Last Updated: 20/2/2024
This Privacy Policy explains how we collect, use and/or store your personal data in connection with your [Sony’s cloud service account for Home Entertainment & Sound Products] (“[SHES Account]”). It also describes your data protection rights, including your right to object to some of the processing which we carry out. More information about your rights, and how to exercise them, is set out in Section 8. Privacy Rights (including EEA and California Privacy Rights) below.
By “we” “us” or “our”, we mean Sony Corporation (1-7-1, Konan, Minato-ku, Tokyo 108-0075, Japan) (“Sony”), which is a Sony group company. For the purposes of applicable data protection laws and regulations where the concepts of "controller" and “processor” are defined, SONY is the "controller" of the Collected Data described in this Privacy Policy.
In order to use certain Sony applications or application features, you will need to maintain this SHES Account.
The privacy policy for the applicable Sony application or service will tell you how your SHES Account will be used in connection with that feature or service, and which Sony group company is responsible. You can find the privacy policy for each application or service within the settings menu for that application or service.
This privacy policy only applies to this SHES Account service and is in addition to any other privacy policy that may apply to your interactions with the Sony group companies or any third party, regarding their products, software or services.
In this Privacy Policy, when we say:
We collect following information in addition to information about your usage of the website of the SHES Account (access status, etc.), some of which may be considered personal information in certain jurisdictions (collectively, the “Collected Data”).
(A) At the time of authentication
In order to create an SHES Account, you will first need to provide sign in authentication via either (1) a Sony account (SHES Cloud service) or (2) a Google, Facebook, Amazon, or Apple (“ID provider”) authentication; provided that a Sony account (SHES Cloud Service) will be required for a SHES Account.
More information about the data we collect in connection with each authentication method is below. We use cookies, activation codes and/or tokens as necessary for us to provide you with SHES Account service or to link your device to a service.
Sony account (SHES Cloud service) authentication
To create or use a Sony account (SHES Cloud service) for authentication when you create a SHES Account, Sony will collect the following:
Once you have successfully signed into your Sony account (SHES Cloud service), your TV or mobile device will receive a digital ‘access token’ from this Sony account (SHES Cloud service). Please be aware that some Sony accounts for other Sony products and services will be linked automatically if you use the same sign-in ID (email address) and password. For more information about linking accounts, please go: https://acm.account.sony.com/linking-account
For password management/reset and authentication, you can also register a security question and answer and telephone number at the Sony account (SHES Cloud service) security setting page. This Collected Data is not used for any other purpose.
ID provider authentication
If you choose to use an ID provider authentication to initiate a SHES Account, Sony will collect the following:
Please note that the information we collect from and through an ID provider may depend on the privacy settings you have set with that ID provider and the permissions you grant to us in connection with linking your SHES Account to your account with an ID provider. We do not share any Collected Data with the ID provider, and the personal information an ID provider has about you is obtained by the ID provider independent of our service and Sony is not responsible for it.
For more information how relevant ID provider handles the processing of your data, please visit the following websites:
(B) At the time of SHES Account creation
After you have completed sign-in authentication, you will create your SHES Account and we will assign identifiers, issue tokens and collect the following information that you provide:
Please note that you may create separate SHES Accounts for each email address you choose to use.
(A) Providing services
Sony processes Collected Data in order to perform its contract with you to:
Please note that the legal basis under EU-law for SONY processing your Collected Data is Article 6 (1) (b) General Data Protection Regulation, the necessary of performance of the [Terms of Use] we have with you.
(B) Email Marketing
With your consent, Sony Corporation will for this purpose collect and share your Collected Data (except for information about your usage of the website of the SHES Account (access status, etc), tokens issued as a result of sign-in authentication and ID provider service that you choose) with Sony Europe B.V. (as an independent controller) ; Sony Electronics Inc; Sony of Canada Ltd or Sony (China) Limited and other Sony group companies depending on where you are located which provides you with general information, recommendations and advertisements, and marketing regarding Sony products, services and other offerings that may be of interest to you via email.
