Last Updated: September 2020
Many of our Cloud Services offered through the Alibaba Cloud Platform are intended for use by business organisations. If you use your organisation’s email address to register an account and purchase or use our Cloud Services, the owner of the domain associated with your organisation’s email address, and/or your organisation, may monitor or control your account with the Alibaba Cloud Platform and access, process, and/or control your personal data, as well as the contents of your communications and files. Your organisation’s use of our Cloud Services may be subject to your organisation’s own rules or policies, and you shall direct all privacy enquiries relating to such rules or policies to your organisation’s administrators. We are not responsible for the privacy or security practices of your organisation.
Cloud Services may be used by our customers (i.e. registered users of Alibaba Cloud) to develop or host their own services and products for the customer’s end users. Any information collected or handled by Alibaba Cloud in such circumstances is processed on behalf of our customer who controls the collection and use of such information. We do not have a direct relationship with the end users of our customers. Where this is the case, end users should direct all privacy enquiries, such as any requests to access, correct, amend or delete personal data, to the Alibaba Cloud customer providing their services or products. We are not responsible for the privacy or security practices of our customers.
A. COLLECTION OF PERSONAL DATA
If you are (i) an individual or (ii) a representative of a business organisation at the time you register to become a user of the Alibaba Cloud Platform and/or purchase Cloud Services, you may be asked to complete registration forms which require you to provide information such as your email address, mobile number, country, preferred language, name, contact address, and screen nickname. You may also provide to us additional optional contact information in your account profile, such as email address for sub-accounts, and additional contact phone numbers.
We record details of your activities (including any purchase or use of our product offerings and services) when you use the Alibaba Cloud Platform and/or certain Cloud Services for legal and/or business purposes. If you make purchases or otherwise transact online through the Alibaba Cloud Platform, we also collect information related to such transactions including, but not limited to, the types and specifications of the Cloud Services, pricing information, and any trade dispute/complaint records.
When you contact our customer support, sales or other departments, we may record the communications for security and customer services purposes and collect additional information to verify your identity.
If you make online purchases for our Cloud Services through the Alibaba Cloud Platform, you may be required to provide information related to your payment instrument (such as credit cards), including information about your payment instrument organisation, your payment instrument number, the security code, and the expiration date of your payment instrument, directly to our payment service provider.
Please note that certain categories of data are necessary for us to provide the Cloud Services, such as user name, address, phone number, and email address. These categories will be specified at the time of collection. In the event that you do not provide any or sufficient data marked as mandatory, we may not be able to complete the registration process or provide you with our Cloud Services.
We also record records of users’ buying and browsing activities on the Alibaba Cloud Platform, including but not limited to Internet Protocol (“IP”) addresses, browsing patterns and purchasing patterns. In addition, we automatically gather statistical information about our Alibaba Cloud Platform and visitors to our Alibaba Cloud Platform including, but not limited to, IP addresses, browser software, operating system, software and hardware attributes, pages viewed, number of sessions and unique visitors.
We may from time to time collect additional information from you (such as copies of identification documents) and obtain information about you from third parties in order to carry out risk control, fraud prevention and compliance procedures. For example, we may collect payment-related information from third parties and combine it with information we collect about you for the purpose of fraud prevention and risk control.
B. PURPOSES FOR THE COLLECTION, RETENTION, USE, DISCLOSURE AND TRANSFER OF PERSONAL DATA
We collect, retain, use and disclose personal data for the following purposes:
processing your registration as a user, providing you with a user ID for our Alibaba Cloud Platform and maintaining and managing your registration;
providing you with customer service and responding to your queries, feedback, claims or disputes;
providing the Cloud Services to you and/or your end users;
processing your purchases and/or subscriptions on the International Marketplace;
personalizing our communication with you based on your order history, and performing research or statistical analysis in order to improve our product offerings and services;
publishing any information you voluntarily submit (which may include, but is not limited to, a photograph or other personal data you provide) to our Alibaba Cloud Platform to be published on our Alibaba Cloud Platform through the publishing tools (such as our discussion forums);
to comply with applicable law, legal process or lawful government request, or in respect of any claims or potential claims brought against us or our parent companies, shareholders, subsidiaries and affiliates;
performing risk control, legal compliance and sanctions screening; and
performing screening and checks for unlawful, fraudulent, deceptive or malicious activities.
Subject to obtaining your specific consent (or where otherwise permitted by applicable law in your jurisdiction), we may use your name, phone number, residential address, email address and fax number (which may incorporate personal data) to provide notices, surveys, product alerts, related communications and other marketing and promotional materials to you relating to goods and services offered by us on our Alibaba Cloud Platform.
