HAHA Privary Policy

Section I: General Provisions

1、How We Collect and Use Your Personal Data

The term of “personal information” or “personal data” means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person .

Personal information does NOT include “anonymized” information, which is data we collect about the use of our Service or about a group or category of products, services or users, or other data from which individual identities or other personal information has been removed so that the individual concerned cannot be identified directly or indirectly. Such data helps us understand trends and our users’ needs so that we can better consider new features or otherwise tailor our Service. This Policy in no way restricts or limits our collection and use of such information.

We may collect information that is automatically collected by us , as well as certain information  that you choose to provide .
More information about the categories and sources of information is provided below.

a)Information provided by you

b)Information From Other Sources

c)Special categories of information

When you open the Vending Machine and take the products you wish to purchase, our cameras on the  Vending Machine may capture video images that include you. We have implemented appropriate technical measures to minimize the capture of personal images and have applied desensitization measures to blur and anonymize any personal images inadvertently captured.For the bank card numbers that we collected directly from you and/or our  payment processors and transaction fulfillment providers (Adyen, Stripe, PayPal, Shift4, PAX, Nayax, WizarPos, Universal PROCESSING)  when you request a refund or make a payment as described above,  these numbers are also truncated.When you open the Vending Machine and take the products you wish to purchase, our cameras on the  Vending Machine may capture video images that include you. We have implemented appropriate technical measures to minimize the capture of personal images and have applied desensitization measures to blur and anonymize any personal images inadvertently captured.For the bank card numbers that we collected directly from you and/or our  payment processors and transaction fulfillment providers (Adyen, Stripe, PayPal, Shift4, PAX, Nayax, WizarPos, Universal PROCESSING)  when you request a refund or make a payment as described above,  these numbers are also truncated.We also want to kindly remind you to exercise caution and avoid sharing such sensitive information about yourself (or others) unless necessary, when using our Services.

2、Cookies and Other Similar Technologies

Many browsers enable you to control the use of cookies at the individual browser level. Cookies are small text files that are stored on your device by us to ensure that the Services’ normal operation and your convenient access to it. Cookies usually contain identifiers, site names, and some numbers and characters. These cookies do not store information that directly identifies you. However, where Internet Protocol (IP) addresses or other identifiers collected through these technologies are considered personal data under applicable law.You can manage or delete cookies through your browser or device settings. Most browsers allow you to block or delete cookies, though doing so may affect the availability or functionality of certain features. Certain strictly necessary cookies may not be disabled, as doing so would prevent the Services from operating correctly.We do not use cookies and similar technologies currently . If cookie or similar technologies are introduced in the future due to product updates, we will update this Policy accordingly and obtain your consent where required by applicable laws and regulations.

3、How We Store Your Personal Information

The personal information we collect and generate in our operations is stored.Tencent Cloud serves as our selected cloud service provider.We store your Personal Data in strict compliance with our internal data retention policies. To determine the appropriate retention period for personal information, we will consider the following factors on a case-by-case basis:

• the amount, nature and sensitivity of the personal data;
• the potential risk of harm from unauthorized use or disclosure of your personal data;
• the  specific  purposes for which we process your personal data and whether we can achieve those purposes through other means; and
• the applicable legal, regulatory, tax, accounting, or other statutory requirements.

The retention period for Personal Data  shall  be the minimum time necessary to achieve the stated purposes:We shall immediately cease retaining such  personal data, and implement measures to delete or anonymize it without undue delay, upon the earliest of the following events: (i) the fulfillment of the original collection purposes; (ii) the termination of the operation of the corresponding product or service; or (iii) our confirmation of your valid erasure request.

We may retain your personal information for a longer period only if one of the following conditions is met: (i) a complaint has been filed in connection with our services; (ii) we hold a reasonable and substantiated belief that litigation may arise in relation to our relationship with you; (iii) such retention is mandated by applicable laws and regulations; or (iv) we have obtained your prior explicit consent . Once the legitimate basis for extended retention no longer exists, we will promptly remove the relevant  p ersonal  data from our systems and records and/or take steps to anonymize it, ensuring that you can no longer be identified from the processed data.

