Yahaha Privacy Policy
Release Date of this Privacy Policy: 19 December, 2022
Effective Date of this Privacy Policy: 23 December, 2022
Welcome to use Yahaha applications and become a part of our creative community!
Yahaha Studios Oy (“we” or “Yahaha”) respects your right to privacy and value the protection of your Personal Data (as defined below). This Privacy Policy (“Privacy Policy”) explains how we collect, process and protect your Personal Data when you use Yahaha’s website, i.e. www.yahaha.com, (the “Website”) and its applications (including the Yahaha Studio applications for Windows and MacOS and the Yahaha Apps for iOS and Android) and how you can exercise your rights to Personal Data protection.
“Personal Data” in this Privacy Policy refers to all information in relation to an identified or identifiable natural person, including nicknames, date of birth, email address, passwords, chat history, social account information, etc., excluding anonymized information.
Our website and/or applications are not intended for minors. Minors under the age of 16 (or other age criteria established by local law) cannot create a Yahaha account and use the Yahaha applications. If you are above the age of 16, but are considered a minor in your country or region (for example, under the age of 18 in some jurisdictions), you must have your parent or legal guardian read this Privacy Policy with you and you represent that you have permission from your parent or legal guardian to create your Yahaha account and use the Yahaha applications.
If you have any questions about this Privacy Policy, please contact us using the contact details provided at the bottom of this Privacy Policy.
This Privacy Policy informs you of the following information:
1. What types of Personal Data do we collect and our purposes
2. How do we process minor’s Personal Data
3. How do we share and entrust the processing of your Personal Data
4. How do we protect your Personal Data
5. How do we store your Personal Data
6. Lawful basis for processing Personal Data (applicable to users located in the EU/EEA)
7. Your rights
8. How do we update this Privacy Policy
9. How to contact us
1. What types of Personal Data do we collect and our purposes
The scope of Personal Data we collect depends on the functions of the Website and the Yahaha applications you use and how you use those functions. The purposes and types of Personal Data we collect are summarized below.
A. The Personal Data you directly provide to us
Registration and Login: When you register an account on our Website or on the Yahaha applications, we will collect your nickname, password, birthday, email or mobile phone number to help you complete the registration and login process, as well as to determine that you meet our age limit for users. If you refuse to provide such Personal Data, you will not be able to complete the registration and login process.
Contact and Marketing: We may use the contact information provided by you (e.g., email address, cell phone number) to send you information about products and services that may be of interest to you. Where required by applicable laws and regulations, we will obtain your consent before sending you marketing messages. If you are not interested in such information, you may refuse at any time during the communication, for example, by clicking on the unsubscribe option or sending us a reply to opt-out.
Inquiries and customer service: Information that you provide to submit inquiries to us, like your name, age, contact details and communication between you and our customer service.
Surveys：Information that you provide when you voluntarily attend our surveys.
Other Features: Information that you provide through other features we make available on the Website and our applications from time to time, where you will be informed about why and what kind of Personal Data we may collect separately.
B. The Personal Data provided by you or generated during your use of Yahaha applications
Creating and Sharing: The Yahaha applications enable you to create personalized 3D content and share it with others. As you create 3D content through the Yahaha applications, we will collect your in-progress or completed 3D content. The Explore Space function allows you to view and experience 3D content posted by other Yahaha users and add it to your Favorites. Within the 3D spaces posted by Yahaha users, you can also chat with other friends online, where we will collect your text or voice chat history. Your chat history is protected by end-to-end encryption.
Social Network and Interaction: When you use our Meet function, we collect the room IDs and room names you join or create, your friends' information, and your text or voice chat history. To show your personalized image to other users, you can set your profile and account avatar in personal page (Me). To help you manage your friendship, you can also add other users to your Block List to avoid receiving messages from them.
Feedback and Help: When you use the Feedback function within the Yahaha applications, we collect the type of questions, descriptions, attachments, and other system information you submit. If you do not provide this information, we may not be able to help you resolve the issue or respond to your question. In addition, if you need to ask for our help, you can contact us through private message or our groups within third-party chat software (such as Discord) and we will assist you based on our communications with you.
Payment and Transaction: We offer a large number of creative materials in our Asset Library within the Yahaha applications, some of which you will need to pay for. If you initiate a payment request, we need to collect your payment amount, payment method, order number and other information to complete the payment and transaction process.
