Privacy Policy

We believe that everyone using FamilyAlbum should be confident in the security of their data. We wrote this Privacy Policy to explain to our users what data we collect, how it’s used, disclosed, and why.

This Privacy Policy also provides information based on laws related to the processing of your personal data. Further, this Privacy Policy sets out the basis by which we will process any personal data that you provide to us or that we obtain from other sources.

Thank you for taking the time to read through this Privacy Policy. If you have any questions, please do not hesitate to contact us.

For the purpose of data protection law, MIXI, Inc. ("we", "us", and "our") is the data controller with respect to your personal data.

1. Our main office address:
   Shibuya Scramble Square 36F, 2-24-12 Shibuya, Shibuya-ku, Tokyo 150-6136, Japan
2. Our email address:
   support@family-album.com
3. You can also contact us by tapping “Inquiries” in the Settings tab of the FamilyAlbum app.

In this Privacy Policy:

1. Your “personal data” means any data which relates to you and from which you can be identified. It may include contact details, other personal information as defined under applicable data protection laws, photographs, and videos.
2. “Processing” means any activity or operation that is carried out in respect of your personal data, including collecting, storing, using, transferring, and deleting.
3. “App” refers to the family photograph/video-sharing mobile and web applications collectively named “FamilyAlbum”.
4. “Child” means any individual under the age of 13 registered as a “child” in the App.

1. Information you provide while using the app. This may include your nickname, age, email address, relationship to the child, payment information (including credit card details and shipping information), usage history of the App, your subscription status (Premium Pro, Premium, or non-subscribed), your language settings, number of photographs/videos you store in the App time to time, whether the user is an album administrator or not as well as the child’s nickname, age, and birthdate. Other personal data may also be contained in photographs and video clips you upload to the App, users’ comments on them, titles of photo albums, photobooks and DVDs, passwords set by users for URLs making it possible for other users to view albums, etc.
   
   In order to use the App, you are required to provide nicknames for yourself and the child, as well as your relationship to the child. Other personal data of yourself or the child is not required. Any additional personal data will only be obtained if and when you choose to provide it to us.
2. Information we collect. This may include your device information (such as operating system/version, hardware model, browser type/version), IP address, FamilyAlbum login information, usage log for the app, device IDs (such as Apple IDFA or Google AAID), and cookies and similar technologies.
   
   For more information regarding cookies and similar technologies, please see “9. Information on the use of cookies and similar technologies” below.
3. Information we collect from other sources. This may include:
   • Information about ad clicks and app installs from marketing platforms
   • Purchase information/history from Apple, Google, and other payment platforms for products and services ordered through the app
   • FamilyAlbum usage activity from analytics platforms
   • Shipping information (including your real name and postal address) provided by other App users when ordering DVDs, photobooks, and/or other products and services purchased through the App as a gift or when greeting cards are sent by the other App users to you under our greeting card service, “Greeting Cards,” which constitutes the part of FamilyAlbum.
   • Perceptual hashes of photographs and video clips, feature vectors of users’ faces, the estimated gender and age of each user’s face, results of classifications of facial images of each user (used for album function for each user), results of automatic suggestions for creating and purchasing photobooks and other products and/or services, tag information on photographs and video clips, etc. generated via Google Cloud Platform.
   • When uploading to the App via Google Photos: Photos/videos selected for upload and profile information registered to Google Photos (If you choose to use this feature, your name, email address, and profile picture are accessed to display in the App while using the feature. This information is not saved to our servers.)

We may use your personal data for the following purposes based on your consent (where required under applicable data protection laws) or our legitimate interests (or an equivalent basis under the laws of your jurisdiction), or in order to perform contracts with you or comply with our legal obligations:

• To provide you with our services. Our services include the App, customized content (such as 1s Movies, auto-generated photobooks, DVDs, auto-generated photo stickers, and other content), delivery of greeting cards, payment processing for products and services purchased within the App, and improvements to the App.
• To provide user support. This includes handling inquiries and complaints, troubleshooting and solving technical issues, and making necessary changes to our services.
• For marketing analytics. This includes collecting and analyzing data to research usage of the app.
• To protect against cyberattacks. This includes maintaining the privacy of our users and investigating and deterring unauthorized or illegal activity.
• For marketing. This includes operating promotional campaigns, measuring the performance of these campaigns, and sending information about our services, products, and features.
• For advertising. This includes displaying ads for features (including personalised ads, where permitted) and other content that might be of interest to you.
• Other. As otherwise permitted or required by applicable laws.

