HANYI INTERNATIONAL (HONG KONG) LIMITED (registered address: RM 4,16/F HO KING COMM CTR 2-16 FAYUEN ST MONGKOK KLN HONG KONG, contact information: [[email protected]], hereinafter referred to as “HanYi International” or “We”) attaches great importance to protecting users’ (hereinafter referred to as “You”) personal data. We process your personal data in accordance with the FontKit Privacy Policy (hereinafter referred to as the “Policy” or “Privacy Policy”). Personal data referred to in this Policy means data referring to any identified or identifiable natural person.

Unless otherwise specified, this Policy applies only to the products and services that you will obtain by using FontKit (also referred to as the “Platform”). The scope of the Platform includes its computer official website, computer client and mobile official website. If you also get any other products and services from us or any third party, please review our or the third party’s other user agreements, privacy policies or related documents corresponding to such products and services.

Before using the Platform, please carefully read and fully understand the terms of this Policy, especially the terms and conditions relating to the exemption and limitation of our liability and the limitation of users’ rights, etc. In order to inform you of the liability exemption and limitation clauses and the content involving your important rights and interests, these clauses will be highlighted in bold font for your attention. When you confirm this Policy by checking the box or clicking “Agree”, you consent that your personal data are processed by us in accordance with relevant laws and regulations as well as this Policy. If you wish to opt-out of this Policy in whole or in part after you have “agreed” to it, please contact us through the means provided in this Policy.

This Policy will help you understand the following:

1. HOW WE COLLECT AND USE YOUR PERSONAL DATA
2. PERMISSIONS AND COOKIES OR SIMILAR TECHNOLOGIES
3. HOW WE ENTRUST THE PROCESSING, SHARE, TRANSFER AND PUBLICLY DISCLOSE OF YOUR PERSONAL DATA
4. HOW WE STORE AND DELETE YOUR PERSONAL DATA
5. HOW WE PROTECT YOUR PERSONAL DATA
6. YOUR RIGHTS AND CHOICES REGARDING PERSONAL DATA
7. CROSS-BORDER TRANSFER OF PERSONAL DATA
8. HOW WE PROCESS PERSONAL DATA OF MINORS/CHILDREN
9. HOW THIS POLICY WILL BE UPDATED
10. CONTACT US

1. HOW WE COLLECT AND USE YOUR PERSONAL DATA

1. In order to provide you with the services of the Platform, we will collect and use your personal data as follows:

PERSONAL DATA	PURPOSE AND USAGE
E-mail Address, Account Password	When you register for an account on the Platform, you will be required to provide your e-mail address and account password. The e-mail address will be used to register your account, log in to your account and receive a verification code for retrieving your account password. The account password will be used when you log in or verify your account. In addition, we may send marketing information, renewal reminders and other information related to the FontKit service to your email address. If you no longer want to get these features, you may opt-out of any of them according to the contact information provided by us.
Third-party Login Account Information	If you register or log in to the Platform through a third-party account (e.g., Google, Facebook, Apple, etc.), we will collect the account information of the third-party account you used for logging in, to manage your Platform account. You can view and manage the above information and authorizations on third-party platforms like Google, Facebook, Apple, etc.
Account Registration Record, Account Login Record	Your account registration record and account login record will be used by the Platform to manage your account and to count your usage of the Platform.
Personalized Setting Information	Your personalized setting information, including personal profile picture, personal username (nickname), team profile picture, team name, team note name, etc., will be used for your personal display and the management of your account by the Platform.
Device Native Font Files (including device native font information and device native font installation package)	Your device's native font files (including device's native font information and native font installation package, hereinafter referred to as "Native Fonts") will be used to identify your Native Fonts, and help the Platform manage your Native Fonts by browsing, activating, de-activating, and grouping them.
Information about the Applications in Use	We will collect a list of applications you are using to help you realize the function of managing and using the Platform fonts in the third-party software.
Font Usage Records	We will collect the records of your font usage, activation and favorites and display the relevant information to you, so that you can easily browse and manage the fonts, as well as manage the fonts you use in the background.
Browser and Device Type	In order to enhance your user experience and ensure that the Platform can be displayed and run normally on different devices and browsers, we will adapt the appropriate version of the Platform content corresponding to the browser and device you are using.
Mac Address	Your Mac address (Media Access Control Address) will be used to identify the device on which the Platform is in operation, and we will configure different service permissions, content and payment schemes for you based on your selected subscription services and your Mac address.
Time Zone	We will set language, currency, and other localized services based on your time zone information.
Billing Information	If you use our paid services, we will collect your billing information through a third party, including payment account, amount, billing address, etc. for the management of your bill and processing payment-related information. The privacy policy link for the third-party payment platform is: (https://www.paypal.com/hk/legalhub/privacy-full?locale.x=en_HK).