Your consent forms the legal basis for SONY to share Collected Data with Sony Europe B.V. providing you with email marketing communication as outlined under EU-law (Article 6 (1) (a) General Data Protection Regulation).
Please note that the Collected Data may be combined with usage data from the applicable application or service you use so that this email marketing may be personalized or tailored to provide you new product information, articles, offers, promotions, and recommendations about Sony products, services and other offerings that may be of interest to you. With your consent Sony Corporation will for this purpose share Collected Data as per your preferences (set by you in the respective product app) with Sony Europe B.V. (as an independent controller) ; Sony Electronics Inc; Sony of Canada Ltd or Sony (China) Limited and other Sony group companies depending on where you are located.
[For EEA residents]
With your additional consent (expressed in a product application and My Sony ID you created) Sony Europe B.V. achieves the personalization or tailoring through profiling of the Collected Data (except for information about your usage of the website of the SHES Account (access status, etc), tokens issued as a result of sign-in authentication and ID provider service that you choose) and other data (such as user log data from the use of the connected Sony device or app) it collected.
Please note that your consent forms the legal basis for SONY to share Collected Data with Sony Europe B.V. providing you with personalized or tailored email marketing communication as outlined under EU-law (Article 6 (1) (a) General Data Protection Regulation).
You can unsubscribe from receiving email marketing any time by using the “unsubscribe” link in the email from the Sony group company in your region or territory or by referring to the privacy policy for your local Sony group electronics company. For more information on the privacy practices of Sony group companies, please refer to the respective privacy policy as follows.
For individuals located in US, for the purposes of this section 2, instead of Sony Europe B.V., the Sony group company in area where you are located is Sony Electronics Inc.
https://products.sel.sony.com/SEL/legal/privacy.html [Privacy Policy] and CA Privacy Notice
For individuals located in Canada, for the purposes of this section 2, instead of Sony Europe B.V., the Sony group company in area where you are located is Sony of Canada Ltd.
(EN) http://corporate.sony.ca/view/privacy.htm
(FR) http://fr.corporate.sony.ca/view/politiquedeconfidentialite.htm
For individuals located in China, for the purposes of this section 2, the Sony group company in area where you are located is Sony (China) Limited.
https://www.sony.com.cn/privacy/terms.html
Sony will make Collected Data available to Sony Europe B.V. (as an independent controller) and to third parties as follows if your country of residence is the EEA. If your country of residence is outside the EEA, Sony may transfer such data to your local Sony electronics company, including Sony Electronics Inc; Sony of Canada Ltd or Sony (China) Limited, or other Sony group companies, and to third parties as follows, depending on your country of residence.
Sony group companies and third-party service providers
If you contact your Sony group company in relation to queries or for repair or return requests of Sony products, we also may need to share Collected Data with that Sony group company in connection with your request.
Sony may use Sony group companies and third party service providers to process the Collected Data. Our service providers include customer support vendors, IT vendors and data hosting vendors, including Amazon Web Services, Inc., which provides data back-up services to us and is located in the US. The service providers are engaged for the purposes of pursuing the activities outlined in this Privacy Policy on Sony’s behalf, acting as processors of Sony.
Business transfer
In the event that we sell or transfer a portion or all of our business, Collected Data may be transferred by us to the purchasing or acquiring entity as part of the transaction. We will continue to ensure the confidentiality of the Collected Data before such transaction occurs, and after such transaction, we will delete the Collected Data as soon as reasonably practicable after such transaction.
Compliance and enforcement
We will retain, use and/or disclose any of Collected Data as required or permitted by law, regulation or order, including to the police or other appropriate authorities, to investigate complaints made by or against you, or to protect or defend ourselves, Sony group companies or third parties, against illegal, criminal or harmful activities.
We will continue to retain Collected Data for 6 months after you delete the SHES Account unless local law tells us to keep it for longer. Please note that we may be required to retain certain information by law.
Where Sony no longer requires the Collected Data, it will be destroyed or de-identified in line with internal Sony information security policies. When we say de-identified, we mean that we will remove information that could be used to identify you from the Collected Data.
