This Tuya Data Processing Addendum (hereinafter the “Addendum”) forms part of Tuya's Terms of Use (the “Agreement”) between Tuya entities or their affiliates (hereinafter “Tuya”) and the Customer, covering the Customer’s use of Tuya products and services. Under the Agreement, Tuya provides certain products or services (the “Services”) to the Customer, and this Addendum is incorporated by reference into the Agreement. Where Tuya processes Customer Data that is subject to applicable data protection laws, the provisions of such local data protection laws shall govern Tuya’s processing of that Customer-Controlled Data. In the event of any conflict between the provisions of this Addendum and the applicable local data protection laws, the provisions of the local laws shall prevail.
1. Data Processing
Scope and Roles: This Addendum applies where Tuya processes Customer Data. In such cases, Tuya will act as a Processor or Sub-processor, depending on the Customer’s role: if the Customer is a Controller, Tuya acts as a Processor; if the Customer is a Processor, Tuya acts as its Sub-processor. Where the Customer acts as a Processor, the Customer represents and warrants that its instructions to Tuya (including the appointment of Tuya as a Sub-processor) have been duly authorized by the relevant Controller.
Subject Matter: The subject matter of the data processing under this Addendum is Customer Data, limited to the performance of contractual obligations between the Customer and Tuya.
Duration: The duration of the processing activities shall follow the Customer’s instructions and the terms of the DPA, and shall continue until the Customer Data is returned or deleted as agreed in this Appendix.
Nature and Purpose: The nature and purpose of the processing are to provide products and services in accordance with the Customer Agreement.
For purposes of this Addendum, “provision” of products includes:
· delivering the functionalities licensed, configured, and used by the Customer and its users;
· troubleshooting (prevention, detection, and resolution of problems); and
· keeping the products up-to-date and in good working order, improving productivity, reliability, efficiency, quality, and security.
For purposes of this Addendum, “provision” of professional services includes:
· delivering professional services, including IoT cloud platform services, deployment, and solution/software development services; and
· troubleshooting (prevention, detection, investigation, mitigation, and resolution of problems, including security incidents, as well as issues identified in the course of maintaining professional services or related products).
Types of Customer Data: Customer Data uploaded to the Services through the Customer’s developer platform account.
Categories of Data Subjects: End users and end consumers of the Customer. As shown in the table below. The specific categories of personal data processed depend on the features and configurations enabled by the Customer.
Data being processed | Purpose of the processing | Retention Policy |
|---|
- Identity Information: nickname, unique account identifier, profile picture or avatar - Contact Information: email address or phone number (if applicable) - Location Information: country/region, time zone - Authentication Credentials: password (stored in encrypted form) - Mobile Device Information: including device model, login IP address, wireless connection information, operating system type and version, App version, push notification identifier, and mobile network information (used for identity verification, account security, and prevention of abuse) - Language Preference | Account creation, identity and access management | - Retained until the user deletes the account - Inactive account deletion: not deleted by default; the Customer may configure deletion policies(e.g., after 1 or 2 years) |
- Home Name - Home Location (approximate location) - Room Name | Home management | - Retained until the user deletes the home or deletes the account |
- Device Basic Information: device name, device ID, MAC address, online status, activation time, firmware version, upgrade information, Bluetooth information, IP address, etc. - Device Configuration Information - Smart Device Logs (for troubleshooting) and Notification Messages - Approximate Location (for weather display) - Precise Location (if applicable): for automated control of devices based on proximity to the home; travel-related devices may record travel routes (only collected when relevant features are enabled) - Health Data (if applicable): including height, weight, heart rate, BMI, body fat percentage, etc. - Robot Vacuum Maps (if applicable) | Smart device management | - Device basic information and configuration information: retained until the user deletes the device or deletes the account - Smart device logs: 7 days - Notification messages: 30-180 days - Health data / location data: retained until the user deletes the data or deletes the device or account - Robot vacuum maps: 180 days |
AI Interaction Data (if applicable): - User Input: voice, text, images, videos - AI-Generated Content: voice, text, images, videos | Providing AI functionalities | - Voice: not retained - Text: 365 days - Images/Videos: 7 days - AI-generated content: 180 days |
IPC Images / Audio/ Video (if applicable) | IPC images/audio/video alerts and cloud storage services | - IPC images/video alerts: 30 days - Video/audio footage stored on cloud: 7 / 14 / 30 days depending on the user's subscription plan |
Customer Support Data: such as inquiry records and troubleshooting records | Technical support and troubleshooting | Retained for a reasonable period after issue resolution (e.g., 2 years) |
Transaction Data: order ID, amount, name of commodity, quantity, currency | Purchase of products or value-added services | 10 years (retained in accordance with applicable tax and financial legal requirements) |
2. Customer Instructions
Tuya shall process Customer Data in compliance with applicable laws and regulations, and in accordance with the Customer’s written instructions, this Appendix, and the Contract. The scope of Customer Data processing shall be defined by the Contract, as well as by the Customer’s and its authorized users’ use and configuration of the Service functionalities (where applicable). The Customer may lawfully provide Tuya with further written instructions (hereinafter referred to as “Additional Instructions”); such Additional Instructions must be mutually agreed in writing in advance and may involve additional costs to be borne by the Customer.