Your personal data may be shared with the following recipients in the situations described below and as otherwise permitted or required by applicable laws:

• Authorized employees or affiliates. When necessary, these authorized employees and affiliates will access the minimum amount of data required to provide customer support, operate our system and services, or investigate fraud or security issues.
• Manufacturers and service/shipping providers of products/services ordered through the app (including photobooks, DVDs, and other products/services). We provide only the minimum amount of information necessary for them to carry out the specific services listed in our contract with them. Further, the information is only used for the exact purposes specified in the contract and all information is deleted after the required task has been completed.
• Payment service providers. Payments for products/services ordered through the app are processed by secure and trusted payment processors, such as Apple, Google, Stripe, and GMO. We do not store payment information.
• Infrastructure vendors and other service providers. We store all data on servers provided by secure infrastructure services. We also provide data to service providers who support our business, such as by analyzing how our app is used, providing customer service, conducting surveys, measuring promotional campaigns, and/or sending emails and push notifications to users, for the purpose of processing the data described in the above.
• Advertising networks and media platforms, internet service providers, or data analytics providers.
• Law enforcement bodies. In response to legal requests, we will share the minimum amount of data necessary with law enforcement bodies.
• Other users invited to your album by you or your partner. The only information accessible by other album members is information that you have provided when using the app.

In order to process personal data as described in “5. Purpose and Legal Basis of Processing Personal Data” above, we retain third-party service providers including the following:

• Amazon Web Services, Google Cloud Platform (to store data, provide our service, etc.)
• Google Firebase (for analytics, to send push notifications, etc.)
• Apple App Store, Google Play Store, Stripe, GMO-PG (to process and confirm payments)
• Zendesk (to provide customer support)
• AppsFlyer (for marketing analytics)
• Meta, X (formerly Twitter) (for advertising and analytics)
• NewRelic (to monitor our service)
• SendGrid (to send emails)
• SurveyMonkey (to conduct user surveys)
• Google Ad Manager (for advertising)

In all cases, we apply strict measures to keep your data safe and your privacy protected. We share your personal data only for the purposes described in “5. Purpose and Legal Basis of Processing Personal Data” above and in accordance with applicable laws.

Whenever we transfer, store, or process your personal data, we take reasonable steps to safeguard the privacy of your data. When using or disclosing personal data transferred from your jurisdiction, we take the measures required by applicable data protection laws. For further details, please refer to the country-specific section below that is applicable to you.

We retain your personal data only to the extent and for the period of time (which shall not exceed any of the periods listed below) necessary to achieve the purposes for which the personal data is collected, except when required by law to retain it for a longer period of time. In that case, we retain your data for the period required by law.

• We retain your personal data until we receive a request from you to delete your account.
• Photos and videos deleted from the app are removed from our servers automatically within 30 days.
• Your personal data will be deleted from our servers within 30 days of receiving a request to delete your account.

We utilize cookies and similar technologies within the app in order to collect certain information, including the following:

• Tracking IDs. Tracking IDs are used by various third-party service providers to associate multiple sessions (and any activity within those sessions) with a unique ID. Your device sends this unique ID with related engagement data, allowing third-party service providers to attribute all relevant activities to one user.
• Cookies. Cookies are small text files stored on your device by your web browser. We use first-party cookies and we allow our third-party service providers to use cookies for their services. These cookies store your login details, preferences, or other information in order to provide a more efficient and personalized experience. You can learn more about cookies here.
• IP addresses. We and our third-party service providers collect IP addresses in services relating to the app.

We use the following first-party cookies based on your consent or without your consent only where permitted by applicable laws.

We may change the expiration time frames listed above in order to optimize the app’s usability.

It is possible to disable cookies and other tracking IDs on your device. To learn more, visit the appropriate link below:

• iOS app users
• Android app users
• Google Chrome browser users

We acknowledge that, depending on where you are located, you may have certain rights, such as the right to access and correct your personal data, discontinue our usage of your personal data, object to or appeal our decision made in relation to your request and other rights stipulated in each applicable jurisdictional law. To exercise any of these rights, please contact us using the information provided in either the country-specific section applicable to you or “21. Contact” below. You also have the right to lodge a complaint with a data protection authority in the jurisdiction where you reside, where you work, or where the alleged infringement of your rights took place. We will comply with any such request in full accordance with the applicable laws and regulations.

