Elephant Robotics Privacy Policy

This Elephant Robotics Privacy Policy (“Privacy Policy”) is applicable for Elephant Robotics and its related affiliates and subsidiaries globally (collectively referred to as “Elephant Robotics” or “we/us/our”). This Privacy Policy applies to all products, websites, and online services of Elephant Robotics, including but not limited to educational robots, professional robots, humanoid robots, AI Kits, Compound Robot Kits, Robotics Education Solutions, and the official website accessible at https://americas.elephantrobotics.com/, with primary applicability to users in the entire Americas region.

Elephant Robotics takes the processing of Personal Data seriously and ensures reasonable and transparent processing of Personal Data in accordance with all applicable laws, local and international regulations, including the European Union’s General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act (“CCPA”), the Personal Information Protection Law of the People’s Republic of China (“PIPL”), the Personal Information Protection and Electronic Documents Act (“PIPEDA”) of Canada, and other relevant regional privacy laws in the Americas. Elephant Robotics protects Personal Data and the privacy of individuals within all areas of its business in accordance with the terms of this Privacy Policy.

1. Personal Data and Data Subject

For the purposes of this Privacy Policy, “Personal Data” means any information relating to an identified or an identifiable natural person (a “Data Subject”). An identifiable natural person is one who can be identified, directly or indirectly, for example, by reference to a name, an identification number, contact information, or online identifiers.

Personal Data is generally categorized as either “Ordinary Personal Data” or “Sensitive Personal Data”. Sensitive Personal Data is always confidential and includes racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, health, and sexual orientation. We do not collect or process any Sensitive Personal Data in connection with our products and services unless explicitly required by law and with the prior express consent of the Data Subject (or their legal guardian for minors). Ordinary Personal Data is partially confidential, and includes but is not limited to name, contact information such as email and telephone number, company or school name, postal address, and payment details. We do not collect device serial numbers, product registration information, or website access data via cookies or similar tracking technologies.

This Privacy Policy applies to all Personal Data that Elephant Robotics collects and processes about individuals, including but not limited to visitors to the official website, customers (including educational institutions, schools, teachers, parents, and makers), minor users of educational products, and users of online services and curriculum platforms. Users may choose to submit Personal Data voluntarily, and failure to submit such information will not affect the ability to view product information on the website.

2. Data Controller

Elephant Robotics is the data controller (“Data Controller”) of the Personal Data covered by this Privacy Policy.

Contact details:

Elephant Robotics

Mailing Address: 5th Floor, CEC Plaza Building, No. 2070 Shennan Middle Road, Fuqiang Community, Huaqiangbei Street, Futian District, Shenzhen City, China

Telephone: +852 9597 0019

Official Website: https://americas.elephantrobotics.com/

Data Protection Team Email: service@elephantrobotics.com

Elephant Robotics has offices and service points in multiple regions around the world. Location and contact details of worldwide offices can be located on the “Contact Us” page of the official website. Elephant Robotics may share Personal Data with other companies and brands owned or controlled by Elephant Robotics (“Affiliates”), and in the event that Elephant Robotics shares Personal Data with Affiliates, the Affiliates’ use of such Personal Data is subject to this Privacy Policy. All Personal Data transfers, including cross-border transfers between Elephant Robotics and Affiliates, are made in compliance with applicable law. More information on data transfers can be found in Section 5 of this Privacy Policy.