The Customer shall ensure that all instructions it issues to Tuya comply with applicable data protection laws. If the Customer itself acts as a processor on behalf of another controller, it shall ensure that it has obtained the necessary authorization from that controller to appoint Tuya as a sub-processor and to issue instructions to Tuya.
If Tuya considers that an Additional Instruction violates applicable data protection laws, it shall promptly notify the Customer. In such case, the Customer shall have the right to withdraw or amend the instruction.
3. Confidentiality
Tuya shall not access, use, or disclose any Customer Data to any third party, except as necessary to maintain or provide the Services, or to comply with applicable laws or valid and binding orders of governmental authorities (such as subpoenas or court orders). If a third party requests access to Customer Data from Tuya, Tuya will make reasonable efforts to direct the third party to request such data directly from the Customer. Tuya will not respond to any such request without the Customer’s prior consent, unless required to do so under applicable law. In cases where Tuya is legally required to respond, Tuya shall promptly notify the Customer and provide a copy of the request on a minimization basis, unless prohibited by law from doing so.
Tuya strictly limits the processing of Customer Data by unauthorized personnel and imposes appropriate contractual obligations on its personnel, including confidentiality, data protection, and data security requirements. All employees authorized to process Customer Data are bound by confidentiality commitments and shall not use such data for any other purpose
4. Sub-processors
Sub-processors provide cloud hosting, data storage, and technical support services for IoT applications. The nature of the processing includes hosting, storing, transmitting, and maintaining personal data in accordance with the Customer’s written instructions, for the purpose of supporting the normal operation of IoT applications and service delivery. The processing period shall be the duration of the Customer’s use of the Services and any retention period specified in the agreement between the Customer and Tuya.
The Customer hereby grants Tuya a general authorization, subject to this Section, to engage the Sub-processors listed in the List of Data Sub-processors to process Customer Data on the Customer's behalf. Tuya shall notify the Customer at least thirty (30) days prior to any change of Sub-processors. If the Customer does not object within such period, the engagement shall be deemed authorized. In the event of an objection, the Customer may:(i) terminate this Addendum in accordance with the terms of the Agreement;(ii) cease using the services provided by the Sub-processor engaged by Tuya; or(iii) migrate the relevant Customer Data to another region where Tuya has not engaged such Sub-processor. Tuya shall limit Sub-processor access to Customer Data to what is strictly necessary to provide or maintain the Services in accordance with the Agreement. Tuya shall enter into a written agreement with each Sub-processor and, where the Sub-processor performs the same data processing services as provided by Tuya under this Addendum, Tuya shall impose the same contractual obligations on the Sub-processor as Tuya assumes under this Addendum. Tuya shall remain responsible for compliance with its obligations under this Addendum and shall be liable for any acts or omissions of its Sub-processors that cause Tuya to breach any of its obligations hereunder.