Maintaining stability and improving user experience: In order to maintain the stability of the Yahaha applications and the security of your account, and to improve your experience (e.g. to perform data analysis and push notifications to you), we collect data related to the operation of the applications and your online operations, such as login status, click data, device data (e.g. device identifiers), application anonymous identifiers, application Token, information related to the operating system, network information (e.g. IP address), etc.
C. The Personal Data provided by third parties
Third-Party Login: To make it easier to use the Yahaha applications, you may also choose to register and log in within the Yahaha applications through an account on a third-party platform (e.g. Apple, Facebook, Snapchat). We will collect your third-party nickname and Open ID, and by registering and logging in through these third-party accounts, you are consenting to the third party providing us with the Personal Data concerned.
If you provide us with any Personal Data of any data subjects other than yourself, please bring this Privacy Policy to their attention. You hereby acknowledge that you have obtained their consent or completed other formality as required by other lawful bases for the Personal Data processing in lieu of consent before providing such Personal Data to us. By submitting such information to us, you represent to us that you are entitled to provide and we are entitled to process relevant Personal Data for the purposes as stated in this Privacy Policy.
In general, we will use your Personal Data only for the purposes described in this Privacy Policy or for purposes that we explain to you at the time we collect relevant Personal Data. However, we may also process Personal Data for other purposes that are not incompatible with the purposes that we have disclosed to you if and where it is permitted by applicable laws and regulations.
D. Personal Data collected automatically when you are visiting or using our Website
When you visit our Website, we may automatically collect certain Personal Data about you or the device you are using, like your IP address, device type, unique device identification numbers, browser type, broad geographic location (e.g. country or city-level location), the time of your visit, and the content that you have viewed.
Collecting this Personal Data enables us to better understand the visitors who come to our Website, where they come from, and what content on our Website is of interest to them. We use this Personal Data for our internal analytics purposes and to improve the quality and relevance of our Website to our visitors.
Some of this Personal Data may be collected using cookies and similar tracking technology, as explained further in our Cookie Notice.
E. Links to third-party websites
Our Website may contain links to third-party websites, which are normally operated by third parties independently from us. This Privacy Policy does not address, and we are not responsible for, the privacy practices of any such third parties. You need to refer to their own privacy policy to understand how they may process your Personal Data. The inclusion of a link on our Website does not imply that we endorse the practices of the linked website or services.
2. How do we process minors’ Personal Data
You declare that you are not a minor under the age of 16. Minors under the age of 16 (or other age criteria established by local law) cannot create a Yahaha account and use the Yahaha applications. If you are above the age of 16, but are considered a minor in your country or region (for example, under the age of 18 in some jurisdictions), you must have your parent or legal guardian read this Privacy Policy with you and you represent that you have permission from your parent or legal guardian to create your Yahaha account and use the Yahaha applications.
If you are the parent or legal guardian of a minor above the age of 16, please ensure that you have read this Privacy Policy and are responsible for your child's activities before allowing your child to create his or her own Yahaha account and use the Yahaha applications. You agree to monitor your child's use of the Yahaha applications and to ensure that your child uses only age-appropriate functions.
That said, we recognize that we have a special obligation to protect minors with respect to the collection and processing of Personal Data. We strongly recommend that parents and guardians educate their children to never disclose or provide any Personal Data about them without your prior permission when using our services. If we learn that we have collected Personal Data from minors under the age of 16 without the permission of their parents or legal guardians, we will delete such Personal Data as soon as possible. If you have questions on how we process minors’ Personal Data, please contact us using the contact details provided in “How to contact us”.
3. How do we share and entrust the processing of your Personal Data
In order to improve and maintain our services, we may engage third parties (such as those who assist us in providing services related to our Website and applications) to process your Personal Data on our behalf. We will enter into strict confidentiality agreements with such third parties and require them to process Personal Data in accordance with our requirements, this Privacy Policy, and the confidentiality and security measures required by applicable laws and regulations.
We may also share your Personal Data with third-parties in the following circumstances:
Prior to sharing, where required by applicable laws and regulations, we may separately inform you of the names of the third parties, their contact information, the purpose and manner of processing and the types of Personal Data, and obtain your consent (or complete any formality as required by other lawful bases).