The following personal data is required to use the app:

• For users who are creating an album: Your nickname, the child’s nickname, and your relationship to the child
• For users who are invited to an album created by another user: Your nickname and your relationship to the child

Please note that you cannot use the app if we cannot obtain the personal data listed above.

We do not knowingly collect or solicit information from anyone under the age of 13 without parental consent. The app is not directed at children under the age of 13 who register themselves without parental consent, and we do not knowingly allow such persons to register. In the event that we learn that we have collected personal data from a child under age 13 without parental consent, we will delete that information as quickly as possible. If you believe that we might have obtained any information from a child under 13 without parental consent, please contact us.

The California Consumer Privacy Act (“CCPA”) requires us to provide additional privacy-related information to California residents. If you are a California resident, please see this section.

For the purpose of this section, “personal information” refers to information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. To the extent this section applies to you, the provisions of this section prevail over any conflicting provisions in other sections of this Privacy Policy.

1. CCPA Disclosures
   Section 4 lists personal information that we may collect and have collected within the preceding 12 months from you and the categories of sources from which we may collect, and have collected within the preceding 12 months, your personal information. Such personal information is classified into the following categories of personal information as set forth in the CCPA.
   • Identifiers, including your real name, your nickname, postal address, email address, payment information (including credit card details and shipping information), your age, the child’s nickname, and IP address. Especially, your real name and postal address will be collected from other App users if the other App users send you the greeting cards by Greeting Cards;
   • Other personal information, including relationship to the child, your language settings, number of photographs/videos you store in the App time to time, whether the user is an album administrator or not, and tag information on photographs and video clips;
   • Characteristics of protected classifications, including the child’s age and birthdates;
   • Commercial information, including usage history of the App, your subscription status (Premium Pro, Premium, or non-subscribed), purchase information/history from Apple, Google, and other payment platforms for products and services ordered through the App;
   • Biometric information, including perceptual hashes of photographs and video clips, feature vectors of users’ faces, the estimated gender and age of each user’s face, and results of classifications of facial images of each user (used for album function for each user).
   • Audio, electric, visual and similar information, including photographs and video clips you upload to our website;
   • Internet or other electronic network activity information, including your device information (such as operating system/version, hardware model, browser type/version), FamilyAlbum login information, usage log for the app, device IDs (such as Apple IDFA or Google AAID), cookies and similar technologies, information about ad clicks and app installs from marketing platforms, and FamilyAlbum usage activity from analytics platforms;
   • Inference, including results of automatic suggestions for creating and purchasing photobooks and other products and/or services; and
   • Sensitive personal information, including biometric information.
   Section 5 lists the business or commercial purposes for which we may collect, use, disclose, sell or share, and have collected, used, disclosed, sold or shared within the preceding 12 months, your personal information.
   
   In the preceding 12 months we have sold and shared your personal information regarding cookies for monetary or other valuable consideration, with third parties which are described in this Privacy Policy, including personal information of minors under the age of 16 years.
   
   We retain each category of your personal information as described in Section 8.
   
