Kumu App Privacy Policy (v2.0)

At kumu, as part of our commitment to create a safe space, we are working our best to ensure that your privacy is respected and your Personal Data is protected. 

Thus, we want you to take a moment and understand what data we obtain about you and our data privacy practices and policies, so you can make an informed decision and exercise meaningful control over your data.

This Privacy Policy will take effect on August 15, 2022. For the old version of the policy click here.

HIGHLIGHTS 

You should read our Privacy Policy in its entirety, but here are a few key points we hope you will take away:

• Kumu is accessible to the general public from anywhere in the world. When you livestream, create a profile, follow a streamer, give virtual gifts, participate in campaigns or post a clip on kumu that are public or intended to be public in nature, individuals that use kumu will access this information and may have the ability to acquire, use, or reveal such information to others. Furthermore, several of our Services (as defined below) are intended to offer others with information on user behavior, such as virtual gifting or a follow to a streamer. We advise you to keep this in mind when using kumu. However, we also provide non-public communication channels on kumu, such as private streaming and chat.
• When you participate in campaigns sponsored by our Business Partners (i.e. any company or individual which transacts business with Kumu, including but not limited to advertisers and merchants), we may share your Personal Data with them in accordance with the terms and conditions of the campaigns. For example, if you participate in DTI (Philippines) registered campaigns of a Business Partner, we may share your information with DTI (Philippines) as part our legal obligation and with the Business Partner as part of our contractual obligation.
• When you purchase products from our Business Partners, we may share your Personal Data with them to fulfill your orders and to third party service providers for the delivery of your ordered products.
• We collect certain Personal Data (e.g. information regarding the device you’re using, IP address, etc.) from you when you use kumu, even if you’re simply browsing livestreams. We use this information to keep the platform safe and to offer you more relevant content, suggested users and advertisements.
• We want to hear from you if you have any concerns regarding this Privacy Policy, how we collect or use your Personal Data, or anything else relating to our policies or practices at kumu. You are welcome to contact us at any time using the contact details set out at the end of the Privacy Policy.

APPLICABILITY 

This Privacy Policy is applicable to the collection and use of Personal Data by KumuMedia International Pte. Ltd. (“kumu,” “we,” “us,” or “our”).  It describes kumu’s practices regarding the collection, use, disclosure, sale and other processing of Personal Data when you: 

• use kumu products and services (e.g. websites, applications, or services supplied, owned, or operated by kumu) which we refer to collectively in this Privacy Policy as our “Services,” or
• otherwise communicate with us 

Kumu acts as the “controller” of your Personal Data for the activities described in this Privacy Policy. That means kumu is the legal entity deciding why and how your Personal Data is collected and used.

EXTERNAL PARTY SITES

Our Services may contain links to other websites [and apps] that we do not operate, which may have privacy policies that differ from our own. If you click on a third party link, you may be directed to that third party’s website [or app landing page]. We strongly advise you to review the privacy policy of every third party site and/or app that you visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites, apps or services.

WHAT PERSONAL DATA DO WE COLLECT – CATEGORIES AND SOURCES 

For purposes of this Privacy Policy, “Personal Data” means any data that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.  This implies that Personal Data includes information that directly identifies you, such as your name, as well as information that can reasonably be used to identify you, such as your device number in certain circumstances. Personal data does not include aggregated data (which does not identify a particular individual). 

USER-PROVIDED AND AUTOMATICALLY-COLLECTED PERSONAL DATA 

We may collect the following categories of Personal Data from you when you [download our app], create an account, stream through our Services, participate in our campaigns and challenges, post klips, use our chat services, purchase coins and share virtual gifts through our Services, contact us (including via social media), participate in our surveys and events, purchase a product in our kumu shop, or otherwise interact with us by using our Services.

USER-PROVIDED PERSONAL DATA

• Personal identifiers. Name, email address, physical address, phone number, [social media account names], registered devices, gender, in-game username (for gaming tournaments and competitions) and age
• Payment Information. Information about billing address and payment method, such as bank account information, credit, debit, or other payment card information
• Transaction Information. Data about purchases and use of services or transactions facilitated by kumu, including purchases made through the Services 
• Usage Information.  Audio, videos, images, and other information uploaded, viewed ,shared and downloaded on and from the Services; interactions and exchanges with other users (e.g. chat, stream, etc.)
• Government ID Data. We may request a government-issued ID in some instances, such as for verification of your identity, or as required by law
• Other Information You Provide to Us. The content of your kumu correspondence, including exchanges with our customer support (including social media) 
• Inferences Drawn From your Data. Inferences we make based upon your interests and viewing preferences 

