API Privacy Policy of Imou Cloud Open Platform - Imou Open Platform

API Privacy Policy of Imou Cloud Open Platform

Last modified: August 29, 2024

Welcome to use Imou Cloud Open Platform API ("API")!

This API, i.e. application programming interface, provides developers ("Developer") of smart device management applications (including mobile and PC applications and websites, collectively referred to as "Application") with service capabilities such as device management, account docking, push configuration, cloud storage services and smart recognition. After integrating this API into its Application, Developer can provide its Application end-user (“End-user”) with services related to smart device management, cloud storage and other related services.

This API only provides services for the Developer. When Developer uses this API, Developer will collect and process its End-user’s personal information on its own, and Hangzhou Huacheng Network Technology Co., Ltd. (“Imou”) will not collect any identifiable personal information of End-user. This privacy policy (“Policy”) is intended to help Developer and End-user understands how Imou collects and uses Developer’s Application-related information when the API is integrated and used. Developer shall read this Policy carefully and integrate and use the API only after confirming that it has fully understand and agreed.

Special Note: 1. If Developer integrates this API into its application, the Developer shall undertake the followings:
(1) Developer shall comply with all applicable laws, policies and regulations regarding the collection and use of End-user’s personal information and protect the security of users’ personal information. If Developer believes that the use of this API will cause its Application to be non-compliant with applicable laws, policies or regulations, it shall contact us or stop using this API.
(2) Developer shall notify End-user of the integration of this API in its Applications, as well as the rules governing the collection, use and protection of End-user’s personal information using this API (i.e. this privacy policy), in a prominent position in its Application or in other ways that can reach End-user (including but not limited to: providing a link to this privacy policy in a conspicuous place in the Application’s user agreement or privacy policy where the End-user can browse this privacy policy).
(3) Developer shall provide End-user with an easy-to-operate mechanism for realizing user rights such as accessing, correcting, and deleting his/her personal information, revoking or changing his/her authorization consent, and canceling his/her personal account.
2. Imou hopes that Developer’s Application that integrates the API collects and uses End-user’s personal information in a legal and compliant manner, but Imou does not know and cannot control how the Developer and its Applications use End-user’s personal information under its control, and therefore Imou should not be held responsible for Developer’s actions. Imou recommends that End-user carefully read the user agreements and privacy policies related to Developer’s Application, and use the Developer’s Applications only after End-user fully understands and agrees to how the Developer collects and uses End-user’s personal information.
3. This privacy policy applies only to the API. The privacy policy of third parties applies to third-party services displayed in the API or third-party services linked to this API. Although third parties are displayed in or linked to this API in certain circumstances, Imou does not know or control third party’s behavior, and therefore Imou will not be responsible for third party’s behavior. Imou recommends that End-user carefully read the user agreement and privacy policy of the Developer’s Application, and use the Developer’s Application only after he/she fully understands and agrees to how the Developer collects and uses End-user’s personal information.
4. The specific API function obtained by End-user is selected by the Developer according to the needs of its Application, which may vary due to the different Developer’s Application used by the End-user. If certain service content is not covered or specific functions are not provided in some Developer’s Application versions, the content of this privacy policy involving the above services/functions and related personal information will not apply.

This privacy policy will help Developer and End-user understand the following. Developer is requested to read this Privacy Policy carefully and confirm that it has fully understand and agree to it before integrating and/or use this API:
1.Definition
2.How does Imou collect and use Developer’ personal information?
3.How does Imou share, transfer, and publicly disclose Developer’ personal information?
4.How does Imou protect and store Developer’ personal information?
5.International Transfer
6.Developer’s Rights
7.How does Imou handle children’s personal information?
8.Changes to this Policy
9.How to contact Imou