3. Legal Grounds for Processing of Personal Data

Elephant Robotics may process Personal Data if one of the following options applies:

  • The Data Subject or their affiliated company has given prior consent to processing of its Personal Data for one or more specific purposes; note that under some legislation Elephant Robotics may be allowed to process Personal Data up and until an individual objects to such processing (“opt-out”), without having to rely on consent or any other of the following legal bases, though this does not apply when the processing of Personal Data is subject to European Data Protection laws;
  • Processing of Personal Data is necessary for the performance of a contract and/or for any pre-contractual obligations;
  • Processing of Personal Data is necessary for compliance with any legal obligations;
  • Processing of Personal Data is necessary to establish, exercise, or defend any legal claims;
  • Processing is related to a task that is carried out in the public interest or in the exercise of official authority vested in Elephant Robotics; and/or
  • Processing of Personal Data is necessary for the purposes of the legitimate interests pursued by Elephant Robotics or by a third party, if such interests are considered to override individual or company interests or fundamental rights. Such legitimate interests may include Elephant Robotics’ interests in developing, marketing, and selling products and providing services, including educational solutions, and pursuing and maintaining business relationships with customers, suppliers, partners, and other stakeholders.

Upon request, Elephant Robotics will provide information to clarify the specific legal basis that applies to specific processing activities, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

qWhere Personal Data is processed for a public interest, in the exercise of an official authority vested in Elephant Robotics or for the purpose of the legitimate interests pursued by Elephant Robotics, an individual may object to such processing by providing a ground related to the individual’s particular situation to justify the objection. However, if Personal Data is processed for direct marketing purposes, an individual can object to such processing at any time without providing any justification by contacting the Global Data Protection Team.

Notice of statutory or required processing. In cases where Elephant Robotics processes Personal Data based on a legal obligation or a requirement under a contract or a requirement that must be met in order to enter into a contract, the customer is obliged to provide Elephant Robotics with the information so that Elephant Robotics can maintain the customer relationship, fulfil the contract and invoice for services, etc. If the customer does not wish to provide Elephant Robotics with the information needed to comply with contractual and/or statutory obligations, the consequence may be that Elephant Robotics is unable to establish or continue the business relationship.

Individuals are not obliged to provide Elephant Robotics with Personal Data in all cases, for example, for use in marketing and newsletter distribution, though in such instances, the individuals will not be able to receive marketing materials and newsletters from Elephant Robotics.

4. The Types of and Purpose for the Collection of Personal Data

Elephant Robotics collects and processes Personal Data, including any applicable Sensitive Personal Data, only for specified, explicit, and legitimate purposes which are relevant to Elephant Robotics’ business, including the development and provision of educational robots, professional robots, and related solutions. Internal Elephant Robotics departments and employees who have access to Personal Data must follow applicable legal requirements, this Privacy Policy, and internal guidelines.

4.1 Employment

Elephant Robotics may collect and process Personal Data of applicants and candidates in accordance with legal requirements for employment-related purposes.

4.2 Visitors

For visitors to Elephant Robotics premises, we may collect and process Personal Data including name, title (if applicable) and contact details for security and safety reasons, and register such information in the visitor log prior to granting access.

4.3 Website Users

Elephant Robotics collects by itself or through authorized third-party service providers Personal Data which may include name, contact information, company or school name, and payment details, all of which are voluntarily provided by users. This data is collected and processed for marketing, advertising, and analytics purposes, as well as for contacting website users, managing contacts and sending messages, remarketing, and behavioral targeting with prior consent, and processing payment transactions for users who choose to purchase products or services. For operation and maintenance purposes, Elephant Robotics and any third-party service providers may collect files that record a user’s interaction with the website, where such Personal Data is obtained through consent by the website users. Our website does not use cookies or similar tracking technologies, and does not support “Do Not Track” requests. Users are responsible for any third-party Personal Data obtained, published, or shared through the website by the user and confirm that they have the third party’s consent to provide such Personal Data to Elephant Robotics. Users who are uncertain about which Personal Data is mandatory are welcome to contact the Global Data Protection Team.

4.4 Data of Minors

Elephant Robotics’ websites and online services are not intended for use by children under the age of 16, except in certain specific circumstances such as educational programs or competitions. In such instances, explicit parental or legal guardian consent will be obtained prior to collecting the Personal Data of minors. If Elephant Robotics becomes aware that Personal Data has been inadvertently collected from a child under the age of 16 without first obtaining the necessary consent, Elephant Robotics will take prompt action to delete such Personal Data from its respective systems.