AUTOMATICALLY-COLLECTED DATA

When you use our Services, we use cookies and other technologies to automatically collect, record, store and otherwise process the following types of Personal Data:  

• Usage Data. Data about your activities on and use of our Services, such as app launches inside our Services, browser history, product engagement, IP address or other unique identifiers, and other information regarding your interaction with our Services and our advertisements
• Device Information. Data that can be used to identify your device, such as the device ID, or information about the device, such as the browser type

We use Google Analytics to evaluate the use of our website. Google Analytics uses cookies and other identifiers to collect information, such as how often users visit a website, what pages they visit when they do so, and what other websites they visited prior to visiting a website. To learn more about how Google Analytics collects Personal Data, review Google’s Privacy Policy.

To learn more about cookies, please check our cookie policy here

INFORMATION FROM OTHER SOURCES

kumu may receive Personal Data about you from other individuals, from businesses or third parties acting at your direction, from our Business Partners such as social media platforms with which you interact, and from third parties that work with us to provide our products and services and assist us with security and fraud prevention and improving our Services.

For instance, we may acquire your Personal Data from social media networks (such as Facebook). By accessing or connecting our Services through social media, you authorize kumu to collect, retain, and otherwise process such Personal Data in accordance with this Privacy Policy and our Terms of Use.

HOW KUMU USES YOUR PERSONAL DATA

Kumu processes the following types of Personal Data for the following purposes and in reliance on the following legal bases: 

You have a right to object to the processing of your personal information where that processing is carried out for our legitimate interests. Please note however that we may not be able to fulfill this request in all instances. You are able to request a copy of the legitimate interest assessment carried out by us.

Where we need to collect the abovementioned categories of Personal Data by virtue of a legal obligation or in light of a contract entered or to be entered into with you, and you do not provide this Personal Data when requested, we may not be able to comply with our legal obligations, provide you with a service or perform the contract we have or are trying to enter into with you. In such case, we may have to terminate our relationship with you.

KUMU’S SHARING OF PERSONAL DATA

 We may share or disclose your Personal Data to the following third parties: 

SERVICE PROVIDERS

We disclose Personal Data to service providers who work on our behalf, such as those that:

• provide website hosting, maintenance, and security services
• provide specific functionality
• assist kumu in improving the kumu Services and developing new services and features
• fulfill, distribute and process returns of products,  orders or contest prizes
• conduct data analysis and report creation
• process payments
• prevent, detect, and investigate fraud or other prohibited actions 

BUSINESS PARTNERS

Campaigns, Contests and Gaming Tournament partners. When you participate in campaigns, challenges and competitions sponsored by our partners, we may disclose your personal data to them in accordance with the terms and conditions of the said campaign, challenge or competition.

Partner merchants. When you purchase product from our kumu shop, we share your personal data with the shop merchants to fulfill your orders, process payment and delivery, return of your orders.

We may also share aggregated, anonymized data with our Business Partners and advertising clients, such as user segment statistics.

LAW AND PUBLIC INTEREST

We may disclose your Personal Data if we believe it is reasonably necessary to comply with law, regulation, legal process, or governmental requests such as court orders, subpoenas, or warrants in the manner allowed by law.

We may also disclose Personal Data when we believe, in good faith, that disclosure is appropriate or reasonably necessary to protect kumu from fraudulent, abusive, or unlawful uses; to investigate and defend ourselves against third-party claims or allegations; to protect the security or integrity of kumu; or to protect the rights, property, or safety of kumu, our users, or others.

AFFILIATES AND CHANGE OF OWNERSHIP

We may also disclose your Personal Data to kumu affiliates (companies controlled by, controlling, or under common control with kumu) and subsidiaries that are either subject to this Privacy Policy or implement standards that are at least as protective as those specified in this Privacy Policy.

Your Personal Data may also be transferred as part of a bankruptcy, merger, acquisition, reorganization, or sale of kumu assets if we are involved in such a transaction, including any evaluation of such a transaction.

HOW DOES KUMU OPERATE AND TRANSFER PERSONAL DATA GLOBALLY

Your information, including Personal Data, is processed at kumu’s operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to — and maintained on — computers/servers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction.

kumu will take all steps reasonably necessary to ensure that your data is transferred securely and in accordance with this Privacy Policy, and applicable laws, and no transfer of your Personal Data will take place to an organization or a country unless there are adequate controls in place including with respect to the security of your Personal Data.

HOW LONG KUMU STORES YOUR PERSONAL DATA

kumu will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy or as required or permitted by applicable laws. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our contractual agreements and policies.