5. Assistance with Data Subject Requests
In the event that a data subject submits a request to exercise their rights, a complaint related to such rights, or any other communication directly or indirectly related to the processing of personal data, Tuya shall promptly provide the necessary cooperation and assistance to support the Customer in fulfilling its obligations under applicable laws and the Agreement. If Tuya receives a request from a data subject, Tuya shall direct the data subject to submit the request directly to the Customer. The Customer shall be responsible for responding to any such request, including, where necessary, by using the features and functionalities of the Products and Services. Tuya shall comply with the Customer’s reasonable requests to assist in responding to such data subject requests.
6. Data Retention and Deletion
At any time prior to the termination date of the Services and within ninety (90) days thereafter, Tuya shall, at the Customer’s request and subject to the terms and conditions of this Addendum, return or delete Customer Data. Ninety (90) days after the termination of the Services, Tuya will delete or anonymize the relevant Customer Data. Note: The above data deletion operations are irreversible.
7. Data Security
7.1 Data Security Policies
Tuya implements comprehensive technical and organizational measures to ensure the security and compliance of Customer Data throughout its entire lifecycle. Key measures include (detailed measures are described in Annex I–Technical and Organizational Measures):
a) Data Encryption
· In-Transit Encryption: Customer Data transmitted over networks is protected by TLS 1.2/1.3 encrypted channels combined with AES content encryption to prevent unauthorized interception or disclosure.
· At-Rest Encryption: Customer Data stored at rest is encrypted using AES-256. Tuya employs a centralized Key Management System (KMS) for the unified management and distribution of encryption keys.
b) Access Control
· Tuya enforces the principle of least privilege and role-based access control (RBAC) to strictly limit access to Customer Data.
· Access is permitted only when necessary to perform processing tasks, subject to management authorization, and granted on a temporary and auditable basis.
· The platform supports two-factor authentication (2FA) to provide an additional layer of protection for Customer Data.
c) Data Integrity and Monitoring
· Measures are in place to ensure data integrity during transmission and storage, including digital signatures and checksum validation.
· Tuya maintains continuous monitoring and auditing of the Customer Data processing environment, including access logging, intrusion detection, regular vulnerability scans, and penetration testing, to promptly identify and mitigate potential risks.
d) DataPseudonymization
· Tuya applies pseudonymization measures to user data. Within the platform, each user is assigned a unique userID, and the platform relies solely on this userID for data retrieval and processing. Direct identifiers such as email addresses or phone numbers are not used, thereby reducing the risk of direct identification and enhancing data security.
7.2 Customer Responsibilities
The Customer acknowledges that the Services include certain features and functionalities that the Customer may elect to use, which may impact the security of Customer Data processed as a result of the Customer’s use of the Services, including, without limitation, the availability of multi-factor authentication on Customer accounts.The Customer is solely responsible for independently determining whether the Products and Services meet its requirements, including any security obligations under applicable Data Protection Requirements.The Customer acknowledges and agrees that, considering the state of the art, implementation costs, the nature, scope, context, and purposes of the processing, and the risks to individuals, Tuya’s security practices and policies provide a level of security appropriate to the risk associated with the processing of Personal Data.
7.3 Security Certifications and Audits
In addition to the information contained in this Addendum, and subject to a mutually executed non-disclosure agreement (NDA), Tuya may provide the following documents and information upon the Customer’s request:
· Privacy Certifications and Assessments: ISO 27701 Privacy Information Management certification, EU GDPR verification report, California CCPA verification report, Canada PIPEDA assessment report, and India DPDPA assessment report.
· Cybersecurity Certifications and Audits: ISO 27001 certification, ISO 27017 certification, CSA STAR certification, and System and Organization Controls (SOC) 2 and SOC 3 reports.
7.4 Customer Audits
If Customer’s audit requirements under applicable Data Protection Requirements cannot reasonably be satisfied through Tuya’s general audit reports, documentation, or compliance information, Tuya will promptly respond to additional audit instructions from the Customer.Before initiating an audit, the Customer and Tuya shall mutually agree on the scope, timing, duration, control and evidence requirements, and cost. Such audits shall be conducted during normal business hours by an independent third-party audit firm holding appropriate certifications, with reasonable prior notice to Tuya, and subject to reasonable confidentiality obligations.
