UBR Children Personal Information Protection Notice
Published by:2024 / 11 / 18

Most of UBR Services are intended for users of all ages. This Notice outlines UBR’s information practices in the PRC with respect to personal information collected from services directed to children under the age of 14 or from children who we have actual knowledge are under the age of 14 ("child" or "children", as defined by the Regulation of Online Protection of Children's Personal Information which is effective since October 1st of 2019, and related law and regulations).

Please see the other sections of the UBR Personal Information Protection Policy for our information practices regarding services that are directed to parents, users over the age of 14, or general audiences.

If we knowingly collect a child’s personal information on a child-directed service, we will retain that information only so long as reasonably necessary to 1) fulfill the request or allow the child to participate in the activity, 2) ensure the security of our users and our online services, and/or 3) as required by law. If we learn we have collected personal information from a child in a manner inconsistent with requirements under the applicable law, we will either delete that personal information or seek parental consent.

  • Collection and Use of Personal Information from Children

    Unless otherwise provided by law, we will first ask for a parent or guardian’s consent to the collection of personal information from a child, and we may collect the following information from children for our online services and a limited number of offline services directed to children, for the purposes described:

    Registration Information: Children may be able to register with an online service to view content, participate in contests, play games and more. We may ask the child to provide a screen name (that does not include the child’s name) and password. We may also request information for notification purposes, such as a parent or guardian’s email address or phone number, the child’s first name and gender, and birth date. We may ask for a child’s email address for purposes of generating a password reminder. In such cases, unless we otherwise obtain consent or notify the parent of ongoing communications (as discussed below), we will hash such email address such that it can only be used as a password reminder and cannot be used to contact the child.
    Email Address for One-Time Response: We may ask for a child’s email address or other online contact information in order to respond to a question or request from a child. We will delete this information after responding to the question or request. If an online service allows children to create accounts by providing name and email address, we will first seek parental consent as required by the appliable law.
    Email Address for Newsletters or Other Ongoing Communications: Our online services may offer ongoing communications to our users, such as newsletters or show updates. In such circumstances, we may collect a child’s email address or other online contact information, along with a parent’s email address. We will notify the parent via email about the collection and use of the child’s information and provide the parent an opportunity to prevent further contact with the child.
    Content: We may allow children to submit content to us. If a child includes personal information in such content, we will take reasonable measures to delete the personal information or first seek parental consent.
    Contests and Sweepstakes Entry Information: Our online services may feature contests or sweepstakes and seek information necessary for a child to participate in such contest, including the child’s first name and parent’s email address or phone number to notify the parent (as required by law). If the child wins the contest, we may contact the parent via email or phone number to request information for prize fulfillment.
    Information to Obtain Parental Consent: We may ask a child for a parent’s or guardian’s email address or other permissible contact information in order to request consent. If we do not receive parental consent within a reasonable time, we will delete the contact information and any other related information collected from the child. We may conduct other methods of parental consent permitted by the appliable law, including obtaining a credit card number and charging a fee (which may be nominal), asking a parent to speak to a customer service representative by phone or video, or requiring submission of a signed consent form.
    Persistent Identifiers: Our online services may automatically collect persistent identifiers for internal operations, including to provide and improve our online services, conduct analytics, authenticate users, personalize content, maintain the security and integrity of the service, and to ensure legal or regulatory compliance. Specifically, we may collect Internet protocol or IP address, pages and content visited, the type and version of operating system or web browser, device ID. We, or our third party service providers, may collect this information using HTTP cookies, flash cookies, HTML5 and Flash local storage, web beacons/GIFs, embedded scripts, and ETags/cache browsers (“Cookies”).
    Photo Validation Information: We provide guests with access to photo validation technology for ticket verification and locker services. With the consent of a child's parent or other guardian, we will collect the child's facial images as uploaded, and the child’s facial information captured by our on-site equipment. We will process and protect such information in strict accordance with the UBR Photo Validation Notice For Park Admission and the UBR Photo Validation Notice For Locker Service, and will delete such information immediately upon expiration of the retention period.
  • Disclosure of Personal Information from Children

    We may share or disclose personal information collected from children in the following circumstances:

    With our service providers in order for them to perform service on our behalf;
    Directly related to national security or national defense;
    Directly related to public security, public health or major public interests;
    Directly related to criminal investigations, prosecutions, trials or execution of court decisions;
    To protect the safety, property or other significant lawful rights and interests of a child or other individuals, and it is hard to obtain consent from the child’s parent or guardian;
    Other circumstances as permitted by the appliable law.

    In addition, personal information collected from a child may be shared or publicly posted if we first obtain parental consent.

  • Protection of Personal Information from Children

    In addition to the protective measures described in the UBR Personal Information Protection Policy, we also implement measures dedicated to children’s personal information, including:

    Dedicated person to perform protection obligations: We designate dedicated persons to take charge of the protection of children's personal information;
    Encryption: We store children's personal information by encryption;
    Access control: We set strict information access authority for our staff in the principle of minimal authorization to control the scope of children's personal information access. Staff's access to children's personal information will be examined and approved by the person in charge of the protection of children's personal information or the manager authorized thereby. The authorized person will record the access and take technical measures to avoid illegal copying or downloading of children's personal information;
    Security assessment mechanism: If we entrust a third party with the processing of children's personal information, we will conduct security assessment of the entrusted party and the acts of entrustment, and sign an entrustment agreement with the third party to specify responsibilities, matters to be processed, processing period, nature and purpose of the processing. The entrustment will also not exceed the authorization scope; and
    Contingency plan: We will immediately initiate the contingency plan and take remedial measures in case that the personal information of children has been or may be divulged, damaged or lost; where a serious consequence has been caused or is likely to be caused, we will immediately report the same to the relevant competent authority, and inform the affected children and their guardians of the relevant situations by mail, letter, telephone, push notice, etc., and if it is difficult to inform them one by one, we will take reasonable and effective measures to release the relevant warning information.
  • Storage of Children’s Personal Information

    In principle, the children’s personal information we collect within the territory of the PRC will be stored within the PRC. If we intend to transfer children’s personal information outside China, we will first seek parental or guardian’s consent.

  • Parental Controls

    Parents or guardians may contact us to review personal information provided by his or her child, have such information corrected, deleted, and/or refuse to allow further collection or use of such information. You may reach to us via the method indicted in the section of Contact Us in the UBR Personal Information Protection Policy.

  • Updates to this Children’s Personal Information Protection Notice

    We reserve the right to amend this Children’s Personal Information Protection Notice at any time to reflect changes to our practices or the law.

    If we make material changes to the way we collect and use children’s personal information, we will provide appropriate notice and seek parental or guardian’s consent again.

    For matters not covered in this UBR Children’s Personal Information Protection Notice, please refer to the UBR Personal Information Protection Policy. For the protection of children's personal information, if there is any conflict between this UBR Children’s Personal Information Protection Notice and the UBR Personal Information Protection Policy, this UBR Children’s Personal Information Protection Notice shall prevail.