2. Rules for Collecting and Using User Information

1) We will collect and use your user information in accordance with the laws and regulations of the country/region to which this Policy applies.

2) If the user information you provide contains third-party personal data, you shall ensure that you have obtained lawful authorization before providing us with such personal data.

3) For personal data that we require your affirmative consent to process, you may withdraw your consent at any time by contacting us in the manner set out in this Policy. Please note that your withdrawal of consent will not affect the validity of our personal data processing activities based on your consent prior to your withdrawal of consent.

4) In accordance with the provision of applicable laws, we may, without obtaining your consent, collect, use or process your personal data beyond the scope, purpose and methods of use defined in this Policy.

5) To the extent that permitted by applicable laws, we may securely encrypt and de-identify the personal data collected from you, so that specific individuals cannot be re-identified, and then use the deidentified data for purposes such as machine learning, algorithm model training, or other data analysis and mining processes, in order to enhance our product experience and assist in business decision-making analysis.

2. PERMISSIONS AND COOKIES OR SIMILAR TECHNOLOGIES

1. Permissions

FontKit will use your device permissions as follows:

PERMISSIONS	PURPOSE AND USAGE
Access to Native Fonts Information	Your device's native font files will be used to identify your Native Fonts and help the Platform manage your Native Fonts by browsing, activating, de-activating, and grouping them.
Permission to Access Information about the Applications in Use	We will obtain the status of the application window you are using (temporary use only on your local machine) to help you manage and use the Platform fonts in the third-party software.

2. Cookies or Similar Technologies

1) Cookies and similar device identification technologies are commonly used on the Internet. When you use the Platform, we may use such technologies to send one or more cookies or anonymous identifiers (hereinafter referred to as “Cookies”) to your device to collect, identify and store information about your visits and use of the Platform. We primarily use Cookies to ensure the security and efficient operation of our products and services, which enables us to remember your identity, confirm the security status of your account, troubleshoot related issues such as crashes and delays, and assist you in tasks like filling out forms and entering search queries. We commit not to use Cookies for purposes other than those mentioned above.

2) The types of Cookies used by the Platform are as follows:

1. Essential Cookies

In order for you to access this website normally and use its functions, we use essential Cookies. These Cookies are crucial for the operation of web pages, helping you navigate smoothly between various pages of this website and utilizing their specific features, such as accessing secure zones.

2. Functionality Cookies

This website uses functionality Cookies to remember your choices and preferences, providing more personalized features. For example, these Cookies can remember your login information so that you don't have to log in again every time you visit.

3. Third-party Cookies

a) PayPal

We use PayPal to handle payment matters. When you choose to make payments through PayPal, PayPal Cookies may be set on your device to facilitate payment processing and ensure transaction security. Regarding how PayPal processes personal data, please refer to the PayPal Privacy Policy (https://www.paypal.com/hk/legalhub/privacy-full?locale.x=en_HK).

b) Google Tag Manager

This website uses Google Tag Manager to manage website tags for easy integration and management of our SEO tools and services. Through Google Tag Manager, we can understand the website’s usage and traffic sources, thereby optimizing our online content and marketing strategies. Google Tag Manager itself does not collect personally identifiable information. For more information about Google Tag Manager, please visit the Google Tag Manager Use Policy (https://www.google.com/analytics/tag-manager/use-policy/).

