Privacy Notice from Burda:ic GmbH

We, Burda:ic GmbH, Arabellastrasse 23, 81925 München (Munich, Germany) (referred to in the following as "Burda:ic"), take privacy and the protection of personal data very seriously. We would like you to know when we store which data, and how we use the data. In this process, we naturally strictly comply with the statutory provisions on privacy and data protection, which are derived for us particularly from the Bundesdatenschutzgesetz (BDSG, German Federal Data Protection Act) and the Telemediengesetz (TMG, German Telemedia Act).

1. What is personal data?
The term “personal data” refers to all information that makes any statements about a person who is or can be identified, and consequently means name, occupation, age, etc., for example. This term does not encompass anonymized information that can no longer be matched to any specific person, such as statistics regarding patterns of use.

2. Why do we collect and process personal data?
You can generally visit our online offer without providing us with personal data. Should you, however, want to use the Sanriotown portal ("Portal") or participate in the Hello Kitty online game ("HKO Game"), we need certain data from you.
The data collected during your registration for the Portal and for participation in the HKO Game help us to offer you the best service possible (for example, the offer in the correct language, features specific to your country, etc.), to contact you if necessary, to verify your age, to individualize you in order to be able to assert our claims against you, and to ensure that we can make it possible for public authorities and/or private third parties to contact you in the event of violations of the law or the rules.

3. Which data do we collect and save?
Data for security purposes are stored automatically on our servers in association with each of your accesses to our Portal; for example, such data include IP address, date, time of day, originating Web site and pages viewed on our Web server. We cannot match these data to particular people. These data can be matched to you, however, if combined with data from third parties, such as your Internet access provider. For our part, we do not conduct any such data fusion, however. The stored data are deleted after six months.
When you register on the Portal or the HKO Game, we collect and store the following data:

• The account name that you have selected for yourself
• Your last name
• Your first name
• Your date of birth
• Your gender
• The country in which you are living
• Your e-mail address

You can also voluntarily enter additional data into your Portal profile and into your HKO Game profile. For your own protection, we recommend that you do not enter any data that would allow any individualization or contact outside the communication channels that we offer.

If you would like to take advantage of special services that are subject to a charge, or if you would like to purchase "Cash Points" for the HKO Game, additional data must be collected for the invoicing, in particular:

• Invoice address
• Telephone number in case questions arise
• Bank data

If you use your Hello Kitty e-mail account, we are required by law to collect the time of day and date, the ID of the mail boxes and the IP addresses of those involved when you send, receive and retrieve emails, and to store this information for six months.

4. How do we protect your data?
We have adopted technical and organizational measures that ensure that the regulations regarding privacy and data protection are observed, both by us and by external service providers who work for us.
Your information is stored on specially protected servers. Only specially authorized people who are involved in the technical, business or editorial maintenance of the servers and the Portal can access these servers.

5. How do we process and use your data?
We process and use the data that you entered when you registered for the Portal for the following purposes:

• We set up your user account and assign you an account name of your choice, with corresponding password, under which you appear at sanriotown.com.
• We set up an avatar for you for your participation in the HKO Game; you can name this avatar and appear in the HKO Game under this name.
• We set up an e-mail account for you with an e-mail address and allow you to use this e-mail account for sending and receiving e-mails.
• We make it possible for you to use all features at sanriotown.com that are available free of charge in your language (provided it is available), while taking into account any special circumstances there may be in your home country.
• We make it possible for you to use additional features, available for a charge, if you have decided to do so.
• We make it possible for you to purchase Cash Points so that you can purchase virtual objects in the HKO Game.
• We send you administrative newsletters and, provided that you consented to it at the beginning and have not since withdrawn your consent, promotional electronic newsletters.
• We use the data collected for security purposes to protect our Web site from destructive accesses and from disruption of the functions, to protect the users from fraud or other criminal offences, to ensure the protection of children and young people, to ensure reputation protection and to uncover and resolve criminal offences and other breaches of the law.
• We use usage data from you in order to make it possible for you to participate in the HKO Game and to credit you with Loyalty Points.
• We fulfil our legal obligation to store data in the event that you use our e-mail service.
  You can withdraw your consent to the sending of electronic promotional newsletters at any time here, effective for the future.