4.5 Marketing

For marketing purposes, Elephant Robotics collects and processes the Personal Data of current and prospective customers, business partners, suppliers, leads, website users, and individuals who have signed up for newsletters or other electronic marketing materials, for purposes including analytics, contacting, managing contacts and sending messages, remarketing and behavioral targeting, advertising, and exhibitions. Such Personal Data is collected and processed with marketing consent obtained through appropriate means, and Elephant Robotics may use third parties as service providers to send out marketing information on its behalf in accordance with applicable legal requirements. For marketing purposes, Elephant Robotics may share Personal Data with third parties such as distributors, business partners, and corporate affiliates, and a list of distributors can be found on the official website while a list of other third parties can be provided upon request. For any further questions related to marketing information, please contact the marketing department via the official website’s contact channels.

4.6 User Experience Research

Elephant Robotics may collect and process users’ Personal Data regarding their experiences, needs, motivations, and behaviors when using Elephant Robotics’ products and services for user experience research, which is entirely voluntary and requires prior consent. The purpose of such research is to better understand how Elephant Robotics’ products and services meet users’ everyday needs.

4.7 Contracts

In connection with sales and purchase transactions, Elephant Robotics collects and processes Personal Data including names, contact details, delivery details, correspondence, and payment details necessary for fulfilling contractual obligations and complying with export control regulations and other legal due diligence obligations.

4.8 Accounting and Finance

For accounting and financial purposes in accordance with applicable requirements, Elephant Robotics collects Personal Data such as name, address, company or school name, payment details and bank details, delivery address and other mandatory information, which is provided to the accounting department by other internal departments or received directly from individuals, companies, or employees.

4.9 Educational Programs

For educational programs including training, curriculum learning, and robotics competitions offered through the official website or related platforms, Elephant Robotics collects and processes Personal Data including name, contact details, and institution or school information (for group participants) with the user’s consent, to facilitate participation, issue certificates and awards, provide personalized curriculum recommendations and learning support. Where educational programs are used by minors, there are separate setups for processing Personal Data that exclude sending newsletters or other marketing material, surveys, or sharing such Personal Data with third parties.

4.10 Legal Action

In the event of a dispute, Elephant Robotics may retain Personal Data necessary for its legitimate interest to ensure that it can properly bring or defend legal claims or during the stages leading to possible legal action, and may need to share this information with third parties such as insurance and/or legal advisers or as required by public authorities.

5. Place and International Data Transfer

Personal Data is processed at Elephant Robotics’ operating offices and in any other places where the parties involved in the processing are located. Elephant Robotics ensures that either the Personal Data is transferred to countries recognized as offering an equivalent level of protection, or the transfer is made pursuant to appropriate safeguards that require the recipient to treat the Personal Data in a manner that is essentially equivalent to legal requirements.

Specific rules apply when Elephant Robotics transfers Personal Data from the EU/EEA to third countries or international organizations, and such transfers are made by entering the European Commission’s Standard Contractual Clauses (“EU SCCs”) or by collecting consent from the Data Subject (Art. 49(1)(a) GDPR).

Elephant Robotics may use electronic communications service providers or share data with partners based outside of the EU, including countries where the legal regime for the protection of Personal Data might not be as sufficient as within the EU, and transfers of Personal Data to the US may fall within the scope of Section 702 of the Foreign Intelligence Surveillance Act, which may require that the Personal Data be handed over to U.S. authorities, with the legal basis for such transfers being Data Subject consent (Art. 49(1)(a) GDPR).

In accordance with the GDPR, Elephant Robotics has concluded a Data Processing Agreement (DPA) and/or Joint Data Controller Agreement (JDCA) and/or agreements with Standard Contractual Clauses (SCCs) with external parties and affiliated companies, as applicable.

Personal Data relating to individuals in the United Kingdom (“UK”) may be processed by Elephant Robotics in countries outside of the UK, in which case the UK International Data Transfer Agreement (“IDTA”) and UK Addendum will apply.