Legal Basis for Processing for Users from European Economic Area (“EEA”)
Our legal basis to process personal data for EEA Users includes processing that is: necessary for the performance of the contract between you and Alibaba Cloud (for example, to provide you with the Cloud Services you request and to identify and authenticate you so you may use the website or Cloud Services); necessary to comply with legal requirements (for example, to comply with applicable accounting rules and to make mandatory disclosures to law enforcement); necessary for our legitimate interests (for example, to manage our relationship with you and to improve our Services); and based on your consent (for example, to communicate with you about our products and services and provide you with marketing information), which may subsequently be withdrawn at any time without affecting the lawfulness of processing based on consent before its withdrawal.
C. DISCLOSURE OF PERSONAL DATA
We may disclose your personal data to third party service providers engaged by us to assist with providing you with our services (including partners providing customer services to you, contacting you regarding promotions products and services, performing risk control, fraud prevention and legal compliance procedures, and conducting payment processing services) (the “Third Party Service Providers”). These Third Party Service Providers may be located in Singapore or outside of Singapore, and are under a duty of confidentiality to us and are only permitted to use your personal data in connection with the purposes specified in Section B above, and not for their own purposes.
We may share your personal data with affiliated companies in the Alibaba Group and/or their designated Service Providers, for the purposes specified at Section B above..
We may provide aggregated or anonymized data to third parties, but when we do so, the information we share is in a de-identified format that does not personally identify you.
Our website offers publicly accessible community forums. Any information you provide in these areas may be accessed, read, collected, and used by others anywhere in the world. To request removal of your personal data from our community forums, contact us at email@example.com.
D. TRANSFER OF PERSONAL DATA
As part of providing you with the Cloud Services, we may need to transfer your personal data from your jurisdiction to an overseas jurisdiction. Recipients of the data in these jurisdictions may be subject to data privacy laws less protective or not equivalent to those in your own jurisdiction. Such overseas transfer or processing of your personal data may be necessary to process and administer your customer account and to provide the Cloud Services (including providing customer services to you, contacting you regarding promotions, products and services, performing risk control, fraud prevention and legal compliance procedures, and conducting payment processing services). You appoint us to perform any such transfer of personal data to any such country and to store and process such personal data in order to provide our Cloud Services to you. You are solely responsible for ensuring compliance with any laws or regulatory obligations relating to personal data and/or privacy and your use of the same on or in connection with the Cloud Services, and you warrant that you have obtained all requisite consents from all relevant data subjects to permit the use of the same.
• EU-U.S. and Swiss-U.S. Privacy Shield
Alibaba Cloud US LLC and Alibaba.com LLC participate in and have certified its compliance with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework. We are committed to subjecting all personal data received from European Union (EU) member countries, the United Kingdom and Switzerland, respectively, in reliance on each Privacy Shield Framework, to the Framework’s applicable Principles. To learn more about the Privacy Shield Frameworks, and to view our certification, visit the U.S. Department of Commerce’s Privacy Shield List.
Alibaba Cloud US LLC and Alibaba.com LLC are responsible for the processing of personal data they receive, under each Privacy Shield Framework, and subsequently transfer to a third party acting as an agent on their behalf. Alibaba Cloud US LLC and Alibaba.com LLC comply with the Privacy Shield Principles for all onward transfers of personal data from the EU and Switzerland, including the onward transfer liability provisions.
With respect to personal data received or transferred pursuant to the Privacy Shield Frameworks, Alibaba Cloud US LLC and Alibaba.com LLC are subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.
Under certain conditions, more fully described on the Privacy Shield website https://www.privacyshield.gov/article?id=How-to-Submit-a-Complaint, you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.
E. SECURITY MEASURES
We use commercially reasonable endeavors to protect the personal data that you provide to us. We also employ several security techniques, including but not limited to the use of industry-standard Secure Socket Layer (SSL) encryption for transmission of personal data in registration information and payment information and the adoption of identity, credential and access management measures for transmission of such personal data to prevent security breaches and unauthorized access of personal data. We limit access to your personal data and other data to people who need access to such data for their work.
Nevertheless, no data transmission over the internet or any wireless network can be guaranteed to be perfectly secure. As a result, while we try to protect your personal data, we cannot guarantee the security of any personal data you transmit to us and you do so at your own risk. We cannot and do not guarantee security in connection with your use of the Alibaba Cloud Platform and our Cloud Services.