Collected Data will be processed, stored and transferred for the purposes outlined in this Privacy Policy to various jurisdictions outside your jurisdiction of residence, including Japan and the US. Collected Data will be processed by staff operating outside your jurisdiction who work for us or for one of our service providers and may be seen by such staff in those countries.
By providing us with the Collected Data, you consent to the transfer, processing and storage of your information in jurisdictions in which the privacy laws may not be as comprehensive as those in the country where you reside and/or are a citizen. Further, courts, law enforcement, and other authorities in countries/regions outside your residence may be entitled to access Collected Data upon its transfer. We have taken reasonable steps to ensure that any transfers of Collected Data meet the requirement of applicable data protection legislation and that your personal information will not be used for purposes not relevant to the purpose for which it was collected or communicated to service providers without your consent except when required or permitted by law.
Where Collected Data is transferred outside the EEA, and where this is to a stakeholder or vendor in a country that is not subject to an adequacy decision by the EU Commission, the Collected Data is adequately protected by EU Commission approved standard contractual clauses which can be accessed here or Binding Corporate Rules.
Sony undertakes reasonable security measures designed to protect against the loss, misuse or alteration of Collected Data. We take information security very seriously but we cannot guarantee or warrant the absolute security of any information that we store on our systems or that is stored on our third party contractors’ systems.
Sony is committed to complying with all applicable laws and regulations regarding the collection, storage and use of personal information concerning children, including the Children's Online Privacy Protection Act in the United States and applicable local legislation in other countries.
This SHES Account is intended for a general audience; it is not directed to and does not knowingly collect personal information from children under the age of 16 or 14 in the case of residents in China. Depending on your country/region of residence, this threshold age for a child may differ.
If you are a parent or guardian and are concerned that your child has provided us with personal information without your consent, you should contact us as indicated in Section 11. Contact Information below.
In some countries, you have certain rights with respect to the Collected Data Sony holds about you. These may include the right to request a copy of the Collected Data that Sony or Sony group companies holds about you and/or you may request that Sony or the Sony group companies, corrects, amends, deletes, erases, destroys, objects or blocks/restrict processing and/or use of such Collected Data if it is inaccurate. In some countries, you may also ask us to provide some types of the Collected Data to you in a structured, machine-readable format and ask us to share (port) such data with another controller. These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete Collected Data which we are required by law to keep, or have compelling legitimate interests in keeping. If you would like to exercise any of these rights, please contact us as described in Section 11. Contact Information below. If you are not satisfied with how we have handled your questions, concerns or have any complaints about how we process personal data, you have a right to lodge a complaint with the local data protection supervisory authority.
[Notice to EU, UK and Switzerland residents]
If you are located in the EEA, UK or Switzerland, you may have the following rights (pursuant to Art. 15-18 and Art. 19-21 GDPR, if you are located in the EEA):
These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.
You also have the right to lodge a complaint to a supervisory authority for data protection (Art. 77(1) GDPR) in the country/region where you live, where you work, or where you consider that a breach of data protection has occurred – although we hope that we can assist with queries or concerns you may have about our use of your Collected Data.
[Notice to US Residents/California Residents]
(i) Notice to Residents of Colorado, Connecticut, Utah, and Virginia
We set forth in our Privacy Policy and Table 1 below the categories of personal data we process, the purpose for processing personal data, the categories of personal data shared, and the categories of third parties with whom personal data is shared.
Starting in 2023, consumers in certain states, including Colorado, Connecticut, Utah, and Virginia, may have the following rights:
Right to Know: the right to confirm whether we are processing personal data about you.
Right to Correct: the right to correct inaccurate Personal Data we hold about you.
Right to Delete: the right to delete the Personal Data provided by you or obtained about you.
Right to Data Portability: the right to access your personal data and obtain a copy of the Personal Data previously collected by us and, to the extent feasible, in a readily usable format to allow data portability.
Right to Appeal: If for any reason you would like to appeal a decision made by us relating to your request to exercise privacy rights, you have the right to submit an appeal to us. Please include your full name, the basis for your appeal, and any additional information to consider.