1. Definition

1.1 Anonymizatio: The process of making the subject of personal information unidentifiable and the processed information unrecoverable through technical processing of personal information. The information obtained after anonymization does not belong to personal information.
1.2 API: refers to the functional interface opened by Imou on its Imou Cloud Open Platform after encapsulation based on Imou Cloud service capabilities.
1.3 Application: refers to an application and related services that are developed and created by the Developer in its own name, enjoy legal operating rights, operate and independently bear legal responsibilities, and integrate this API after being registered on Imou Cloud Open Platform.
1.4 Children: minors under the age of sixteen, or equivalent minimum age in the relevant jurisdiction.
1.5 Client device: refers to the mobile terminal device used by the End-user.
1.6 De-identification: The process of making it impossible to identify or associate the subject of personal information without the help of additional information through technical processing of personal information.
1.7 Developer: refers to an individual, legal person or other organization that has effectively applied and registered on Imou Cloud Open Platform, and provides various services directly to End-users by developing, creating or obtaining legal authorization to operate applications that integrate this API in its own name and independently bears legal responsibility.
1.8 Imou Cloud Open Platform: refers to the website (https://open.imoulife.com/) and the subordinate sub-pages of the aforementioned platform website that owned, controlled and operated by Hangzhou Huacheng Network Technology Co., Ltd., hereinafter referred to as "Open Platform" or "Platform".
1.9 Personal information: refers to any information recorded electronically or otherwise that can identify a specific natural person or reflect the activities of a specific natural person alone or in combination with other information.
1.10 Personal sensitive information: Personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions or offences.

2. How does Imou collect and use Developer’s personal information

By integrating into Developer’s application with API via Imou’s cloud open platform, Developer can provide device management, account docking, push configuration, cloud storage services and other services to its End-user. In order to achieve these services, Imou will collect below information:
(1) Account information, including administrator account information and sub-account information.
(2) Client device information, including operating system and system language Settings.
(3) Monitoring device information, including device serial number and channel number.
(4) Operation log information, including error code, cost (operation time), and start time (operation start time).
(5) Picture information, including vehicle pictures, face pictures, humanoid pictures.
Please note that client device information, monitoring device information and operation logs are the basic information needed to ensure the normal operation of API services via Imou cloud open platform, and the identity information of a specific natural person cannot be identified. If Imou combines such non-personal information with other information to identify a specific natural person, it may be regarded as personal information, in which case, Imou will obtain authorization from Developer (except as otherwise provided by law) and anonymize and de-identify the above information. Face pictures and humanoid pictures are personal sensitive information, Developer must ensure that it has obtained the authorization consent of its End-user and ensure that its End-user agrees to Imou’s collection.
Apart from the detail activities specified above, Imou may process Developer’s personal data which is permitted or required by applicable laws without seeking authorization and consent in the following circumstances:
1)Processing is necessary for the performance of a contract or in order to take steps at Developer’s request prior to entering into a contract.
2)Processing is necessary for compliance with a legal obligation.
3)Processing is necessary in order to protect the vital interests of data subject or of another natural person.
4)Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested.
5)Processing is necessary for the purposes of the legitimate interests pursued by Imou or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of data subject, in particular where the data subject is a child.
6)Other lawfulness of processing as specified in applicable laws.

Imou may share, assign or disclose Developer’s personal data with Imou’s affiliated companies or third parties in the following circumstances:
1)Upon Developer’s explicit consent:
Imou may share, assign or disclose Developer’s personal data with third parties after obtaining Developer’s explicit consent or where Developer provides initiatively to Imou. Developer shall be fully responsible and liable for the personal data obtained from other resources or from other data subjects.
2)Trusted third parties:
Imou may share, assign or disclose Developer’s personal data with certain trusted third parties that perform business functions for Imou or provide services to Imou, being Imou’s subsidiaries and affiliates; or contractors, service providers, and other third parties Imou use to support its business and who are bound by contractual obligations to keep personal data confidential and use it only for the purposes for which Imou disclose it to them.
3)Required by applicable laws:
Imou may share, assign or disclose Developer’s personal data to comply with applicable legal requirements such as court order, legal process, including to respond to any government or regulatory authority’s request or for investigations (e.g. disclosure to prevent crime or fraud, or to comply with a court order or legislation).
4)Merger, acquisition or bankruptcy:
Imou may share, assign or disclose Developer’s personal data where there is a merger, acquisition or bankruptcy procedure. Imou will require the successor who holds Developer’s personal data to continue to perform the obligations in accordance with this Policy.
5)Public Interest:
Imou may share, assign or disclose Developer’s personal data for public interest purpose, such as to deal with public health emergencies, or, in case of emergency, to protect the health of natural persons and the safety of their property.

