Addendum for California Residents

This section applies to California residents covered by the California Consumer Privacy Act of 2018 (“CCPA”).

The CCPA provides California residents with certain legal rights such as access, deletion, disclosure, or “do not sell.” These rights are not absolute and are subject to certain exceptions.

Collection and Disclosure of Personal Information

Over the past 12 months, through your use of WeChat, we may have collected and disclosed the following categories of Personal Information from or about consumers, as defined in the CCPA:

• Identifiers, such as phone number, name, alias, token, username, IP address, mobile application store user ID, mailing address, emergency contact information, and contact list. This information is collected directly from the consumer or device;
• Geolocation data, including geolocation information derived from GPS coordinates, Wi-Fi access points, IP address, and public posts. This information is collected directly from the consumer or device, and we obtain consumer consent prior to collecting any “precise geolocation” data (as defined under the CCPA), which is considered “sensitive” under the CCPA;
• Internet or other electronic network activity information, including your device model, network type, OS type and version, client version, call history, chat data, invitations data, call credits history, search history, log data, information related to third party accounts that you have linked to WeChat, and survey information. This information is collected directly from a device;
• Commercial information, including payment card information and transaction verification information. This information is collected directly from the consumer or device;
• Audio, electronic, visual, or similar information, including a profile picture. This information is collected directly from the consumer; and
• Other information that is described in subdivision (e) of Section 1798.80, such as nationality and gender (this information is being collected in the consumer context rather than the employer context). This information is collected directly from the consumer.

We collect Personal Information for the following purposes:

• To operate and administer WeChat;
• To communicate with consumers;
• To improve our services;
• For security and verification purposes, including to prevent and detect fraudulent activity; and
• To address and remediate technical issues and bugs.

For additional information about how each type of Personal Information is used and retained, see the main portion of the Privacy Policy.

We may disclose each of the categories of Personal Information identified in the Privacy Policy to the following types of entities:

• Related group companies within our corporate group who process your Personal Information in order to operate the services (as described in the section “Who Do We Share Your Data With” of the Privacy Policy);
• Other companies that provide services on our behalf who are prohibited by contract from retaining, using, or disclosing Personal Information for any purpose other than for providing such services to us;
• Other users of WeChat and Weixin with respect to Personal Information you publicly post through WeChat;
• Official Accounts and Mini Program operators, and other third party services which you choose to use your WeChat account for login;
• Regulators and judicial authorities and law enforcement agencies; and
• Entities that acquire all or substantially all of our business.

We do not sell or share personal information and in the past 12 months, we have not sold or shared personal information of California residents within the meaning of “sold” or “shared” in the CCPA. Further, we do not have actual knowledge that we “sell” or “share” personal information of residents under 16 years of age.

Rights under the CCPA

If you are a California resident and the CCPA does not recognize an exemption that applies to you or your Personal Information, you have the right to:

• Request we disclose to you free of charge the following information covering the 12 months preceding your request:
  • the categories of Personal Information about you that we collected;
  • the categories of sources from which the Personal Information was collected;
  • the purpose for collecting Personal Information about you;
  • the categories of third parties to whom we disclosed Personal Information about you and the categories of Personal Information that was disclosed (if applicable) and the purpose for disclosing the Personal Information about you; and
  • the specific pieces of Personal Information we collected about you;
• Request we delete Personal Information we collected from you, unless CCPA recognizes an exemption;
• Request that we correct inaccurate personal information we maintain about you; and
• Be free from unlawful discrimination for exercising your rights including providing a different level or quality of services or deny goods or services to you when you exercise your rights under the CCPA.

We aim to fulfill all verified requests within 45 days pursuant to the CCPA. If necessary, extensions for an additional 45 days will be accompanied by an explanation for the delay.

Please note that in order to protect your information, we will need to verify your identity before responding to any request to exercise your rights. In some cases we may need to collect additional information to verify your identity, such as a government issued ID.

How to Exercise Your Rights

First, you may wish to log into your account and manage your data from there. If you are a California resident to whom the CCPA applies, you may exercise your rights, if any, to other data by contacting us at dataprotection@wechat.com or by submitting a request here.

Under the CCPA, you may exercise these rights yourself or you may designate an authorized agent to make these requests on your behalf by contacting us at dataprotection@wechat.com. For requests by an authorized agent, we may require you to directly verify your identity with us, and confirm with us that you provided the authorized agent permission to submit the request.

Other U.S. States

This section applies to U.S. residents who live in states that have comprehensive privacy laws similar to the CCPA that apply to us. If you are a California resident, please see the section above, California, for information on your rights in relation to information that we have collected about you.

Sensitive Data Collection

For certain WeChat features, such as sharing of location via chat, geo-tagging a location in Moments and Status, People Nearby and Shake, we may collect geolocation data from U.S. residents that could be considered “precise geolocation data” under applicable U.S. state privacy laws. We do not collect such data without obtaining your consent. We may also collect information from children under the age of 13 who use WeChat, but only after obtaining parental/guardian consent.