   The following list describes: (i) the categories of personal information that we have disclosed for our business or commercial purposes within the preceding 12 months; and (ii) the categories of third parties to whom we have disclosed such personal information for our business or commercial purposes within the preceding 12 months.
   • Identifiers
   • - Authorized employees or affiliates
   • - Manufacturers and service/shipping providers of products/services ordered through the app (including photobooks, DVDs, and other products/services)
   • - Payment service providers
   • - Infrastructure vendors and other service providers
   • - Law enforcement bodies
   • - Other users invited to your album by you or your partner
   • Other personal information
   • - Authorized employees or affiliates
   • - Manufacturers and service/shipping providers of products/services ordered through the app (including photobooks, DVDs, and other products/services)
   • - Infrastructure vendors and other service providers
   • - Law enforcement bodies
   • - Other users invited to your album by you or your partner
   • Characteristics of protected classifications
   • - Authorized employees or affiliates
   • - Manufacturers and service/shipping providers of products/services ordered through the app (including photobooks, DVDs, and other products/services)
   • - Infrastructure vendors and other service providers
   • - Law enforcement bodies
   • - Other users invited to your album by you or your partner
   • Commercial information
   • - Authorized employees or affiliates
   • - Manufacturers and service/shipping providers of products/services ordered through the app (including photobooks, DVDs, and other products/services)
   • - Infrastructure vendors and other service providers
   • - Law enforcement bodies
   • Biometric information
   • - Authorized employees or affiliates
   • - Infrastructure vendors and other service providers
   • - Law enforcement bodies
   • Audio, electric, visual and similar information
   • - Authorized employees or affiliates
   • - Manufacturers and service/shipping providers of products/services ordered through the app (including photobooks, DVDs, and other products/services)
   • - Infrastructure vendors and other service providers
   • - Law enforcement bodies
   • - Other users invited to your album by you or your partner
   • Internet or other electronic network activity information
   • - Authorized employees or affiliates
   • - Infrastructure vendors and other service providers
   • - Law enforcement bodies
   • Inference
   • - Authorized employees or affiliates
   • - Manufacturers and service/shipping providers of products/services ordered through the app (including photobooks, DVDs, and other products/services)
   • - Infrastructure vendors and other service providers
   • - Law enforcement bodies
   • - Other users invited to your album by you or your partner
   • Sensitive personal information
   • - Authorized employees or affiliates
   • - Manufacturers and service/shipping providers of products/services ordered through the app (including photobooks, DVDs, and other products/services)
   • - Infrastructure vendors and other service providers
   • - Law enforcement bodies
   • - Other users invited to your album by you or your partner
   The following list describes: (i) the categories of personal information, including personal information of minors under the age of 16 years, that we will sell or share for our business or commercial purposes; and (ii) the categories of third parties to whom we will sell or share such personal information for our business or commercial purposes.
   • Your subscription status, your language settings, relationship to the child, usage history of the App, whether the user is an album administrator or not, and cookies.
   • - Advertising networks and media platforms, internet service providers, or data analytics providers.
2. Rights of California Residents
   Under the CCPA, you are entitled to the following rights:
   • Right to know. You have the right to request to disclose (i) the categories of personal information that we collected, sold or shared about you within the preceding 12 months, (ii) the categories of sources from which we have collected personal information, (iii) business or commercial purpose for collecting, selling, or sharing personal information, (iv) the categories of third parties to whom we disclose, sell or share personal information, (v) specific pieces of personal information we collected about you. You may only make a request for access twice within a 12-month period.
   • Right to delete.You have the right to request the deletion of your personal information that we collect or maintain, subject to certain exceptions.
   • Right to correct.You have the right to request the correction of inaccurate personal information that we collect or maintain about you.
   • Right to opt-out.You have the right to opt-out of sale or sharing personal information about you.
   
   To exercise your right to know, delete, or correct your personal information, you may submit a request via email at support@family-album.com
   
   If you would like to opt out of sale or sharing of your personal information, you may click [Do Not Sell or Share My Personal Information] or in the App settings.
   
   For your requests, you must provide us with sufficient information that allows us to reasonably verify you are the person about whom we collected the personal information and describe your request with sufficient detail to allow us to properly evaluate and respond to it. If we are not able to verify your identity for your requests to know, delete, or correct, with the information provided, we may ask you for additional pieces of information.
   
   Only you, or a person that you authorize to act on your behalf, may make a request related to your personal information. If you are an authorized agent making a request on behalf of another individual, you must provide us with signed documentation that you are authorized to act on behalf of that individual.
   Additionally, you have the right to not to receive discriminatory treatment if and when you exercise your rights conferred by applicable law.
   
   Please note, we do not process sensitive personal information for the purposes that, under applicable law, require us to support the right to limit the use or disclosure of sensitive personal information.
3. California Do Not Track
   Cal. Bus. & Prof. Code § 22575(b) provides that California residents are entitled to know how we respond to “Do Not Track” browser settings. We do not currently take actions to respond to Do Not Track signals because a uniform technological standard has not yet been developed.
4. California Shine the Light
   Within the meaning of California’s “Shine the Light” law (Cal. Civ. Code § 1798.83), we do not disclose personal information to third parties for their own direct marketing purposes.

The Colorado Privacy Act (“CPA”) requires us to provide additional privacy-related information to Colorado residents. If you are a Colorado resident, please see this section.

This section applies to information that we collect on our App or when you use our products and services that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your device (for the purpose of this section, “personal information”). To the extent this section applies to you, the provisions of this section prevail over any conflicting provisions in other sections of this Privacy Policy.

