Privacy Notice

Last updated: 21 February 2023

Summary

To help you understand how we process your personal data, we have prepared a brief summary of our Privacy Notice. For more details, please see the full version of the Privacy Notice below. We recommend that you also read the full version of the Privacy Notice so that you fully understand how we handle your personal data and what options and rights you have in relation to your personal data.

Key Points	Summary
Who is responsible for collecting and using your data?	OnePlus Technology (Shenzhen) Co., Ltd. is responsible for collecting and using your personal data.
Data We Use	We process data about you that you directly provide to us or that we collect when you use our Services. We may also receive personal data about you from third parties.
What we use it for	We will use your personal data only when we have a lawful basis to do so, such as the performance of contract to provide you with Services, for our legitimate interest, with your consent or to comply with our legal obligations. We may also process your personal data when you participate in promotional activities such as prize draws.
How long we keep your data	We will not keep your personal data for longer than we need it. In most cases, we will keep your personal data only for as long as necessary to use it for the purposes that we tell you about. Sometimes, though, the law requires us to keep it for longer.
Marketing	We may send you information about Services or offers that you may be interested in. If we need your consent to do that, we will only do so with your consent and you can opt out of such marketing communications at any time.
Sharing Your personal data with Third Parties	We may share your personal data with other companies that are controlled by, or under common control with us, third parties such as our business partners and service providers or where we are required to do so by law. We will ensure that our business partners and service providers are subject to appropriate data protection obligations.
Security	We take the security of your data very seriously. We have implemented various technical and organisational measures to protect your personal data.
Your Rights	Some data protection laws may grant you rights in relation to your personal data, including, for example, the right: • to be informed of how we process your personal data; • to access the personal data we hold about you and information about their processing; • to request that we delete or update inaccurate personal data; or • to complain to the relevant regulator if you think that we have infringed any of your rights. If you are living in Europe, you will have specified rights further outlined in this Privacy Notice.
Children	Our Services are aimed at users who are at least 18 years old. We try not to collect and use children’s data.
International Transfer	We are a global business, so we may transfer your personal data to other countries. We will ensure that we abide by storage localisation requirements and put appropriate legal safeguards in place for such transfers.
Updates	We may update this Privacy Notice from time to time and will notify you of any updates in an adequate manner.
Contact Us	If you have any questions, you can contact us at privacy@oneplus.com.

Privacy Notice

This Privacy Notice describes how we collect, use, disclose, transfer, store and otherwise process your personal data when you are using our services, including our websites, our smartphones or wearable devices, apps, online services and other products (hereinafter collectively referred to as "Services"). Please read the Privacy Notice carefully and familiarise yourself with our privacy practices before using our Services or providing your personal data.

This Privacy Notice will help you understand the following:

A. General Provisions

I. Responsibilities

II. How We Collect Personal Data and What Types of Personal Data We Collect

III. How We Use Your Personal Data

IV. How We Use Cookies and Similar Technologies

V. How Long We Keep Your Personal Data

VI. How We Disclose Your Personal Data

VII. How Your Personal Data Is Transferred Globally

VIII. How We Protect Your Personal Data

IX. Your Rights Regarding Your Personal Data

X. How We Process Children's Personal Data

XI. Third-Party Websites

XII. How This Privacy Notice Is Updated

B. GDPR Specific Provisions

I. Legal Bases for the Processing of Personal Data

II. Additional Information on How Your Personal Data Is Transferred Globally

III. Additional Information on Cookies and Other Tracking Technology

IV. Additional Information on Your Rights Regarding Personal Data

C. California, United States Specific Provisions

I. Additional Information on What and How Your Personal Data Is Processed

II. Additional Information on Your Rights Regarding Your Personal Data

D. Contact Us

In addition to this Privacy Notice, specific privacy notices might apply depending on the Services used. We will, in each case, provide you with the applicable privacy notice.

The general provisions of Section A shall apply to you, regardless of your location. Section B only applies to customers located in the European Union, Liechtenstein, Norway, the United Kingdom or Switzerland ("Europe"). Section C only applies to customers located in California, United States.

A.General Provisions

I.Responsibilities

This Privacy Policy explains how OnePlus Technology (Shenzhen) Co., Ltd., along with its affiliates (hereinafter referred to as “we”, “us” or “OnePlus”), collects, uses, shares, transfers and protects the personal data of the user (hereinafter referred to as “you”) and the corresponding rights of the user. Personal data refers to any information related to a natural person that has been identified or is identifiable. [1] Within the meaning applicable law, we will act as a data controller when we process your personal data.