We will cease to retain your Personal Data, or remove the means by which the data can be associated with you, as soon as it is reasonable to assume that such retention no longer serves the purpose for which the Personal Data was collected, and is no longer necessary for legal or business purposes.

HOW KUMU SECURES YOUR PERSONAL DATA

To safeguard your Personal Data from unauthorized access, collection, use, disclosure, copying, modification, disposal or similar risks, we have put in place reasonable and appropriate administrative, physical and technical measures. 

You should be aware, however, that no method of transmission over the Internet or method of electronic storage is completely secure. Data security incidents and breaches can occur due to a variety of factors that cannot reasonably be prevented; therefore, our safeguards may not always be adequate to prevent all breaches of security.  

YOUR PRIVACY RIGHTS AND MANAGING YOUR PERSONAL DATA

CALIFORNIA RESIDENTS

California residents may have specific rights with respect to the Personal Data we collect.  Click [here] for additional information about California residents’ rights and disclosures of our privacy practices as required under applicable California law.

PRIVACY RIGHTS

We generally rely on Personal Data provided by you (or your authorized representative). In order to ensure that your Personal Data is current, complete and accurate, please update us if there are changes to your Personal Data.

Subject to certain restrictions and limitations, you have certain rights in respect of your Personal Data. In particular, you have the following rights:

• Right to access – to receive a copy of your Personal Data. We will have to adequately verify your identity before any action can be taken;
• Right to rectification – to request for amendments to be made to your Personal Data where this is inaccurate or incorrect;
• Right to restriction – to ask that we restrict or suppress the processing of your Personal Data which means that whilst we are permitted to store the Personal Data we cannot otherwise process it;
• Right to erasure – to request for the deletion of your Personal Data that we hold. However, we may not always be able to delete your Personal Data for legal and regulatory reasons;
• Right to object – to object to the processing of your Personal Data which we carry out in reliance on our legitimate interests. In such instances, we will investigate to see if there is compelling reason for processing to continue. You cannot object to the processing which is a legal obligation or where we must process your Personal Data to satisfy a contract to which you are a party. Also, you can object to marketing communications at any time;
• Right to withdraw you consent – to withdraw your consent to the processing of your Personal Data at any time (where kumu is processing your personal information based on your consent). Please note that withdrawing your consent may prevent us from further providing all or part of our Services to you but does not affect the lawfulness of our processing of your Personal Data based on such consent before the withdrawal;
• Right to data portability – to receive certain Personal Data that you have provided to us, in a machine-readable form and/or that we transmit it to a third party with your express authorisation; and
• Right to lodge a complaint –to complain to the relevant supervisory authority if your privacy rights are violated, or if you have suffered as a result of unlawful processing of your Personal Data.

We may ask you for identifying information and attempt to match it to information that we maintain about you. If we can’t verify your identity or authority to make the request, and confirm the Personal Data belongs to you, we won’t be able to complete your request. We will notify you to inform you of this. You do not need to create an account with us to make a verifiable request. Personal data submitted in a verifiable request will only be used to confirm the requestor’s identity or permission to make the request. 

If you would like to exercise your rights, please contact the Data Protection Officer using the contact details below. 

To the extent permitted under applicable data protection laws, we may charge a reasonable fee for an access request to cover our administrative costs of providing the information in certain situations.  If so, we will inform you of the fee before we proceed with your request.

We will respond to your request as soon as reasonably possible and within thirty (30) calendar days. Should we not be able to respond to your request within thirty (30) days after receiving your request and where we are permitted to do so under applicable data protection laws, we will inform you in writing within thirty (30) days of the time by which we will be able to respond to your request.

ADDITIONAL INFORMATION OR ASSISTANCE

To protect your privacy and implement security, we will take reasonable steps to verify your identity before granting your request. We reserve the right to charge an appropriate fee for complying with your request where allowed by applicable law. There may be situations where we cannot grant your request especially if it jeopardizes the privacy of others, is frivolous or vexatious, or would be extremely impractical.

CHILDREN’S PRIVACY

kumu recognizes and values the importance of protecting the privacy of children, which we define as anyone under the age of thirteen. Our Services are not intended for or directed to children under the age of thirteen, and anyone under the age of thirteen are not permitted to use kumu. If we discover that we are processing data for such users (under the age of 13), we shall take reasonable steps to guarantee that their records are erased and data processing is ceased. Please inform us if you suspect we have Personal Data about or acquired from a child under the age of 13.

You must also be of legal age in your country to consent to the processing of your Personal Data (in some countries we may allow your parent or guardian to do so on your behalf).

