Privacy Policy Soneium Spark

Privacy Policy

Privacy Policy for Soneium Spark Incubation Program

Last revised: September 5th, 2024

This Privacy Policy sets out how Sony Block Solutions Labs Pte. Ltd., of 105 Cecil Street＃24-02 The Octagon Singapore 069534 (“SBSL”, “we”, “our” or “us”) collects, uses, stores and otherwise processes Collected Data (defined below) in relation to Soneium Spark, an incubation program to develop a community of visionary creators and builders who will shape the future of Soneium.

It also describes your data protection rights, including the right to object to some of the processing which SBSL carries out. More information about your rights, and how to exercise them, is set out in Section 9 “Privacy Rights” below.

Please note that Soneium Spark may provide access to services, sites, technology, applications and resources that are provided or otherwise made available by third parties (“Third-Party Services”). When you access and use Third-Party Services which are not governed by this Privacy Policy and our Terms of Service, their own terms of conditions, privacy policies or other agreements with such third parties will govern your use of such Third-Party Services.

Table of Contents

1. Definition
2. What personal data we collect
3. Why we process personal data
4. With whom we share Collected Data
5. Where we transfer Collected Data
6. How long we retain your personal data
7. Protection of your personal data
8. Children
9. Privacy Rights
10. Changes to this Privacy Policy
11. Contact Information

1. Definition

1.1 “Collected Data” has the meaning set forth in Section 2 below.

1.2 “Sony Group Companies” means Sony Group Corporation, which is the ultimate parent company of SBSL and any legal entities controlled by Sony Group Corporation (the term “control” in this context means the direct or indirect ownership of at least fifty percent (50%) of the voting interest in such corporation or the power in fact to control the management decisions of such entity).

1.3 “Service Provider” means any third party who processes personal data on behalf of SBSL, including but not limited to hosting providers, analytics service providers and customer support providers.

2. What personal data we collect

SBSL collects data as described below, which may include personal data, (collectively, the “Collected Data”) directly from you or indirectly through other Sony Group Companies and/or third parties, if any. For the purposes of the GDPR and other applicable data protection laws and regulations where the concepts of “Controller” and “Processor” are defined, SBSL is the “Controller” of the Collected Data.

2.1 Data collected directly from you

• IP address: SBSL collects the above information automatically when you apply to Soneium Spark.
• Information you provide us: We collect information through application form you submit to us and information you provide to us in relation to your application and participation in Soneium Spark. In addition, if you contact us, SBSL collects any information you provide through communication.

2.2 Data collected indirectly from other Sony Group Companies and/or third parties

• Blockchain Data: SBSL may collect blockchain data from the test or main network including timestamps or events, transaction IDs, digital signatures, transaction amounts and wallet addresses.

3. Why we process personal data

3.1 SBSL processes your Collected Data for the purposes as described below. For these purposes, SBSL may use Collected Data in conjunction with the information collected through other Sony Group Companies’ products and services if you use one of those.

Purpose	Category of Collected Data	Legal Basis
Provision of Soneium Spark To provide Soneium Spark to you (including evaluating your eligibility for Soneium Spark). This includes making necessary notifications and providing updates.	Collected Data listed in Section 2.1.-2.2	We have a legitimate interest to provide Soneium Spark to you and to check if any improvements are needed.*
Enhancement of our products, services and business based on statistical data To analyse your Collected Data in order to improve and develop Sony Group Companies’ products, services and business.	Collected Data listed in Section 2.1.-2.2	We have a legitimate interest in understanding how our products and services are used, to learn what business strategies are effective and to improve them. *
Protecting the interests of Sony Group Companies and users To protect Sony Group Companies’ business interests and legal rights and the interests and legal rights of our users. This includes the use of Collected Data in connection with legal claims, compliance, egulatory, auditing, investigative purposes (including disclosure of such information in connection with legal proceedings or litigation).	Collected Data listed in Section 2.1.-2.2	We have a legitimate interest in protecting Sony Group Companies’ business interests and legal rights, and the interests and legal rights of our users.*
Compliance with law To respond to requests from and, where required, report content to government or public authorities, law enforcement officials, courts, regulators or similar in accordance with our legal and regulatory obligations under applicable laws.	Collected Data listed in Section 2.1.-2.2	When we have a legal obligation under EU/UK laws: We process Collected Data in order to comply with applicable law and regulations. When we have a legal obligation under laws outside the EU/UK: We have a legitimate interest in protecting Sony Group Companies’ business interests and legal rights, and the interests and legal rights of our users.*

