IDEO Privacy Policy
This privacy policy is a legally binding agreement between you (“User”, “you” or “your”) and IDEO Creative Design (Shanghai) Co. Ltd. (“IDEO China”, “we”, “us” or “our”).
We greatly respect your privacy and your trust and confidence in us. We are fully committed to protecting any data that you share with us in accordance with the Personal Information Protection Law of the People's Republic of China (2021).
This privacy policy (“Policy” or “Privacy Notice”) describes the types of personally identifiable information we may collect from you or that you may provide on the https://ideo.cn/ website (“Website” or “Service”) and any of its related products and services (collectively, “Services”), and our practices for collecting, using, maintaining, protecting, and disclosing that Personal Information. It also describes the choices available to you regarding our use of your Personal Information and how you can access and update it.
If you do not agree to the processing of your personal information in the way described in this policy, please cease to access our websites or services. By continuing to access our services you are accepting the terms described within this policy.
What kind of personal information we collect about you
Whilst using, accessing or consuming any of our services, we may request that you provide information to deliver such services and this information may be used to identify you as a specific natural person, directly or indirectly (“Personal identifiable Information” or “PI”). Personal identifiable Information does not include anonymized information.
We commit to only requesting the minimal personal information required to deliver services including:
Basic Personal Information – this will include your full name, your job title, your company name, your postal address, your email address and your phone number.
Personal education information – this will include relevant information to support a job application including Position, Work Unit, Educational Background, Academic Degree, Educational Experience, Work Experience and Training Records.
Physiological and health information - this will include relevant information to support a job application including Medical History, History of Present Illness.
Online identity information - including alias name, nickname and IP Address.
Sensitive personal information
We do not intend to collect sensitive personal data unless we are legally required to do so. Examples of sensitive personal data include ethnic origin, political opinions, religion or beliefs, trade union membership, genetic or health status, sexual orientation, and criminal records. If you choose to provide sensitive personal data to us for any reason, the act of doing so constitutes your explicit consent, where such consent is necessary and valid under your local law, for us to collect and use that information in the ways described in this Privacy Notice or as described by us and accepted by you at the point where you disclosed such information. Before sensitive personal data is provided to us by you, you must contact us. We will clarify to you whether the provision of the sensitive personal data is required by law or contract or is necessary for the conclusion of the contract, and whether there is an obligation to provide the sensitive personal data and the consequences of non-provision of such data. Do not provide sensitive personal data to us, unless you hereby consent to our use of that data for its legitimate business purposes and consent to the transfer and storage of such information to and from our databases. Please refer to the section of this policy called “Your Rights” for how to contact us.
How we use the information we collect about you
We may need to collect and use certain Personal Information to provide the goods and services that we provide to you. Any personal information shared with us will only be for business purposes and if permitted by law. If you do not provide the information that we request, we may not be able to provide you with the requested products or services. Any of the information we collect from you may be used for the following purposes:
Contractual obligations
Business support activities
Human resource management functions
Send marketing and promotional communications
Send product and service updates
Run and operate the Website and Services
Processing your Personal Information can only be undertaken where there is a lawful basis to do so. These lawful bases are described in the Personal Information Protection Law of the People’s Republic of China (PIPL) Article 13, and their applicability depends on how you interact with our Website and/or Services. Any data processed by us will meet one of the following conditions:
You have given your consent for one or more specific purposes;
Provision of information is necessary for the performance of an agreement with you and/or for any pre-contractual obligations thereof;
Provision of information is necessary for conducting human resource management in accordance with the labor rules and regulations developed according to the law and the collective contract signed according to the law;
Processing is necessary for compliance with a legal obligation to which you are subject;
Processing is related to a task that is carried out in the public interest or in the exercise of official authority vested in us.
Note that under some legislations we may be allowed to process information until you object to such processing by opting out, without having to rely on consent or any other of the legal bases. In any case, we will be happy to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Information is a statutory or contractual requirement, or a requirement necessary to enter into a contract.