ACCESSIBILITY

We are committed to ensuring that our communications are accessible to people with disabilities.  To make accessibility-related requests or report barriers, please contact us at dpo@kumu.ph.

CHANGES

We may revise this Privacy Policy from time to time without any prior notice. You are advised to review this Privacy Policy periodically for any changes. You may determine if any such revision has taken place by referring to the date on which this Privacy Policy was last updated.

If we make material changes to the Privacy Policy, we will let you know via email and/or a prominent notice on our Service, prior to the change becoming effective and update the date at the top of this Privacy Policy. Your continued use of our services constitutes your acknowledgement and acceptance of such changes.

CONTACT

You may contact our Data Protection Officer if you have any inquiries or feedback on our Personal Data protection policies and procedures, or if you wish to make any request, in the following manner:

Data Protection Officer dpo@kumu.ph, 6F Robinsons Cybergate Tower 3, Pioneer St., Mandaluyong City, Philippines.

ADDITIONAL DISCLOSURES FOR CERTAIN JURISDICTIONS 

CALIFORNIA PRIVACY NOTICE

This California Privacy Notice(“California Notice” or “Notice”) supplements the Privacy Policy above and applies to California residents.  It describes our data collection practices with respect to the Personal Data we collect about California residents when they use our Services, communicate to us and engage with us offline.  The Notice also describes rights California residents have with respect to the Personal Data we collect.  

Terms that are defined in the Privacy Policy have the same meaning when used in this California Notice.

Categories of Personal Data We Collect and Have Collected in the Past 12 Months – Sources and Categories

In the 12 months preceding the date of this California Notice, we may have collected your Personal Data when you download our app, create an account, stream through our Services, participate in our campaigns and challenges, post klips, use our chat services, purchase coins and share virtual gifts through our Services, contact us (including via social media), participate in our surveys and events, purchase a product in our kumu shop, or otherwise interact with us by using our Services.  We will continue to collect Personal Data from the same sources.   

In the  twelve (12) months prior to the date of this Notice, we have collected, and will continue to collect, the following categories of Personal Data:

• Personal Identifiers: Name, physical address, phone number, unique personal identifier, IP address, device ID, email address, in-game username, account name and password, [social media account names], governmental ID information
• Financial information: Bank account information, credit, debit, or other payment card information 
• Protected class information: Gender, age range
• Commercial information:  Records of products or Services purchased or consumed
• Internet or other electronic network activity:   Data about your activities on and use of our Services, app launches inside our Services, browser history, search history, and product engagement, information regarding your interaction with our Services and our advertisements, device and browser type
• Audio and visual information: Audio, videos, images, and other information uploaded, viewed ,shared and downloaded on and from the Services; interactions and exchanges with other users (e.g., chat, stream)
• Inferences drawn from any of the Personal Data identified above. 

Purposes for Collection of Personal Data 

We use your Personal Data for the following purposes to provide Services to you; to perform our obligations in the course of or in connection with our Services requested by you; to allow you to leave comments on content and engage in campaigns or rewards programs; to verify your identity and respond to, handle, and process queries, requests, applications, complaints, and feedback from you; to process payment or credit transactions; to provide you with news, special offers and general information about our Services. 

We also use your Personal Data to comply with any applicable laws, regulations, codes of practice, guidelines, or rules, or to assist in law enforcement and investigations conducted by any governmental and/or regulatory authority. This includes, but is not limited to, as applicable, disclosure of Personal Data of the winners of DTI registered campaigns to Philippines’ Department of Trade and Industry, and processing your Personal Data in accordance to the regulatory requirements of Anti-Money Laundering Council and Bangko Sentral ng Pilipinas.

Additionally, we use Personal Data to monitor or improve our Services; for internal business analysis; to prevent fraud, activities that violate our Terms of Service or that are illegal; and to protect our rights and the rights and safety of our users or others. 

Categories of Personal Data Disclosed for Business Purpose in Past 12 Months 

Additional Information About How We May Disclose Personal Data

We may also disclose your Personal Data as required or permitted by law, to comply with a subpoena or similar legal process or government request, or when we believe in good faith that disclosure is legally required or otherwise necessary to protect our rights and property or the rights, property or safety of others, including to law enforcement agencies, and judicial and regulatory authorities. We may also share your Personal Data with third parties to help detect and protect against fraud or data security vulnerabilities.  And we may transfer your Personal Data to a third party in the event of an actual or contemplated sale, merger, reorganization of our entity or other restructuring.