4. How do we protect your Personal Data
We use appropriate technical and organizational measures to protect your Personal Data that we collect and process. The measures that we use are designed to provide a level of security appropriate to the risk of processing your Personal Data. Please be aware and understand that we cannot ensure an absolutely secure Internet. If you find that your Personal Data is breached, please contact us using the contact details provided in “How to contact us” immediately so that we can take corresponding measures.
In the event of any accident, force majeure event or other circumstances leading to the breach of your Personal Data, we will make every effort to control the situation and promptly inform you of the cause, the security measures we have taken and you can take and other relevant information. In the event of a security incident related to Personal Data, we will report to the competent authorities in accordance with the requirements of applicable laws and regulations, promptly investigate the problem, and take emergency measures.
5. How do we store your Personal Data
A. Storage of Data and Cross-border Transfer
Your Personal Data collected by our Website and the applications is saved in our data base in the Netherlands. For the need of our global operation, your Personal Data may be transferred to, and stored, at a jurisdiction different from the one you are located. Such jurisdiction may not provide the same level of data protection as your jurisdiction. Under such circumstances, we will take all necessary and appropriate safeguards to ensure the security of your Personal Data in transit and require that the recipient of your Personal Data offers an adequate level of protection and security in accordance with this Privacy Policy and applicable laws and regulations, for instance by entering into the appropriate data processing agreements and, if necessary, standard contractual clauses with the recipient or adopting an alternative mechanism for the transfer of Personal Data as approved by applicable regulators.
B. Retention Period
We will store your Personal Data only to the extent as necessary to the proper business needs of our company (e.g. for the purposes of providing service to you or complying with the requirements of laws, tax and finance), except as provided otherwise by applicable laws or regulations. When there is no such business need to use your Personal Data or the time limit for retention expires according to applicable laws or regulations, we will delete or anonymize your Personal Data. For example, we store your chat data in the Yahaha applications for only seven days, and we will delete such data immediately after the expiration date.
6. Lawful basis for processing Personal Data (applicable to users located in the EU/EEA)
Our lawful basis for collecting and using the Personal Data described in this Privacy Policy will depend on the Personal Data concerned and the specific context in which we collect it. The specific lawful basis on which we rely for each of the purposes which we process your Personal Data for is set forth below:
Purposes | Lawful basis (as applicable) |
Provide registration and login functions | Necessary for conclusion or performance of contract (GDPR 6.1(b)), or legitimate interest (GDPR 6.1(f)) of the controller |
Provide content creating and sharing functions | |
Provide social network and interaction functions | |
Provide user feedback and help functions | |
Provide payment and transaction functions | |
Maintain stability and improve user experience | |
Enable third-party login | |
Contact you and send marketing messages to you | Your consent (GDPR 6.1(a)) |
Comply with regulatory, compliance, or legal obligations and/or requirements, or to assist law enforcement and government authorities as permitted or required by applicable laws and regulations | Necessary for performance of legal obligation (GDPR 6.1(c)) |
When choosing to use your data on the basis of our legitimate interests, we always use the balance test to weigh our interests against your interests or fundamental rights and freedoms. If you would like to obtain information on the balancing test regarding the legal basis for data processing, please contact us by using the contact details provided in the “How to contact us” section below.
7. Your rights
We value the protection of your Personal Data. If you want to access, correct, or delete your Personal Data, or if you want to refuse marketing messages, file a complaint, withdraw consent, or exercise other rights under applicable laws and regulations, please do so as described below or contact us. Please note that certain rights may be restricted according to the GDPR and other applicable legislation.
A. Access your Personal Data
You have the right to access the Personal Data that we collect about you. For Personal Data such as nicknames, user names, avatars, account emails, personal profiles, etc. that you voluntarily provide to us, you can view them in your personal page (Me) within the Yahaha computer and mobile applications (both iOS and Android versions); for Personal Data that you provide and generate while using the Yahaha applications, as well as Personal Data that third parties provide to us (e.g. chat messages, payment information, etc.), you can access them within the corresponding functions of Yahaha. You also have the right to request a copy of your Personal Data from us, by contacting us using the contact details provided in the “How to contact us” section below.