1. CPA Disclosures
   Please see sections 5, 10 and 13.a.
2. Rights of Colorado residents
   Under the CPA, you are entitled to the following rights:
   • Right to Confirm and Access. You have the right to confirm whether we Process your Personal Information and to request access to that Personal Information we have collected and maintain about you except that we will not confirm or provide Personal Information that we believe would disclose our trade secrets. You may exercise this right as described below.
   • Right to Correct. You have the right to correct any inaccuracies in your Personal Information Processed by us, taking into account the nature of the Personal Information and the purposes of the Processing of your Personal Information. We may also not be able to accommodate your request to change the Personal Information if we believe doing so would violate any law or legal requirement or cause the Personal Information or the information associated with the Personal Information to be incorrect.
   • Right to delete. You have the right to request that we delete all of your Personal Information. We may not accommodate a request to erase your Personal Information if we believe the deletion would violate any law or legal requirement or cause any information associated with the Personal Information to be incorrect.
   • Right to Portability. To the extent you provide us with your Personal Information and to the extent we Process your Personal Information, you have the right to request that we provide you a copy of, or access to, all or part of such Personal Information in a portable, and to the extent technically feasible, readily usable format that allows you to transmit the Personal Information to another controller without hindrance. We shall not provide data that we believe would disclose our trade secrets.
   • Right to opt-out. To the extent applicable, you have the right to opt-out of Processing your Personal Information for the purposes of: (i) targeted advertising; (ii) the sale of your Personal Information; or (iii) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer. We do not Process Personal Information for the purpose of profiling within the meaning of CPA.
   
   Additionally, you have the right to not to receive discriminatory treatment if and when you exercise your rights conferred by applicable law.
   
   To exercise your right to know, delete, or correct your personal information, you may submit a request via email at support@family-album.com
   
   If you would like to opt out of sale or Processing for targeted advertising, you may click [Do Not Sell or Share My Personal Information] or in the App settings.
   
3. Appeal Process
   You may appeal a refusal by us to take action on your request to exercise any of your CPA rights within a reasonable period of time after we provide you notice of such refusal by contacting us through the contact information listed below.
   
   Within 45 days after we receive your appeal, we will inform you in writing of any action taken or not taken in response to your appeal, including any explanations for the reasons for the decision. If we require more time, and if an extension is permitted under the CPA, we will inform you of the reason and extension period in writing. If your appeal is denied, you may lodge a complaint with the Attorney General in your state through his/her contact information available at Colorado Attorney General.

The Oregon Consumer Privacy Act (“OCPA”) requires us to provide additional privacy-related information to Oregon residents. If you are an Oregon resident, please see this section.

This section applies to information that we collect on our App or when you use our products and services that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your device (for the purpose of this section, “personal information”). To the extent this section applies to you, the provisions of this section prevail over any conflicting provisions in other sections of this Privacy Policy.

1. OCPA Disclosures
   Please see sections 5, 10 and 13.a.
2. Rights of Oregon residents
   Under the OCPA, you are entitled to the following rights:
   • Right to Confirm and Access. You have the right to confirm whether we Process your Personal Information and to request access to that Personal Information we have collected and maintain about you except that we will not confirm or provide Personal Information that we believe would disclose our trade secrets. You may exercise this right as described below.
   • Right to Correct. You have the right to correct any inaccuracies in your Personal Information Processed by us, taking into account the nature of the Personal Information and the purposes of the Processing of your Personal Information. We may also not be able to accommodate your request to change the Personal Information if we believe doing so would violate any law or legal requirement or cause the Personal Information or the information associated with the Personal Information to be incorrect.
   • Right to delete. You have the right to request that we delete all of your Personal Information. We may not accommodate a request to erase your Personal Information if we believe the deletion would violate any law or legal requirement or cause any information associated with the Personal Information to be incorrect.
   • Right to Portability. To the extent you provide us with your Personal Information and to the extent we Process your Personal Information, you have the right to request that we provide you a copy of, or access to, all or part of such Personal Information in a portable, and to the extent technically feasible, readily usable format that allows you to transmit the Personal Information to another controller without hindrance. We shall not provide data that we believe would disclose our trade secrets.
   • Right to opt-out. To the extent applicable, you have the right to opt-out of Processing your Personal Information for the purposes of: (i) targeted advertising; (ii) the sale of your Personal Information; or (iii) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer. These decisions include decisions that result in the provision or denial by the controller of financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities, health care services or access to essential goods or services. We do not Process Personal Information for purposed of profiling within the meaning of OCPA.
   
   Additionally, you have the right to not to receive discriminatory treatment if and when you exercise your rights conferred by applicable law.
   
   To exercise your OCPA rights, you may submit a request via email at support@family-album.com
   
   If you would like to opt out of sale or Processing for targeted advertising, you may click [Do Not Sell or Share My Personal Information] or in the App settings.
   
