Privacy Policy
Products to which this Policy applies:
Smart lock control mobile application (English name: SecuOps Lock) (hereinafter "App");
Smart lock control PC management software (English name: Resource Security Management System) (hereinafter "PC client");
And the cloud services supporting the operation of the above clients (including accounts, permissions, key distribution, log storage, etc., hereinafter "Cloud Services"). The App, PC client, and Cloud Services are collectively referred to as the "Smart Lock Software."
Corresponding hardware products:
MakeID smart locks (including keys)
I. Scope of Application and Definitions
1.1 Scope
This Policy applies to all scenarios in which you use the Smart Lock Software and Cloud Services through the App or PC client, and applies only to functions that are actually enabled, displayed on the page, and authorized by the organization, including login, device and permission management, Bluetooth/NFC/Bluetooth key/4G remote unlock, QR code scanning and recognition, work photography, device map, alerts, log queries, lock initialization, key import and distribution, and user authorization.
1.2 User Roles
This product is sold and deployed for enterprise and organizational customers. For the purposes of this Policy: (1) End User means a natural person who uses the App to unlock, query unlock records, view lock locations, upload lock status, and perform other operations, including employees, contractors, service personnel, or other authorized persons of the organizational customer; (2) Administrator means a natural person authorized by the organization to use the PC client or management functions to perform operations such as lock initialization, log queries, user authorization, and key import. Regardless of role, your personal information is protected under this Policy and applicable law.
1.3 Data Processing Relationship with the Organizational Customer
This product is primarily intended for enterprise and organizational customers. For information whose purposes and means of processing are determined by the organizational customer, such as end user accounts, the binding relationship between personnel and devices, access permissions, unlock and approval records, work records, and business-related location information, the organizational customer is generally responsible for determining the purposes, scope, and rules of use of such information. We primarily provide account, permission management, device management, log storage, key distribution, and other related technical services in accordance with the organizational customer's instructions. For information whose purposes and means of processing we independently determine for purposes such as safeguarding account and system security, maintaining service operation, troubleshooting, and fulfilling our own legal obligations, we may bear corresponding data controller responsibility under applicable law. The specific data protection responsibilities of the parties may be further agreed in the contract signed with the organizational customer or the Data Processing Addendum.
1.4 Relationship with the User Agreement
The licensing, installation and updates, account management, user conduct rules, intellectual property, liability for breach, and other matters of the Smart Lock Software are governed by the User Agreement. This Policy and the User Agreement apply concurrently; for matters involving rules on personal information processing, this Policy and the applicable data processing agreements shall prevail.
1.5 Third-Party Independently Provided Products or Services Are Subject to Their Own Rules
After you navigate from the App or PC client to a third-party application or page, please separately read the privacy policy or related notices provided by the third party.
II. How We Collect and Use Personal Information
2.1 Common Scenarios (App and PC client)
| Scenario | Information that may be processed | Purpose and trigger method |
|---|---|---|
| Account registration and login | Mobile number (one-click login with your own number (where available)), account, password or securely processed account credentials, email, authentication token, role, organization, login time, IP address, login status | Submitted by you upon registration or login, or configured by your organization; used to verify identity, maintain sessions, enforce organizational authorization, and safeguard account security. |
| Security, logs, and troubleshooting | Operation type (login, unlock, authorization, initialization, key import, log query, etc.), operation time, operation result, device status, error information, client version, operating system version, device model, network status, IP address | Used for security auditing, anomaly investigation, dispute resolution, service stability maintenance, device and account security, and fulfilling applicable legal obligations. |
| Statistical analysis and operating environment security | Device model, operating system and App version, device identifiers, network type, IP address, necessary operating environment and exception information, application usage and custom business events; other disclosed information is processed only when actually required by the function or integrated SDK | Used only where the relevant functions are enabled and applicable legal requirements are met, to compile product usage statistics, identify abnormal installations or potential security risks, troubleshoot faults, and improve the product. We do not conduct cross-context behavioral advertising or advertising profiling for this purpose. |
The specific device identifiers, network parameters, and other information processed for statistical analysis, performance monitoring, and third-party SDKs are governed by the actual released version and the content set out in Section V of this Policy. We reasonably control the scope of information collected based on the actual needs of product functions, security, and service improvement.
