Privacy Policy | Toys”R”Us China Official Website

Release date: 29th October 2021

Effective date: 29th October 2021

Personal Information Protection Policy

Toys”R”Us (China) Trading Co., Ltd. (“we” or “Toys”R”Us”) respects users’ privacy and personal information. When you register Toys”R”Us accounts, purchase our products online, leave product reviews, and receive our customer services, this Personal Information Protection Policy (“Policy”) tells you how we collect, use, store, share and transfer your personal information, and your rights to your personal information.

Before starting to use our products and services, please read carefully to ensure you thoroughly understand this Policy, especially those areas marked in bold. Please proceed to access out products or services after confirming your full understanding and giving your consent.

If you have any questions, comments or suggestions about the content of this Policy, please feel free to contact us via the contact information provided in Section IX.

This Policy aims to help you understand:
I. Definition and scope of application
II. How we collect and use your personal information
III. How we share, transfer and disclose your personal information
IV. How we retain and secure your personal information
V. Your rights
VI. How we process children’s personal information
VII. International transfers of personal information
VIII. How this Policy is updated
IX. How to contact us

I Definition and scope of application

Definition

Personal information: various types of information that is recorded by electronic or other means and related to any identified or identifiable natural person; anonymized information is excluded.
Sensitive personal information: the personal information that is likely to result in damage to one’s dignity or personal or property safety once disclosed or illegally used, including such information as biometric identification, religious beliefs, specific identity, medical health, financial account and whereabouts and tracked locations, as well as the personal information of minors under the age of 14.
Anonymization: the processing of personal information in a way that makes it impossible to identify natural persons and cannot be reversed.
De-identification: the processing of personal information in a way that makes it impossible to identify certain natural persons without the use of additional information.

This Policy applies to all products and services provided by Toys “R”Us through the websites “Toys”R”Us China official website” (www.toysrus.com.cn) and “Babies”R”Us official website” (www.babiesrus.com.cn) (“Websites”) and the WeChat mini program “Toys”R”Us China Official Store” (the “WeChat Mini Program”).

II How we collect and use your personal information

When you use our products and services, we may need to collect and use your personal information in the following two ways:

In order to provide the basic functions of our products and/or services, we need to collect and use information necessary for such basic functions. If you refuse to provide your information, you may not be able to use our products and/or services. For example, the name, address and mobile phone number of the receiver are necessary for placing an order;
In order to provide ancillary functions of our products and/or services, we need to collect and use other additional information. If you refuse to provide this information, you cannot use relevant ancillary functions or the functions cannot achieve the intended effects. For example, location information is required for “finding a nearby offline store”.

We will specifically explain the types and purposes of personal information collected and used based on each business function as below.

Account registration

Websites and WeChat Mini Program offer visitor mode, where you may browse product information and place an order without an account. However, if you would like to view and manage your orders, or use other functions of Websites and WeChat Mini Program, you must register an account.
To register an account on Websites, you must at least provide us with your name, password, and mobile phone number.
To simplify the registration process on Websites, you may register with your QQ account and if so, we will collect your nickname, image, and gender from QQ; you may also register with your Weibo account and in that case, we will collect your basic information, friendships and Weibo comments from Weibo. Under these two circumstances, you only need to provide your mobile phone number separately to us for account registration.
To register an account in WeChat Mini Program, we must collect your WeChat nickname, image, Open ID and Union ID through the WeChat authorization interface.
The above information is collectively referred to in this Policy as Account Information.
After you successfully register an account on Websites, our system will automatically generate your Star Card Membership Card number. Based on the Star Card Membership system, we will provide you with exclusive benefits such as special offers, point deductions, free trials and lucky draws.