3. Appeal Process
   You may appeal a refusal by us to take action on your request to exercise any of your OCPA rights within a reasonable period of time after we provide you notice of such refusal by contacting us through the contact information listed below.
   
   Within 45 days after we receive your appeal, we will inform you in writing of any action taken or not taken in response to your appeal, including any explanations for the reasons for the decision. If we require more time, and if an extension is permitted under the OCPA, we will inform you of the reason and extension period in writing. If your appeal is denied, you may lodge a complaint with the Attorney General in your state through his/her contact information available at Oregon Attorney General.

The Texas Data Privacy and Security Act (“TDPSA”) requires us to provide additional privacy-related information to Texas residents. If you are a Texas resident, please see this section.

This section applies to information that we collect on our App or when you use our products and services that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your device (for the purpose of this section, “personal information”). To the extent this section applies to you, the provisions of this section prevail over any conflicting provisions in other sections of this Privacy Policy.

1. TDPSA Disclosures
   
   Please see sections 5, 10 and 13.a.
   
   NOTICE: We may sell your Sensitive Personal Information.
   
   The TDPSA defines the sale of Personal Information as the “sharing, disclosing, or transferring of personal data for monetary or other valuable consideration by the controller to a third party.”
   
   Under the TDPSA, sensitive information includes Personal Information from a known Child.
2. Rights of Texas residents
   
   • Right to Confirm and Access. You have the right to confirm whether we Process your Personal Information and to request access to that Personal Information we have collected and maintain about you except that we will not confirm or provide Personal Information that we believe would disclose our trade secrets. You may exercise this right as described below.
   • Right to Correct. You have the right to correct any inaccuracies in your Personal Information Processed by us, taking into account the nature of the Personal Information and the purposes of the Processing of your Personal Information. We may also not be able to accommodate your request to change the Personal Information if we believe doing so would violate any law or legal requirement or cause the Personal Information or the information associated with the Personal Information to be incorrect.
   • Right to delete. You have the right to request that we delete all of your Personal Information. We may not accommodate a request to erase your Personal Information if we believe the deletion would violate any law or legal requirement or cause any information associated with the Personal Information to be incorrect.
   • Right to Portability. To the extent you provide us with your Personal Information and to the extent we Process your Personal Information, you have the right to request that we provide you a copy of, or access to, all or part of such Personal Information in a portable, and to the extent technically feasible, readily usable format that allows you to transmit the Personal Information to another controller without hindrance.
   • Right to opt-out. To the extent applicable, you have the right to opt-out of Processing your Personal Information for the purposes of: (i) targeted advertising; (ii) the sale of your Personal Information; or (iii) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer. We do not process Personal Information for the purpose of profiling as defined under the TDPSA.
   
   Additionally, you have the right to not to receive discriminatory treatment if and when you exercise your rights conferred by applicable law.
   
   To exercise your TDPSA rights, you may submit a request via email at support@family-album.com
   
   If you would like to opt out of sale or Processing for targeted advertising, you may click [Do Not Sell or Share My Personal Information] or in the App settings.
   
3. Appeal Process
   You may appeal a refusal by us to take action on your request to exercise any of your TDPSA rights within a reasonable period of time after we provide you notice of such refusal by contacting us through the contact information listed below.
   
   Within 45 days after we receive your appeal, we will inform you in writing of any action taken or not taken in response to your appeal, including any explanations for the reasons for the decision. If we require more time, and if an extension is permitted under the TDPSA, we will inform you of the reason and extension period in writing. If your appeal is denied, you may lodge a complaint with the Attorney General in your state through his/her contact information available at Texas Attorney General.

The Utah Consumer Privacy Act (“UCPA”) requires us to provide additional privacy-related information to Utah residents. If you are a Utah resident, please see this section.

This section applies to information that we collect on our App or when you use our products and services that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your device (for the purpose of this section, “personal information”). To the extent this section applies to you, the provisions of this section prevail over any conflicting provisions in other sections of this Privacy Policy.

1. UCPA Disclosures
   
   Please see sections 5, 10 and 13.a.
   