4. How does Imou protect and retain Developer’ personal information?

4.1 Data security measures

(a) Imou attaches great importance to information security and privacy protection. Imou strives to take appropriate physical, technical and management security measures to protect personal information and prevent personal information from being accessed, disclosed, used, modified, damaged or lost without authorization. For instance, Imou uses encryption technology to improve the security of personal information and trusted protection mechanisms to prevent personal information from being maliciously attacked, and deploys access control mechanisms to ensure that only authorized personnel can access personal information.
(b) Imou has passed the following certifications related to information security and privacy protection: Information Security Level Protection Level 3 Certification, ISO 27001 Information Security Management System Certification, ISO 27017 Cloud Service Information Security Management System Certification, ISO 27018 Cloud Personal Data (PII) Privacy Protection Certification, ISO 27701 Privacy Information Management System Certification, CSA STAR Cloud Security Certification, ITSS Cloud Service SaaS Service Level 3 Certification and Service Privacy Protection Certification in line with GDPR.
(c) Imou strongly recommends that Developer use complex passwords to ensure account security. Imou will try its best to ensure the security of any information sent by the Developer. Notwithstanding the above, no method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, Imou cannot guarantee that Developer’s information is under absolute security with the existing security technology. Developer is requested to properly protect his/her personal information and only provide or share it with others when necessary. If the Developer finds that its personal information has been leaked, especially if its account and password have been leaked, the Developer shall contact Imou immediately so that Imou can assist in taking appropriate measures.
(d) If a security incident such as personal information leakage occurs, Imou will handle it as required by applicable data protection law which includes, where required, notifying the incident to the relevant data protection supervisory authority and data subjects.

4.2 The retention of personal data

Imou will retain Developer’s personal data for no longer than it is necessary for the purposes stated in this Policy, unless otherwise extending the retention period is required or permitted by applicable laws and regulations. To determine the appropriate retention period for personal data, Imou may consider the amount, nature and sensitivity of the personal data, the potential risk from unauthorized use or disclosure of Developer’s personal data, the purposes for which Imou processes Developer’s personal data and whether Imou can achieve those purposes through other channels. If Developer wants to learn more about the retention period of his/her personal data, he/she may directly contact Imou at cloud_openteam_intl@imou.com.

5. International Transfers

Since Imou has affiliates around the world to offer services and Imou may store Developer’s personal data on Imou’s servers located in different countries. In light of this, Developer’s personal data may be transferred outside the region or country where Developer uses or integrates the API, which may have different legal rules and level of protection on personal data. In such circumstances, Imou will take necessary measures to ensure that Developer’s personal data is processed in conformity with the applicable laws, including obtaining Developer’s consent to the cross-border transfer of his/her personal data, signing standard contractual clauses approved by the EU Commission when necessary, and taking appropriate technical security measures to safeguard Developer’s personal data.

6. Developer’s Rights

Developer can send Imou an email at cloud_openteam_intl@imou.com or by entering into【Imou Cloud Open Platform – Console – Work Order】 to request exercising its rights in relation to its personal data. Developer may also object to or request Imou to restrict the processing of its personal data. If Imou process Developer’s personal data based on its consent, Developer may withdraw its consent at any time by contacting Imou at cloud_openteam_intl@imou.com. A summary of Developer’s legal rights is set out below:

Request access to Developer’s personal data (commonly known as a “data subject access request”). This enables Developer to receive a copy of the personal data Imou holds about Developer and to check that Imou is lawfully processing it by entering into【Imou Cloud Open Platform – Console – Basic Information】.
Request correction of the personal data that Imou holds about Developer. This enables Developer to have any incomplete or inaccurate data Imou holds corrected by entering into【Imou Cloud Open Platform – Console – Basic Information】, though Imou may need to verify the accuracy of the new data Developer later provides to Imou.
Request erasure of Developer’s personal data. This enables Developer to ask Imou to delete or remove its personal data where there is no good reason for Imou continuing to process it. Developer also has the right to ask Imou to delete or remove its personal data where Developer has successfully exercised its right to object to processing (see below), where Imou may have processed its data unlawfully or where Imou is required to erase its personal data to comply with local law. However, for specific legal reasons, such as it is legally mandatory for Imou to retain Developer’s personal data, Imou may not be able to comply with Developer’s request of erasure but Imou will notify Developer at the time of Developer’s request in such circumstance, if applicable.
Object to processing of Developer’s personal data where Imou is relying on a legitimate interest (or those of a third party) and there is something about Developer’s particular situation which makes Developer want to object to processing on this ground as Developer feels it impacts on its fundamental rights and freedoms. Developer also has the right to object where Imou is processing its personal data for direct marketing purposes. In some cases, Imou may demonstrate that Imou has compelling legitimate grounds to process Developer’s personal data which override Developer’s rights and freedoms.
Request restriction of processing of Developer’s personal data. This enables Developer to ask Imou to suspend the processing of Developer’s personal data in the following scenarios: (a) if Developer wants Imou to establish the data's accuracy; (b) where Imou’s use of the data is unlawful but Developer does not want Imou to erase it; (c) where Developer needs Imou to hold the data even if Imou no longer requires it as Developer needs it to establish, exercise or defend legal claims; or (d) Developer has objected to Imou’s use of Developer’s data but Imou needs to verify whether Imou has overriding legitimate grounds to use it.
Request the transfer of Developer’s personal data to Developer itself or to a third party. Imou will provide to Developer, or a third party Developer has chosen, Developer’s personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated data which Developer initially provided consent for Imou to use or where Imou used the data to perform a contract with Developer.
Withdraw consent at any time where Imou is relying on consent to process Developer’s personal data. However, this will not affect the lawfulness of any processing carried out before Developer’s withdraw its consent. If Developer withdraws its consent, Imou may not be able to provide certain functions or services of the API to Developer. Imou will advise Developer if this is the case at the time Developer withdraws its consent.
For security reasons, Imou may take steps to authenticate Developer’s identity before providing access to the personal data. Developer has the right to lodge a complaint with the relevant Data Protection Authority.

7. How does Imou handle children’s personal information?

This API is mainly for adults. If the Developer is a minor under the age of 16, or equivalent minimum age in the relevant jurisdiction (refer to “Child” or “Children” below), please be sure to read this Policy carefully under the supervision and guidance of its parents or other legal guardians before using the API, and use the API or provide personal information only with the consent of its legal guardian. If Developer collects or submits a Child's personal information to Imou via using the API for the purpose of, for example, interacting with Children, the Developer shall ensure that it has obtained the prior authorized consent of the Child's legal guardian. If a Child's legal guardian has reason to believe that the Child has submitted personal information to Imou without his or her prior consent, please contact Imou via the contact information in this Policy to request correction or deletion of the relevant content involving the Child's personal information. If Imou finds it collecting personal information of a Child without prior verifiable parental or legal guardian consent, Imou will delete that the Child’s personal data unilaterally, unless otherwise the processing is permitted by applicable law or deemed necessary for the protection of the Child.

8. Changes to this policy

Imou will keep this Policy under review and may modify this Policy from time to time. If there is any major changes to this Policy, Imou will notify Developer through different channels, for example, by posting a pop-out notice on the App to notify the major changes or announcing the changes on the main exposure page of the official website of Imou Cloud Open Platform. If Developer does not agree to such changes, it shall stop integrating/using this API. If Developer continues to integrate/use the API, it shall be deemed that Developer agrees to be bound by the revised Privacy Policy.

9. How to contact Imou

If Developer has any question or comment on this Policy, please contact Imou through email at cloud_openteam_intl@imou.com, or by mail at:
Hangzhou Huacheng Network Technology Co., Ltd
Room 101, Building 1, No. 1866, Binxing Road, Changhe Sub-district, Binjiang District
Hangzhou, Zhejiang Province, P.R. China
310053