Xooloo SAS (“Xooloo”) understands privacy is very important for our users and we take special precautions to protect the privacy of our youngest users. Xooloo Messenger is a Service from Xooloo that helps children communicate with family and friends. This Children’s Privacy Policy applies when Xooloo collects personal information from children under 13 (“Child Users”) in our apps or other services that link to this policy. All defined terms in this Children’s Privacy Policy shall have the same meaning as defined in the Privacy Policy.

Xooloo does not knowingly collect personal information from children under the age of 13 without the consent and at the direction of a parent or legal guardian. Xooloo permits parents to set up child profiles associated with parent accounts via the Service or at www.xooloo-messenger.com/parent, so that children may access the Service under the parent or legal guardian supervision. We endeavor to only collect as much information as is reasonably necessary for the child to use the Service and to ensure that parents or legal guardians have access to and control of their child’s use of the Service. This Children’s Privacy Policy applies to all Child Users of the Service. To learn more about our general privacy practices that apply to parents and our other users, please refer to the Privacy Policy.

If we learn that personal information of a child has been collected on our Service without appropriate parental consent, then we will take appropriate steps to delete this information. If you are a parent or legal guardian and discover that your child under the age of 13 has a registered account with our Service without your consent, please contact us at dpo@xooloo.com and request that we delete that child’s personal information from our systems.

By creating or validating a Child User profile associated with a parent account and permitting your child to use the Service, you expressly agree to the practices described in this Children's Privacy Policy and you consent to the collection, use, and disclosure of your child's personal information as described herein. You can withdraw consent at any time by contacting us at dpo@xooloo.com and request that we delete that child’s personal information from our systems.

We collect personal information from Child Users in the following ways through their use of the Service:

• Child User Account Information Before Parental Consent. During registration, we collect the Child User’s first name, date of birth, animated avatar (Xavatar), and their parent or legal guardian’s phone number for us to obtain parental consent and provide the child access to their limited account on the Service. If the Child User opts-in to receive push notifications on their device, we also collect push token. We use this information to provide the Service to the Child User, to communicate with parents or legal guardians about their child’s account and activities, and for other purposes as described below.
• Child User Account Information During and After Parental Consent. During the parent validation process, we collect from parents or legal guardians the following information: child last name; and parent or legal guardian role (mother, father, other), first and last name, and email address. After such validation has been successfully completed, we may also collect any additional information from or about the Child User that they or their parent or legal guardian may provide, such as phone number, contact list (discussed below), school/class name, grade and school address, mailing address to receive goods, and wishlist items. We use this information to provide the Service to the Child User, to provide parents or legal guardians with appropriate controls for their Child User’s use of the Service, to communicate with parents or legal guardians about their child’s contacts, account and activities, such as account alerts and their child’s wishlist, and for other purposes as described below.
• Additional Information from Parent or Legal Guardian. We may collect the following information from parents or legal guardians: second parent or legal guardian first and last name, phone number and e-mail address; and parent or legal guardian contact list (discussed below). We use this information to provide the Service to the Child User, to provide parents or legal guardians with appropriate controls for their Child User’s use of the Service, to communicate with parents or legal guardians about their child’s account and activities, such as account alerts and their child’s wishlist, and for other purposes as described below.
• Information Collected Through Use of the Service. We collect the following types of information about the Child User’s use of the Service:
  • We collect any content and communications that the Child User shares or receives through the Service, including contacts (as described below), wishlist items, and the text and content of any messages with contacts or our automated chatbot, including text, audio recordings, photos, videos, links, and communications’ metadata (e.g., IP address, date and time stamps).
  • We collect information about the Child User’s activities and engagement with the Service, such as games/activities played, tools and features they use, including the time, frequency, and duration of activities on the Service. We may also collect additional information when accounts or messages are reported to Xooloo.
  • We collect information from the Child User if they contact Xooloo Support or fill out a survey/contact form on the Service.
  We use this information to provide the Service, provide access to the features and activities on our Service, customize content and track progress through the Service and to analyze, support and improve the performance of our Service, and for other purposes as described below.
   
• Information about Friends/Contacts & Device Contacts. We collect information from Child Users about their friends and contacts through the Service, such as their first and last name, selected avatar (Xavatar), Xooloo ID, phone number, email address, duration of Xooloo membership, date of birth, and other information the Child User may provide. We also collect metadata and other information about how they interact, such as friendship duration, account creation date, who invites whom, the feature used to invite (e.g., contact page, suggestion from Xooloo or from parent), and friendship status (e.g., blocked). With their permission, we also collect a Child User’s or parent or legal guardian’s device contacts, so they may invite friends and contacts to the Service. You may control the Services’ access to your device information at any time through the “Settings” (or similar) application on your mobile device. Child Users can invite friends to the Service using a friend’s Xooloo ID, mobile phone number, or email address and can view friends who belong to the same group or school as them, or friends who are already Xooloo users or not when they share their device contacts. Xooloo can also suggest contacts to invite based upon child device contact list when shared, child phone number when provided by the child, and parents contact lists when shared.
  We may inform parents or legal guardians who have a Xooloo account and have shared their contact list if another parent who belongs to their contact list has a Xooloo account and a child registered on Xooloo (we will not disclose the name of the child). Parents or legal guardians can also select contacts from their device contact list to invite to the Service or to suggest the Child User to invite. In addition, Xooloo may suggest to parents or guardians who have shared their contact list potential contacts that the parent or guardian may wish to suggest to the Child User. Parents or legal guardians may control the Services’ access to their device information through the “Settings” (or similar) application on their device.
• Location Information. When you search for a school on the Service, we may collect geolocation data such as latitude and longitude via mobile device sensors. We collect this type of data if you grant us access to your location through your device. You can remove our access at any time through your mobile device settings. We may also derive your approximate location from your IP address.
   