Personal Data relating to individuals in Mainland China may be processed by Elephant Robotics in countries outside of Mainland China in compliance with local laws including the PIPL, and such Personal Data may be transferred to third parties who may in turn store or transfer the data outside of Mainland China.

Personal Data relating to individuals in ASEAN member states may be processed by Elephant Robotics in countries outside of the ASEAN region, with the ASEAN Model Contractual Clauses applying to such transfers.

Personal Data collected by Elephant Robotics is mainly stored and processed in the United States, and may be transferred to third parties including cloud service providers, payment service providers, and logistics service providers for the purpose of fulfilling business obligations, with appropriate agreements in place to govern such transfers.

6. Retention Period

Personal Data collected by Elephant Robotics shall be processed and stored for as long as required by the purpose for which the Personal Data was originally collected and in accordance with Elephant Robotics’ internal Document Retention Policy.

Elephant Robotics may be permitted to retain the Personal Data for a longer period if valid consent to the processing activity has been obtained and not subsequently withdrawn, or if obligated to do so for the performance of a legal obligation or where necessary to establish, exercise, or defend a legal claim.

  • Contract-related data is retained for the duration of the contract plus the statutory retention period (e.g., 7 years for tax and accounting records) after the expiration or termination of the contract;
  • Customer service and after-sales data is retained for the product warranty period plus 2 years after the expiration of the warranty;
  • Marketing data is retained until the Data Subject withdraws consent or objects to direct marketing;
  • Minor User Data is retained only for the duration of the relevant educational service and deleted immediately after the service is completed unless required by law to retain it for a longer period;
  • We do not collect website access data including cookies, so there is no related retention;
  • Legal action-related data is retained until the resolution of the dispute and the expiration of the relevant statute of limitations.

  • Once the retention period expires, the Personal Data shall be deleted or anonymized, and the right to access, the right to erasure, the right to rectification, and the right to data portability cannot be accommodated after the expiration of the applicable retention period.

7. Individuals’ Rights

Where legally required, Elephant Robotics shall inform individuals of the purpose of processing their Personal Data, rights to have their Personal Data rectified, deleted, or blocked, and the identity of the company responsible for the collection and processing of their Personal Data. In all other cases, users may inquire with the Global Data Protection Team to find out which rights apply to them.

Individuals have the following rights:

  • Withdrawal of consent: the right at any time to withdraw previously given consent to the processing of its Personal Data, and such withdrawal will not affect the lawfulness of processing conducted prior to the withdrawal;
  • Object to processing of Personal Data: the right to object to the processing of Personal Data if such processing is carried out on a legal basis other than consent, with further details provided in relevant sections of this Privacy Policy, and may object to direct marketing without providing any justification;
  • Access to Personal Data: the right to learn if Personal Data is being processed by Elephant Robotics, obtain disclosure regarding certain aspects of the processing and obtain a copy of the data undergoing processing;
  • Verify and seek rectification: the right to verify the accuracy of their Personal Data and ask for it to be updated or corrected;
  • Restrict the processing of Personal Data: the right, under certain circumstances, to restrict the processing of their Personal Data, in which case Elephant Robotics will not process the mentioned Personal Data for any purpose other than storing it;
  • Have Personal Data deleted or otherwise removed: the right, under certain circumstances, to obtain the erasure of their Personal Data from Elephant Robotics;
  • Have Personal Data transferred to another data controller: the right, under certain circumstances, to have Personal Data transmitted to another controller without any hindrance;
  • Lodge a complaint: the right to bring a claim before their competent data protection authority.

8. Training

To prevent any violation of applicable law, regulations, and corporate standards, Elephant Robotics organizes formalized data protection training for its employees in accordance with a corporate training plan. Training on data protection may be conducted via electronic communication, webinars, or in-person training. All employees are trained on basic data protection requirements and certain groups have more advanced training on Personal Data processing based on business needs, ensuring that all personnel involved in data processing understand their obligations under this Privacy Policy and applicable laws.