Order placement and management

When you plan to check out the products and/or services in your shopping cart, our system will generate an order. In the process of placing an order, you must fill in at least the receiver's name, address and mobile phone number. In addition, the order will contain the information about such products and/or services, the order number, the time when the order was generated, the price and the method of payment. The collection of the above information is to help the transaction proceed smoothly, ensure the transaction security, facilitate your inquiry of order information, provide customer services, and for other purposes previously outlined.
You may order products and/or services for others through Websites and WeChat Mini Program. If you provide aforementioned personal information of the actual receiver, you must ensure that you have obtained his/her consent.
You may provide additional information including email address and remarks to us to ensure the accurate delivery of products or services. Please note that orders can be generated and processed without such additional information.
The above information is collectively referred to as Order Information. We (including relevant third-party service providers) will use Order Information to verify your identity, confirm transactions, process payment, distribute and deliver, inquire about orders, and provide customer services and after-sales services.

Payment

To complete the order payment, you may choose payment methods provided by third-party payment companies ("Payment Companies", including Alipay, WeChat Pay, UnionPay, MasterCard and Visa). The payment function itself does not collect personal information, but we need to share your order number and transaction information including your bank account number, validity period, repayment amount and necessary bank card (both debit card and credit card) related information with these Payment Companies to respond to your payment instructions and process the payment.

Delivery

To ensure that the products and/or services you purchased can be delivered smoothly, safely, and accurately, we will share Order Information with local courier partners.

Customer services and dispute resolution

Account Information and Order Information is a necessary component of our customer services.
To ensure the security of your account, our customer service department will use Account Information to verify your identity. When you seek customer services and after-sales services related to orders, we will access Order Information. You may provide additional information when communicating with our customer service staff in scenarios such as modifying the delivery address and the receiver's mobile phone number.

Product review

You may leave product reviews through the comments function we provide for you. Please note that the reviews you leave may involve personal information or even sensitive personal information of you or others. For example, you may upload pictures and videos containing personal information in your product reviews. Please consider carefully whether to share or even publicly disclose relevant information when using our services.
If your reviews involve others' personal information, you must obtain his/her consent before disclosure.

“Geoffrey’s Birthday Club” benefits

You may fill in your child/children’s name, gender and date of birth and we will distribute gift vouchers, child’s birthday gift, and provide you with opportunities to participate in parent-child activities.
We strictly abide by laws and regulations and agreements with you, and collect your children’s personal information based on your willingness to join the Geoffrey’s Birthday Club. Please carefully read the tips on the page where you can fill in your child’s information, and fill in and submit only when you are the parent or guardian of the children.

Marketing activities

We will also obtain your order information from Websites, WeChat Mini Program and stores, and distribute coupons based on your purchase preferences.
In addition, we will send store and discount information which may be more in line with your needs based on your location, age and gender of your children. If you do not wish to receive such information, you can follow the steps indicated in the information to unsubscribe.

Other additional services

In order to provide more convenient, higher-quality, and personalized products and/or services, and improve your experience, we may collect and use your personal information in the course of providing the following additional services. If you refuse to provide this information, it will not affect your use of the basic services provided by the WeChat official account, but you may not be able to obtain the user experience brought by those additional services. These additional services include:

Additional services of photo/video access and upload based on photo albums: when the permission of the photo album is given, you can upload photos from your photo album to communicate with online customer service.
Recommendation service based on location information: when the location permission is given, we can obtain your location information and provide you with relevant store information based on your location.

You can decide whether to enable or disable these permissions. Please note that if you enable any permission, you authorize us to collect and use relevant personal information to provide you with corresponding services. Once you disable the permission, you cancel the authorization of personal information collection and use, and we will cease to collect and use your information based on the corresponding permissions, as well as providing corresponding services. However, your disabling of the permission will not affect the previous collection and use of information based on your authorization.

Please see our separate cookie policy (https://www.toysrus.com.cn/en-cn/cookie-policy.html) for our use of cookies on Websites.
Cookies on WeChat Mini Program is subject to Tencent’s Cookie Policy. Please refer to https://privacy.qq.com/policy/cookie-privacypolicy for more details.