*Consent (but only in certain jurisdictions where we are not relying on any of the above).

3.2 Where we collect the Collected Data to perform a contract with you, or where we have to collect Collected Data by law, provision of this data is mandatory and we will not be able to make available Soneium Spark to you or carry out Soneium Spark without this information. In all other cases, provision of any requested Collected Data is optional, but not providing information may affect your ability to use the services or use particular aspects of the services if information is needed for those purposes. You may unsubscribe from receiving marketing materials at any time by clicking on the “unsubscribe” link in the email you receive or updating your preferences to indicate through which modes of communication and what kind of marketing communications you wish to receive.

3.3 There are instances where we have a legitimate interest to use the Collected Data. Our legitimate interest will vary depending on what we are using the Collected Data for, and we explain above what the interest is and how it relates to the processing operations that we are carrying out. Where we process the Collected Data on the basis of a legitimate interest, then – as required by data protection law – we have carried out a balancing test to document our interests, to consider what the impact of the processing will be on individuals and to determine whether individuals’ interests outweigh our interests in the processing taking place. You can obtain more information about this balancing test by using the contact details as set out in Section 11 below.

4. With whom we share Collected Data

SBSL shares your Collected Data with the following entities.

Entities with whom we share Collected Data	Detail
Sony Group Companies	We share Collected Data with Sony Group Companies where those companies process it on our behalf to provide products and services to you. If we have your permission, we also share Collected Data under the following categories with Sony Group Companies for them to send you marketing materials or survey requests. <Categories of Collected Data> [2.1.-2.2]
Service Providers	We share Collected Data under the following categories with Service Providers, including Sony Group Companies. <Categories of Collected Data> [2.1.-2.2]
Linked Third Party services	When you use third party services that are linked through our Service, the providers of those services or product will receive information about you. <Categories of Collected Data> [2.2]
Government authorities, law enforcement officials, regulators, and court and similar	We may share some or all Collected Data under the following categories with government authorities and/or law enforcement officials if required by law, or if necessary for us to protect our legitimate interests, or the interests of others, in compliance with applicable laws. <Categories of Collected Data> [All information listed in Section 2]
Counterparty of Business transfer	In the event that we undertake a merger, acquisition, reorganization or disposal, some or all Collected Data under the following categories may be disclosed to any prospective purchaser and/or its advisers and will be passed to the new owners of the business. <Categories of Collected Data> [All information listed in Section 2]
Professional advisors	In some cases, if this is necessary for the purposes listed above, we may share some or all Collected Data under the following categories with professional advisers including lawyers, auditors, or insurers. <Categories of Collected Data> [All information listed in Section 2]

5. Where we transfer Collected Data

We will process, store and transfer Collected Data for the purposes outlined in this Privacy Policy from your country/regions of residence globally to countries/regions outside your country/region of residence. Collected Data will be processed by staff operating outside your country/region of residence who work for us or for one of our Service Providers. Some of the countries and regions may not provide the same level of data protection as your country.