If you would like to submit a request to exercise one of the rights listed above, you can do so by completing this form: Data Requests
Right to Opt-Out of Targeted Advertising: Your local Sony electronics company may engage in online advertising and analytics practices that may be considered “targeted advertising” or a “sale” of data under applicable state law.
To exercise your rights to opt-out targeted advertising, please ensure that the setting for “Personal Information” in the [Account Setting] on the account page of SHES Account accessible from the applicable app or service is disabled.
You may also submit a request here: Opt-out of Targeting Advertising
Right to Opt-Out of Profiling or Sale of Personal Information: While state laws may permit you to opt-out of the sale of your Personal Data and out of profiling in furtherance of decisions that produce legal or similarly significant effects, we do not engage in either of these activities at this time.
(ii) Notice to California residents: California Privacy Notice
This California Privacy Notice is effective as of 20/2/2024.
This California Privacy Notice supplements our Privacy Policy sets forth the disclosures and rights for California Consumers regarding their personal information, as required by the California Privacy Rights Act, as amended, and any implementing regulations adopted thereunder (“CPRA”). Terms (including defined capitalized terms) used in this California Privacy Notice have the same meanings given in the CPRA, unless otherwise defined.
California Consumer Rights. Subject to certain exceptions, as a California consumer, you may have the following rights regarding your CA Personal Information:
Agents. If you are an authorized representative submitting a request on a consumer’s behalf, please complete the applicable request per the instructions below. We will follow up to request a signed, written permission signed by the individual who is the subject of the request authorizing you to make the request on their behalf. The written permission must state your full legal name, the full legal name of the individual who is the subject of the request, and a clear description of the permission granted. Alternatively, you may submit a copy of a power of attorney under applicable state law. In either case, please also indicate in your email the nature of your request. The consumer’s identity, in addition to your own, will need to be independently verified in order for us to be able to fulfill your request. We may also ask the consumer to directly confirm with us that they provided you permission to submit the request. Please keep in mind that if we do not receive adequate proof that you are authorized to act on the consumer’s behalf, we may deny the request.
Verifying Requests. In your request, you must provide enough information to allow us to verify you are the person about whom we collected Personal Information, or their authorized representative. You must also describe your request with enough detail so that we can understand, evaluate and respond to it. We will only use the information you provide in a request to verify your identity.
When you exercise your Right to Know, Right to Delete, and/or Right to Correct, we may ask that you provide us with additional information in order to verify your identity and fulfill your request. If we are unable to verify your identity, we will not be able to process the request.
Exercising Your Rights.
Right to Know; Right to Delete; Right to Correct
If you are a California Consumer and would like to exercise your Right to Know, Right to Delete, and/or Right to Correct, please submit your request at: Data Requests; or you may call us toll-free at 1-833-681-9900.
Do Not Sell or Share for Cross Context Behavioral Advertising
Right to Opt-Out of Sale/Sharing
You may also submit a request here: Opt-out of Targeting Advertising
Data Retention. Sony retains data for as long as you hold a SHES Account(s). Sony either deletes Collected Data or de-identifies the data it holds after approximately six (6) months from the deletion of such SHES Account, except as required or permitted by law.
Data Reporting
Click here to access our data reporting metrics for the previous calendar year.
Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights
California Consumers have the right to not receive discriminatory treatment for exercising CPRA rights. We will not discriminate against you for exercising your CPRA rights.
Notice of Financial Incentive
Under California regulations, if we offer certain loyalty or similar program(s) directly or reasonably related to the collection, retention or deletion of your Personal Information, such program may be considered a “financial incentive”. In such case, we will be required to make additional disclosures to you, which we will provide when you agree to participate.
Personal Information We Collect & Purposes for Collection
The Personal Information we collect about you will depend upon how you use the SHES Account. Accordingly, we may not collect all of the below information about you. In addition to the below, we may collect and/or use additional types of information and will do so after providing notice to you and obtaining your consent to the extent such notice and consent is required by applicable law.