2.2 App-Specific Scenarios
The following scenarios apply only to functions that are actually enabled, displayed on the page, and authorized by the organization.
| Scenario | Information that may be processed | Purpose and trigger method |
|---|---|---|
| Bluetooth and Bluetooth key unlock | Bluetooth/nearby-device permission, nearby Bluetooth device name and identifier, MAC address or equivalent identifier, signal strength, connection status, device information, operation result | When you enter the relevant page or actively initiate an operation, search for, identify, and connect to authorized locks or keys to complete device operations. |
| NFC unlock | NFC read information, lock serial number or identifier, key interaction result, device information, operation result | When you actively touch an NFC lock or use the relevant function, identify the authorized device and complete secure communication. |
| 4G remote unlock | Device number, network status, operation command, operator, time, and result | Send commands to devices supporting remote control and record results upon your active operation. |
| System location and map | Longitude/latitude provided by the system, location accuracy, time, and address information resolved by business or map services; device location and map interaction information | Invoke system location only when functions such as unlock location recording, work photography, device map, or location selection require it, and use it for facility security, work records, or device management based on the organizational customer's configuration and user operations. |
| QR code scanning and image recognition | Camera view, images you actively select, QR code/barcode recognition results, device codes | Identify devices when you actively scan a code or select an image; the specific processing method is governed by the actual function and released version. |
| Work photography and upload | On-site photos, capture time, device and task information, necessary location and watermark information | Record the work process, device status, and completion when you actively photograph or upload. Please do not upload persons, documents, or other personal information unrelated to the task. |
| Local storage and offline tasks | Login status, language, account preferences, securely protected login credentials, device and task caches, pending sync operation records | Stored on your terminal to maintain settings, support offline operations, and resume synchronization; you may delete the relevant local information through the functions provided by the App, by clearing App data, or by uninstalling the App, but records already synchronized to the Cloud Services are still processed in accordance with this Policy and the organizational customer's configuration. |
2.3 PC Client-Specific Scenarios
| Scenario | Information that may be processed | Purpose and trigger method |
|---|---|---|
| Lock initialization and parameter configuration | Device number, model, firmware version, initialization parameters and configuration results | Processed when you actively connect a lock and perform initialization or parameter configuration, for device activation, parameter writing, and operation/maintenance management. |
| Key import and cloud distribution | Key identifier or ciphertext, import time, operator, associated devices, distribution status and time | Keys imported via the PC client are encrypted and uploaded to the Cloud Services, and distributed to authorized users' Apps for secure verification and key pairing with locks during App unlocking. Keys are not used for advertising, user profiling, or identity recognition unrelated to access control, and are stored and transmitted in encrypted or other appropriate secure forms. |
| User authorization and permission management | Authorized users, roles, organization, device numbers and binding relationships, permission status, application reasons, approval records | Submitted when administrators configure or approve unlock permissions and organizational roles, for permission management and audit traceability. |
| Log queries | Query conditions, query time, scope of query results | Records administrators' query behavior over unlock, authorization, operation, and other logs, for security auditing, dispute resolution, and liability traceability. |
If you refuse to provide information necessary to implement a particular function, the corresponding function may be unavailable, but this does not affect other functions that do not depend on that information. Operating system permission authorization is only used to control access to device capabilities and does not necessarily mean that "consent" is the sole legal basis for the relevant personal information processing; the specific legal basis depends on the processing scenario and applicable law.