Please note that, in relation to aftersales-services, we work with authorised exclusive distributors. These authorised exclusive distributors are responsible for the processing of personal data that you provide to them in connection with your requested customer service, or in connection with their marketing activities.

II.How We Collect Personal Data and What Types of Personal Data We Collect

The term personal data is broadly defined and means any information relating to an identified or identifiable individual. This means that not only the data that, for example, identifies you directly, such as your name or address, is personal data but also other data, which when combined with other information accessible to us, enables us to link that data to you, for example, an IP address.

Our channels for collecting personal data include: 1. personal data that you provide to us directly; 2. personal data that we automatically obtain when you interact with our Services, such as information on your interactions with our Services or us, and/or; 3. personal data that we obtain about you from third parties.

The personal data we collect depends on the environment in which you interact with us and the choices you make, including your privacy settings and the features and Services you use.

1. Personal Data Directly Provided by You

You may provide personal data to us directly, in which case you are generally free to choose which personal data you want to provide to us. However, if some personal data is required for the performance of our Services and you choose not to provide that personal data, we may not be able to provide you with the Services you requested. Personal data we directly collect from you may, for instance, include the following:

• If you order Services from us, or use a paid Service: We may collect your delivery details, bank account number, credit card details, billing address and other financial information relating to the transaction, order number, name and contact details, information about purchase/return/refund requests or other requests and any other communication records, so we can process your order.

• If you register an OnePlus account：some of our Services requires you to create an account or to complete a personal profile. In these services, we may ask you to provide personal data to set up an account or a personal profile. Types of personal data include email address, username and password created, region, phone number, profile picture.

• When you follow our social media accounts or interact with us in any other way: We may collect your profile information, the content and details of the timing of the communication exchanged or other personal data as required to respond to your request. The data we receive is dependent on your privacy settings with the social network.

• When you share content with others: Some of our Services allow you to communicate and share content with others. The communicated or shared content shall be transmitted through and stored in our system.

• When you sign up for our User Experience Program: When participating in this program, we may collect your device information (device identification data, configuration data, system and app data, advertising ID, IP address and time zone), your usage data (such as product function usage statistics, product upgrade statistics and data about app installation, uninstallation and error logs), information about the location of your device (to the extent you allow such location tracking separately) and your log information (such as the time and duration for which the service was used, any search terms that were entered using the service and information about device and software events such as reboots, upgrades, errors and crashes). This program may require a network connection, and some data can only be uploaded over Wi-Fi.

• We may ask you to provide personal data or collect it under other circumstances such as in connection with marketing: Such activities include when you enter prize draws, use coupons or enter other competitions, participate in promotional or marketing activities organised by us or our business partners on our behalf, complete questionnaires or participate in user forums or blogs hosted by us or our business partners. To this extent, we may ask you to provide personal data such as your name, address, email address, phone number and other personal data as indicated in connection with such activities.

• When you subscribe to our newsletters: We may collect your name, email address and information on how you interact with our promotional communication (such as whether or not you have opened the email or tapped on an accompanying link).

• In some jurisdictions we may be required to conduct real name authentication for certain Services you might use: In such a case, we will also collect your full name and details of your government-issued ID. If you refuse to provide such personal data we may not be able to provide you with the corresponding Services.

• In case we provide you with a chat function or any other function on the Platform to contact our customer service: We may collect Your Information including but not limited to your account ID, identity verification details, contact details, order details, chatting history, complaint or query related details, details about the product or services being enquired, etc.

2. Personal Data We Automatically Collect About Your Use of Our Services

In addition to the personal data you provide yourself, we may also automatically collect information about your use of our Services, particularly when you are using your device. The personal data we may collect includes the following:

• Device information: This may include the device name, device model, region and language settings, device identification number (IMEI number), device hardware information and status, IP address, MAC address, operating system version and the settings of the device used to access the Service.

• Log information: This may include when and how long the Service is used, search terms entered through the Service and the device error logs. The Android system on your smartphone and/or wearable is designed in such a way that your error or crash log will contain information collected at the time of the event, which allows us to analyse the reasons for the crash. Such information may sometimes include your personal data, such as phone number, email address, Google account or Facebook account. However, we have implemented security measures to ensure that this information is used only for error log analysis and not for personal identification or other purposes.