• Device Information. We automatically collect usage information as well as information about the device and network used to access the Service. For example, we may collect an IP address or a partial IP address, location when shared, browser type, language preferences, VOIP token, device name, OS Version, screen resolution, time zone, device local, build model and build manufacturer, device messaging availability, available camera, device authentication token, random install ID, IP address, crash report and other information about the device used to access the Service, such as the device type, model and manufacturer. We also collect usage information such as the day/time stamp, pages viewed, and similar information. This information may be typically collected through cookies or mobile SDKS or similar technologies. We use this information to operate, maintain and provide the features and functionality of the Service, and to develop and improve our Service.
   

We use the information we collect for the following purposes and as otherwise described above:

• To provide the Service and its services and enable Child Users, parents or legal guardians, and other Service users to connect and communicate, including facilitating invitations to the Service and sending messages and other communications.
• To personalize the experience, including personalization of product features and recommendations (such as wishlist items).
• To improve our Service and for other internal business purposes, such as evaluating and enhancing the Service, improving the Service and troubleshooting.
• To communicate with parents or legal guardians, and Child Users, such as when we receive a contact inquiry, provide updates on Child User activities and send information about our policies, terms, and practices.
• To help maintain the safety, security, and integrity of the Service, technology assets, and our users.

We may use human review, automated systems and/or machine learning to accomplish the functions and activities listed in this section.

We may share or disclose a Child User’s personal information to third-parties in the following instances:

• With the Child User’s approved contacts and their parents or legal guardians on the Service. The Child User’s first and last name, animated avatar (Xavatar), Xooloo ID, date of birth, date of account creation, membership duration, school/class name, grade, games/activities ranking are visible to and shared by default with a Child User’s approved contacts on the Service. The Child User’s approved contacts on the Service also see any content the Child User shares with them (e.g., via messages/chat). This includes audio, photos, videos, links, wishlist items, status, and any content shared or visible during the communication. The following information is shared with/visible to parents or legal guardians of the Child User’s approved contacts: first and last name, animated avatar (Xavatar), age, parent or legal guardian first and last name.
• With other Xooloo users (in limited instances). When a Child User provides Xooloo access to their device contacts, the Child User may see who among their device contacts list are Xooloo users (in order to invite them as an approved contact). In this case, Xooloo will only share whether or not the Child User contact is a Xooloo user. Further, certain Child Users’ information (first and last name, animated avatar (Xavatar), age and date of birth) may be visible to the parents or legal guardians for non-approved Child User contacts in groups chats to which they belong.
• With the Child User’s parents or legal guardians. We share Child Users’ information and activities (such as contacts list, wishlists, and profile information) with the parent account associated with the Child User. Parents are informed by email of the Child User’s new contacts once an invitation sent by the Child User or received by the Child User has been accepted. Parents or legal guardians are also informed of people who belong to the same group chat of their Child User but are not approved contacts of their Child User. We inform parents that have shared their contact list if a parent in their contact list has a Xooloo account or has a child registered on Xooloo.
• With third party vendors, service providers, contractors or agents who perform services and functions to us on our behalf and who are subject to confidentiality and security obligations.

We may also share their personal information if we have a good faith belief that access to or disclosure of such information is reasonably necessary to (a) satisfy any applicable law, regulation, legal process, judicial proceeding, or enforceable governmental request; (b) enforce applicable Terms of Use, including investigation of potential violations thereof; (c) detect, prevent or otherwise address fraud, security or technical issues; (d) protect the rights, property, or personal safety of Xooloo, its users, or the public; or (e) as required or permitted by law. If Xooloo is involved in a merger, acquisition, bankruptcy, change of control, or any form of sale of some or all of its assets. In this case, personal information may be transferred or disclosed in connection with the business transaction, subject to any applicable laws. We may also use and share de-identified or aggregated information in a manner that cannot be reasonably used to identify an individual user.

We do not permit third parties to collect personal information from or about our Child Users over time for the purpose of serving targeted advertising on our Service or on other websites, services or mobile applications that are directed to children and families. We do work with some third-party partners to collect data (typically through cookies, mobile SDKs or similar technology) through our Service for purposes of providing analytics, fraud detection, A/B testing, and some advertising services, but we take certain steps designed to limit the amount of data they can collect from Child Users.

At any time, parents or legal guardians may revoke their consent provided, refuse to allow us to further collect or use your child's personal information, and direct us to delete your child’s personal information by contacting us at dpo@xooloo.com. You may also cancel your child’s account at any time by accessing your parent section within the Service or the webpage https://xooloo-messenger.com/parent/.

Parents or legal guardians may review the information collected from their Child User(s) at any time by logging into the parent section of the Service or the webpage https://xooloo-messenger.com/parent/. You may also contact us at dpo@xooloo.com to fulfill this request.

Before we make material changes to our data collection, use, or sharing practices as reflected in this Children’s Privacy, we will notify parents or legal guardians so they have the opportunity to review the changes before they go into effect for the Child User.

If you have questions about this Children’s Privacy Policy, please contact us at:

Xooloo SAS 20 rue Danielle Casanova, 75002 Paris, France dpo@xooloo.com Tel: +33 1 42 86 00 00