You fully acknowledge and agree that we may collect and use your personal information without your consent, under any of the following circumstances:

where the collection or use is necessary for execution and performance of a contract requested by you;
where the collection or use is necessitated by the performance of our legal obligations.
where the collection or use is in response to public health emergencies, or for the purpose of protecting your or others’ health and safety or property in emergencies;
where the personal information is used in news reporting or public sentiment monitoring in the public interest within a reasonable scope;
where the personal information is collected from publicly-available information within a reasonable scope;
other circumstances specified in laws and administrative regulations.

We may collect your personal information through a third party to enhance our understanding of you and improve the products and services we provide accordingly. We will confirm the legality of the source of such personal information and the scope of consent. If we intend to use your personal information beyond your consent, we will request your consent again.

Please note that, in accordance with applicable laws, if we take technical measures to process personal information, making it impossible to be used to re-identify specific individuals and such a process is irreversible, we may use such information for statistics and analysis to improve our products and services, and support our business decisions, which does not require separate notice and your consent.

III How we share, transfer and disclose your personal information

Sub-contracting

We may outsource related services and certain suppliers will perform part of the work on our behalf. These suppliers include (some suppliers are also involved in personal information cross-border transmission, please see Section VII for details):

Fung Omni Services Limited	Assist in processing orders from WeChat Mini Program and dispatch orders to our order management system.
Deppon Logistics Co., Ltd	Deliver our products and services based on orders.
eWave Limited	Integrate our various systems to ensure the systems are organically combined and coordinated.
Shanghai Ugo Media Co., Ltd.	Assist in processing Star Card member information and children’ information; provide Star Card member registration service; and hold parent-child activities.
Shanghai Intone Network Technology Co., Ltd.	Assist in processing Star Card member information and children’s information; issue coupons to Star Card members; provide child birthday party registration; and provide exclusive benefits for membership upgrades.
Capillary Information Technology (Shanghai) Co., Ltd.	Issue coupons to Star Card members; and hold personalized activities for Star Card members
ChinaPay e-payment Service Co.,Ltd.	Assist in capturing and processing payments for all transactions
Baidu, Inc.	Provide store location maps on website for customers to navigate and analytical tools on website overall traffic performance.
Alibaba Cloud Computing Co. Ltd.	Provide fast delivery of Internet content by using its Content Delivery Network service.
QQ (by Tencent Holdings Ltd.)	Assist in customer login or registration by using the existing social account
Weibo (by Weibo Corporation)	Assist in customer login or registration by using the existing social account
AddThis (by Oracle Corporation)	Provide a web widget for sharing an item using a variety of integrated social services/platforms

According to our contracts, the suppliers shall use the information to the extent necessary for performing their contractual obligations, to ensure that we can smoothly provide products or services to you, and they have no right to use it for other purposes. Under this circumstance, our suppliers process your personal information in accordance with our instructions, and they do not constitute personal information processors.

Sharing

We will keep your personal information strictly confidential. Unless otherwise required by law, we will not share your personal information with any company, organization or individual.

Transfer

Transfer your personal information according to your prior explicit consent;
If your personal information is transferred as a result of a merger, acquisition or bankruptcy liquidation, we will inform you and ensure that the surviving company or organization that will possess your personal information to be continuously bound by this Policy. If the purpose and method for personal information use changes, we will require the surviving company or organization to seek your consent again.

Public Disclosure

In principle, we will not publicly disclose your personal information. If your personal information must be publicly disclosed, we will inform you of the purpose for disclosure, the type of personal information to be disclosed, and whether any sensitive personal information is involved, and seek your separate consent.

Under any of the following circumstances, our sharing, transfer or disclosure of your personal information is not subject to your consent:

where the collection or use is necessary for execution and performance of a contract requested by you;
where the collection or use is necessitated by the performance of our legal obligations;
where the collection or use is in response to public health emergencies, or for the purpose of protecting your or others’ health and safety or property in emergencies;
where the personal information is used in news reporting or public sentiment monitoring in the public interest within a reasonable scope;
where the personal information is collected from publicly available information within a reasonable scope.
Other circumstances specified in laws and administrative regulations.