• Location information: This may include the GPS signal of the device or information about Wi-Fi access points and base stations near you, or the device location ID and network service provider ID when you access some location-based services (for example when you use the weather app). We will ask you if you want to enable location-based services for each of the various location-based apps. You can disable the location settings of your device from the device settings. If you disable location information, the functionalities of the apps that use location information to provide Services to you may be impaired.

• Camera: To ensure the camera app functions properly, we collect operational data (such as how many times you use the app and the number of photos taken), information about the photos taken (such as the photosensitivity and number of faces captured) and information about the available space left on your mobile phone.

• Other information about your use of the Service: This may include the version of the app or browser type being used, language settings, IP address, device type, IMEI, websites visited and how you interact with content provided through the Service.

Please also see the Section "How We Use Cookies and Similar Technologies" below for further information on personal data that we automatically collect via cookies and other tracking technology when you visit our website.

3. Personal Data We Obtain From Third Parties

We may obtain personal data about you from third parties. For example, where permitted by law, we may obtain data about you from public or commercial sources, including your activity on social networks you use, and may combine it with other information received from you or relevant to you. In particular, if you interact with us through a social media site or third-party service, such as when you like, follow or share OnePlus content on Facebook, Twitter or other sites, we may receive information from the social network, including your profile information, picture, user ID associated with your social media account and any other information you permit the social network to share with third parties.

4. Types of Data Processed Locally on Your Device

For the avoidance of doubt and to ensure transparency about the processing of data, please note that the data set out in this section will only be collected and processed locally on your device and not uploaded to our servers. Therefore, we will neither access, collect nor otherwise process such data, nor will we be able to disclose this information to any third party or use it for any other purpose. This also means that this data processing is done by you only and is thus not subject to this Privacy Notice. If you want to exercise your rights in relation to such data or would like to modify or delete it, we will not be able to support you, except to provide information on how you can handle your data yourself.

• When you use facial and fingerprint recognition: These functionalities enable rapid unlocking of your device with your pre-recorded facial or fingerprint information. To activate this function, you will need to provide your facial information or your fingerprint information captured from different angles. This type of information will be encrypted and stored using a unique secret key.

• Photos information: The "Photos" app uses local image and video recognition algorithms on your device to enable you to organise your photos and videos. If you allow the app to use your location information, the device will record latitude and longitude information for your photo and video files. If you do not want to record your location when you take a photo, you can disable this feature at any time in your device's settings. When you search for a picture, the device's technology will identify photos that match the search terms, allowing you to quickly view relevant photos.

5. Other Non-personal Data

Non-personal data refers to information which cannot be directly or indirectly associated with any specific individual. We may process aggregated or otherwise anonymised data.

We collect non-personal data to understand users' preferences, improve our operational efficiency and optimise our websites and your product experience. If the non-personal data is combined with personal data, all such data will be treated as personal data.

III. How We Use Your Personal Data

1.We will use your personal data for the following purposes:

• to provide you with OnePlus 's Services, process your orders or fulfil the contract between you and OnePlus;

• to help you create and manage your OnePlus account, activate Services you have purchased, your warranty service and specific software licenses and provide notifications for software updates;

• to diagnose product issues and provide other customer care and support Services;

• to conduct customer surveys in order to enhance your user experience and improve our Services along with their security features;

• to analyse the customer market on the basis of the country where the users use our Services;

• to analyse the efficiency of our business operations;

• to analyse error logs to improve phone quality and app functions;

• to allow and manage your participation in prize draws, contests or similar promotional activities held by us;

• to communicate with you and reply to your questions or comments submitted through email or our online platforms, including social media accounts;

• to ensure the functionality and safety of our Services, verify your identity, conduct internal auditing and prevent and investigate fraud, cybersecurity threats or other improper use;

• to enhance and develop our Services, so as to improve the product usage experience, user-friendliness, operational performance, functions and design;

• to pursue or defend against legal claims;

• to comply with our legal obligations.

2. When we want to use the personal data for other purposes not covered by this Privacy Notice, we will inform you thereof and ensure that said use of your personal data is lawful.

3. We do not make any decisions involving the use of algorithms or profiling that produces legal effects or other effects that significantly affect you.

IV. How We Use Cookies and Similar Technologies

We use cookies and similar tracking technologies on our website and other Services.

1. What Are Cookies?

Cookies are small text files that are transferred from our Services and stored on your device. Our Services may use "cookies" and other technologies such as pixel tags and web beacons (collectively referred to as "Cookies"). Cookies may be stored on your computer. Cookies not set by us will not be accessible to us.