Neither the Customer nor the auditors shall access data of Tuya’s other customers, nor access Tuya systems or facilities unrelated to the applicable Products and Services. The Customer shall bear all costs and expenses associated with such audits, including reasonable costs and expenses incurred by Tuya for time spent on such audits, except where costs are directly attributable to Tuya’s provision of the Services.
If an audit report generated by the Customer reveals any material breach, the Customer shall share such report with Tuya, and Tuya shall promptly remediate any identified material non-compliance.
Nothing in this section shall alter the terms of the GDPR or affect the rights of supervisory authorities or data subjects under applicable Data Protection Requirements.
8. Data Transfers and Location
8.1Data Transfers
For Transfers from the EEA, UK, and Switzerland:
Transfers of Customer Data outside the European Economic Area (EEA), the United Kingdom, and Switzerland for the purpose of providing the Services shall be governed by the European Commission’s 2021 Standard Contractual Clauses (“SCCs”). These SCCs are hereby incorporated by reference into this Addendum to ensure that all applicable cross-border data transfers are subject to safeguards that comply with applicable data protection laws. Where non-European Tuya affiliates are involved or where the Customer accesses European-hosted data remotely from outside Europe, such access shall be deemed a data transfer and shall be governed by the SCCs.
Where the Customer acts as a Controller, the Controller-to-Processor SCCs shall apply; where the Customer acts as a Processor, the Processor-to-Processor SCCs shall apply. Tuya implements and maintains the security measures set forth in Annex I of the 2021 SCCs to protect Personal Data within the scope of the GDPR. For Transfers from Brazil:
To the extent the processing of Customer Data is subject to the Brazilian General Data Protection Law (Law No. 13,709/2018 - "LGPD") and is transferred outside of Brazil to a jurisdiction not recognized by the Brazilian National Data Protection Authority ("ANPD") as providing an adequate level of data protection, such cross-border data transfers shall be governed by the standard contractual clauses approved by the ANPD ("Brazilian SCCs").
Where the Customer acts as a Controller, the Brazilian SCCs applicable to Controller-to-Processor transfers (provided in both English and Portuguese) shall apply; where the Customer acts as a Processor, the Brazilian SCCs applicable to Processor-to-Processor transfers (provided in both English and Portuguese) shall apply. Tuya implements and maintains the security measures set forth in the applicable Annex of the Brazilian SCCs to protect Personal Data within the scope of the LGPD. 8.2 Data Location
Customers may designate data centers where Customer Data is stored and processed, including data centers located within the European Economic Area (EEA). For EU/ECC users, Customer Data will only be stored in the Frankfurt, Germany or Eemshaven, Netherlands data centers.
9. Security Incident Notification
9.1 Security Incidents
If Tuya becomes aware of any activity that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data processed by Tuya (each, a “Security Incident”), Tuya shall, without undue delay:
1. Notify the Customer of the Security Incident;
2. Investigate the Security Incident and provide the Customer with detailed information regarding it; and
3. Take reasonable steps to mitigate the effects of and minimize any damage resulting from the Security Incident.
Security Incident notifications will be provided to the Customer by any means chosen by Tuya, including by email. The Customer is solely responsible for ensuring that Tuya is provided with accurate contact information.
9.2 Notification Obligations
If Tuya notifies the Customer of a Security Incident, or if the Customer otherwise becomes aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data, the Customer shall be responsible for determining whether notification or other obligations apply under applicable data protection laws, and for fulfilling those obligations. Tuya shall take reasonable measures to assist the Customer in complying with its obligations to notify the relevant supervisory authorities and data subjects of such Security Incident in accordance with Articles 33 and 34 of the GDPR and any other applicable laws and regulations.
10. How to Contact Tuya
If Customer believes that Tuya has not complied with the privacy or security commitments under this Addendum, Customer may contact Tuya using the following details:
Contact Address
Tuya Smart Inc.