III. Sensitive or Security-Sensitive Information
Precise location information, access and unlock records, work records that may form a movement trajectory, account credentials, and keys and key-interaction related information may be regarded as sensitive personal information or sensitive data in some jurisdictions, or may have a higher degree of privacy and security sensitivity by their nature. The above information is not necessarily equivalent to "special categories of personal data" as referred to in Article 9 of the EU GDPR; if the actual business involves special categories or sensitive data as defined by relevant laws, it will be processed in accordance with applicable law.
We process the above information only to the extent necessary for purposes such as implementing access control, verifying unlock authorization, performing device operations, recording necessary work, safeguarding device and account security, audit traceability, and dispute resolution, and we adopt measures such as access control, permission isolation, transmission protection, key encryption or signing, and log auditing.
When the App first uses location, camera, Bluetooth, or other functions, it will request the relevant permissions in accordance with operating system rules; if applicable law requires consent as the legal basis for the relevant processing, we will process it in accordance with applicable law.
When organizational customers use functions such as location, access logs, and work records, they shall determine the lawful basis for processing in accordance with the applicable law of their location, and fulfill obligations such as notification, labor/employment, employee monitoring, or data protection assessment toward their employees, contractors, or other end users.
IV. System Permissions and Device Interfaces
| Permission/device interface | Purpose | Impact of refusal or disabling |
|---|---|---|
| Location (App) | Obtain longitude/latitude through Android/iOS system location for enabled functions such as unlock location, work photography, device map, and location selection. | Relevant location recording, map positioning, or location-dependent work functions may be unavailable. |
| Bluetooth/nearby devices (App) | Search for, identify, and connect to smart locks or Bluetooth keys. | Device operations dependent on Bluetooth cannot be used. |
| NFC (App) | Read and communicate with NFC-enabled smart locks. | Mobile NFC unlock cannot be used. |
| Camera (App) | Scan codes to identify devices, capture and submit work photos. | Code scanning and photography functions are unavailable. |
| Album/photos (App) | You actively select existing images for recognition or business upload. | Cannot select images from the album; does not affect direct photography. |
| Network and network status (App/PC client) | Used for login, permission and device synchronization, remote operations, record upload, map loading, service availability determination, performance monitoring, statistical analysis, and operating environment security. Network information actually processed by third-party SDKs is governed by Section V and the corresponding SDK configuration. | Online services and synchronization functions cannot be used normally; some non-essential statistics or performance functions may be affected. |
| Local device interfaces (PC client) | When you actively operate, the PC client may connect to locks through local interfaces such as Bluetooth adapters, NFC readers, or data cables for initialization, parameter configuration, and key writing. | The corresponding device initialization, configuration, and key writing functions cannot be used. |
Applies only to functions that are actually enabled, displayed on the page, and authorized by the organization. Permissions are usually requested when you first use the relevant function. You may manage App permissions in the device's system settings. Withdrawing a permission does not affect processing already lawfully completed before withdrawal, but may result in the corresponding function being unavailable.
V. List of Third-Party SDKs and Services
The following list is compiled based on the current project's runtime invocations and packaging configuration. Different operating systems, SDK versions, function configurations, and release channels may result in differences in the information actually processed. This list will be adjusted according to the actual released version, SDK configuration, and function changes.