2. How We Use Cookies

We and our third-party partners use Cookies to better understand the functionality of our mobile software on your device, and to monitor and analyse how you use and interact with our Services so that we can continue to improve them (such as to evaluate information on how often you use the Services, events that occur on our Services and where an app was downloaded). We do not link information that we store in analytics software to any personal data you may submit through our mobile apps.

We and our third-party partners also use Cookies to analyse trends, manage websites, track user activity across these websites and collect aggregate demographic information about our user base.

3. Types of Personal Data We Collect

This information may include Internet protocol (IP) addresses, browser type, Internet service provider (ISP), referring/exit pages, files viewed on our site (such as html pages and graphics), operating system, date/time stamp and/or touch stream data.

4. Third-Party Tracking and Online Advertising

We partner with third parties to display advertisements on our websites and apps or to manage our advertisements on other sites. Our third-party partners may use cookies or similar tracking technologies to provide advertisements to you based on your browsing activities and interests. If you wish to opt out of interest-based advertising, you can manage Cookies as described in the following paragraph, click here , or if located in the European Union click here. Please note that opting out of interest-based advertising does not mean you will no longer see advertising on your device – it just means that adverts may no longer be tailored to your interests.

5. Clear/Disable Cookies

Depending on your mobile device and operating system, you may not be able to delete or block all cookies. Please note that if you choose to refuse all cookies, you may not be able to use the full functionality of our Services. These settings will typically be found in the "Options" or "Preferences" menu of your browser.

See the instructions below on how to manage cookies in some common web browsers:

• Microsoft Internet Explorer

• Microsoft Edge

• Mozilla Firefox

• Google Chrome

• Safari for macOS

• Safari for iOS

For more information about cookies and instructions on how to configure your browser to accept, delete or reject cookies, see www.allaboutcookies.org.

Please note that deleting or blocking cookies may not be effective for all types of tracking technologies, such as Local Storage Objects (LSOs) like HTML5.

If the "Do Not Track" function is enabled in your browser, we will respect your choice.

Where required by law, we will provide you with further information about cookies.

V. How Long We Keep Your Personal Data

We will only store your personal data for as long as necessary to achieve the collection purposes set out in this Privacy Notice, unless a longer retention period is required by law. If we are required by law to store your personal data beyond this period (such as for tax and commercial law reasons), we will delete the personal data at the end of this storage period.

After the expiry of the aforementioned retention periods, we will delete or anonymise your personal data.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use and disclosure of your personal data, the purposes for which we process the personal data and the applicable legal requirements.

If, after you sign up for our promotional emails, you unsubscribe from receiving our promotional emails, we will delete your personal data from our mailing lists. However, we will continue to store your email address in a blocklist to ensure that you will not receive any further communication.

VI. How We Disclose Your Personal Data

At times OnePlus may make certain personal data available to other companies that are wholly or jointly controlled by us ("Affiliates") and other third parties that work with OnePlus in order to provide Services to you. Your personal data will not be shared with third parties for their own independent marketing purposes.

• Affiliates: Your personal data may be shared with OnePlus's Affiliates for the purpose of rendering our Services to you. If Affiliates wish to process data for a different purpose, they must first seek your consent, unless another lawful basis exists.

• Service Providers and Partners: Some of our Services will be provided with the assistance of third parties. We may also share some personal data with our partners in particular so as to deliver you a better service and improve your user experience. For example, when you use the security centre app, third-party service providers are used to scan for viruses and free up storage space on your phone, and we engage third-party service providers to provide you with enhanced customer service. We may also rely on service providers to identify and serve targeted advertisements, provide email services, provide tax and accounting services, organise competitions and deliver web hosting or analytics services. Any such service providers will, through appropriate data processing agreements, be bound to only process personal data on OnePlus's behalf and under our instructions, unless such service providers act as independent controllers.

• Purchasers and third parties in connection with a business transaction: Where a merger, acquisition, bankruptcy liquidation or similar action takes place, we may transfer or disclose your personal data to a limited, but necessary extent to the applicable third party.

• Law enforcement, regulators and other parties for legal reasons: We may also disclose your personal data to third parties as required by law, or if we reasonably believe that such action is necessary (a) to comply with a subpoena or other legal proceedings, legal actions or government agency requests; (b) when we believe in good faith that a disclosure is necessary to comply with the law and the reasonable requests of law enforcement; (c) to protect and exercise our legal claims, rights and property; (d) to protect your rights, property or personal safety or that of others; (e) to investigate fraud and (f) to protect the security or integrity of our Services.