B. Correct your Personal Data
We will endeavor to ensure that your Personal Data is accurate and up-to-date by implementing appropriate measures. If your Personal Data is inaccurate or incomplete, you have the right to correct such Personal Data. For Personal Data such as nicknames, user names, avatars, account emails, profiles, passwords, etc. that you voluntarily provide to us, you can correct them within your personal page (Me) within the Yahaha computer and mobile applications (both iOS and Android versions); for Personal Data that you provide and generate while using the Yahaha applications and Personal Data that third parties provide to us (e.g. chat messages, payment information, etc.), if you think such Personal Data needs to be corrected, you can contact us using the contact details provided in the “How to contact us” section below. Please note that for Personal Data provided by third parties (such as the nickname and Open ID of third-party platform account), we may not be able to keep the information up to date and may need you to contact the third-party for corrections.
C. Delete your Personal Data
You have the right to request that we delete your Personal Data, including your Yahaha account and related Personal Data (including account number, nickname, email address, profile, etc.). You can do this on your personal page (Me) within the Yahaha computer and mobile applications (both iOS and Android versions) or by using the contact details provided in the “How to contact us” section below. Please note that after you submit a request to delete your account, you will no longer be able to log in to your Yahaha account or use the Yahaha applications, so please decide carefully. In addition, we will also voluntarily delete your Personal Data after the expiration of the retention period of the Personal Data when the purposes of processing in the first part of this Privacy Policy no longer exist.
If we terminate our services or operations, we will notify you at least thirty (30) days in advance and will delete or anonymize your Personal Data after termination of services or operations.
D. Right to opt-out marketing
You can exercise this right by clicking on the “unsubscribe” or “opt-out” option (or other similar option or link) when you register account with us or in the marketing messages we send you.
E. Right to file a complaint
You have the right to file a complaint with the data protection authority about our collection and use of your Personal Data. For more information, please contact your local data protection authority. Before you file a complaint, we also sincerely hope that you will first provide us with your comments and we will endeavor to answer your questions and protect your rights.
F. Right to withdraw consent
If we process your Personal Data based on your consent, you may withdraw your consent at any time. Please note that withdrawal of your consent will not affect the lawfulness of any processing we have carried out prior to your withdrawal of consent, nor will it affect the lawfulness of our processing of your Personal Data based on a lawful basis other than your consent.
G. Other rights under applicable laws and regulations
If you want to exercise your statutory data subject rights under other applicable laws and regulations (such as requiring us to transfer your Personal Data to a third party designated by you, or restricting our processing of your Personal Data, or refusing to allow us to process your Personal Data based on our legitimate interests, if the statutory conditions are met), you may contact us using the contact details provided in the “How to contact us” section below.
H. Identity verification and responding to your requests
In order to protect the security of your information, we may need to verify your identity before responding to your requests to exercise your rights, for example, by requiring you to provide certain identity-related supporting information.
We will respond to your request to exercise your data subject rights in accordance with the requirements under applicable laws and regulations and in a timely manner.
8. How do we update this Privacy Policy
We may update this Privacy Policy from time to time in response to the changes in legal, technical or business developments. When we update our Privacy Policy, we will take appropriate measures to inform you, for example by email, by displaying a notice on our Website or in-app notice prior to the effective date of the updated privacy policy, depending on the significance of the changes we make. Before we make material changes to this Privacy Policy, we will make sure you can accept such changes, as required by applicable laws and regulations.
You can see when this Privacy Policy came into effect by checking the “Effective Date” displayed at the top of this Privacy Policy. If you continue to use any functions of Yahaha applications, you are deemed to have accepted the updated Privacy Policy.
9. How to contact us
If you have any questions or concerns about this Privacy Policy or our processing upon your Personal Data, especially if you consider that our processing of your Personal Data impairs your legitimate interests, please contact us or our DPO using the contact details below. We will review your question without delay and make a timely reply according to the applicable laws and regulations. Our contact details are as follows:
Company Name: Yahaha Studios Oy
Address: Tammasaarenkatu 3, 00180 Helsinki, Finland
Telephone: +358-505536599
E-mail: contact@yahahastudios.com
Data Protection Officer (DPO)
Privaneer Oy
Address: Linnoitustie 6, 02600 Espoo, Finland
Email: yahaha@privaneer.com