   We do not “sell” your Personal Information since the term is defined under the UCPA as the “exchange of Personal Information for monetary consideration by the controller to a third party.”
2. Rights of Utah residents
   
   • Right to Confirm and Access. You have the right to confirm whether we Process your Personal Information and to request access to that Personal Information we have collected and maintain about you except that we will not confirm or provide Personal Information that we believe would disclose our trade secrets. You may exercise this right as described below.
   • Right to Correct. You have the right to correct any inaccuracies in your Personal Information Processed by us, taking into account the nature of the Personal Information and the purposes of the Processing of your Personal Information. We may also not be able to accommodate your request to change the Personal Information if we believe doing so would violate any law or legal requirement or cause the Personal Information or the information associated with the Personal Information to be incorrect.
   • Right to delete. You have the right to request that we delete your Personal Information. We may not accommodate a request to erase your Personal Information if we believe the deletion would violate any law or legal requirement or cause any information associated with the Personal Information to be incorrect.
   • Right to Portability. You have the right to request that we provide you a copy of, or access to, all or part of your Personal Information, to the extent technically feasible, in a portable and readily usable format and that allows you to transmit the Personal Information to another controller without impediment, where the Processing is carried out by automated means.
   • Right to opt-out. To the extent applicable, you have the right to opt-out of Processing your Personal Information for the purposes of: (i) targeted advertising; or (ii) the sale of your Personal Information.
   
   Additionally, you have the right to not to receive discriminatory treatment if and when you exercise your rights conferred by applicable law.
   
   To exercise your UCPA rights, you may submit a request via email at support@family-album.com
   
   If you would like to opt out of Processing for targeted advertising, you may click [Do Not Sell or Share My Personal Information] or in the App settings.

The Virginia Consumer Data Protection Act (“VCDPA”) requires us to provide additional privacy-related information to Virginia residents. If you are a Virginia resident, please see this section.

This section applies to information that we collect on our App or when you use our products and services that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your device (for the purpose of this section, “personal information”). To the extent this section applies to you, the provisions of this section prevail over any conflicting provisions in other sections of this Privacy Policy.

1. VCDPA Disclosures
   
   Please see sections 5, 10 and 13.a.
   
   do not “sell” your Personal Information since the term is defined under the VCDPA as the “exchange of Personal Information for monetary consideration by the controller to a third party.”
2. Rights of Virginia residents
   
   • Right to Confirm and Access. You have the right to confirm whether we Process your Personal Information and to request access to that Personal Information we have collected and maintain about you except that we will not confirm or provide Personal Information that we believe would disclose our trade secrets. You may exercise this right as described below.
   • Right to Correct. You have the right to correct any inaccuracies in your Personal Information Processed by us, taking into account the nature of the Personal Information and the purposes of the Processing of your Personal Information. We may also not be able to accommodate your request to change the Personal Information if we believe doing so would violate any law or legal requirement or cause the Personal Information or the information associated with the Personal Information to be incorrect.
   • Right to delete. You have the right to request that we delete all of your Personal Information. We may not accommodate a request to erase your Personal Information if we believe the deletion would violate any law or legal requirement or cause any information associated with the Personal Information to be incorrect.
   • Right to Portability. To the extent you provide us with your Personal Information and to the extent we Process your Personal Information, you have the right to request that we provide you a copy of, or access to, all or part of such Personal Information in a portable, and to the extent technically feasible, readily usable format that allows you to transmit the Personal Information to another controller without hindrance. We shall not provide data that we believe would disclose our trade secrets.
   • Right to opt-out. To the extent applicable, you have the right to opt-out of Processing your Personal Information for the purposes of: (i) targeted advertising; (ii) the sale of your Personal Information; or (iii) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.
   
   To exercise your VCDPA rights, you may submit a request via email at support@family-album.com
   
   If you would like to opt out of Processing for targeted advertising, you may click [Do Not Sell or Share My Personal Information] or in the App settings.
   
3. Appeal Process
   You may appeal a refusal by us to take action on your request to exercise any of your VCDPA rights within a reasonable period of time after we provide you notice of such refusal by contacting us through the contact information listed below.
   
   Within 45 days after we receive your appeal, we will inform you in writing of any action taken or not taken in response to your appeal, including any explanations for the reasons for the decision. If we require more time, and if an extension is permitted under the VCDPA, we will inform you of the reason and extension period in writing. If your appeal is denied, you may lodge a complaint with the Attorney General in your state through his/her contact information available at Virginia Attorney General.

In addition to the other sections of this Privacy Policy, this section applies if we process any personal data within the scope of, the EU General Data Protection Regulation and/or the UK General Data Protection Regulation (collectively, the “GDPR”). If you are an EU or UK user, please read this section.