| SDK/service and provider | Purpose and timing | Information and method that may be processed | Privacy policy | Region |
|---|---|---|---|---|
|
DCloud uni-app/5+ App runtime environment DCloud (Beijing) Network Technology Co., Ltd. |
Provides basic App runtime, WebView, system capability bridging, network, and local storage capabilities. | May process device model, operating system, App information, device identifiers, network information, logs, and data returned by system permissions depending on the invoked functions; usually processed on the terminal, and necessary capabilities may require network access. | DCloud Terms of Service and Privacy Policy | Global |
|
Amap Open Platform JS API Amap Software Co., Ltd. |
Loads maps, markers, and provides map interaction when entering domestic maps, device locations, or location selection pages; does not serve as the Android/iOS location provider. | May process longitude/latitude, device or user locations displayed on the map, IP address, browser/WebView information, map interaction, and network logs, and transmit them to Amap over the network. | Amap Open Platform Privacy Policy | Mainland China |
|
Google Maps JavaScript API Google LLC |
Loads maps, markers, and provides map interaction in applicable regions or corresponding map pages. | May process longitude/latitude, IP address, device and browser/WebView information, map interaction, and network logs, and may involve cross-border transfer. | Google Privacy Policy | Regions outside mainland China |
|
Huawei Unified Code Scan SDK (Android) Huawei Software Technologies Co., Ltd. |
Identifies device codes when you use the code scanning function. | May process camera image data and basic device, App, and runtime information, and complete recognition based on SDK capabilities. | Huawei Unified Code Scan SDK (Android) Privacy Policy | Global |
|
Umeng+ APM SDK Umeng Tongxin (Beijing) Technology Co., Ltd. |
Monitors App crashes and performance after user consent, for anomaly investigation and stability improvement. | May process device identifiers, device, system, App, and network information, performance data, exception stack traces, and runtime logs, and transmit them to Umeng over the network. | Umeng+ APM SDK Privacy Policy | Global |
|
Umeng+ Mobile Statistics SDK Umeng Tongxin (Beijing) Technology Co., Ltd. |
Initialized after user consent; used to compile App usage statistics, perform App data statistical analysis, identify abnormal installations and potential security risks, monitor operating environment security, safeguard account security, investigate anomalies, and improve the product. | May process device information (including Android ID, IDFA, OAID, OpenUDID, GUID, etc., depending on the system and SDK version), network information (including IP address, network type, Wi-Fi status, Wi-Fi parameters, Wi-Fi list, BSSID, SSID, etc.), location information (optional), installed application information (such as application name, package name, and installation status), system and App version, application usage, and custom events, and transmit them to Umeng over the network. | Umeng+ Mobile Statistics SDK Privacy Policy | Global |
|
Number Authentication - Android Alibaba Cloud Computing (Beijing) Co., Ltd. |
Invoked only when the login page provides, prefetches, or you select one-click login with your own number. | May process masked mobile number, carrier, network type, SIM card and terminal environment information, IP address, and authentication token; interacts with Alibaba Cloud and the corresponding carrier over the network. | Number Authentication - Android Privacy Policy | Mainland China |
| China Mobile Number Authentication | When your number belongs to China Mobile and you select one-click login, assists in completing your own-number authentication. | May process masked mobile number, network type, SIM card status, device and network environment, and authentication token, and complete verification over the carrier's network. | China Mobile Authentication Service Terms | Mainland China |
|
Unicom Authentication SDK Unicom Online Information Technology Co., Ltd. |
When your number belongs to China Unicom and you select one-click login, assists in completing your own-number authentication. | May process masked mobile number, network type, SIM card status, device and network environment, and authentication token, and complete verification over the carrier's network. | Unicom Authentication SDK Privacy Policy | Mainland China |
| China Telecom Number Authentication | When your number belongs to China Telecom and you select one-click login, assists in completing your own-number authentication. | May process masked mobile number, network type, SIM card status, device and network environment, and authentication token, and complete verification over the carrier's network. | China Telecom Authentication Service Agreement | Mainland China |
In-house device capability note. The App also uses MakeID's in-house modules such as MakeID NFC smart lock communication, MakeID code scanning/recognition, Bluetooth locks, and electronic keys. These modules are used to invoke NFC, camera, and Bluetooth capabilities on the terminal, identify devices, and perform authorized operations. They are not independent third-party SDKs; the relevant information is processed by Chongqing Pisen Technology Co., Ltd. in accordance with this Policy. Necessary device numbers, operation results, and security logs may be transmitted to the business servers.
PC client third-party component note. As of the update date of this Policy, if the PC client has not integrated any third-party statistics, advertising, or analytics SDK that independently collects personal information, we will not provide PC client user personal information to third parties for such purposes. If the relevant components or processing methods change, this Policy or the corresponding list may be adjusted accordingly.