IV How we retain and secure your personal information

We will only retain your personal information for a limited period necessary for achieving the purposes specified in this Policy or as required by law. We will promptly delete or anonymize your personal information after such retention period expires.

We have technical and administrative measures that meet industry standards to protect your personal information, to prevent unauthorized data access, public disclosure, use, tampering, damage or loss. For example, we use trusted protection mechanisms to prevent malicious attacks on data, and deploy access control mechanisms to ensure that only authorized personnel can access personal information.

The Internet environment is not one hundred percent secure, and we will endeavor to ensure or guarantee the security of any information you provide. Please properly protect your personal information, and do not share your membership account and other information with others.

In case of any personal information security incident, we will, in accordance with requirements set out in laws and regulations, inform you promptly of the following matters, including basic information about the security incident and the potential impact, the measures we have taken or will take to deal with such incident, suggestions on what measures you may take to prevent or mitigate risks, and your remedies. We will inform you of the status of the incident by email, letter, phone or push notifications. In the event that it is difficult for our notification to reach every individual affected, we will make public announcements in a reasonable and effective manner. Meanwhile, we will report the status of the handling of the security incident as required by the regulator.

V Your Rights

We respect and honor your rights to your personal information under relevant laws and regulations, and common practices in other countries and regions, which include the following:

Access to your personal information

Account Information: you can access Account Information in the “Personal Information” “Password” “Address Book” sections on the “My Account” page of Websites, or the “Address Management” section on the “My” page of WeChat Mini Program.
Order Information: you can access Order Information on the “My Order” page.
Children’s information: you can access your children’s information in the “Geoffrey’s Birthday club” section on the “My Account” page of Websites.

Correct/update your personal information

Account Information: if you find that Account Information is incorrect or Account Information has changed, you may modify in the “Personal Information” “Password” “Address Book” sections on the “My Account” page of Websites, or the “Address Management” section on the “My” page of WeChat Mini Program.
Order Information: if you find that Order Information is incorrect, you can modify in “My Order” page of the Websites and WeChat Mini Program/ or call customer service hotline at 400-886-8828.
Children’s information: if you find that your children’s information you provided is wrong or has changed, you can modify in the “Geoffrey’s Birthday club” section on the “My Account” page of Websites.

Deregister your account

You may deregister your account by calling the customer service hotline at 400-886-8828 or by connecting with online customer service. Once your account is deregistered, our services will cease, and your personal information will be deleted upon your request, unless otherwise required by law.

Delete your personal information

help@toysrus.com.cn

When our processing of personal information violates law;
When we collect or use your personal information without your consent;
When our processing of personal information violates our agreement with you;
When the purpose of processing your personal information has been achieved, cannot be achieved, or the processing is no longer necessary (e.g. when you no longer use our products or services, or you have deregistered your account);
When we no longer provide you with any products or services; or
When you have withdrawn your authorization and consent to our processing of your personal information.

Once your information has been removed from our services, such deletion may not be immediately synchronized in our systems, and we will delete the information once our systems are updated.

Change the scope of your consent

Each business function requires certain basic personal information. You may withdraw your consent regarding the collection and use of any supplemental personal information at any time by means of calling our customer service hotline at 400-886-8828 or emailing to help@toysrus.com.cn.
Once you withdraw your consent, we will not process the corresponding personal information. However, your withdrawal of consent does not affect our previous processing of your personal information based on your consent.
If you do not wish to receive our advertisements or notifications, you may contact us through our customer service hotline at 400-886-8828 or our email address at help@toysrus.com.cn.

Obtain a copy of your personal information

You have the right to obtain a copy of your personal information that we have processed. Please contact us if you need this.
If conditions prescribed by law are met, we can also directly transfer your personal information to a third party designated by you at your request.