Your Rights
According to relevant laws, regulations and standards in China, as well as common practices in other countries and regions, we will ensure your following rights to your PI:
Access your Personal Information
You have the right to access your Personal Information unless laws and regulations specify otherwise. We have a duty to provide the required information upon request:
Your PI and types of PI held by us;
The source from where we obtained your PI;
The identity or type of any third party who has obtained your PI.
If you wish to access your data, you can do so by sending an email to privacynotice@ideo.com We will respond to your access request within 30-days. A second option to send us a request to access your data is to submit a request at the IDEO Privacy Center, found at ideo.ethyca.com.
2. Rectify your Personal Information
When you find a mistake in your information that we are processing, you have the right to ask us to rectify it. You can submit a rectification request by sending an email to privacynotice@ideo.com .
3. Delete your Personal Information
You can submit a request to delete your PI to us through the channels listed in “(I.) Access your Personal Information” under the following circumstances:
If our processing of PI violates laws or regulations;
If our processing of PI breaches our agreement with you;
If you no longer use our products or services or you have cancelled your account;
If we no longer provide you with products or services.
When we decide to respond to your deletion request, we will also inform the entity that acquires your PI from us and ask it to delete your PI without delay, unless otherwise specified in laws and regulations, or the entity has acquired specific authorization from you.
When you delete the information from our services, we might not immediately delete the corresponding information from our backup system but will delete it when the backup system is updated.
4. Change the scope of your consent
Where consent has been provided to obtain Personal Information, you can give or withdraw your consent at any time. To do so, please submit a rectification request by sending an email to privacynotice@ideo.com. If you provided consent through your participation in design research for us or our clients, you may revoke or modify your consent by visiting https://designresearch.ideo.com/ and making the desired changes to your profile, or visiting https://designresearch.ideo.com/revoke and submitting a request.
5. Restrict automated decision-making by information systems
We do not use automated decision-making technologies within our company or associated companies.
6. Respond to your above-mentioned requests
For security, you might be required to submit written requests or prove your identity by other means. We might ask you to verify your identity before handling your request.
We will respond in 30 days. If you are not satisfied, you can file a complaint by sending an email to privacynotice@ideo.com
We will not charge you for your reasonable requests in principle. However, a fee to reflect the cost will be imposed as appropriate on repeated requests beyond reasonable scope. As for repeated requests that are groundless and need excessive technological means (e.g., developing a new system or fundamentally changing the current practices) to fulfil, bring about risks to others’ legitimate rights and interests or are downright impractical (e.g., Involving information stored on a backup disk), we might reject.
We will not be able to respond to your request under the following circumstances:
Related to our compliance with the obligations under the laws and regulations;
Directly related to national security or defence security;
Directly related to public security, public health or major public interests;
Directly related to criminal investigations, prosecutions, trials and enforcement of court decisions, etc.;
We have sufficient proof that you have subjective malice or abuse of rights；
For the purpose of safeguarding your life, property and other important legal rights and interests or those of other individuals but it is difficult to obtain consent;
Responding to your request will cause serious harm to your legitimate rights and interests, or those of other individuals or organizations.
Involving trade secrets.
How we entrust the processing, sharing, transfer and disclosure of your Personal Information
Entrustment of processing
IDEO Creative Design (Shanghai) Co. Ltd. is part of a group of companies owned by IDEO LP (“IDEO Group”, “IDEO” or our “Company”). We will not share your Personal Information with any external vendors or companies that are not part of the IDEO Group. If we require the assistance of any third parties, we will first obtain your explicit consent.
Sharing
We will not share your PI with any company, organization or individual other than our Company, unless with your explicit consent.
Transferring
We will not transfer your PI to any company, organization, or individual, except under the following circumstances:
Transfer with explicit consent: after acquiring your explicit consent, we will transfer your PI to other parties within the IDEO Group;
When the transfer of PI is involved in a(n) merger, acquisition or bankruptcy, liquidation, we will require the new company or organization to which your PI is transferred to continue to be bound by this PI Protection Policy; otherwise, we will require the new company or organization to seek your consent again.
