PICO Privacy Policy

Last Updated: 16/05/2023

PICO Immersive Pte. Ltd. (“we”, “our”, or “us”) provides innovative virtual reality products and services through our websites, applications, content, hardware, and services (collectively, the “PICO Services”). This Privacy Policy outlines how we handle information that identifies or is associated with you (“personal data”), including how we collect, use, and share personal data on our PICO Services.
We are the controller responsible for your personal data. Please take a moment to familiarize yourself with our privacy practices, and contact us at privacy@picoxr.com if you have any questions.

1. Personal Data We Collect

When you interact with the PICO Services, such as when you create a PICO account, contact our customer support team, use the PICO hardware or participate in an online survey, we collect your personal data, including:

• Information You Provide to Us. For example:
  
• Account Information. When you register an account to use the PICO Services, you will provide information such as your username, profile photo, email address, the country you are located in, and your date of birth.
• Transaction Information. If you add your payment information to your profile or make purchases on or through the PICO Services, we collect information relating to the transaction such as your payment information, purchase activity, and shipping and contact details.
• Government-Issued ID. In certain jurisdictions, we may ask for a government-issued ID in limited circumstances, including when processing a refund request, or as required by law.
• Correspondence. When you communicate with us, we will receive details such as your contact information like your telephone number,the content of your communications with us, including interactions with customer support like the call recording and contacts through social media channels.
• User Content. We collect content you generate on the PICO Services, such as comments you post under a game or an app in the PICO Store, and information about this content, such as the date and time you created the content.

• Information Automatically Collected. We collect information automatically when you use the PICO Services, including:
  
• Your engagement with Pico Services. We receive information about you when you log in and out of PICO Services, which apps you download and the time/date you launch those apps on the PICO headset, and in-app purchases you have made in a game provided by a third-party developer. We also receive information about how you use the apps on the PICO headset, for instance, we receive information about your PICO Browser usage, such as which browser features you use. When you make a choice in the PICO headset settings, we will also record your choice.
• Device and network information. This includes information about the type of device you're using, such as a headset, PC, TV, or mobile phone; the configuration of the device, such as the device brand and model, name and version of the operating system, CPU information, and screen resolution; your network, such information about your local wireless network and your IP address; and how your device is performing, such as the battery level. We also collect certain identifiers that are unique to you or your device, including device identifiers such as the serial number of the PICO headset, your PICO user ID, and other identifiers.
• Information collected via cookies. We use cookies and similar technologies to operate and provide the PICO Services. For example, we use cookies to remember your language preferences, and for security purposes. To learn more about our use of cookies, please see our Cookies Policy. We will obtain your consent to our use of cookies where required by law.
• Location. We collect your approximate location based on your device and network information, such as your device’s IP address.
• Troubleshooting information. We collect troubleshooting information such as crash logs which may contain your user ID, device ID, IP address, CPU usage, amount of time it takes to load a feature, power consumption information, frame rate, and whether you use a certain feature.

• Personal Data We Receive from Other Sources. PICO may receive personal data about you from business partners and from other lawful sources.

1. Our Use of Your Personal Data

We use personal data to provide the PICO Services to you, to improve the PICO Services, to market to you, for security and fraud prevention, and to comply with applicable law. We may also use personal data for other purposes as allowed under applicable law.

• To provide the PICO Services. We use the information we collect to provide you with the PICO Services. For example, we use this information to:
  
• Provide you with PICO Services, including creating accounts for you and to process your transactions;
• Communicate with you about PICO Services, including to notify you about your transactions, account, or any changes to our terms, conditions, and policies; and
• Provide technical support.

• To improve the PICO Services. We also use the information we collect to improve the PICO Services. For example, we use the information to:
  
• Understand users’ feedback about the PICO Services;
• Identify and address technical issues, including crashes and other malfunctions, on the PICO Services;
• Conduct and learn from research about the ways in which you interact with the PICO Services;
• Improve and develop our features;and
• Monitor the quality of customer service to improve our service,and prevent any disputes arising between you and us.

• To market to you. We use the information we collect to send you promotional messages about the PICO Services. We also use this information to measure the effectiveness of our marketing activities. If you would like to opt out of receiving marketing messages, please follow the instructions in such marketing messages. We will obtain your consent to send you such messages where required by law.
• For security and fraud prevention. We use the information we collect to verify accounts, devices, and activities, combat harmful conduct, detect and prevent technical or security issues, including fraudulent activity, and promote the safety and security on and off the PICO Services.
• To comply with applicable law. For example, to satisfy tax or reporting obligations, or to comply with a lawful governmental request.

1. How We Share Your Personal Data

We may share personal data with developers that provide apps on the PICO Services, our affiliated companies, service providers who act on our behalf, our partners, third parties in the context of corporate transactions, with your consent, or otherwise as required or allowed by law.

• Developers. You can interact with third-party games, apps and services through the PICO Services. We share your personal data with these developers so they can provide you with the experiences you have requested. For example, with your permission, we make available to third party developers your PICO account information including your profile picture, username, and region.
  