For EEA/UK Individuals: SBSL takes appropriate measures to ensure that all transfers of Collected Data outside of the EEA/the UK meet the requirements of applicable EU and UK data protection legislation. Where information is transferred outside the EEA and the UK, where the privacy laws may not provide an equivalent level of protection to those in your home country and where this is to a stakeholder or vendor in a country that is not subject to an adequacy decision by the EU Commission or the UK Government, the personal data is adequately protected by the vendor's EU / UK Processor Binding Corporate Rules, the EU Commission’s approved standard contractual clauses which can be accessed here or the addendum to the EU Commission’s standard contractual clauses or standalone international data transfer agreement approved under UK data protection law (as applicable). A copy of the relevant mechanism can be obtained for your review on request by using the contact details below.

For Singapore Individuals: SBSL takes appropriate measures to ensure that all transfers of Collected Data outside of Singapore meet the requirements of the Personal Data Protection Act 2012 of Singapore (“PDPA”), and that the recipient of the Collected Data is bound by legally enforceable obligations to provide to the Collected Data a standard of protection that is at least comparable to the protection under the PDPA. Where information is transferred to a country outside Singapore where the privacy law or personal data protection law may not provide an equivalent level of protection to the PDPA, the personal data is adequately protected by appropriate contract. A copy of the relevant mechanism can be obtained for your review on request by using the contact details as set out in Section 11 below.

6. How long we retain your personal data

6.1 Save as otherwise expressly stated in this Privacy Policy, we retain Collected Data for as long as we carry out Soneium Spark. 6.2 If there is a claim or a potential claim, or if we are required to retain information by law then we will keep the data for so long as is reasonably necessary for this. 6.3 We will cease to retain the Collected Data, or remove the means by which the Collected Data can be associated with particular individuals, as soon as:

• the purpose for which the Collected Data was collected is no longer being served by retention of the Collected Data; and
• retention is no longer necessary for legal or business purposes.

7. Protection of your personal data

We protect the Collected Data using physical, technical, and administrative security measures to reduce the risks of loss, misuse, unauthorized collection, use, access, disclosure, disposal and alteration of Collected Data, and the loss of any storage medium or device on which Collected Data is stored in accordance with common Sony Group Companies policies based on industry standards and best practices such as the International Organization for Standardization (ISO) 27001 series of standards and best practices such as the National Institute of Standards and Technology (NIST) SP800 series. These measures include systematic implementation and periodic review of information security management, periodic employee education and training, periodic inventory of information assets, implementation of physical security measures (Management of employee entry and exit, terminal management, etc.), encryption of communications, access controls, and periodic vulnerability management of information systems.

8. Children

SBSL is committed to complying with all applicable laws and regulations regarding the collection, storage and use of Collected Data concerning children. We do not directly or knowingly collect Collected Data from children. Depending on your country/region of residence, this threshold age for a child may differ. If you are a parent or guardian and are concerned that your child has provided us with Collected Data without your consent, you should contact us as indicated in Section 11 “Contact Information” below.

9. Privacy Rights

9.1 In some countries, you have the following rights with respect to Collected Data SBSL processes about you:

• (1) Ask us for a copy of Collected Data
• (2) Ask us to correct, delete or restrict our processing of Collected Data
• (3) Request us to transmit some Collected Data that you have provided to us, to a third party without hindrance, or to give you a copy of it so that you can transmit it to a third party, where technically feasible
• (4) Object to our processing Collected Data on the basis of our legitimate interests (or those of a third party)
• (5) Where we have asked for your consent, to withdraw consent at any time. If you ask to withdraw your consent, this will not affect any processing which has already taken place at that time.
• (6) Ask us for the information about the ways the Collected Data has been or may have been used or disclosed by us within a year before the date of your request

9.2 You can exercise these rights by contacting us as indicated in Section 11 “Contact Information” below. These rights may be limited, for example, if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.

9.3 If you have unresolved concerns, you have the right to complain to a data protection authority in the country where you live, work, or where you believe a breach has occurred. Details of EU data protection authorities are available here. and the website of the data protection authority of the UK Information Commissioner’s office is here. The details of the Singapore Personal Data Protection Commission can be found here.