We retain your personal data as long as you have an account with us, as needed to provide services or products to you, to resolve disputes, to serve the purpose of research and statistical analysis or as required or permitted by applicable laws, such as tax and accounting laws.
F. RIGHT TO ACCESS/CORRECT PERSONAL DATA; CONTACTING US
You have the right to request access to your personal data held by us (or on our behalf) and to request correction or deletion of such personal data. Additionally, upon request, we will provide you with information about whether we hold your personal data. You may contact us at firstname.lastname@example.org to request access, correction or deletion of your personal data. We will respond to your request within a reasonable timeframe. You may also have supplemental rights under applicable law in relation to your personal data. For example, if you are an EEA user, you have the right to object to or request the restriction of processing of your personal data, and to request portability of your data.
In cases where we act as a processor, we have no direct relationship with the individuals whose personal data we process. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data should direct their query to Alibaba Cloud’s client (the data controller).
You may receive e-newsletters from us. If you would like to discontinue receiving this information, you may update your email preferences by using the “Unsubscribe” link found in emails we send to you or at your member profile.
We do not knowingly collect personal data of minors (persons under the age of 18). If a minor has provided us with personal data, the parent or guardian may contact us on the minor’s behalf to request that we cease any further collection, use and/or disclosure of the personal data and delete the personal data we may hold relating to the relevant minor.
• European Economic Area (EEA)
For individuals in the EEA, and/or in relation to processing conducted by or on behalf of Alibaba.com (Europe) Limited, please contact:
Attention: Data Protection Officer
c/o Alibaba.com (Europe) Limited, 8th floor, Millbank Tower, 21-24 Millbank, London SW1P 4QP, United Kingdom
E-mail address: email@example.com
If Alibaba.com (Europe) Limited is not the relevant “data controller” for the purposes of EEA data protection law, you will be directed to the relevant entity.
• Outside the EEA
In all other cases, please contact:
Attention: General Counsel /Alibaba Cloud (Singapore) Private Limited, Legal Department, c/o 26/F, Tower One, Times Square, 1 Matheson Street, Causeway Bay, Hong Kong.
E-mail address: firstname.lastname@example.org
In addition to the addresses listed above, if you have a privacy or data use concern which has not been addressed to your satisfaction, you may contact our third party dispute resolution provider (free of charge) here.
You can determine if and how a cookie will be accepted by configuring the browser which is installed in the computer you are using to access the Alibaba Cloud Platform. If you choose, you can change those configurations. You may be able to change your browser preferences or settings to reject all cookies, or choose to consent each time a cookie is sent. If you reject all cookies by choosing the cookie-disabling function in your browser, you may be required to re-enter information on our Alibaba Cloud Platform more often and certain features of our Alibaba Cloud Platform may be unavailable.
To manage Flash cookies, please click here.
By accessing and using our Alibaba Cloud Platform and/or Cloud Services, and by accepting the cookies, you consent to the storage of cookies on your devices. You also consent to the access of such cookies by us and by our partners mentioned above.
Office of the Australian Information Commissioner
GPO Box 5218
Sydney NSW 2001
Telephone: 1300 363 992
These additional disclosures are required by the California Consumer Privacy Act (“CCPA”). This California Addendum does not apply to personal data that is not processed by us a business pursuant to the CCPA, such as any personal data processed by Alibaba Cloud on behalf of its customers.
We provide you certain rights described in Section F above in accordance with state law. We will not charge you different prices or provide different quality of services unless those differences are related to your information or otherwise permitted by law. Please submit your request by sending us an email to email@example.com. Once we receive your request, we may verify it by requesting information sufficient to confirm your identity, including by asking you to verify information about your use of the Alibaba Cloud Platform and/or our Cloud Services. If you would like to use an agent registered with the California Secretary of State to exercise your rights, we may request evidence that you have provided such agent with power of attorney or that the agent otherwise has valid written authority to submit requests to exercise rights on your behalf.
Alibaba Cloud is the controller of personal data only when it collects personal data and determines the purposes and means of processing that personal data. For example, when customers of our Cloud Services register an account with us or provide contact information in order to receive customer support, we are the controller of that data. When customers host their own services on our Cloud Services, we act as a data processor with respect to that data.
Our business may require us to transfer your personal data to countries outside of the EEA, including to countries that may not provide the same level of data protection as your home country, such as the United States, Singapore and China. We take appropriate steps to ensure that recipients of your personal data are bound to duties of confidentiality and we implement measures such as standard contractual clauses. A copy of those clauses can be obtained by contacting us at firstname.lastname@example.org.
You may lodge a complaint with a supervisory authority if you consider that our processing of your personal data infringes applicable law.