For third-party SDKs, we will manage the scope of relevant data processing in light of the actual released version, functional needs, and available configuration.
VI. Cookies, Local Storage, and Similar Technologies
The App uses local storage, databases, and necessary identification information to save login status, language, account preferences, device and task caches, offline records, and security status; the PC client uses local configuration and caches to save login status, interface preferences, and device connection configurations. The client itself does not use cookies or similar technologies for advertising tracking or cross-context behavioral advertising.
Third-party map pages, embedded web pages, or third-party services may use necessary local storage, cookies, or similar technologies in accordance with their own rules; the relevant processing is governed by the actual functions, third-party service rules, and applicable law.
VII. Sharing, Entrusted Processing, Transfer, and Public Disclosure
We do not sell your personal information for monetary consideration, nor do we share or process your personal information for cross-context behavioral advertising or targeted advertising purposes. We only share, disclose, or entrust the processing of personal information within the following necessary scope:
- Providing account, role, permission, device, location, photo, approval, and operation log information to your organization, authorized administrators, or authorized backend personnel in accordance with the organizational customer's management rules, for device management, access control, security auditing, and dispute resolution;
- Providing information necessary to implement the relevant functions to cloud services, maps, SDKs, technical support, and other service providers listed in this Policy or agreed by contract, and managing the relevant processing activities in accordance with applicable agreements, service configuration, and legal requirements;
- Where required by applicable contracts, statutory obligations, requests lawfully made by courts or competent regulatory/enforcement authorities, or where necessary to protect the life, bodily safety, or significant property safety of natural persons;
- In other sharing circumstances where applicable law requires consent, after obtaining valid consent.
When we process personal information on behalf of an organizational customer, the relevant data processing responsibilities and sub-processor arrangements may be determined in accordance with applicable law, the customer contract, or the data processing agreement.
In the event that a merger, division, acquisition, reorganization, asset transfer, or bankruptcy liquidation causes a change in the control relationship over personal information, the relevant personal information will be processed in accordance with applicable law and the transaction arrangements.
Except where permitted or required by applicable law, we will not publicly disclose personal information.
VIII. Storage, Retention, and Cross-Border Transfer
8.1 Storage location. We store user data based on the account's region of registration: data of users in mainland China is stored in the Alibaba Cloud Shenzhen data center, and data of users outside mainland China is stored in the Alibaba Cloud Singapore data center. Except for the following circumstances, we will not transfer or provide data outside the storage location, or provide it to entities outside the storage location: (1) where necessary for providing technical support, troubleshooting, and security assurance, and where such access is implemented under least-privilege, encryption, access control, and audit measures; (2) where necessary for the organizational customer to conduct cross-regional unified management of devices, personnel, and permissions in accordance with its instructions or management rules; (3) where required by applicable law or with your separate consent. If the aforementioned necessary access constitutes a cross-border transfer of personal data or outbound transfer of personal information under applicable law, we will adopt standard contractual clauses or equally effective safeguards in accordance with applicable law.
8.2 Cross-border transfer. In addition to the storage arrangements described in Article 8.1, your personal information may also cross national or regional borders under the following circumstances: (1) where your country or region of residence differs from the data storage location accessed, and the relevant information is transferred between your location and the service node (including EU and UK users accessing data stored on the Singapore node); (2) where the organizational customer conducts cross-regional unified management of devices, personnel permissions, or logs in accordance with its instructions or management rules, including overseas administrators accessing data of mainland China users, or mainland China administrators accessing data of overseas users; (3) where technical support and operations/maintenance personnel located in a country or region different from the data storage location access data under controlled measures in accordance with Article 8.1; (4) when using third-party services such as maps, statistics, and performance monitoring, the relevant information may be processed by third parties in the countries or regions where their service nodes are located, and the specific third parties and their applicable regions are governed by the list in Section V of this Policy; (5) where required by statutory obligations or requests lawfully made by judicial authorities, competent regulators, or enforcement authorities, or where necessary to protect the life, health, and significant property safety of natural persons.