10. Changes to this Privacy Policy

This Privacy Policy may be updated from time to time for any reason. We will notify or request your consent (if necessary under applicable law) of any changes to this Privacy Policy.

11. Contact Information

The data controller for Collected Data is Sony Block Solutions Labs Pte. Ltd., of 105 Cecil Street＃24-02 The Octagon Singapore 069534. If you have any questions or concerns about this privacy policy or if you wish to exercise any legal right you have in respect of Collected Data, you can contact from here or reach out to SBSL’s data protection officer (“DPO”) at the address above.

12. Consent

12.1 By [clicking “I accept” to this Privacy Policy, accessing our website, using any services provided by SBSL (including the Soneium Spark), signing up for any products and services provided by SBSL, submitting any information, or otherwise showing your agreement thereon], you agree and consent, or will be deemed to have agreed and consented that, your personal data (which may form part of the Collected Data) may be collected, processed, shared and transferred to third parties by SBSL, the Sony Group Companies and their Services Providers and agents as described in Sections 2 through 5 of this Privacy Policy.

12.2 Where you are providing any personal data on behalf to SBSL on behalf of any individual or legal entity (other than yourself), you warrant and represent to SBSL that you have obtained the prior consent of such individual or legal entity for the relevant purposes for which you made the disclosure or as was notified to you at the relevant time, including for all purposes set out and as required by this Privacy Policy.

12.3 It is important that the information you provide us with is true, accurate, current and complete. We rely on you to ensure that the Collected Data about you is accurate. You may notify us of any changes to your Collected Data by contacting us as indicated in Section 11 of this Privacy Policy.

13. ADDITIONAL NOTICES - US STATE RIGHTS

Notice to Virginia Residents
We set forth above in our Privacy Policy the categories of personal data we process, the purpose for processing personal data, the categories of personal data shared, and the categories of third parties with whom personal data is shared. Virginia Consumers have the following rights with respect to their personal data subject to the meanings and exceptions set forth in the Virginia Consumer Data Protection Act ("VCDPA"):

1. To confirm whether we are processing your personal data defined in the VCDPA (hereunder, "Personal Data") and request to access such data.
2. That we correct inaccurate Personal Data we hold about you.
3. That we delete the Personal Data provided by you or obtained about you.
4. To obtain a copy of the Personal Data previously provided by you to us and, to the extent feasible, in a readily usable format to allow data portability.

If you are a Virginia Consumer and would like to exercise any of these rights, please complete the form here: Data Requests.
Opt-out of Targeted Advertising: Virginia Consumers have the right to opt-out out of the processing of your Personal Data for the purposes of targeted advertising. SBSL engages in online advertising and analytics practices that may be considered "targeted advertising" under the VCDPA. To exercise your rights to opt-out of targeted advertising, you may submit a request here: Opt-out of Targeted Advertising.
In addition, you may need to disable sharing through cookies set by third parties on certain SBSL websites which may be considered targeted advertising under the VCDPA. To manage your cookie preferences, please refer to the "Manage Cookies" link on the cookie banner or in the footer for the applicable website and ensure that "Targeting Cookies" are disabled. While the VCDPA also permits you to opt-out of the sale of your Personal Data, at this time we do not engage in the sale of Personal Data to third parties for monetary compensation. Similarly, we do not process your Personal Data for purposes of profiling as set forth in the VCDPA that would require such an opt-out.

VCDPA Appeals
Pursuant to the VCDPA, if, for any reason, you would like to appeal a decision made by us relating to your request, you have the right to submit an appeal and can do so by completing this form: Data Requests . Please include your full name, the basis for your appeal, and any additional information to consider.

Notice to California Residents
This California Privacy Notice is effective as of [2024-09-04].