Please note that your PI may be transferred outside of the People’s Republic of China under these circumstances, and by giving us your PI you consent to the transfer of your PI outside of the People’s Republic of China.
Public Disclosure
We will only publicly disclose your PI under the following circumstances:
After we obtain your explicit consent;
Statutory disclosure: we might publicly disclose your PI as stipulated by laws, regulations or the mandatory requirements of government agencies; however, where data is shared overseas with other IDEO Group companies, any such legal requests will only be complied with upon approval from the Cyberspace Administration of China. (CAC)
Privacy of children
We do not knowingly collect any Personal Information from children under the age of 14. If you are under the age of 14, please do not submit any Personal Information through the Website and Services. If you have reason to believe that a child under the age of 14 has provided Personal Information to us through the Website and Services, please contact us to request that we delete that child’s Personal Information from our Services.
We encourage parents and legal guardians to monitor their children’s Internet usage and to help enforce this Policy by instructing their children never to provide Personal Information through the Website and Services without their permission. We also ask that all parents and legal guardians overseeing the care of children take the necessary precautions to ensure that their children are instructed to never give out Personal Information when online without their permission.
Cookies
When you visit the Sites, we may use cookies or similar technologies to analyse trends, administer the Sites, gather demographic information about our User base as a whole, and track Users’ movements around the Sites, including, in the case of cookies such as Hotjar, activity on individual pages in real-time (you may opt out of Hotjar here). A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you browse our Sites; cookies contain information that is transferred to your computer's hard drive. Our Sites use cookies to distinguish you from other Users of our Sites. This helps us to provide you with a positive experience when you browse our Sites and also allows us to improve our Sites and services.
We use the following categories of cookies:
Strictly necessary cookies: These are cookies that are required for the operation of our Sites. They include, for example, cookies that enable you to log into secure areas of our Sites.
Analytical/performance cookies: They allow us to recognize and count the number of visitors and to see how visitors move around our Sites when they are using them. This helps us to improve the way our Sites work, for example, by ensuring that Users are finding what they are looking for easily.
Functionality cookies: These are used to recognize you when you return to our Sites. This enables us to personalize our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
Targeting cookies: If you opt in, these cookies record your visit to our Sites, the pages you have visited and the links you have followed. We will use this information to make our Site more relevant to your interests, but also to ensure that we are aligning our Site in the best way with our target visitors.
Most browsers are initially set up to accept cookies, but you can set your cookie preferences in the banner that appears on all IDEO websites listed above or reset your browser to refuse all cookies or to indicate when a cookie is being sent. If you choose to disable cookies, it may limit your use of certain features or functions on our Sites or services. If you wish to restrict or block the cookies that are set by any website you should do this through each individual browser setting and on each device, you use to access the Internet (for these Sites, you can set those preferences in the cookie banner that appears on all IDEO Sites listed above). You can allow cookies from specific websites by making them “trusted websites” in your Internet browser. For more information on how to do this, and how to change your browser settings, you may visit: www.allaboutcookies.org
LOG DATA:
When you visit the Sites, whether through an account or as a non-registered User browsing, we automatically track certain information that your browser sends whenever you visit our Sites. We use this information to do internal research on our users’ demographics, interests, and behaviour to better understand and protect you and our community. This information may include the URL that you just came from, which URL you go to next, access times and dates, your computer browser information, your IP address, and other statistics (“Log Data”). We use Log Data to monitor and analyse the use of the services on the Sites and for the Sites’ technical administration, to increase our Sites’ functionality and User-friendliness, and to better tailor the Sites to our Users’ needs. For example, some of the information is collected so that when you visit the Sites again, we will recognize you and provide you with information appropriate to your interests. We also use the information to verify that the visitors to our Sites met the criteria to process their requests.
OPT-OUT MECHANISMS:
Currently, our systems recognize browser “do-not-track” requests. You may also disable certain tracking as discussed in this section (e.g., by disabling cookies) and you may opt-out of Internet-based advertising by following the instructions above in this Cookies section.