Rights Regarding Personal Data

Your Right To Request Disclosure of Information We Collect and Share About You

We are committed to ensuring that you know what Personal Data we collect. To that end, you can ask us for any or all of following types of information regarding the Personal Data we have collected about you in the 12 months prior to our receipt of your request:

• Specific pieces of Personal Data we have collected about you; 
• Categories of Personal Data we have collected about you; 
• Categories of sources from which such Personal Data was collected; 
• Categories of Personal Data that the business sold or disclosed for a business purpose about the consumer;
• Categories of third parties to whom the Personal Data was sold or disclosed for a business purpose; and 
• The business or commercial purpose for collecting or selling your Personal Data.

Your Right To Request Deletion of Personal Data We Have Collected About You  

Upon your request, we will delete the Personal Data we have collected about you, except for situations where the CCPA authorizes us to retain specific information, including when it is necessary for us to provide you with a good or service that you requested; perform a contract we entered into with you; maintain the functionality or security of our systems; or comply with or exercise rights provided by the law.  The law also permits us to retain specific information for our exclusively internal use, but only in ways that are compatible with the context in which you provided the information to us or that are reasonably aligned with your expectations based on your relationship with us.  We will act on your deletion request within the timeframes set forth below.

Your Right to Ask Us Not to Sell Personal Data We Have Collected About You

You can direct us not to sell your Personal Data by submitting an opt-out request through our Data Request Form , or by contacting us.  We will act on your request within the timeframes set forth below.

Exercising Your Rights and How We Will Respond

To exercise any of the rights above, or to ask a question, contact us, complete and submit our Data Request Form or use the contact details set out at the end of this California Notice .

For requests for access or deletion, we will first acknowledge receipt of your request within 10 business days of receipt of your request.  We provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances.  If we expect your request is going to take us longer than normal to fulfill, we will let you know.

For requests to stop the sale of your Personal Data, we will comply no later than 15 business days after receipt of your request.  

We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations.  In some cases, the law may allow us to refuse to act on certain requests.  When this is the case, we will endeavor to provide you with an explanation as to why.  

Verification of Identity – Access or Deletion Requests

We will ask you for identifying information and attempt to match it to information that we maintain about you.  

If we are unable to verify your identity with the degree of certainty required, we will not be able to respond to your request.  We will notify you to explain the basis of the denial.  

Ensuring Veracity of Opt-Out Requests

If we have a good-faith, reasonable belief that a request to opt-out of the sale of Personal Data is fraudulent, we may deny the request.  Should this occur, we will inform you and explain why we believe the request is fraudulent. 

Authorized Agents

You may designate an agent to submit requests on your behalf.  The agent must be a natural person or a business entity that is registered with the California Secretary of State.   

If you would like to designate an agent to act on your behalf, you and the agent will need to comply with our verification process: 

• Requests to Know or Delete Personal Data: If the agent submits requests to access, know or delete your Personal Data, the agent will need to provide us with your signed permission indicating the agent has been authorized to submit the opt-out request on your behalf.  We will also require that you verify your identity directly with us or confirm with us that you provided the agent with permission to submit the request. 
• Requests to Opt Out of Sale: If the agent submits a request to opt out of the sale of your Personal Data, the agent will need to provide us with your signed permission indicating the agent has been authorized to submit the opt-out request on your behalf.  

Please note that this subsection does not apply when an agent is authorized to act on your behalf pursuant to a valid power of attorney.  Any such requests will be processed in accordance with California law pertaining to powers of attorney.   

Requests for Household Information

There may be some types of Personal Data that can be associated with a household (a group of people living together in a single dwelling).  Requests for access or deletion of household Personal Data must be made by each member of the household.  To the extent we collect household information and requests are made pertaining specifically to such information, before responding to a request, we will verify the identity of each member of the household using the verification criteria explained above and will also verify that each household member is currently a member of the household.

No discrimination for exercise of CCPA rights

We will not discriminate against you for exercising any of your CCPA rights. Unless the CCPA allows it, we will not deny your use of our services.

California “Shine the Light” disclosure

In certain circumstances under the California “Shine the Light” law, residents of California have the right to opt out of the sharing of certain categories of Personal Data (as defined in the Shine the Light statute) with third parties for their direct marketing purposes. kumu does not share your Personal Data to third parties for the purpose of direct marketing.

Do Not Track

Some browsers have a “do not track” feature that lets you tell websites that you do not want to have your online activities tracked.  At this time, our websites do not respond to browsers’ do not track signals.

Contact information

For questions about our U.S. state data privacy practices, including about how to exercise your data access rights under California law, please contact us at dpo@kumu.ph

MORE RESOURCES

• Terms of Use
• Kumunity Guidelines
• Recruitment Privacy Policy
• Old Terms of Use
• Old Privacy Policy