Responding to your requests

You can reach us via the contact information provided in Section IX. We will promptly respond to your rights requests within 15 working days, unless otherwise specified by applicable laws or regulations. You may contact us to make a complaint if you are dissatisfied with our response.

We will not respond to your requests under any of the following circumstances:

where the processing is necessitated by the performance of our legal obligations;
where the processing is necessary for reasons of state security or national defense security;
where the processing is necessary for reasons of public security, public health, or material public interests;
where the processing is necessitated by the investigation, prosecution, adjudication, or law enforcement of criminal cases etc.;
where we have proof that your request is frivolous or vexatious;
where the processing is necessary for safeguarding your or others’ material legal rights and interests, such as the right to life and property, and it is difficult to obtain your consent;
where responding to your requests will give rise to serious damages to the rights and interests of you or other individuals or organizations;
where your requests involve our trade secrets.

VI How we process children’s personal information

We regard any minor under the age of fourteen as a child. We attach great importance to the protection of children’s personal information, and strictly abide by laws and regulations to protect the security of children’s personal information.
If it is proved that children have registered and used our products and/or services without the consent of their guardian, we will contact the guardian and work to delete relevant personal information promptly.
We will not collect personal information from children actively and directly. With regard to children’s personal information collected with the consent of their guardian, in addition to complying with the provisions of this Policy, we will also follow the principles of justification and necessity, informed consent, explicit purpose, security assurance, and legitimate use, and strictly follow relevant requirements of the Children’s Personal Information Network Protection Regulations and other laws and regulations in place for children’s personal information storage, use, and disclosure, and will not exceed the limited period necessary to achieve the purpose of collection and use. We will promptly delete or anonymize children’s personal information after such period expires. If you have any inquiry, concern or comment on our children’s personal information practices, you may contact us via email at help@toysrus.com.cn. Our dedicated personnel for protection of children's personal information will promptly respond to your requests.
When you choose to use our related products and/or services for a child under your guardianship, we may need to collect the personal information of the child from you in order to perform relevant services. We will inform you of the purpose and use of the collection and seek your consent if it is necessary to collect children’s personal information to provide a service. If relevant information is not provided, you will not be able to receive relevant services. In addition, please be aware that in the function of product reviews, the product information actively provided by you may contain children’s personal information. As a guardian, you should judiciously perform your guardianship duties to protect the security of children’s personal information. Please guide and supervise children carefully if children wish to register or use our products and/or services by themselves.
Children or their guardians have the right to access and correct children’s personal information at any time, and can also request that personal information be deleted. Please contact us if you have any comments, suggestions, complaints or reports regarding children’s personal information, and we will provide assistance at any time.
Please note that our Star Card membership is not open to children. Please pay close attention to the notice on the Star Card registration page. Please do not register or use relevant functions of the Star Card membership if you are under the age of fourteen.

VII International transfers of personal information

Toys”R”Us provides products and services through resources and network facilities across the world. Therefore, subject to the purpose of this Policy, your personal information may be transferred to overseas affiliates of Toys”R”Us or their authorized service providers, or accessed by such affiliates or service providers. The current overseas recipients mainly include:

Comestri

Overseas recipients: Comestri Hong Kong Limited. Its server is hosted in Hong Kong
Method of cross-border transfer: Transmit via data interface
Contact information:

(a) by contact form at www.comestri.com/contact;

(b) by e-mail at privacy@comestri.com, or

Purpose and method of processing: Assist in the management of orders from Websites and WeChat Mini Program.
Types of personal information: Your name, email address, phone number, Star Card number and address
Methods and procedures for exercising personal information rights to overseas recipients: Exercising personal information rights through Toys”R”Us.