Email marketing
We offer electronic newsletters to which you may voluntarily subscribe at any time. We are committed to keeping your e-mail address confidential and will not disclose your email address to any third parties except as allowed in the information use and processing section or for the purposes of utilizing a third-party provider to send such emails. We will maintain the information sent via e-mail in accordance with applicable laws and regulations.
In compliance with the CAN-SPAM Act, all e-mails sent from us will clearly state who the e-mail is from and provide clear information on how to contact the sender. You may choose to stop receiving our newsletter or marketing emails by following the unsubscribe instructions included in these emails or by contacting us.
Links to other resources
The Website and Services contain links to other resources that are not owned or controlled by us. Please be aware that we are not responsible for the privacy practices of such other resources or third parties. We encourage you to be aware when you leave the Website and Services and to read the privacy statements of each and every resource that may collect Personal Information.
Information security
We secure information that you provide on computer servers in a controlled, secure environment, protected from unauthorized access, use, or disclosure. We maintain reasonable administrative, technical, and physical safeguards in an effort to protect against unauthorized access, use, modification, and disclosure of Personal Information in our control and custody. However, no data transmission over the Internet or wireless network can be guaranteed.
Therefore, while we strive to protect your Personal Information, you acknowledge that:
There are security and privacy limitations of the Internet which are beyond our control;
The security, integrity, and privacy of any and all information and data exchanged between you and the Website and Services cannot be guaranteed;
Any such information and data may be viewed or tampered with in transit by a third party, despite best efforts.
Data breach
In the event we become aware that the security of the Website and Services has been compromised or Users’ Personal Information has been disclosed to unrelated third parties as a result of external activity, including, but not limited to, security attacks or fraud, we reserve the right to take reasonably appropriate measures, including, but not limited to, investigation and reporting, as well as notification to and cooperation with law enforcement authorities. In the event of a data breach, we will make the necessary reporting to the authorities in China and make reasonable efforts to notify affected individuals if required by law. When we do, we will send you an email.
Changes and amendments
We reserve the right to modify this Policy or its terms related to the Website and Services at any time at our discretion. When we do, we will revise the updated date at the bottom of this page. We may also provide notice to you in other ways at our discretion, such as through the contact information you have provided.
An updated version of this Policy will be effective immediately upon the posting of the revised Policy unless otherwise specified. Your continued use of the Website and Services after the effective date of the revised Policy (or such other act specified at that time) will constitute your consent to those changes. However, we will not, without your consent, use your Personal Information in a manner materially different than what was stated at the time your Personal Information was collected.
Acceptance of this policy
You acknowledge that you have read this Policy and agree to all its terms and conditions. By accessing and using the Website and Services and submitting your information you agree to be bound by this Policy. If you do not agree to abide by the terms of this Policy, you are not authorized to access or use the Website and Services.
Contacting us
If you have any questions, concerns, or complaints regarding this Policy, the information we hold about you, or if you wish to exercise your rights, we encourage you to contact us using the details below:
IDEO China
IDEO Legal
IDEO Creative Design (Shanghai) Co. Ltd.
Building 11, No. 1262 Yan’An West Road, Columbia Circle, Changning District, Shanghai, China
Zip code: 200050
Tel: +86 21 6154 6780
IDEO LP United States
IDEO Legal
privacynotice@ideo.com
2525 16th St, San Francisco, California, United States
Zip code: 94103
IDEO LP UK
Data Protection Officer for Europe
privacynotice@ideo.com
ePrivacy GmbH
represented by Prof. Dr. Christoph Bauer
Burchardstr. 14, Zip code: 20095
Hamburg, Germany
We will attempt to resolve complaints and disputes and make every reasonable effort to honour your wish to exercise your rights as quickly as possible and, in any event, within the timescales provided by applicable data protection laws.
If you are not satisfied with our reply, especially if our processing of PI violates your legal rights, you can seek solutions through the following external channels:
Cyberspace Administration of China
225 Chaoyangmennei Da JieBeijing, China 100010
Telephone: +10 8805 0686
Website: www.cac.gov.cn
PRIVACY POLICY UPDATED AS OF JANUARY 1, 2024