333 West San Carlos Street, Suite 600
San Jose, CA 95110
EU Representative Contact Address (as required under Article 27 GDPR)
Tuya GmbH (acting as Tuya’s representative in the European Economic Area)
Peter-Müller-Straße 16/16a
40468 Düsseldorf, Germany
Customer may contact Tuya’s privacy representative through the above addresses or via privacy@tuya.com. 11. California Consumer Privacy Act (CCPA) Addendum
If Tuya processes Personal Data within the scope of the CCPA, Tuya makes the following additional commitments to the Customer. Tuya shall process Customer Data on behalf of the Customer and shall not retain, use, or disclose such data for any purpose other than those set forth in this Addendum and as permitted under the CCPA (including any “sale” exemptions). Under no circumstances shall Tuya sell any such data. These CCPA provisions do not limit or diminish Tuya’s data protection commitments made to the Customer under the Data Processing Addendum, Product Terms, or any other agreement entered into between Tuya and the Customer.
12. Definitions
The following terms used in this Addendum shall have the meanings set forth below:
· “Customer” Refers to Tuya’s OEM/ODM App customers and SDK customers.
· “Customer Data” means the personal data stored under the Customer’s account on the Tuya Developer Platform and related to the use of the Services, including personal data received by Tuya on behalf of the Customer, such as personal data in OEM/ODM Apps and SDKs.
· “Applicable Data Protection Laws” means all laws, statutes, regulations, rules, ordinances, decrees, standards, and other similar legal instruments or legislation applicable to the processing of Customer-Controlled Data, as amended, consolidated, re-enacted, or replaced from time to time, including the GDPR.
· “Controller” has the meaning given under the GDPR.
· “Personal Data” means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
· “Sub-processor” means any other processor engaged by Tuya to process Customer Data, Professional Services Data, or Personal Data, as described in Article 28 of the GDPR.
· “EEA” means the European Economic Area.
· “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation).
Annex I Technical and organizational measures
Measures ofpseudonymisationand encryption of personal data
| Encryption for Personal Data | Encryption Method |
|---|
| encryption in the product device end | AES128 |
| encryption in the APP end | AES256 |
| encryption in the cloud storage | AES256 |
| for Camera devices | images: AES128 |
| video streams: AES128 and I frame | |
| encryption in the transmission | TLS1.2 for the communication channel;AES128 for the data itself in the transmission |
Measures for Ensuring Ongoing Confidentiality, Integrity, Availability and Resilience of Processing Systems and Services
Measures for Ensuring the Ability to Restore Data Availability and Access
Data Backup PolicyElectronic backup is a mandatory requirement so that data and application programs can be restored when an incident impacting the integrity of such data may occur. This Policy applies to information resource installation and support personnel, personnel who are responsible for information resource security, and data owners. Implementation of this Policy may effectively reduce various threats to prevent core data loss and hardware faults, so as to ensure data integrity and availability.
Processes for Testing, Assessing, and Evaluating Security Measures
The Security Risk Assessment with Privacy ConsiderationsIt is a process to ensure the security assessment have been conducted with a project initiation, once any risk identified, the security team will tackle the risks before release.
Measures for User Identification and Authorisation
In internal systems, the SSO is implemented, with the changed password upon the registration of a new user. Once the user logs in the internal system, the user may use the 8-character password with a 6-digits dynamic code.
Measures for Ensuring Physical Security of Locations at Which Personal Data Are Processed
Clean Desk PolicyEmployees are not allowed to place sensitive information files on the desktop directly. Employees shall keep the desk tidy and keep the work-related materials classified and stored properly.
Safe StorageWhen contacting third-party personnel, necessary protective measures should be taken to prevent sensitive information assets from being accessed by outsiders. When employees leave the office for a long time or off duty, employees need to store sensitive documents and removable storage media in a lockable cabinet.
Computer Screen Clearing & Lock ScreenFor all terminal computers, including desktops and laptops, employees are responsible for clearing sensitive information related to the company's business on the desktop screen. When leaving the office computer, employees must lock the screen of the operating system and start a screen saver with a password (starting time should not exceed 5 minutes) to ensure that other personnel cannot operate the system.
Control of Office Equipment (printers, copiers, fax machines, voice messages, etc.)Sensitive information processing office equipments (e.g., copiers, fax machines, etc.) must be placed in a special print area. Shredding machines must be placed in the public print area for employees that need to destroy discarded sensitive files, reducing the risk of sensitive information leakage.When printing, copying or faxing documents involves non-public information (top secret, confidential and secret), the employee should pay close attention to the operation of the equipment, and promptly retrieve all documents from the equipment.If the equipment fails while processing the company’s sensitive information, the employee should not leave the equipment until the data is removed or cleaned up.All printing tasks must be log archived if technically feasible, and the administrator shall generate a print log report every month and submits it to each department head for audit.