We may have used Personal Information for the business or commercial purposes described in Table 1:
[Table 1]
| Categories of Personal Information Collected | Purposes for Collection of Personal Information | Who We Share Personal Information With for a Business Purpose | Third Parties We Sell To, or Share With for Cross Context Behavioral Advertising |
|---|---|---|---|
|
Identifiers: Such as: Email address; your name, postal code, online identifier such as IP address; Device ID, Android |
|
|
Third party ad vendors via our local operating company |
|
Electronics and Network Information: Such as: usage status |
|
|
None |
|
Sensitive Information Such as: your log-in/password information |
|
|
None |
|
Inferences Drawn from Other Information and Consumer Characteristics: These may relate to demographics (e.g., gender, age, region/general location), interests or hobbies, and inferences drawn from collected information. |
|
|
Third party ad vendors via our local operating company |
For more information about our local Sony electronics company’s California privacy practices, please refer to this California-specific information here: Calif. Privacy Notice
Additional Notice to California Residents:
If you are a California resident, under the California “Shine the Light” law, you have the right to receive: a) information identifying any third party company(ies) to which we may have disclosed, within the past year, personal information pertaining to you and your family for that company's direct marketing purposes; and b) a description of the categories of personal information disclosed. To obtain such information, please email your request to privacy@am.sony.com, and include your name, email address, mailing address or zip code, and a reference to “Your California Privacy Rights – SHES Account.” We are not responsible for requests that are not labeled or sent properly, or do not have complete information.
(iii) Notice to Nevada Residents:
If you are a Nevada resident, you have the right to opt-out of the sale of certain personally identifiable information we have collected about you to third parties. Sony does not currently sell your personally identifiable information as those terms are defined under Nevada law. However, if you wish to submit a request to opt-out of the sale of such information if Sony were to engage in such a sale in the future, you may submit your request in writing to: privacy@am.sony.com. Your request must reference “Your Nevada Rights – SHES Account” and include your name, mailing address, zip code, and email address. We are not responsible for requests that do not come through the designated request mechanism or do not contain sufficient information to allow us to process your request. We will respond to valid requests within 60 days.
[Notice to Quebec (Canada) Residents]
This notice sets forth disclosures and rights for consumers residing in Québec regarding their personal information, as required by the Québec’s Data Privacy Law 25.
Profiling: With your consent, we may use technologies which collect information about your use of the application associated with your SHES Account that may enable us to develop a profile of your interests or preferences.
Location Tracking: We may use technologies which collect information about your general location, such as the country in which you are located; however, we do not track your location without your consent.
Consumer Rights:
Subject to certain exceptions, you may have the following rights regarding your personal information:
Exercising your rights: If you are a Quebec resident and wish to exercise your right(s), please: submit your request here: SOCAN Privacy Request Webform; or you may call us at: 1-888-494-7669.
For requests to access, in order to have us provide specific pieces of information, we will require a signed declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request.
Contact Information for Sony Canada’s Privacy Officer is available in the Section below, How to Contact Us about this Privacy Policy.
[Notice to China residents]
If you reside in China, you may have the following rights:
if you would like to exercise any of these rights, please contact Sony at www.sony.net/SonyInfo/Support/.
If you are not satisfied with how we have handled your questions, concerns or have any complaints about how we process personal data, you have a right to lodge a complaint with the departments fulfilling personal information protection duties and responsibilities (Art. 65 para 1 PIPL).
[For Asia & Oceania Residents except for China and Japan Residents]
Please read this Privacy Policy carefully because by using this SHES Account, you will be deemed to have agreed and consented to the terms of this Privacy Policy.
By using this SHES Account, or providing us with Collected Data, you fully understand and consent to the transfer of the Collected Data internationally, processing and storage of such Collected Data in the United States and other jurisdictions, where the privacy laws may not be as comprehensive as those in the country where you reside and/or are a citizen.
This may impact your rights in your local jurisdiction and also in the applicable overseas jurisdiction(s). These overseas jurisdictions may also need to disclose Collected Data to a third party, such as an overseas authority.