Rights under U.S. State Privacy Laws

Depending on the state you live in, you may have some or all of the rights listed below in relation to information that we have collected about you. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law, including in the event you reside in a state that does not currently grant you these rights.

• Right to request that we confirm whether we process information about you and give you access to that information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another business without impediment;
• Right to request that we delete information we maintain about you; and
• Right to request that we correct inaccurate information we maintain about you.

Note that we do not process your information for the purposes of targeted advertising, profiling in furtherance of decisions that produce legal or similarly significant effects, or selling your information (as all such terms and concepts are defined under applicable U.S. state privacy laws).

How to Exercise Your Rights

You may exercise any of these rights by contacting us at dataprotection@wechat.com or by submitting a request here. We will not discriminate against you for exercising any of these rights. We may need to collect additional information to verify your identity, such as your email address or a government issued ID. Depending on your location, you may designate, in writing or through a power of attorney document, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us.

Right to Appeal

In addition, you may have the right to appeal our decision regarding a request related to these rights by contacting us at dataprotection@wechat.com. When you submit a request or launch an appeal, we will limit our collection of your information to only what is necessary to securely fulfil your request or process your appeal. We will not require you or your authorized agent to pay a fee for the verification of your request or appeal.

Republic of Korea

The following section applies for the purposes of users located in Korea only.

Children under the age of 14 must not use WeChat for any purpose without first obtaining parental/guardian consent to the Privacy Policy (both for the parent/guardian themself and on their child's behalf). We do not knowingly collect Personal Information from any children under the age of 14 without such consent. Please contact our Data Protection Officer if you believe we have any Personal Information from any children under the age of 14 without such parental/guardian consent – we will promptly investigate (and remove) such Personal Information.

The Personal Information (including your personal location information) we provide to third parties located outside of Korea for the WeChat service is as follows:

The mandatory retention periods for Personal Information required by law in Korea is as follows:

Destruction of Personal Information

We destroy Personal Information upon the extinguishment of need for such Personal Information, such as the expiration of its retention period and achievement of its purpose for processing, except where there is a law or regulation that requires us to retain that Personal Information. Inactive accounts are automatically deleted after 180 days (except if you have a positive balance in your WeChat Pay or Weixin Pay account or are the administrator of an Official Account or Mini Program).

The destruction procedure of Personal Information (including your personal location information) is as follows:

• Destruction procedure : Personal Information that needs to be destroyed is destroyed in accordance with our data deletion and retention protocols under the supervision of our Data Protection Officer.
• Destruction method : We destroy Personal Information recorded and saved in electronic format via methods such as Low Level Format so as to disable the reproduction thereof; and Personal Information recorded and saved in hardcopy via grinder or incineration.

Domestic Privacy Representative

Pursuant to the Article 32-5 of Act on the Promotion of the Use of the Information Network and Information Protection, the information regarding the domestic agent is as follows:

• Name: Tencent Korea Yuhan Hoesa
• Address: 152, Taeheran-ro, Gangnam-gu (Gangnam Finance Center, Yeoksam-dong), Seoul, Korea
• E-mail: dataprotection@wechat.com

Personal Location Information

Purposes for which your personal location information is processed: To provide location information-based services as described in our Terms and Conditions of Location-Based Service.

Period for retaining your personal location information: Retained for the minimum period necessary to provide you with location-based services.

Grounds for retaining the data verifying the collection, use and provision of location information and period of retaining the data: In accordance with Article 16(2) of the Act on the Protection and Use of Location Information ("Location Information Act"), we will automatically record data verifying the collection, use, and provision of location information in a location information system, and preserve the data for 6 months or longer.

Notification under the Article 19(3) of the Location Information Act: After you share your personal location information with a third party, we may be required to notify you of the relevant details (i.e. who will get the information, as well as the date, time and purpose of the sharing) via WeChat or other permitted methods.

Rights of the legal guardian of a child and methods for exercising those rights under the Article 26(1) of the Location Information Act: Where the legal guardian of any of the following persons (hereinafter referred to as "Child"):

• (i) a child of eight years old or younger;
• (ii) a person under adult guardianship; or
• (iii) a person with a mental disorder defined in Article 2(2) 2 of the Act on Welfare of Persons with Disabilities, classified as a person with a severe disability defined in subparagraph 2 of Article 2 of the Act on the Employment Promotion and Vocational Rehabilitation of Persons with Disabilities (limited to those registered as disabled persons under Article 32 of the Act on Welfare of Persons with Disabilities);

gives consent to the use or provision of personal location information regarding the child, for the protection of the child's health or safety, we shall deem that the child has consented to such use or provision.

For the protection of the health or safety of the child, the legal guardian who intends to consent to the use or provision of personal location information of the child must submit a written consent to us at dataprotection@wechat.com along with a document proving that he/she is the legal guardian.

The legal guardian can exercise all of the rights of the subject of personal location information if he/she agrees to the use or provision of personal location information for a child.

Contact Information of Location Information Officer:

• E-mail: dataprotection@wechat.com