Weixin

Weixin is the Chinese version of WeChat, a multipurpose chat and messaging tool.

3/10

How we calculate ratings →

Handling

Does the policy allow personally-targeted or behavioral marketing? Yes

0/10

Does the service allow you to permanently delete your personal data? No

0/5

Does the service allow third-party access to private personal data? Yes

0/10

This may come in the form of outright data sharing or by using local third-party analytics software (such as Google Analytics, which collects a plethora of user information).

Note that whether the policy allows sharing aggregated user data does not affect this question.

If the personal data is encrypted when it passes through the third-party, it does not count as third-party access (as the data is inaccessible to that party).

If personal data has been made public by, for example, posting it to a blog, it does not count as private personal information (and is therefore not considered by this question).

Score

Yes

The policy allows sharing personal data with third parties (not just critical service providers), and does not explicitly list the third parties.

Yes, all parties specified (including non-critical service providers such as advertisers)

30%

Yes, not all parties specified (but only to critical service providers)

70%

Yes, all parties specified (only to critical service providers)

80%

100%

Citation

At present, Weixin will not actively share or transfer your personal information to any third parties outside of Tencent.

If there are other circumstances in which your personal information is to be shared or transferred [...] we will directly obtain or verify the third party has obtained your prior express consent [...]

If we have to disclose such information publicly, we will inform you of the

purpose of such disclosure,
type of information disclosed
the sensitive information that may be involved,
and obtain your prior express consent.

in accordance with relevant laws and regulations and national standards, [...] we may share, transfer, or publicly disclose personal information without prior consent of the subject of personal information

Notes

They can (each node correspond to a paragraph in "External Parties" section):

share personal information with your consent or share personal information with third-party that have your consent.
publicly disclose personal information when notifying you of crucial detail, and obtain your consent
disclose personal information WITHOUT notice if it is related to jurisdiction etc.

When does the policy allow law enforcement access to personal data? Always

0/5

Score

Always

This includes cases in which law enforcement either runs the service or has a known backdoor into (or relationship with) the service.

Not specified

When reasonably requested

60%

Only when required by a court order or subpoena

80%

N/A (no personal data to share)

The service would have no personal data to share with law enforcement.

100%

Never (special legal jurisdiction)

The service operates in a jurisdiction in which sharing data with law enforcement is never required.

100%

Citation

[We] may share, transfer, or publicly disclose personal information without prior consent of the subject of personal information:

When it is directly related to national security or national defense;
When it is directly related to public safety, public health, or major public interests;
When it is directly related to a criminal investigation, prosecution, trial or execution of judgments;
When it is for protecting vital legitimate interests of you or of other individuals, such as right of life, property, and reputation, while it’s hardly to obtain the consent of the individual;

we may collect and process your relevant personal information without asking for your consent:

When it is directly related to national interests such as national security and national defense, or it is directly related to major public interests such as public safety, public health, and public knowledge;
When it is directly related to a criminal investigation, prosecution, trial or execution of judgments;
In order to protect vital legitimate interests of you or of other individuals, such as right of life, property, and reputation, while it’s hardly to obtain the consent of the individual;
[...]
When it is necessary for conducting statistical or academic research which is for public interest, [...]

Notes

They can collect and disclose personal information WITHOUT consent for things like "national security" and "public interests"

Transparency

Does the policy outline the service's general security practices? Yes, including audits

2/3

Score

Somewhat

The policy provides only a very vague overview of its security practices.

30%

Yes

60%

Yes, including audits

"Reviews," "monitoring," etc. also count as audits.

80%

Yes, including independent audits

Independent "reviews," "monitoring," etc. also count as independent audits.

100%

N/A

The service doesn't collect any personal information.

100%

Citation

Currently, Weixin has passed the assessment test and undergone the record-filling of Level 3 Graded Protection of Information System Security. In terms of information security, Weixin has also implemented and achieved the certification to ISO27001, the international information security management system standard, TRUSTArc and some other authoritative international standards.

Notes

In "Information Security" section, they listed some of their practice about information security, but not exhaustive.

The information security is audited then obtained ISO 27001

Is the policy's history made available? No

0/5

Does the policy require users to be notified in case of a data breach? Not necessarily

0/7

Will affected users be notified when the policy is meaningfully changed? Yes

5/5

Collection

Does the service collect personal data from third parties? No

10/10

Is it clear why the service collects the personal data that it does? Somewhat

3/10

Does the service allow the user to control whether personal data is collected or used for non-critical purposes? No

0/10

Does the policy list the personal data it collects? Yes, generally

7/10

Score

The policy does not claim to not collect personal data, but it also doesn't provide any meaningful insight into the types of personal data it collects.

Only summarily

The policy uses overly vague language to provide a summary of the types of collected personal data.

30%

Yes, generally

All general categories of collected personal data are listed, though not all types of personal data are explicitly mentioned (for example, the list might use a phrase like 'such as' when listing types of personal data).

70%

Yes, exhaustively

All types of collected personal data are listed specifically

100%

N/A (no personal data is collected)

100%

Notes

In the "1.The Information We Collect" section

Last Updated

May 26, 2021

Sources

Source #1 ↗

Contributors

Anonymous