Where outbound transfer of personal information of mainland China users is involved, we will perform the corresponding procedures in accordance with the Personal Information Protection Law and the Provisions on Promoting and Regulating Cross-Border Data Flows. For international data transfers subject to restrictions under EU, UK, or other applicable data protection laws, we will adopt applicable data transfer mechanisms or other necessary contractual, technical, and organizational safeguards based on the actual data flows, the location of the recipients, and applicable law.
8.3 Retention period. We determine a reasonable retention period based on the processing purposes, the organizational customer's configuration, contractual arrangements, system security needs, and applicable legal requirements. Different types of information may be subject to different retention periods.
Account and organizational relationship information is generally retained during the existence of the account or the corresponding customer relationship; unlock, authorization, approval, key distribution, operation, security, and audit logs are retained based on the organizational customer's configuration, facility security, dispute resolution, and applicable legal requirements; work photos, location records, and task data are retained based on the organizational customer's business needs and actual configuration; local caches may be handled through client functions, system settings, clearing data, or uninstalling the application.
When the relevant information is no longer reasonably necessary to achieve the processing purposes, we will delete, de-identify, restrict the use of, or otherwise appropriately process it in accordance with actual system capabilities, contractual arrangements, and applicable law.
IX. Protection of Personal Information
We adopt technical and organizational measures commensurate with the system functions and processing risks, such as identity verification, permission management, transmission protection, secure protection of important data and keys, interface verification, and necessary logging. Specific security measures may be adjusted according to the product version, system architecture, and actual risks. For encryption keys, authentication credentials, and other security-sensitive information, we adopt corresponding protective measures in accordance with their security attributes.
Please properly keep your account, password, verification code, terminal, and electronic key, and do not disclose or share them with unrelated persons.
In the event of a personal information security incident that may affect individual rights and interests or system security, we will adopt corresponding handling measures based on the nature of the incident, the data processing roles of the parties, contractual arrangements, and applicable law.
X. Your Personal Information Rights
Within the scope provided by applicable law, you may have rights such as inquiry or access, copy, data portability, correction, supplementation, deletion, withdrawal of consent, restriction of or objection to processing, and the right to know or request an explanation of the processing rules. Some U.S. state laws may also grant eligible individuals the right to opt out of certain data processing, restrict the use of sensitive data, or appeal the outcome of a rights request.
You may submit relevant requests through the contact methods listed in Article XIII of this Policy. For business data whose purposes and means of processing are primarily determined by the organizational customer, you may also submit requests directly to your organization; if we receive such a request as a processor for the organizational customer, we may forward the request to the organizational customer or handle it in coordination with the customer.
Accounts are usually configured by your organization, and cancellation, permission changes, and some log processing may require administrator cooperation. For device and facility security, auditing, dispute resolution, investigation of security incidents, or fulfillment of legal obligations, some access, approval, or security records may not be immediately deletable; to the extent permitted by law, we will restrict their continued use and adopt protective measures.
We may need to take reasonable measures to verify the identity and permissions of the requester to prevent unauthorized access to or deletion of personal information. For requests that meet the conditions of applicable law, we will process them in accordance with applicable law.
We will not discriminate against you or provide unfavorable treatment prohibited by law because you exercise your privacy rights in accordance with the law.
XI. Protection of Minors
The Smart Lock Software is primarily intended for use by enterprises and organizations in work, facility management, or authorization scenarios. It does not provide general consumer services to children or minors, nor does it target minors as its users.
In principle, organizational customers should not open accounts or assign device access permissions to minors who lack the corresponding legal capacity or who do not meet the local statutory conditions. Where there is a genuine legitimate business need and applicable law permits, the organizational customer is responsible for determining the appropriate legal basis, fulfilling the necessary notification, and obtaining guardian consent or other authorization required by law.