Third-party content providers may also collect information from you directly through the experiences they provide. Please note that any information you share with these third parties will be subject to those third parties’ own privacy policies.

• Affiliated companies. As a global company, the PICO Services are supported by a number of affiliated entities within our corporate group. We share your information with affiliated entities as necessary to enable them to provide important functions such as cloud hosting, security, research and development, analytics, online payments, customer and technical support, and content moderation.

• Service providers. We may engage third parties to act as our service providers and perform certain tasks on our behalf, such as processing or storing data, including personal data, in connection with delivering the PICO Services. The service providers are obligated to handle personal data consistent with this Privacy Policy and according to our instructions. They can not use the personal data we share for their own purposes and must delete or return the personal data once they've fulfilled our request.

• Partners. From time to time, we may partner with third parties to provide services or other offerings. We require our partners to protect your personal data.

• Corporate transactions. Your information may be disclosed to third parties in connection with a corporate transaction, such as a merger, sale of assets or shares, reorganisation, financing, change of control, or acquisition of all or a portion of our business.

• With your consent. We may share personal data with others at your direction or with your consent.

• Law enforcement. We may disclose information about you if we determine that for purposes of national security, law enforcement, or other issues of public importance, disclosure is necessary or appropriate. We may also disclose information about you where there is a lawful basis for doing so, if we determine that disclosure is reasonably necessary to enforce our terms and conditions or to protect our operations or users.

1. Your Choices and Rights
   

You have the following choices with respect to your personal data. Depending on the nature of the choice you would like to exercise, we may need to verify your identity before honoring your request.

• Access or update your information. You may request to access or update your personal data by emailing us at the email address provided in the ‘Contacting us’ section of this Privacy Policy.

• Delete your data. You may request to delete the personal data by emailing us at the email address provided in the ‘Contacting us’ section of this Privacy Policy. If you delete the information we identify as required or mandatory, we may not be able to provide all or part of the PICO Services.

• Revoking your consent. If we have asked for your consent to collect, use, or share your personal data, you can revoke it by changing your choice in the relevant device or app settings, or by emailing us at the email address provided in the ‘Contacting us’ section of this Privacy Policy. We will process such requests within a prompt timeframe after receipt and your revocation will become effective once processing is complete, until which time we will continue to handle your personal data as described in this Privacy Policy.

• Opt-out of marketing communications. You may opt-out of marketing-related messages by following the opt-out or unsubscribe instructions enclosed in the messages, or by submitting a request to the email address provided in the ‘Contacting us’ section of the Privacy Policy. You may continue to receive service-related and other non-marketing messages.

• Others. You may also have a right to oppose, request a copy of your authorization, limit our collection and use of your personal data, and potentially others, depending on the jurisdictions where you are located. In the event that you wish to make a complaint about how we process your personal data, please contact us in the first instance at privacy@picoxr.com. This is without prejudice to your right to launch a claim with your data protection authority or follow the dispute resolution process provided in the Terms of Service.

1. Transferring Your Personal Data

We provide the PICO Services on a global basis. This means that the information that we collect from you may be transferred to, and stored at, a destination outside of the country you reside in, including in Singapore where we are based. It may also be processed by staff operating outside your country who work for us, for one of our service providers or one of our partners. We will take all steps necessary to ensure that your information is treated securely and in accordance with this Privacy Policy and applicable law.

1. Data Security and Retention

We take appropriate technical and organizational measures to help protect personal data from unauthorized access, use, disclosure, alteration, and destruction. Unfortunately, the transmission of information via the internet is not completely secure and, as such, we cannot guarantee the security of your information transmitted via the PICO Services.
We retain information for as long as necessary to provide the PICO Services and for the purposes set out in this Privacy Policy. We also retain information when necessary to comply with contractual and legal obligations, when we have a legitimate business interest to do so (such as improving and developing our website and app service, and enhancing the safety, security and stability of our website and app service), and for the exercise or defence of legal claims.

1. Children

PICO Services are not intended for use by children under 13 years of age or under the equivalent minimum age threshold in the relevant jurisdictions. If we learn that we have collected personal data from a child under 13 we will delete it as soon as possible.

1. Changes to This Policy

If we make changes to this Privacy Policy, we will provide notice of such changes as appropriate, such as by sending you an email notification to the address you have provided, and/or providing notice through the PICO Services. If we make an administrative change, we will update the "Last Updated" date at the top of this Privacy Policy.

1. Contacting Us

If you have questions about this Privacy Policy, please contact us by email at privacy@picoxr.com.

1. Jurisdiction-Specific Terms

In the event of a conflict between the provisions of the below Jurisdiction-Specific Terms that are relevant to your jurisdiction from which you access or use the PICO Services, and the rest of this Privacy Policy, the relevant jurisdictions’ Jurisdiction-Specific Terms will supersede and govern the data processing.

a. EEA, UK and Switzerland
The information provided in this section applies to individuals in the European Economic Area, United Kingdom and Switzerland, which we refer to in this notice collectively as “Europe”.