9. Ongoing Auditing & Monitoring

Through a combination of external and internal controls, ongoing auditing, and monitoring, Elephant Robotics seeks to maintain secure processing of data and prevent data loss. In the event of negative audit findings, the responsible department must prepare a mitigation plan, including corrective and preventive actions to mitigate risks and bring procedures and policies in compliance with legal requirements, corporate standards, and this Privacy Policy.

Regular internal audits are conducted by the internal audit department to assess compliance with data protection requirements, while external audits by independent third-party professional institutions ensure the objectivity and effectiveness of the data protection framework. Real-time monitoring systems are in place for data processing systems and IT infrastructure to detect and respond to abnormal data access and processing behaviors promptly.

Elephant Robotics has formulated a detailed data security incident emergency response plan to address data breaches or other security incidents, including investigation, containment, remediation, and notification of competent authorities and affected Data Subjects as required by law.

10. Reporting System and Contact Details

In case of questions and/or possible violations of this Privacy Policy, please contact the Global Data Protection Team at:

Elephant Robotics

Mailing Address: 5th Floor, CEC Plaza Building, No. 2070 Shennan Middle Road, Fuqiang Community, Huaqiangbei Street, Futian District, Shenzhen City, China

Telephone: +852 9597 0019 (please request to speak with the Legal Department)

E-mail: service@elephantrobotics.com

Any request can be exercised free of charge and will be addressed as expeditiously as possible and always within one (1) month or sooner, if required by applicable law. For complaints about data processing activities, Elephant Robotics will conduct a thorough investigation and inform the complainant of the investigation results and handling measures in writing.

If employees or third-party service providers are found to have violated this Privacy Policy or relevant data protection laws and regulations, any person may report the violation through the above contact channels, and Elephant Robotics will keep the reporter’s information confidential and conduct a timely investigation and handling.

11. Changes to this Privacy Policy

Elephant Robotics reserves the right to amend this Privacy Policy. The latest edition will always be available on the official website, and we strongly recommend that you continually monitor and update yourself with our Privacy Policy. This Privacy Policy is written in English and may be translated into another language. In the event of a discrepancy, the English version shall prevail. The continued use of Elephant Robotics’ products and services by the Data Subject after the effective date of the revised Privacy Policy shall be deemed as acceptance of the revised content.

12. Region-Specifics

In accordance with applicable privacy laws and depending upon the jurisdiction, additional requirements may apply with respect to the collection and processing of Personal Data. Elephant Robotics may choose or be required by law to provide different or additional disclosures relating to the processing of Personal Information about residents of certain countries, regions, or states.

For EU/EEA and UK residents, and other regions not specifically mentioned, this Privacy Policy applies.

For residents of the State of California in the United States, please refer to the separate Privacy Notice for California Residents, which supplements this Privacy Policy to comply with the CCPA and related regulations.

For residents of the State of Nevada in the United States, Chapter 603A of the Nevada Revised Statutes permits a Nevada resident to opt out of future sales of certain covered information that a website operator has collected or will collect about the resident, and to submit such a request, please contact the Global Data Protection Team at service@elephantrobotics.com with the subject line, “Nevada Opt-Out Request”.

For residents of Colorado, Connecticut, Utah, and Virginia in the United States, please refer to the separate Privacy Notice for Residents of Colorado, Connecticut, Utah, and Virginia.

For China residents, please see the separate Elephant Robotics China Privacy Policy.

For Japan residents, please see the separate Japan Privacy Notice.

For Canada residents, Elephant Robotics complies with PIPEDA and other relevant Canadian data protection laws and regulations, with a separate Canada Privacy Notice available on the official website.

For residents of other countries or regions in the Americas, this Privacy Policy applies in full, and Elephant Robotics complies with relevant local data protection laws and regulations, with supplementary provisions formulated and published on the official website if local laws have additional requirements.