This California Privacy Notice supplements our Privacy Policy and applies only to California residents. This notice sets forth the disclosures and rights for California Consumers regarding their personal information, as required by the California Privacy Rights Act and any implementing regulations adopted thereunder ("CPRA"). Terms (including defined capitalized terms) used in this California Privacy Notice have the same meanings given in the CPRA, unless otherwise defined.

California Consumer Rights. Subject to certain exceptions, as a California consumer, you may have the following rights regarding your CA Personal Information:

• Request to Know. Request information regarding what Personal Information we collect, use, disclose, and sell, including the right to request that we provide you with the categories and/or specific pieces of Personal Information we have collected about you;
• Request to Delete. Request deletion of the Personal Information we collect about you;
• Request to Correct. Request correction of inaccurate Personal Information that we maintain about you;
• “Do Not Sell or Share My Personal Information.” Request to opt-out of the “sale” of your Personal Information or the “sharing” of your Personal Information to a third party for cross-contextual behavioral advertising (i.e., targeted advertising). As we do not knowingly collect Personal Information of residents younger than the age of 16, we also do not knowingly sell or share for cross-contextual behavioral advertising their Personal Information.

"Limit the Use and Disclosure of Sensitive Personal Information." Under the CPRA, we must only provide the Right to Limit the Use and Disclosure of Sensitive Personal Information when Sensitive Personal Information is collected or processed for the purpose of inferring characteristics about a consumer or does not fall under certain statutory exceptions. SBSL's use and disclosure of Sensitive Personal Information is not used for such purposes and/or falls within the statutory exceptions, and we therefore do not offer this right at this time.

Verifying Requests
In your request, you must provide enough information to allow us to verify you are the person about whom we collected Personal Information, or their authorized representative. You must also describe your request with enough detail so that we can understand, evaluate and respond to it. We can't respond to your request if we can't verify your identity. Making such a request does not require you to create an account with us, and we will only use the information you provide in a request to verify your identity. We will take reasonable steps to verify your identity based upon the information you provide and the type of request you are making. When you exercise your Right to Know, Right to Delete, and/or Right to Correct, we may ask that you provide us with additional information in order to verify your identity and fulfill your request. If we are unable to verify that the individual submitting the request is the same individual about whom we have collected information (or someone authorized by that individual to act on their behalf), we will not be able to process the request. Pursuant to the CPRA, we will not require you to verify your identity, beyond asking for the information necessary to complete your request, when you exercise your Right to Opt-Out of Sale or Sharing.

Agents
If you are an authorized representative submitting a request on a consumer's behalf, please complete the applicable fields of information in the submission form. We will follow up to request a signed, written permission signed by the individual who is the subject of the request authorizing you to make the request on their behalf. The written permission must state your full legal name, the full legal name of the individual who is the subject of the request, and a clear description of the permission granted. Alternatively, you may submit a copy of a power of attorney under Probate Code sections 4000-4465. The consumer's identity, in addition to your own, will need to be independently verified in order for us to be able to fulfill your request. Please keep in mind that if we do not receive adequate proof that you are authorized to act on the consumer's behalf, we may deny the request.

Exercising your Rights
Right to Know; Right to Delete; Right to Correct
If you are a California Consumer and would like to exercise your Right to Know, Right to Delete, and/or Right to Correct, please submit your request at: Data Requests; or you may call us toll-free at 1-833-681-9900. For requests to know, in order to have us provide specific pieces of information, we will require a signed declaration under penalty of perjury that you are the consumer whose Personal Information is the subject of the request.

Do Not Sell or Share for Cross Context Behavioral Advertising
Right to Opt-Out of Sale/Sharing. California Consumers have the right to opt-out of the sharing of your Personal Information to a third party for cross-context behavioral advertising (i.e., targeted advertising). California Consumers also have the right to opt-out of the "sale" of your Personal Information for monetary or other valuable consideration. Please note that we do not sell Personal Information for monetary or other valuable consideration. If you are a California Consumer and would like exercise your Right to Opt-Out of Sale or Sharing, please submit your request at: Do Not Sell or Share My Personal Information.