Office Environment MonitoringThe entrances and exits of the office building and the entry and exit of people in key corridors should be monitored, and surveillance videos should be stored. The retention period of the video shall not be less than 7 days. The monitoring cycle is 7*24 hours. The request of the video recording needs to be approved.
Miscellaneous Security Measures
· Employees are not allowed to conduct confidential meetings in public places, open offices, and conference rooms.
· After meeting, the whiteboard in the meeting room should be wiped clean in time, and the projector should be turned off. All items brought into the meeting room should be taken away to prevent the leakage of sensitive information.
· For visitors, it is strictly forbidden to touch and use any facility and items in the employee's work area without permission, including documents, desktop computers, network cables, telephones, etc. The reception staff are obliged to inform and supervise, report, and stop related behaviors in advance.
· Fire fighting equipments must be deployed on each floor and each office at fixed locations. Administrative department must check the effectiveness of the fire-fighting equipment on a monthly basis.
· For external visitors, personnel from relevant business departments must personally pick up the visitors and register at the reception desk. Administrative department has the right to inspect suspicious objects brought out by leaving personnel. Employees need to wear work badges in the office area. If the employee badge is not worn, Administration department shall control his/her entry and exit according to the requirements of third-party personnel.
· Office must be promptly locked in off-hours and Administration Department will patrol and check.
· Information Security Department organizes Human Resources, Information Systems Department, Security Department, Administration Department and other departments conduct on-site inspection of office environment on a monthly basis.
· All express mails should be delivered to the designated reception office. The mails must be signed by the owner in principle. In circumstances of signed for by another person, then the person must sign his/her name in the receive and dispatch record book.
Measures for Ensuring Events Logging
Log management are documented from four perspectives:
· Application System Logs
· Operating System Log
· Database Log
· Network and Security Log
The general operation information, including user login and exit, operating system startup and termination, and daily operations will be recorded.The warning information, including system service or configuration change information, privilege permission operation information, manual modification, addition, and deletion of sensitive operations to the system, and key operations that are automatically processed by the system.The error information, including fatal errors that affect the normal operation of the system, as well as system operation alarms and fault information.The logs will be recorded and reviewed periodically and assessed, at least on a quarterly basis.
Measures for Certification/Assurance of Processes and Products
Change Management Security PolicyThis Policy manages changes in a reasonable and predictable way to allow employees and customers to plan accordingly. Changes shall be planned strictly, monitored carefully, tracked, and assessed to reduce adverse impact on user groups and increase the information resource value. This Policy consist of 3 parts: system change, database change, and internal R & D project change. It also sets forth necessary processes to internally review and approve of such changes before execution.
Measures for Ensuring Data Minimisation
The Security Risk Assessment with Privacy ConsiderationsIt is a process to ensure the security assessment have been conducted with a project initiation, once any risk identified, the security team will tackle the risks before release.
Privacy Impact Assessment (PIA)The data collection process will be assessed through a PIA and the principle of data minimisation will be addressed during the assessment.
Measures for Ensuring Limited Data Retention
Data will be managed at the least retention period according to relevant data protection laws and regulations. Once the deletion process begins, the data will be removed automatically.
Measures for Ensuring Accountability
The accountability is set out in the Service Agreement or DPA as agreed with the data exporter.
Measures for Allowing Data Portability and Ensuring Erasure
The data portability can be fulfilled when the customer requested, the data importer will provide API for the customer or the parties designated by the customer, after that the data will be removed with a written notice confirming the removal.
Measures for Transfers to (Sub-)Processors
Specific technical and organisational measures to be taken by sub-processors to assist the controller, and for transfers from a processor to a sub-processor, to the data exporter include:
· Secure cloud service
· Industry recognized security standards (AES and TLS encryption)
· Multiple desensitization
· Access control for data importer, data exporter, and data subprocessors
· Security management for IT systems relating to data processing activities
· Data backup management
· Procedures for handling data subjects requests