If processing of personal information involving children or minors is discovered, the relevant processing will be handled in light of the organizational customer's actual use scenarios and applicable law. This service does not provide general consumer services to children.
XII. Policy Updates
We may update this Policy due to changes in laws and regulations, regulatory requirements, business functions, data processing practices, third-party services, or security measures. For material changes that may substantially affect the manner of personal information processing, we may provide updated information through in-product notices, websites, email, or other appropriate means.
If new processing activities require consent under the law, they will be handled in accordance with applicable law.
The "Updated" and "Effective" dates at the top of the Policy will reflect the latest version. We recommend that you review this Policy periodically.
XIII. Contact Us
If you have questions, comments, complaints, or rights requests regarding this Policy, you may contact us through the above email. We will process and respond within the time limit prescribed by applicable law after verifying the necessary identity information.
XIV. Region-Specific Supplementary Terms
14.1 EU / European Economic Area (EEA)
To the extent the GDPR applies, for business data whose purposes and means of processing are determined by the organizational customer, the organizational customer generally acts as the controller and we generally act as the processor; the data processing responsibilities of the parties are governed by applicable law, the customer contract, and the Data Processing Addendum (DPA). For information whose purposes and means of processing we independently determine for our own account security, platform security, service operation and maintenance, customer relationship management, or fulfillment of statutory obligations, we may act as the controller.
For our processing activities in which we act as controller, the applicable legal bases may include:
- Performance of a contract, or taking steps at the data subject's request prior to entering into a contract (Article 6(1)(b) GDPR);
- Compliance with a legal obligation (Article 6(1)(c));
- Legitimate interests (Article 6(1)(f)), such as safeguarding account, device, and network security, preventing fraud and unauthorized access, maintaining service stability, and improving the product after balancing rights and interests;
- Consent (Article 6(1)(a)), used only where the applicable scenario genuinely requires consent as the legal basis, and you may withdraw it in accordance with the law.
The permission controls for location, camera, Bluetooth, and other functions provided by the operating system are not exactly the same as the legal bases for processing under the GDPR.
Under the conditions prescribed by the GDPR, you may have rights such as access, rectification, erasure, restriction of processing, objection to processing, data portability, withdrawal of consent, and the right to lodge a complaint with a competent data protection supervisory authority. If we conduct automated decision-making or profiling for which notification is required by law, we will explain it separately; currently we do not rely solely on automated processing to make decisions that produce legal effects or similarly significant effects on end users.
Where restricted transfers of EEA personal data to third countries or regions are involved, the relevant processing is carried out in accordance with Article 8.2 and applicable law.
14.2 United Kingdom
To the extent the UK GDPR and the Data Protection Act 2018 apply, we will assume controller or processor responsibility according to our actual processing role. The applicable legal bases for processing, data subject rights, and security requirements are in principle consistent with the framework described in Article 14.1, and are governed by current UK law.
For restricted transfers from the UK to outside the UK, the relevant processing is carried out in accordance with Article 8.2 and applicable law.
You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) in accordance with applicable law. You may also contact us first through the contact methods in Article XIII so that we can handle your question or request.
14.3 United States
The scope of application, thresholds, consumer definitions, and exemptions of U.S. state privacy laws differ. This Article applies only when the corresponding law applies to us, the organizational customer, or the specific processing activities.
(1) Categories and purposes of personal information. We may process account and identification information, device and network information, access and unlock records, permission and approval records, precise location (when the relevant functions are enabled), work photos, logs, and other security information as described in Section II of this Policy, for providing and maintaining the Smart Lock services, identity and authorization verification, facility and device security, troubleshooting, customer support, auditing, and legal compliance.