• The public, when posted in certain public spaces: Some of our Services allow you to connect and interact with others. Your profile information or information that you post in a forum or on a blog, including personal data, will be accessible to other users or the general public by default when you create it. Such content will be accessible by the general public or the members of the Service depending on the Service used.

• Otherwise with consent: We may disclose your personal data to certain other third parties with your consent.

VII. How Your Personal Data Is Transferred Globally

1. We leverage our resources and servers around the world to provide Services. We have data centres in the U.S., France, Singapore, India and Indonesia, which means that in compliance with applicable laws, your personal data might be transferred to or accessed from countries or regions outside of where you use our Services.

2. Please note that different countries or regions offer different levels of data protection. This means that your personal data could be stored in a country that offers a level of protection that may, in certain instances, be less protective of your personal data than the country or region in which you are located. However, in such cases, we will take measures to ensure that the personal data we collect is processed in accordance with this Privacy Notice and applicable laws, and that your personal data is adequately protected. For example, we might ask your permission to transfer your personal data across borders, and we will implement adequate security measures (such as encryption and de-identification where feasible) and sign the necessary data transmission/sharing agreements with the recipients of your personal data prior to the transfer taking place. We will also specifically ensure that we comply with laws that require us to store data locally within a specific country or region.

VIII. How We Protect Your Personal Data

1. The security of your personal data is very important to us. We have taken reasonably practical, technical and organisational measures in accordance with industry standards to protect personal data collected in connection with our Service and prevent it from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. However, please note that while we have taken reasonable measures to protect your personal data, no websites, Internet transmissions, computer systems or wireless connections are absolutely secure. In particular:

• Where appropriate, we will de-identify your personal data to mitigate the risk that other organisations or individuals may identify you on the basis of that personal data. We may also implement full security encryption during storage and transmission to prevent your personal data from unauthorised access, use or disclosure (such as by using SSL to encrypt many Services). We regularly review practices regarding personal data collection, storage and processing (including physical security measures) to prevent unauthorised access to or tampering with our various systems and your personal data.

• We only allow our employees and personnel of authorised service companies to access such personal data on a need-to-know basis, in order to process such personal data or provide relevant Services to you. These employees and external personnel are subject to strict contractual confidentiality obligations. If they fail to perform these obligations, they may be held liable and/or their relationship with OnePlus may be terminated.

• When transmitting and storing special categories of personal data, we use extra security measures, such as encryption of the transmitted content. We also use technical measures to process your personal biometric information so that we only need to store essential data (such as basic parameters necessary to identify a person, but not the raw facial and fingerprint data).

• We carefully select our business partners and service providers and ensure that they are sufficiently bound to protect personal data and will be subject to privacy audits and assessments.

• We conduct security and privacy protection training, testing and other activities to enhance employee awareness of and proficiency in personal data protection.

• We use international and industry-recognised standards to protect your personal data and actively pursue relevant security and privacy protection accreditation.

• We promise not to sell personal data to any third party and guarantees the legitimate and fair use of user information only to the extent permitted by law.

2. In case of a personal data security incident, we will act in accordance with applicable law and notify you and/or the competent data protection authority of any such security incident where required, and take measures to mitigate any risks arising therefrom.

IX. Your Rights Regarding Your Personal Data

1. Subject to applicable laws in your jurisdiction, you may have specific rights regarding your personal data. This may include the following rights in particular:

• The right to be informed: OnePlus is publishing this Privacy Notice to keep you informed as to how we handle your personal data and what options and rights you have regarding your personal data.

• The right to access: If you wish to access your personal data, some of our Services provide an interface through which you may directly search for or access certain personal data. You may also request access to the personal data we hold about you and information about its processing by contacting us using the "Contact Us" section.

• The right to rectification: If you find that the personal data we process about you is inaccurate or incomplete, you are entitled to ask us to make rectifications without undue delay and request the completion of your personal data where appropriate.

• You can opt out of the User Experience Program at any time through your device settings or by contacting us: (please refer to the section "Contact Us" below). After you opt out of the Program, we will delete or anonymise all data collected from your device for the Program.

• Unsubscribe from marketing communications: If you no longer wish to receive marketing communications, you may unsubscribe from such communications at any time using the method provided in each promotional message.