6. Do we pass your data on to third parties?
We convey your data to our service provider, Outblaze Ltd. (1117 E. Putnam Ave 337, Riverside, CT 06878, USA), on whose servers the data is stored on our behalf. We furthermore convey your data to Sanriotown Digital Europe SPRL, Chaussée de Gand 1150, 1082 Berchem-Saomte-Agathe, Belgium, and to Sanrio Digital Ltd., 100 Cyberport Road, Cyberport 2, Hong Kong, who carry out parts of the data utilizations listed above on our behalf. Outblaze Ltd. (Unit 1106-08, Cyberport 2, 100 Cyberport Road, Hong Kong) furthermore provides the e-mail service for us. The three companies named above also exchange data among themselves for the aforementioned purposes. All three companies are obligated to comply with strict data protection and privacy standards and they strictly abide with these specifications. The data passed to and among the participating companies is always restricted to the minimum required in order to carry out our services.

We furthermore convey your data to public bodies or private third parties authorized to receive such information if and to the extent we are obligated or become obligated to do so by law or court order.

The contributions to our blogs, forums, evaluation portals and chats, as well as the data you input into your profiles for the Portal and the HKO Game, are (read) accessible to all users. You should review your contributions carefully before making them public to ensure that you have not included any information that is not intended for the public. You must anticipate that contributions or data that you make publicly accessible will be recorded in search engines and be accessible globally, even without a specific call to our offer. It is often not possible to force foreign providers to delete or correct such entries.

When transmitting e-mails from your Sanriotown e-mail account, we generally transmit your first and last name to the receiver so that he or she can tell at a glance who has sent the e-mail. You can change this setting, however, at any time under "Europe.sanriotown.com > options > preferences" so that your first and last name are no longer shown to the receiver of your e-mails in the future.

Should the Permission for Use Contract that we have with you be transferred to a third party (for example, in the framework of the sale of the Web site and/or the services offered through Sanriotown.com), we shall convey to this third party the data that we have saved with regard to you in order to allow this third party to continue the Permission for Use Contract with you.
We do not pass your data on to third parties under any circumstances other than those mentioned above.

7. Right of revocation
You can revoke the general consent to the processing of your personal data that you granted when you registered at any time effective for the future. If you do so, however, technical conditions will then prevent you from using our offer.

8. Notice of termination and changing/deleting data that we have stored
If you give notice to terminate your Permission for Use Contract for the Portal, or if the contract is terminated for other reasons, we shall delete your User Account and the data stored there, or, we shall block your User Account and the data stored there if and for as long as a legal obligation to save the data applies and/or we have to keep certain data for accounting or invoicing reasons. We shall use these data only for these purposes, and shall store them only for the time period stipulated by law. After this time the data will be deleted.

9. Cookies
In some areas of our offer, we use cookies in order to control our services and target them to the users. Our offers can also be used without cookies, but in this case, not all functions can be used. Most browsers are set up so that they automatically accept cookies. You can deactivate the saving of cookies, however, or set up your browser in such a way that it notifies you as soon as cookies are sent.

10. Links to other Web sites
Our online offer contains links to other Web sites. We cannot influence the compliance of their operators with the privacy and data protection provisions.

11. Children and young people
People under the age of 18 years should not send any personal data to us without first obtaining permission from their parents or legal guardians. Those under 18 cannot use certain functions in our offer. This is why we ask for your date of birth when you register.

12. Contact for questions related to privacy and data protection
If you have questions, suggestions or comments on the subject of privacy and data protection, please send an e-mail to Burda:ic at datenschutz@burda-ic.com.
The rapid development of the Internet makes it necessary for us to revise our privacy notice from time to time. You can read the latest information regarding Burda:ic GmbH’s handling of personal data here at any time.

Version as of June 12th, 2009