(2) Sale, sharing, and targeted advertising. We do not sell personal information for monetary or other valuable consideration, nor do we share or process personal information for the purpose of cross-context behavioral advertising (as referred to under California law) or targeted advertising (as referred to under other state laws). If the relevant processing practices change, they will be handled in accordance with the then-applicable law.
(3) Sensitive data. Precise geolocation, account login credentials, and certain access security information may constitute "sensitive personal information" or "sensitive data" under certain state laws. We process them only to the extent reasonably necessary and appropriate for providing access control, facility security, user authorization, and other disclosed business purposes. Where applicable law grants rights to restrict use, withdraw consent, or other rights, you may submit a request through the methods in Article XIII.
(4) State privacy rights. To the extent provided by applicable law, you may have the right to access/know, obtain copies, correct, and delete personal information, and to opt out of the sale of personal information, targeted advertising, or certain profiling; some states also provide rights such as data portability, withdrawal of consent, or appeal of decisions refusing rights requests. We will determine the applicable rights based on the requester's state of residence, identity, processing scenario, and the corresponding law.
(5) California. If the CCPA/CPRA applies to our processing activities, California individuals may request to know/access, delete, and correct in accordance with the law, and where applicable, opt out of sale or sharing, limit the use and disclosure of certain sensitive personal information, and submit eligible requests through an authorized agent. We will not discriminate in a manner prohibited by law because you exercise your CCPA/CPRA rights.
(6) Appeals. If applicable state law grants you the right to appeal a decision on a privacy rights request, you may submit an appeal through the contact methods in Article XIII and indicate "Privacy Appeal / 隐私申诉" in the subject line.
For information about enterprise employees, contractors, and B2B contacts, the scope of application and exemptions of different state laws differ. For example, California law may cover certain employee or B2B-related personal information when the applicable thresholds are met, while other state laws may treat employment-context data differently. We will determine the applicable requirements based on the specific state law and processing scenario.
14.4 Mainland China
(1) Legal basis. We process your personal information in accordance with the Personal Information Protection Law, following the principles of lawfulness, legitimacy, necessity, and good faith. The legal bases include: obtaining your consent; where necessary for the conclusion or performance of a contract to which you are a party, or necessary for implementing human resources management in accordance with labor rules and regulations formulated in accordance with the law and collective contracts concluded in accordance with the law; where necessary for performing statutory duties or obligations; where necessary for responding to public health emergencies, or for protecting the life, health, and property safety of natural persons in emergency situations; and other circumstances prescribed by laws and administrative regulations.
(2) Separate consent. We will obtain your separate consent in accordance with the law (except where laws or administrative regulations provide otherwise) in the following circumstances: ① processing sensitive personal information, including precise location information, unlock and approval records that may reflect movement trajectories, account credentials, etc.; ② publicly disclosing your personal information; ③ providing your personal information to overseas recipients.
(3) Your rights. In accordance with the Personal Information Protection Law, you have the right to: know and decide, and to restrict or refuse others' processing of your personal information; access and copy your personal information, and, where the conditions prescribed by the national cyberspace administration are met, request the transfer of your personal information to a processor you designate; request correction and supplementation; and request deletion.
(4) Children's personal information. The personal information of minors under the age of fourteen is sensitive personal information. The services under this Policy are not directed to children; where the processing of children's personal information is genuinely necessary due to the organizational customer's actual use scenario, the organizational customer shall ensure that consent of the child's parent or guardian is obtained before processing (processed as sensitive personal information with separate consent), formulate special processing rules, and adopt strict protective measures.
(5) Entrusted processing role. As an independent personal information processor, the organizational customer bears processor obligations under the Personal Information Protection Law for information whose purposes and means of processing it determines; we, as the entrusted processor, process the relevant personal information in accordance with the agreement with the organizational customer and legal provisions, and assist the organizational customer in responding to your exercise of the above rights.
14.5 Other Regions
If the personal information or data protection laws of your jurisdiction impose other mandatory provisions on the matters of this Policy, the relevant processing will be carried out in accordance with applicable law.