• The right to deactivate your OnePlus account. You can deactivate your account via https://www.oneplus.com/th/customer/info#/, by choosing “Deactivate my account”. Your account will have a 15-day deactivation period, followed immediately by account deletion. You may choose to reactivate your account at any time within 15 days. Afterwards, your account will be permanently deleted.

2. You may also have further legal rights concerning your personal data, depending on the jurisdiction in which you are located. In this respect, please see the GDPR-specific Section if you live in Europe.

3. If you wish to make a request, you can submit it through privacy@oneplus.com.

4. Please note that, in the interest of security, we may ask you to verify your identity before processing your request.

5. Certain jurisdictions might entitle you to refer the complaint to the relevant regulatory authority if you are not satisfied with the response you received.

6. In principle, we do not charge a fee for responding to your reasonable request. However, for multiple and repetitive requests that exceed a reasonable limit, we may charge a reasonable fee to cover some of our costs, depending on the nature of the request. We are entitled to refuse requests in whole or in part, and we may refuse requests that are manifestly unfounded, unreasonably repetitive or that require disproportionate technical effort (for instance, requests that require the development of new systems). In addition, we may not respond to requests that directly concern significant issues of public interest or may cause serious damage to the legitimate rights and interests of you or other individuals or entities.

X. How We Process Children's Personal Data

1. Our Services are mainly intended for adults. A child should not use our Services without his/her legal guardian's consent. We treat anyone less than 18 years of age (or the equivalent minimum age for full legal capacity in the relevant jurisdiction) as a child.

2. If we discover that a child's personal data has been collected, we will delete the corresponding data as soon as possible.

3. If you believe that we might have any personal data concerning a child, please contact us using the "Contact Us" section.

XI. Third-Party Websites

1. OnePlus Services may contain links to third-party websites, products and services. You can choose whether to access websites or accept products and services provided by third parties or not. For example, the "Follow us" function on our official website provides links to our official social media accounts (such as Facebook, Instagram, LinkedIn and Twitter) where you can view marketing or promotional information published by OnePlus .

2. We do not control third-party privacy and data protection policies and do not accept any responsibility or liability for such policies. At the same time, such third parties are not bound by this Privacy Notice. Therefore, before submitting personal data to third parties, we strongly recommend that you refer to the privacy protection practices of such third parties.

XII. How This Privacy Notice Is Updated

We reserve the right to update or modify this Privacy Notice from time to time. We will, as appropriate, send you notifications of material updates to this Privacy Notice in a form we deem appropriate and we will update the "last updated" date at the start of this Privacy Notice.

B. GDPR-Specific Provisions

The following provisions only apply to you if you live in Europe.

I. Legal Bases for the Processing of Personal Data

Our processing of your personal data as described in the Section "How We Use Your Personal Data" is based on the following legal grounds:

1. Consent: We may process your personal data with your consent. In particular, we may ask for your consent to participate in promotional activities, such as to send you promotional messages or enable you to participate in the User Experience Program and certain Services, including services through which we collect location information. You have the right not to provide consent, or to withdraw it at any time. The withdrawal of your consent does not affect the lawfulness of our use of your personal data before your withdrawal. If you have granted us consent to use your personal data, we will use it only for the purposes specified in the consent declaration. Please note that to the extent our processing is based on your consent and you deny your consent or withdraw it, we may not be able to provide the service relating thereto. Besides from that, neither the initial denial nor a withdrawal will have any negative consequences for you.

2. Perform or enter into a contract with you:

We rely on this legal basis in particular in the following cases:

• to provide you with OnePlus's Services, process your orders or fulfil the contract between you and OnePlus;

• to help you create and manage OnePlus account, activate Services you have purchased, your warranty service and specific software licenses and provide notifications for software updates;

• to allow and manage your participation in prize draws, contests or similar promotional activities held by us; and

• to diagnose product issues, repair customer equipment and provide other customer care and support Services.

3. Compliance with a legal obligation: OnePlus may be obliged to process personal data to comply with our legal obligations, for example where OnePlus is required to retain data for tax law or commercial purposes.

4. Legitimate interests: The processing of your personal data may also be necessary for OnePlus 's legitimate interests. In particular, such cases may include the following:

• to conduct customer surveys to enhance your user experience;

• to analyse the customer market on the basis of the country where you use our Services, including the number of users for product marketing and promotion;

• to analyse the efficiency of our business operations;

• to analyse error logs to improve phone quality and app functions;

• to communicate with you and reply to your questions or comments submitted to us by any means;

• to ensure the functionality and safety of our Services;

• to verify your identity;

• to conduct internal auditing and to prevent and investigate fraud, cybersecurity threats or other improper use;

• to enhance and develop our Services, including relevant security features, so as to improve the product usage experience, user-friendliness, operational performance, functions and design;

• to pursue or defend against legal claims.