Salesforce

Overseas recipients: Salesforce.com Singapore Pte Ltd. Its server is hosted in Japan
Method of cross-border transfer: Transmit via data interface & cloud storage
Contact information:

(a) Fill out the form on www.salesforce.com/form/other/privacy-request/

(b) email Salesforce at privacy@salesforce.com or datasubjectrequest@salesforce.com

(d)write to Salesforce at:
Salesforce Data Protection Officer (Salesforce Privacy Team)
415 Mission St, 3rd Floor
San Francisco, CA 94105, USA

Purpose and method of processing: Assist in processing orders from Websites and dispatching orders to our order management system.
Types of personal information: Your gender, name, age, email address, mobile phone number, password, Star Card number and address, as well as your child/children’s gender, date of birth and name
Methods and procedures for exercising personal information rights to overseas recipients: Exercising personal information rights through Toys”R”Us.

Bazaarvoice

Overseas recipients: Bazaarvoice, Inc.. Its server is hosted in North America
Method of cross-border transfer: Transmit via data interface & cloud storage
Contact information:

(a) email at privacy@bazaarvoice.com, or

(b) by mail to:

<ATTN: Legal Dept
10901 Stonelake Blvd
Austin, TX 78759]

Purpose and method of processing: Assist in the realization of the product review function on Websites.
Types of personal information: Your gender, name, email address, and location
Methods and procedures for exercising personal information rights to overseas recipients: Exercising personal information rights through Toys”R”Us.

Amazon Web Service

Overseas recipients: Amazon Web Services, Inc.. Its server is hosted in Singapore
Method of cross-border transfer: Transmit via data interface
Contact information:

(a) by contact form at https://aws.amazon.com/contact-us/compliance-support/

(b) by mail to:

Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109-5210, ATTN: AWS Legal

Purpose and method of processing: Assist in the realization of password reset and order confirmation functions.
Types of personal information: Your phone number
Methods and procedures for exercising personal information rights to overseas recipients: Exercising personal information rights through Toys”R”Us.

Toys”R”Us CRM

Overseas recipients: Toys”R”Us (Asia) Limited. Its server is hosted in Hong Kong
Method of cross-border transfer: Transmit via data interface
Contact information:

(a) call our customer service hotline at 400-886-8828, or

(b) email at help@toysrus.com.cn

Purpose and method of processing: Assist in processing and managing Star Card member information.
Types of personal information: Your name, gender, and date of birth, as well as your child/children’s name, gender, and date of birth
Methods and procedures for exercising personal information rights to overseas recipients: Exercising personal information rights through Toys”R”Us.

We will obtain your separate consent for the cross-border transfer of your personal information in accordance with relevant laws and regulations. Please pay close attention to the notice on the relevant pages of Websites and WeChat Mini Program. We will strictly follow relevant procedures to transmit and process your personal information, and sign contracts with overseas recipients to ensure that your information is protected at the same level as in the People’s Republic of China.

VIII How this Policy is updated

Toys”R”Us reserves the right to modify this Policy at any time.
Without your explicit consent, we will not diminish your rights under this Policy. If this Policy is updated, we will release the updated version through Toys”R”Us Websites and WeChat Mini Program as well as sending notifications (e.g. sending a text message or displaying a pop-up window). Please review the updated version to ensure that you are fully aware of the updated content of the Policy.
If you do not agree to our revision of the Policy, please stop using related products and services immediately. If you continue to use such products or services after this Policy is updated, you are deemed to have fully read and agreed to be bound by the updated Policy.

IX How to contact us

If you have any questions, suggestions or comments about our Policy or about the use of your personal information, you can call the customer service hotline at 400-886-8828 (Monday to Friday: AM 9:00 – PM 10:00; Saturday, Sundays and holidays: AM 10:00 – PM 6:30), send an email to help@toysrus.com.cn, or contact our online customer service.
In order to verify your identity, you may be required to provide additional materials or written requests for processing your request and/or complaint. We will respond within 15 working days.
If you are dissatisfied with our response, especially when our personal information processing impairs your legal rights, you can also file a lawsuit with a court with jurisdiction in the defendant’s domicile.

Toys”R”Us (China) Trading Co., Ltd.