4、How We Store Your Personal Information

a)Cloud service provider

We have entrusted Tencent Cloud to store your Personal Data as listed in  Section 3  of the Privacy Policy. We have entered into data processing agreements to ensure that appropriate technical and organizational measures are adopted to protect your rights and interests regarding Personal Data.

b)Authorized partners

For the performance of certain features or to provide you with better Services and a better user experience, some components of our Services will be supported by our authorized partners.

• To ensure the normal operation of HAHA Vending Machine, we may share your personal information we collected (as described in Section 1 above) with our vending machine clients, distributors, and agents, who are also responsible for the daily operation of the vending machine.
• When you swipe, tap or insert  cards to start shopping and pay, the payment processors and transaction fulfillment providers (Adyen, Stripe， PayPal), which partner with us may collect your certain personal information. Please note that we do not and cannot control any data processing activities conducted independently by Adyen，Stripe，PayPal. Adyen， Stripe， PayPal act as independent data controllers with respect to any personal information they process.This means that once your data is transmitted to them, they independently determine the purposes and means of their subsequent data processing. We do not take responsibility for their independent processing activities. Each company maintains its own data processing practices, and we encourage you to carefully review their respective privacy policies. If you object to personal data transmission to them, please refrain from using HAHA Vending Machine.

We uphold the principles of  data  minimization, necessity, and legality to carry out such  disclosing . Before  disclosing information, we will require authorized partners to take relevant confidentiality and security measures to process personal information in accordance with this Policy and applicable laws in your jurisdiction.We will not  share your personal information with third parties for their own marketing or commercial purposes.

c)Corporate transactions

Where a merger, acquisition or bankruptcy liquidation takes place, if transfer of personal information is involved, we will request the new company or organization which obtains your personal information to be subject to this Policy, otherwise we will ask such company or organization to acquire your authorization and consent again.

d)Legal obligations and rights

We will only publicly disclose your Personal Data after obtaining your express consent or it is mandatorily required by laws, such as in compliance with subpoena, legal proceedings, legal actions or compulsory request by supervisory department of government agencies.

5、How We Protect Your Personal Information

a)We have taken reasonably feasible and technical measures to protect collected services-related data. However, please be attention, even if we undertake reasonable measures to protect your data, there is no website, internet transmission, computer system or wireless connection that are definitely safe.

b)We have taken safeguarding measures in accordance with industry standards to protect the personal information you provided and prevent data from unauthorized access, public disclose, use, modification, damage or loss. We take allreasonably practical measures to protect your personal information. In particular:

• We encrypt a lot of information. We periodically review practices regarding information collection, storage and possessing (including physical security measures), to prevent various systems from unauthorized access.
• With regard to the security control of data access and use, we have implemented a strict data authorization control mechanism. The core production database is restricted to the internal network access and does not open public network ports. The production and testing environments are isolated by network segments. Manual execution of SQL is conducted through the auditing function built into the data management tool. The database operates in a primary-backup mode .
• The security of your information is extremely important to us. Therefore, we endeavour to ensure the security of your Personal information and implement measures such as security encryption during storage and transmission to prevent your information from unauthorized access, use, or disclosure.

c)In case of personal information security incident is likely to result in high risk to the rights and freedoms of personal information subjects, we will promptly inform you of the relevant information related to the leakage by email.

6、Your Rights

As the subject of the personal information, you are entitled to have the rights provided by the privacy laws in your jurisdiction. Your rights may include part or all of those described underneath. You can exercise your rights entitled by the privacy laws in your jurisdiction at any time by sending your requests to +1（323）767-7987 or service@mkt-ads.hahavending.com.Your rights may include:

a)Right to be informed:

We publish this Policy to inform you of how we handle your personal information, how we use it, and who we share it with. We are committed to the transparency of the use of your information.

b)Right to accessyour personal information:

You have the right to access personal information we hold about you.

c)Right tocorrect your personal information:

You have the right to correct your information where that information is not accurate. You can correct your personal information by contacting us via the  methods stated in this Policy.When your identity is confirmed, we will rectify it accordingly.

d)Right to deleteyour personal information:

You can remove certain personal information that we have stored about you. However, please note that we may need to retain personal information if there are valid grounds under data protection laws for us to do so (e.g., for the defense of legal claims or freedom of expression) but we will respond to you and let you know if that is the case.

e)Right to restrict processing:

You are entitled to request  us to restrict processing of your  personal  data under the following circumstances:

• You contest the accuracy of your  personal data , for a period enabling us to verify the accuracy of the  personal  data;
• T he processing is unlawful and you oppose the erasure of your  personal  data and requests the restriction of their use instead;
• We no longer need your  personal  data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims;
• You have objected to processing, pending the verification whether the legitimate grounds of us override those of yofu.

f)Right to data portability:

You can request a copy of certain data in a machine-readable form that can be transferred to another provider if such right is requested by the privacy laws in your jurisdiction.

g)Right of Refusal:

You  have the right to object at any time to processing of personal data concerning  you which is based on performance of a task carried out in the public interest or in the exercise of official authority vested in us or based on  the purposes of the legitimate interests pursued by  us or by a third party . We shall no longer process the personal data unless  we demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of  you or for the establishment, exercise or defense of legal claims.

Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

h)Right to Withdraw Consent:

You may withdraw your consent for the processing of your personal information by submitting a request to us via email.We will deal with your request within a reasonable time frame from the time when the request was received, and thereafter not processing your personal information as per your request.

Please note that your withdrawal of consent could result in certain legal consequences. Depending on the extent to which you authorize us to process your personal information, it may mean that you will no longer be able to enjoy the use of our services. However, any decision on your part to withdraw your consent or authorization will not affect personal information processing previously performed with your permission.

i)Right to Refuse Automated Decision:

You may have rights not to be bound by automatic decisions, including user profiling, if such right is requested by the privacy laws in your jurisdiction.However, at present, we do not use your Personal Data for automated decision-making,including  user  profiling.

j)Right to lodge complaints to the supervisory authority:

To help us verify that you are the subject of the personal information and exercise your rights outlined above, we may require you to provide sufficient proof of identification. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.If you are concerned about the way in which we are managing your personal information and think we may have breached any relevant laws and obligations, please contact us.
We will respond and reply to you as soon as possible. Generally, we will reply to you within one (1) month upon receipt of your request (If necessary, we may extend it by an additional forty-five ( 45 )  day s as permitted by law. We will inform you thereason for the extension within the aforementioned 30-day period, such as the request is too complicated or too much in volume).
If you feel we have not resolved your concern, you have the right to  get in touch with usand/or lodge a complaint with your local privacy or data protection regulator.

7、How We Process Children’s Personal Information

Our Services are mainly adult-oriented and we do not offer services directly to a child or use personal information of children for the purposes of marketing.
We treat anyone under 16 years old (or equivalent minimum age in relevant jurisdiction) as a child. We do not knowingly collect any information about or market to children, minors or anyone under the age of 16. If you are less than 16 years old, we request that you do not submit information to us. If we become aware that a child, minor or anyone under the age of 16 has provided us with personal information, we will take steps to  delete relevant personal information immediately .

8、How Your Personal Information is Transferred Globally

Generally, data from users is stored in a third-party cloud storage located in United States or the purpose of necessary maintenance of the Services, your personal data may be accessed by our personnel in China.
We will implement corresponding protective measures in accordance with the requirements of applicable data protection laws to ensure data security.
By agreeing to this Privacy Policy and using our products, you consent to our processing of such international data transfers.
Where personal data is generated  within the European Economic Area (“EEA”) is transferred to countries outside  the EEA, we will ensure that appropriate protective measures are taken to comply with General Data Protection Regulation (“ GDPR”).
If you have any question regarding your  personal data’s security and/or our international transfer manners or would like to withdraw your consent to the international transfer, please contact us via:service@mkt-ads.hahavending.com.

9、How This Policy is Updated

We reserve the right to update or modify this Policy from time to time. For significant changes to our Privacy Policy, we will push the updated Privacy Policy to you.

10、Inconsistency

In case of any inconsistency between this Policy and other privacy policies on personal information management related to the Services, the latest policy content shall prevail.

11、Contact Us

If you have any concerns or doubt over our Privacy Policy, please contact us via:

• Phone:+1（323）767-7987
• Email:service@mkt-ads.hahavending.com

Section II: Special Provisions

12、Special Provisions for  the  United States

a)General terms

If you are residents of the United States and where we meet the relevant threshold tests, the following additional terms apply. If any conflict arises between the main Privacy Policy, the following terms shall prevail:

b)Special Terms for California

If you are a consumer resident in California and where we meet the relevant threshold tests, the following provisions shall apply.