Your personal data will only be processed on the above grounds after we have appropriately assessed and balanced our interests against your right to privacy.

II. Additional Information on How Your Personal Data Is Transferred Globally

In case your personal data is transferred to jurisdictions located outside of Europe, we will ensure that appropriate safeguards exist and are applied, such as:

1. the recipient of the personal data is located within a country that benefits from an "adequacy" decision of the European Commission;

2. the recipient has signed a contract based on "model contractual clauses" approved by the European Commission, obliging them to protect your personal data;

3. or in the absence of the above appropriate safeguards, we will ask you for your explicit consent for the cross-border transfer of your personal data or take any other measures that are recognised as providing a sufficient level of protection for your personal data.

For more information about the safeguards relating to personal data transfers outside of Europe, please submit your request via privacy@oneplus.com.

III. Additional Information on Cookies and Other Tracking Technology

If you wish to obtain detailed information on the use of cookies and other tracking technology, please read our Cookies Statement.

IV. Additional Information on Your Rights Regarding Personal Data

Subject to the legal requirements under the GDPR, you have the following rights:

• The right to access: You may request access to the personal data we hold about you.

• The right to rectification: If you find that the personal data we process about you is inaccurate or incomplete, you are entitled to ask us to make rectifications without undue delay and to request the completion of your personal data where appropriate.

• The right to erasure: You can submit a request to us to delete personal data, and we shall have the obligation to erase it without undue delay in some circumstances – for example, if we do not have a legal reason to continue to process the personal data to the extent required by applicable laws and regulations. Please note in so far as you delete all the data that is contained in your device, this does not mean that you have deleted all data that OnePlus collects and processes about you. Therefore, we encourage you to contact us (please refer to the section "Contact Us" above) to request that your personal data is deleted.

• The right to restriction of processing: You have the right, in certain circumstances, to request OnePlus to temporarily restrict the processing of your personal data, such as where the accuracy of that personal data is contested by you, while we verify the accuracy of that personal data. We will keep just enough data, or process such data as is necessary to ensure that we comply with your restriction request in the future.

• THE RIGHT TO OBJECT: You have the right to object to any processing justified by legitimate interests based on grounds relating to your particular situation at any time. Should you decide to object to the processing of your personal data, we will stop processing personal data that concerns you, unless we can demonstrate compelling reasons for continuing to process your personal data that override your interests, rights and freedoms, or in the case that we establish, exercise or defend our legal claims. You can object to direct marketing activities at any time for any reason whatsoever.

• The right to data portability: You have the right to obtain a copy of your personal data in a structured, commonly-used and machine-readable format and transmit such data to another provider or have such data transmitted to another provider under certain circumstances.

• The right to withdraw consent: If you have given us your consent to process your personal data but change your mind later, you have the right to withdraw your consent at any time. The withdrawal of your consent does not affect the lawfulness of our use of your personal data before your withdrawal. If you want to withdraw your consent with regard to receiving promotional communications, you can unsubscribe through the method described in each promotional message. If you withdraw your consent, we may no longer be able to provide you with the corresponding Service.

• The right to lodge a complaint: You have the right to lodge a complaint with a competent supervisory authority about the way we handle or process your personal data, or file a lawsuit in a court with jurisdiction. Information about how to contact your local data protection supervisory authority is available here.

C．California, United States Specific Provisions

I. Additional Information on What and How Your Personal Data Is Processed

Under California law, we are required to provide the following information regarding information that we collect from California residents. We may have collected the following personal data in the past 12 months:

Category of personal data	Source(s)	Purpose	Disclosure to third parties
Identifiers , which may include name, postal address, online identifier, Internet Protocol address, email address or account name	Directly from you Indirectly from you (eg from observing your actions on our website) From third party service provider, such as social media	To fulfil or meet the reason you provided the information (eg to help you manage your OnePlus account, to contact you in relation to our Services, and to respond to an inquiry or process an order)	Disclosure for business purposes to: OnePlus’ affiliates, third-party service providers, payment processors
Personal data categories contained in customer records, which may include name, address, telephone number, bank account number, credit card number, debit card number, or any other payment and financial information	Directly from you	To fulfil or meet the reason you provided the information (eg to help you manage your OnePlus account, to contact you in relation to our Services, and to respond to an inquiry or process an order)	Disclosure for business purposes to: OnePlus’ affiliates, third-party service providers, payment processors
Commercial information , which may include records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies	Directly from you From third party service provider, such as a retailer	To fulfil or meet the reason you provided the information (eg to help you manage your OnePlus account, to contact you in relation to our Services, and to respond to an inquiry or process an order	Disclosure for business purposes to: OnePlus’ affiliates, third-party service providers, payment processors
Biometric information, which may include face or fingerprints	Directly from you	To fulfil or meet the reason you provided the information (eg such information is stored only on your device in order for you to enable face or fingerprints recognition functions to unlock your mobile device)	None
Internet or other similar network activity , which may include browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement	Indirectly from you (eg from observing your actions on our website) From third party service provider, such as social media	To fulfil or meet the reason you provided the information (eg to improve our Services, or to provide targeted advertising with your consent)	Disclosure for business purposes to: OnePlus’ affiliates, third-party service providers
Geolocation data, which may include physical location or movements	Directly from you Indirectly from you (eg from observing your actions on our website)	To fulfil or meet the reason you provided the information (eg to help you manage your OnePlus account, to contact you in relation to our Services, and to respond to an inquiry, to process an order, or provide targeted advertising with your consent)	Disclosure for business purposes to: OnePlus’ affiliates, third-party service providers
Inferences drawn from other personal data, which may include a profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes	Indirectly from you (eg from observing your actions on our website) From third party service provider, such as social media	To fulfil or meet the reason you provided the information (eg to provide targeted advertising with your account)	Disclosure for business purposes to: OnePlus’ affiliates, third-party service providers

II. Additional Information on Your Rights Regarding Your Personal Data

For residents of California, United States only, California Civil Code Section 1798.83 permits users who are California residents to request certain information regarding our disclosure of personal data to third parties for their direct marketing purposes. To make such a request, please contact us using the details in the “Contact Us” section below.

California residents are also entitled to the below rights:

(A) the right to know and access information about the categories and specific pieces of personal data we have collected about you, as well as the categories of sources from which such information is collected, the purpose for collecting such information, and the categories of third parties with whom we share the personal data we have collected;

(B) the right to request the information regarding our disclosure of personal data to third parties for business purposes. To make such a request, please contact us using the details in the “Contact Us” section below;

(D) the right to opt out of the sale of your personal data to third parties. Note, we do not sell personal data, including the personal data of minors under 16; and

(E) the right to not be discriminated against for exercising any of the rights mentioned above.

(F) the right to deactivate your OnePlus account.You can deactivate your account via https://www.oneplus.com/th/customer/info#/, by choosing “Deactivate my account”. Your account will have a 15-day deactivation period, followed immediately by account deletion. You may choose to reactivate your account at any time within 15 days. Afterwards, your account will be permanently deleted.

Whenever feasible for verification, we will match the identifying information provided by you to the personal data already maintained by us. If, however, we cannot verify your identity from the information already maintained by us, we may request additional information. You may designate an authorised agent to make a request on your behalf. Such authorised agent must be registered with the California Secretary of State. We may deny a request from an agent that does not submit proof that they have been authorised by you to act on your behalf.

You can exercise your rights by contacting us using the details set out in the “Contact Us” section below and put “California Privacy Rights” in the subject line of your request and we will response your request within 15 days.

D. Contact Us

If you have questions or concerns regarding our Privacy Notice or practices, please submit your request through:

• Email:privacy@oneplus.com

• Postal address: F18, Block C, Tairan Building, Tairan 8th Road, Chegongmiao, Futian District, Shenzhen, China, ZIP Code: 518040

If you are located in Europe, our EU representative is Reflection Investment B.V. You can contact our EU representative via the following methods:

(a)Email: eurepresentative@oneplus.com

(b)Postal address: Hofplein 20, 3032AC Rotterdam, the Netherlands.

Our UK representative is Unumplus Limited. You can contact our UK representative via the following methods:

(a)Email: ukrepresentative@oneplus.com

(b)Postal address: 7 Albert Buildings, 49 Queen Victoria Street, London, United Kingdom, EC4N 4SA.

For users in India, please contact our Grievance Officer in India, at: legal.india@oneplus.com

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.