed over any of its assets; a trustee in bankruptcy is appointed, if the Data Importer is an individual; a company voluntary arrangement is commenced by it; or any equivalent event in any jurisdiction occurs then the Data Exporter, without prejudice to any other rights which it may have against the Data Importer, shall be entitled to terminate these clauses, in which case the authority shall be informed where required. In cases covered by (i), (ii), or (iv) above the Data Importer may also terminate these clauses.

(c) Either party may terminate these clauses if (i) any Commission positive adequacy decision under Singapore PDPA 2012 (or any superseding text) is issued in relation to the country (or a sector thereof) to which the data is transferred and processed by the Data Importer, or any superseding text becomes directly applicable in such country.

(d) The parties agree that the termination of these clauses at any time, in any circumstances and for whatever reason (except for termination under clause VI(c)) does not exempt them from the obligations and/or conditions under the clauses as regards the processing of the personal data transferred.

VII. Variation of these clauses

The parties may not modify these clauses except to update any information in Annex B, in which case they will inform the authority where required. This does not preclude the parties from adding additional commercial clauses where required.

VIII.Description of the Transfer

The details of the transfer and of the personal data is specified in Annex B. The parties agree that Annex B may contain confidential business information which they will not disclose to third parties, except as required by law or in response to a competent regulatory or government agency, or as required under Clause I(e). The parties may execute additional annexes to cover additional transfers, which will be submitted to the authority where required. Annex B may, in the alternative, be drafted to cover multiple transfers.

ANNEX A to the Data Transfer Agreement

DATA PROCESSING PRINCIPLES

1. Purpose limitation: Personal data may be processed and subsequently used or further communicated only for purposes described in Annex B or subsequently authorized by the Data Subject.

2. Data quality and proportionality: Personal data must be accurate and, where necessary, kept up to date. The personal data must be adequate, relevant and not excessive in relation to the purposes for which they are transferred and further processed.

3. Transparency: Data subjects must be provided with information necessary to ensure fair processing (such as information about the purposes of processing and about the transfer), unless such information has already been given by the Data Exporter.

4. Security and confidentiality: Technical and organizational security measures must be taken by the organization that are appropriate to the risks, such as against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, presented by the processing. Any person acting under the authority of the organization, including a processor, must not process the data except on instructions from the Data Exporter.

5. Rights of access, correction and objection: As provided under the PDPA, Data Subjects must, whether directly or via a third party, be provided with the personal information about them that an organization holds, except for requests which are manifestly abusive, based on unreasonable intervals or their number or repetitive or systematic nature, or for which access need not be granted under the law of the country of the Data Exporter. Provided that the authority has given its prior approval, access need also not be granted when doing so would be likely to seriously harm the interests of the Data Importer or other organizations dealing with the Data Importer and such interests are not overridden by the interests for fundamental rights and freedoms of the Data Subject. The sources of the personal data need not be identified when this is not possible by reasonable efforts, or where the rights of persons other than the individual would be violated. Data subjects must be able to have the personal information about the rectified, amended where it is inaccurate or processed against these principles. If there are compelling grounds to doubt the legitimacy of the request, the organization may require further justifications before proceeding to rectification, amendment. Notification of any rectification, amendment to third parties to whom the data has been disclosed need not be made when this involves a disproportionate effort. A Data Subject must also be able to object to the processing of the personal data relating to him if there are compelling legitimate grounds relating to his particular situation.

6. Data used for marketing purposes: Where data is processed for the purposes of direct marketing, effective procedures should exist allowing the Data Subject at any time to "opt-out" from having his data used for such purposes.

7. Automated decisions: For purposes hereof "automated decision" shall mean a decision by the Data Exporter or the Data Importer which produces legal effects concerning a Data Subject or significantly affects a Data Subject and which is based solely on automated processing of personal data intended to evaluate certain personal aspects relating to him, such as his performance at work, creditworthiness, reliability, conduct, etc. The Data Importer shall not make any automated decisions concerning Data Subjects, except when:

(a) (i) such decisions are made by the Data Importer in entering into or performing a contract with the Data Subject, and

(ii) the Data Subject is given an opportunity to discuss the results of a relevant automated decision with a representative of the parties making such decision or otherwise to make representations to that parties.

Or

(b) Where otherwise provided by the law of the Data Exporter.

ANNEX B

DESCRIPTION OF THE TRANSFER

Data subjects

The personal data transferred concern the following categories of data subjects:

End-User's who have authorized reading and writing of their health and fitness data via Health Kit service.

Purposes of the transfer(s)

The transfer is made for the following purposes:

Enable data management for developers of End-Users'

Categories of data

The personal data transferred concern the following categories of data:

End-User Data as defined in Agreement.

Recipients

The personal data transferred may be disclosed only to the following recipients or categories of recipients:

Data importer (or 3rd party authorized by data importer)

Sensitive data (if appropriate)

The personal data transferred concern the following categories of sensitive data:

End-User's health and fittness data.

Data protection registration information of data exporter (where applicable)

Not Applicable

Additional useful information (storage limits and other relevant information)

None

Contact points for data protection enquiries

Data importer

Name: ………………………………………

Role: ………………………………………

Address: ………………………………………

Mail: ………………………………………

Data exporter

Name: ………………………………………

Role: ………………………………………

Address: ………………………………………

Mail: ………………………………………

Place Data Protection Contact here Huawei: datamanagement.hshk@huawei.com