Legal bases for processing. We use your personal data only as permitted by law. Our legal bases for processing your personal data described in this Privacy Policy are described in the table below.

Processing purpose	Legal basis
To enable us to administer, operate, and provide the PICO Services to you including to create accounts and process your transactions and to provide you with troubleshooting.	Processing is necessary to perform the contract governing our provision of the PICO Services or to take steps that you request prior to signing up for an account to use the PICO Services.
To understand how you use the PICO Services, including reviewing user feedback, to monitor, improve and develop the Pico Services and conduct product development.	The processing is necessary for our legitimate interests, namely, to identify and resolve issues with the PICO Services and to improve the PICO Services.
To comply with any legal obligation, including where necessary to assist in law enforcement and investigations conducted by any governmental and/or regulatory authority.	This processing is necessary in order to comply with our legal obligations.
To communicate with you, including to notify you about changes to the PICO Services, provide customer support to you and send you other service-related messages.	The processing is necessary for the performance of a contract with you.
We may use this information to send you marketing communications in accordance with your preferences.	The processing is necessary for our legitimate interests, namely to promote new developments and features of our PICO Services. We will obtain your consent to send you messages where required by law.
To enforce our terms, conditions and policies, including to ensure that you are old enough to use the PICO Services.	The processing is necessary for the performance of a contract with you.
To help us detect abuse, fraud, and illegal activity on the PICO Services.	The processing is necessary for our legitimate interests, namely, to ensure that the PICO Services are safe and secure.

Your rights. If you are located in Europe, in addition to the rights set out in section 4 "Your Choices and Rights", you also have the following rights in relation to your personal data:

• Right of portability. If any automated processing of personal data is based on your consent or a contract with you, you have a right to transfer or receive a copy of the personal data in a usable and portable format.
• Right to erasure. You have the right, in some circumstances, to require us to erase your personal data without undue delay if the continued processing of that personal data is not justified.
• Right to restriction. You have the right, in some circumstances, to require us to limit the purposes for which we process your personal data if the continued processing of the personal data in this way is not justified, such as where the accuracy of the personal data is contested by you.
• Right to objection. You also have the right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation. There may be compelling reasons for continuing to process your personal data, and we will assess and inform you if that is the case.

To make such requests, contact us at the email address provided in section 9 "Contacting Us".
You also have the right to lodge a complaint with your local supervisory authority, but we encourage you to first contact us with any questions or concerns.
Cross-border transfer. We have taken appropriate safeguards to ensure that your personal data will remain protected and require our third-party service providers and partners if applicable to have appropriate safeguards as well. For onward transfers of your personal data, we ensure that: (i) the personal data is transferred to countries recognized as offering an equivalent level of protection; or (ii) the transfer is made pursuant to appropriate safeguards, such as standard data protection clauses adopted by the European Commission.

UK GDPR Representative: Cosmo Technology Private Limited, whose registered office is at 2 Temple Back East, Temple Quay, Bristol, BS1 6EG, United Kingdom.

b. South Korea
If you are using our services in South Korea, the following additional terms apply. In the event of any conflict between the following additional terms and the provisions of the main body of this policy, the following terms shall prevail.

Data security. We work hard to protect the PICO Services and our users from unauthorized access to or unauthorized alteration, disclosure or destruction of information we hold. To this end, we have in place technical, managerial and physical safeguards, including internal policies for data protection, limitation of access to personal data on a need-to-know basis and control of access to the facilities where personal data is processed.

Data retention. We destroy personal data for which the purposes of collection as consented to by you have been achieved, or for which the periods of use as consented to by you or as provided in this Privacy Policy have expired; provided, however, we will continue to store your personal data for any statutorily-prescribed periods, where applicable.

Children. The PICO Services are not intended for use by children under 14 years of age.

Destruction of personal data. We destroy your personal data in a manner that renders it unrestorable by the relevant department.

Entrustment and/or overseas transfer of personal data. We entrust your data to our affiliates and service providers, some of whom are located outside of Korea (see the Privacy Policy Addendum (for the Republic of Korea) below for a list), subject to your consents or notifications to you, if applicable. The entities receiving and processing your data are committed to using and storing personal data in compliance with domestic and international regulations and to taking all available physical and technical measures to protect personal data.
Local representative pursuant to the Personal Information Protection Act. Please send your inquiries concerning privacy issues in South Korea to our local representative pursuant to the Personal Information Protection Act. Contact details are as follows.
- Bae, Kim and Lee LLC
- Representative: Yangho Oh
- Address: Tower B, Centropolis, 26 Ujeongguk-ro, Jongno-gu, Seoul 03161, Korea
- Phone: +82-2-3404-0108
- Email: koreaprivacypico@bkl.co.kr

Transferee	Purpose of Transfer	Items of personal information transferred
Alibaba Cloud (Singapore) Private Limited	CDN cache server	content files
Broadonetech Pte. Ltd	CDN cache server	content files