Cookie Based Opt-Outs for Do Not Sell or Share for Cross Context Behavioral Advertising. SBSL engages in online advertising practices (and certain analytics or similar activities), which may be considered a “sale” or “share” for cross-context behavioral advertising as defined in the CPRA. In addition to submitting the form above, you may need to disable sharing through cookies set by 3rd parties on certain SBSL websites. To manage your cookie preferences, please refer to the “Manage Cookies” link in the cookie banner or footer for the applicable website and ensure that “Targeting Cookies” are disabled

Data Retention
We retain all categories of Personal Information described in this California Privacy Notice for as long as it is reasonably necessary for the purposes outlined in this California Privacy Notice, considering the time period reasonably necessary to: provide the goods or services you request; exercise the choices and rights you have requested; comply with our contractual obligations; comply with applicable legal, regulatory, or other obligations; including litigation holds and agency regulations. Except as noted differently specific pages or apps, we retain your personal information while you have an account with us, or while you are using the Website or continuing to interact with us. Right to Non-Discrimination for the Exercise of a Consumer's Privacy Rights California Consumers have the right to not receive discriminatory treatment for exercising CPRA rights. We will not discriminate against you for exercising your CPRA rights.

Notice of Financial Incentive
Under California regulations, if we offer certain loyalty or similar program(s) directly or reasonably related to the collection, retention or deletion of your Personal Information, such program may be considered a "financial incentive", In such case, we will be required to make additional disclosures to you, which we will provide when you agree to participate

Personal Information We Collect & Purposes for Collection
The Personal Information we collect about you will depend upon how you use the Website or otherwise interact with us. Accordingly, we may not collect all of the below information about you. In addition to the below, we may collect and/or use additional types of information and will do so after providing notice to you and obtaining your consent to the extent such notice and consent is required by the CPRA.

We may have used Personal Information for the following business or commercial purposes: 

Categories of Personal Information Collected	Business or Commercial Purposes for Collection of Personal Information	Categories of Sources from Which Personal Information Was Collected	Categories of Third Parties to Whom We May Disclose Personal Information for a Business Purpose	Categories of Third Parties to Whom this Type of Personal Information is Sold or Shared for Cross Context Behavioral Advertising
Identifiers Such as name, phone number, mailing address, email, and online or device identifiers such IP address	We may use this type of information to: Provide requested services; respond to your inquiries; maintain and improve our products and services; monitor and maintain security of our systems and prevent fraud; internal business, legal and compliance purposes	We may collect this type of information from: Consumers; Sony Group companies;	We may disclose this type of information to: Sony Group companies; Service Providers;	N/A
Internet or Other Electronic Network Activity This category includes information such as computer and connection information, browser type, operating system.	maintain and improve our products, services and features; monitor and help maintain security of our systems and prevent fraud; internal business, legal and compliance purposes	Consumers; Sony Group companies;	Sony Group companies; Service Providers; Legal Authorities (as required by law); Business Transfer Recipients.	N/A
Inferences Drawn from Other Information and Consumer Characteristics These may relate to demographics , interests or hobbies, and inferences drawn from collected information.	To develop, maintain and improve the products, services and features offered by us and the Sony Group companies	Consumers; Sony Group companies	Sony Group companies; Service Providers ; Legal Authorities (as required by law); Business Transfer Recipients.	N/A

Additional Notice to California Residents:
If you are a California resident, under the California "Shine the Light" law, you have the right to receive: (a) information identifying any third party companies to which we may have disclosed, within the past year, personal information pertaining to you and your family for that company's direct marketing purposes; and (b) a description of the categories of personal information disclosed. To obtain such information, please email your request to privacy@am.sony.com, and include your name, email address, mailing address or zip code, and a reference to "Your California Privacy Rights." We are not responsible for requests that are not labeled or sent properly, or do not have complete information.