1. Purpose and Legal Basis of Processing Personal Data
   We use your personal data for the following purposes based on the following legal basis:
   • To provide you with our services. Our services include the App, customized content (such as 1s Movies, auto-generated photobooks, DVDs, auto-generated photo stickers, and other content), payment Processing for products and services purchased within the App, and improvements to the App (Performing contracts or legitimate interests).
   • To provide user support. This includes handling inquiries and complaints, troubleshooting and solving technical issues, and making necessary changes to our services (Legitimate interests).
   • For marketing analytics. This includes collecting and analyzing data to research usage of the app (Consent or legitimate interests).
   • To protect against cyberattacks. This includes maintaining the privacy of our users and investigating and deterring unauthorized or illegal activity (Legitimate interests).
   • For marketing. This includes operating promotional campaigns, measuring the performance of these campaigns, and sending information about our services, products, and features. (Consent or legitimate interests).
   • For advertising. This includes displaying ads for features (including personalised ads, where permitted) and other content that might be of interest to you (Consent or legitimate interests).
   • Other. As otherwise permitted or required by applicable laws. (Performing legal obligations or legitimate interests).
When we Process your personal data based on your consent, you may withdraw your consent at any time by contacting us using the information provided in “d. EU/UK Representative” or “21. Contact” below. The withdrawal of your consent shall not affect the lawfulness of Processing performed based on your consent before its withdrawal.


2. Cross-border Transfer of Personal Data
   Whenever we transfer, store, or Process your personal data, we take reasonable steps to safeguard the privacy of your data. When using or disclosing personal data transferred from the European Economic Area and/or the UK, we adhere to the standard contractual clauses approved by the European Commission and/or the Government of the UK, adopt other means under European Union law and/or UK law to ensure adequate safeguards, or obtain your consent. You can obtain more details about the protection given to your personal data when it is transferred outside the EEA and/or the UK (including a copy of the standard contractual clauses which we have entered into with recipients of your personal data) by contacting us using the information provided in “d. EU/UK Representative” or “21. Contact” below.
3. Your Rights
   Under the GDPR, you have the following rights:
   • The right to obtain information regarding the processing of your personal data and access to the personal data which we hold about you.
   • The right to request that we rectify your personal data if it is inaccurate or incomplete.
   • The right to request that we erase your personal data in certain circumstances. This may include (but is not limited to) circumstances in which:
   • - it is no longer necessary for us to retain your personal data for the purposes for which we collected it;
   • - we are only entitled to process your personal data with your consent, and you withdraw your consent; or
   • - you object to our processing of your personal data for our legitimate interests, and our legitimate interests do not override your own interests, rights and freedoms.
   • The right to request that we restrict our processing of your personal data in certain circumstances. This may include (but is not limited to) circumstances in which:
   • - you dispute the accuracy of your personal data (but only for the period of time necessary for us to verify its accuracy);
   • - we no longer need to use the personal data except for the establishment, exercise or defence of legal claims; or
   • - you object to our processing your personal data for our legitimate interests (but only for the period of time necessary for us to assess whether our legitimate interests override your own interests, rights and freedoms).
   • The right to object to us about our processing of your personal data.
   • The right to receive any personal data which we process about you on the basis of your consent or on a contract (as opposed to any other legal ground) and where the processing is carried out by automated means in a structured, commonly used and machine-readable format and/or request that we transmit that data to a recipient where this is technically feasible. Please note that this right only applies to personal data which you have provided to us.
   To exercise any of these rights, please contact us using the information provided in “d. EU/UK Representative” or “21. Contact” below.
4. EU/UK Representative
   You can contact our EU/UK representative using the contact information below.
   • EU representative: DP-Dock GmbH (Address: Ballindamm 39, 20095, Hamburg, Germany; Email: mixi@gdpr-rep.com)
   • UK representative: DP Data Protection Services UK Ltd. (Address:16 Great Queen Street, Covent Garden, London, WC2B 5AH, UK; Email: mixi@gdpr-rep.com)

We may occasionally update this Privacy Policy in order to better meet our obligations under data protection laws. Significant changes may be accompanied by a notification and/or request for consent, as required by law.

Should you have any questions or concerns regarding this Privacy Policy, please do not hesitate to contact us.

FamilyAlbum at MIXI, Inc.
Shibuya Scramble Square 36F, 2-24-12 Shibuya, Shibuya-ku, Tokyo 150-6136, Japan
support@family-album.com

You can also contact us by tapping “Inquiries” in the Settings tab of the FamilyAlbum app.

You can contact our Data Protection Officer (DPO) by email at dpo@mixi.co.jp.