By using this SHES Account, or providing us with Collected Data, you agree that you will not hold Sony or Sony group companies liable for any complaints or damages whatsoever relating to the processing of the Collected Data by an acquiring entity in the event a business transfer as described in paragraph 3 of this Privacy Policy takes place.
[For Japan Residents]
Joint use among Sony group companies
Sony may jointly use the Collected Data about you residing in Japan with Sony group companies including Sony Marketing Inc., which provides products and services of Sony group companies in Japan. Upon such joint use, Sony undertakes reasonable security measures in line with information security policies commonly applied to Sony group companies.
Storage of Collected Data outside of Japan
Collected Data is stored in a server in the United States provided by a data back-up services provider (Amazon Web Services, Inc. located in the U.S.). Please refer to here (in Japanese) for the overview of personal information-related regulations in the United States.
Additional notice pertaining to “security measures”
Sony applies Sony group companies policies provided in accordance with industrial standards and best practice as represented in the standards in the 27001 families set forth by International Organization for Standardization and NIST to put strict security measures in place for personal information collected and retained by Sony. These measures include implementation and periodical review of organizational information security management, regular training for staffs, periodical review of information assets, implementation of physical security measures (e.g., monitoring of staff entry and exit, device monitoring), encryption of messages, strict access control, regular maintenance of vulnerability in information system. If Sony engages a third party for a part of processing activities of personal information collected and retained by Sony (including a third party engaged by such third party), Sony outsources processing of personal information only after confirming that necessary and appropriate measures for information security management are in place by the third parties.
Sony also expresses basic polices about handling of personal information in our domestic Sony group and common privacy policy (https://www.sony.co.jp/privacy/).
From time to time we may have to update this Privacy Policy. We will let you know of any material changes to this Privacy Policy through the SHES Account. If the applicable law requires us to obtain your consent, we will ask you for your consent.
FOR RESIDENTS IN THE EU or Switzerland:
If you have a privacy concern, complaint or question, please contact Sony Europe B.V., who is Sony’s representative in the EU, at privacyoffice.SEU@sony.com
You can also get in touch by writing to Sony Europe B.V., The Privacy Office, The Heights, Brooklands, Weybridge, Surrey KT13 0XW, United Kingdom, or you can contact your local Sony Group Companies at https://sony-europe.com.
FOR RESIDENTS IN THE UK:
If you have a privacy concern, complaint or question please contact Sony Europe B.V., who is Sony’s representative in the UK, at: privacyoffice.SEU@sony.com
You can also get in touch by writing to Sony Europe B.V., The Privacy Office, The Heights, Brooklands, Weybridge, Surrey KT13 0XW, United Kingdom.
FOR RESIDENTS IN KOREA:
We would designate a domestic representation according to Korea local regulation as following:
Name: Sony Korea Corporation (representative director: Okura Kikuo)
Address: 24F, One IFC, 10 Gukjegeumyung-Ro, Yeongdeungpo-Gu, Seoul, Korea Contact information: 02-1588-0911 / sokprivacy@sony.co.kr
FOR RESIDENTS IN CHINA:
If you have a privacy concern, complaint or question, please contact Sony (China) Limited at SChina_Privacy_Dep@sony.com
FOR RESIDENTS IN JAPAN:
If you have any questions about this Privacy Policy or you would like to exercise rights to disclosure, correction, etc., utilization cease about various information collected by Sony from you, please get in touch via the following.
* You may apply for disclosure, etc. about retained personal data.
FOR RESIDENTS IN OTHER COUNTRIES OR REGIONS:
If you have any concerns about how we process your data, you can find our contact details below or on the website of your local Sony Group Companies at:
The US and Canada: privacy@am.sony.com
For Mexico, Central and South America and the Caribbean:
Regional Latin American Privacy Office at https://www.sony-latin.com/corporate/SOLA/home.html
Africa, Middle East: https://www.sony-mea.com/en/locale-selector
Asia & Oceania: https://www.sony-asia.com/locale-selector