3) Most browsers provide users with the ability to clear the browser's cache data. You can perform the corresponding data clearing operation through your browser or configure settings to reject or manage Cookies. However, please note that disabling Cookies may result in your inability to use Platform services or features that rely on Cookies.

3. HOW WE ENTRUST THE PROCESSING, SHARE, TRANSFER AND PUBLICLY DISCLOSE OF YOUR PERSONAL DATA
1. Entrust the Processing

We will entrust third-party service providers to process your personal data, and such entrustment will not exceed the scope in this Policy. Our service providers may include companies that support us in marketing, sales, consulting, communication, software maintenance and support, analytics, social media, market research, license compliance, security, and user authentication. When processing your information, our service providers must comply with applicable national/regional laws.

2. Share, Transfer and Publicly Disclose of Your Personal Data

Except as expressly permitted or exempted by the laws applicable to you or us, we will not provide (including sharing, transferring or publicly disclosing) your personal data to other companies, organizations and individuals without your content. Additionally, under no circumstances, we will sell your personal data.

4. HOW WE STORE AND DELETE YOUR PERSONAL DATA

Your personal data will be stored in a data center located in your country. For specific storage methods and policies for your personal data, please refer to the relevant information provided by our third-party storage service provider, ALIBABA CLOUD (SINGAPORE) PTE LTD (https://www.alibabacloud.com/help/zh/legal/latest/alibaba-cloud-international-website-privacy-policy). Unless required by the legal provisions on the mandatory storage period, we will only retain your personal data for the duration necessary to fulfill the purposes stated in this Policy. Upon expiration of the storage period, we will delete or anonymize the stored personal data in accordance with applicable laws. Our determination of the storage period for personal data is primarily based on the following criteria:

1. Complete service and service records relating to you in response to any inquiries or complaints you may issue.
2. Ensure the safety and quality of the services we provide to you.
3. In accordance with relevant requirements regarding the statute of limitations for litigation.
4. Whether you consent to a longer storage period.
5. Whether there are any special agreements or mandatory legal provisions regarding storage periods.
5. HOW WE PROTECT YOUR PERSONAL DATA
1. In order to safeguard your personal data, we implement physical, technical, and administrative security measures that comply with legal requirements and industry standards, at the current technological level. These measures are aimed at reducing the risks of loss, misuse, unauthorized access, disclosure, and alteration of your personal data. Examples of these security measures include but are not limited to data encryption during transmission, firewalls and encrypted storage, physical access controls, and information access authorization controls.
2. We have established a dedicated information security management department. This department is responsible for establishing information security management mechanisms, organizing and implementing information security management policies and systems, and establishing information system security defense systems, to resist threats such as host intrusions, network DDoS attacks, and web application attacks. We have also developed information security incident response plans to ensure timely response to information security incidents, organize or cooperate with regulatory agencies as required to conduct investigations, and take appropriate corrective measures to strengthen subsequent preventive acts.
3. With respect to the processing of personal data, we have set up strict access control and monitoring mechanisms for accessing personal data, grant the authority of processing data to our staff in accordance with the principle of least privilege, and require all personnel, who may have access to personal data, to fulfill information security and confidentiality obligations through means such as signing labor contracts, issuing rules and regulations, and system process prompts. We also provide continuous training on information security protection and legal compliance to all personnel and conduct regular information security assessments.
6. ABOUT YOUR RIGHTS AND CHOICES REGARDING PERSONAL DATA
1. Your Rights regarding Personal Data

As a data subject, you have the rights to access, correct and delete your personal data, limit the use of your personal data, and determine data portability, subject to any restrictions imposed by applicable national/regional laws. Additionally, you have the rights to withdraw your consent and object to our processing of your personal data for legitimate interests. You also have the right to file a complaint with regulatory authorities.

Please note that the aforementioned rights are provided for illustrative purposes only. Your rights may be limited or expanded according to applicable national/regional laws. Here, we provide clarification using the rights enjoyed by residents or users of Virginia, Colorado, Connecticut, Utah, and California as examples:

RIGHTS	VIRGINIA, COLORADO, CONNECTICUT, UTAH	CALIFORNIA	DETAILS
Right to access	√	√	The right to know and obtain what personal data we collect from you.
Right to delete	√	√	The right to delete the personal data we have collected from you, subject to exceptions.
Right to correct inaccurate data	√(excluding Utah)	√	The right to correct your inaccurate personal data collected by us.
Right to limit use or disclosure of sensitive personal data	N/A	√	You have the right to request to limit the use and disclosure of your sensitive personal data to the scope necessary to maintain our service.
Right to determine data portability	√	√	You may request to receive a copy of your personal data, including specific pieces of personal data, including, where applicable, to obtain a copy of the personal data you provided to us in a portable format.
Right to non-discrimination	√	√	You have the right not to suffer any discriminatory treatment by us, such discriminatory treatment may be incurred due to your exercising of privacy rights, including denying goods or services, charging different prices or rates for goods or services, providing a different level or quality of goods or services, etc.
Right to opt-out	√	√	You can require us to no longer use your personal data for specific purposes, such as under California law, including not selling personal data or sharing personal data for behavioral advertising. The specific scope of the right to opt-out varies in different regions.

2. Responding to Your Rights Request

1) With respect to your rights related to personal data under applicable laws, we will make a response within 45 days following receiving your rights request or within the time period under applicable laws in your country/region.

2) In order to protect the security of your account and the security of your personal data, in case that you make such a request to us, we may verify your identity (e.g., by adding an account verification, by requiring you to provide a written request, or by other reasonable means) before processing your request.

3) Unless otherwise provided by applicable laws, we have the right to refuse requests that are not directly related to your identity, requests that are made without reasonable justification, and requests that require excessive technical means (e.g., requiring the development of a new system or a fundamental change in an existing practice), requests that pose a risk to the legal rights of others, and impractical requests.

4) You may submit your rights request to us at [[email protected]].

7. CROSS-BORDER TRANSFER OF PERSONAL DATA

As we operate globally, it may be necessary to transfer, store and process personal data in other countries where we or our parent company, affiliates, subsidiaries, or service providers (including sub-processors) have facilities. The data protection laws and other laws of these countries/regions may differ from the laws of the jurisdiction in which you reside. When transferring personal data across borders to such recipients, we will fulfill our compliance obligations in accordance with applicable laws and provide appropriate safeguards, such as encrypted transfers based on SSL/TLS over HTTPS.

8. HOW WE PROCESS PERSONAL DATA OF MINORS/CHILDREN

FontKit is not designed for use by minors/children (the definition of minors/children is determined by the applicable laws of your residence). If you are a minor/child, please do not use FontKit, and we will not intentionally collect or use personal data of minors/children. Due to limitations in current technology and business models, it is difficult for us to identify the identity of minors/children. In e-commerce activities, we assume that you are an adult under applicable laws. If you discover that a minor/child has provided us with personal data, please contact us promptly for deletion (email address: [[email protected]]). If we discover on our own that we have collected and used personal data of minors/children, we will proactively delete it.

9. HOW THIS POLICY WILL BE UPDATED
1. In accordance with changes in applicable laws and the operational needs of our services, we may periodically amend the Policy. Any changes to this Policy will be published on our website/client, we will publish the updated version of this Policy and update the “Release/Update Date” with version number at the top of this Policy. The updated version of this Policy, once published on our website/client, will supersede the current version of this Privacy Policy and be deemed to have been agreed upon and accepted by you. In the event of material changes to this Policy or the decrease of your owned rights due to changes on the current version of the Privacy Policy, we will notify you in a more prominent manner and obtain your affirmative consent.
2. If we make changes to this Policy, we will also archive the previous versions of this Policy (click here to find the previous versions) for your reference.
10. CONTACT US

If you have any questions about this Policy, or any related complaints, comments, or requests for rights, you may contact us at [[email protected]]. Upon receiving your inquiry, we will handle it in a prompt and proper manner. Generally, we will respond within 45 days or within the timeframe required by applicable laws in your country/region.