Oculus Privacy Policy Legal Bases

Effective Date: October 11, 2020

Under European law, companies must have a legal basis to process data. You have particular rights available to you depending on which legal basis we use, and we've explained these below. You should know that no matter what legal basis applies, you always have the right to request access to, rectification of, and erasure of your data under the General Data Protection Regulation (the “GDPR”). To exercise your rights, visit the Oculus Privacy Center.

For all people who have legal capacity to enter into an enforceable contract, we process data as necessary to perform our contracts with you (the Oculus Terms of Service, “the Terms”). We describe the contractual services for which this data processing is necessary in the “Oculus Products” section of the Terms, and in the additional informational resources accessible from the Terms.

The core data uses necessary to provide our contractual services are:

• To provide, personalize, and improve the Oculus Products;

• To promote safety, integrity and security;

• To transfer, transmit, store, or process your data outside the EEA, including to within the United States and other countries;

• To communicate with you, for example, on product-related issues; and

• To provide consistent and seamless experiences across the Oculus Products.

These uses are explained in more detail in the Oculus Privacy Policy, under “How do we use information?” and “How is information shared?”. We’ll use the data we have to provide these services; if you choose not to provide certain data, the quality of your experience using the Oculus Products may be impacted.

When we process data you provide to us as necessary to perform our contracts with you, you have the right to port it under the GDPR. To exercise your rights, visit the Oculus Privacy Center.

The other legal bases we rely on in certain instances when processing your data are:

• Your consent:

  • For collecting information that you allow us to receive through the device-based settings you enable, so we can provide the features and services described when you enable the settings.

When we process data that you provide to us based on your consent, you have the right to withdraw your consent at any time and to port that data you provide to us, under the GDPR. To exercise your rights, visit the Oculus Privacy Center.

• Our legitimate interests or the legitimate interests of a third party, where not outweighed by your interests or fundamental rights and freedoms:

  • To permit you to use certain features of the Oculus Products, such as hand tracking. The legitimate interests we rely on for this processing are:

    • To provide you with engaging virtual, mixed, and augmented reality (collectively, “XR”) experiences that rely on these features, and to continue to innovate and improve Oculus Products.

  • To promote safety, integrity and security on all the Facebook Company Products, in combination with data collected through other Facebook Company Products. The legitimate interests we rely upon for the processing are:

    • To keep the Facebook Company Products secure and to keep users safe when they use the Oculus Products and other Facebook Company Products.

  • For sharing measurement and analytics information with third party apps, developers, and other online content providers on the Oculus Products. The legitimate interests we rely on for this processing are:

    • In the interests of third party apps, developers, and other online content providers, to help them understand their customers, improve their businesses and the games or other experiences they offer, and evaluate the effectiveness of their content.

  • For providing marketing communications to you. The legitimate interest we rely on for this processing is:

    • To promote Oculus Products and issue our direct marketing.

  • To research and innovate for social good. The legitimate interest we rely on for this processing is:

    • To further the state of the art or academic understanding of XR technology as well as of important social issues to impact our society and world in a positive way.

  • To share information with others including law enforcement and to respond to legal requests. See the Oculus Privacy Policy, “How do we respond to legal requests and prevent harm?” for more information. The legitimate interests we rely on for this processing are:

    • To prevent and address fraud, unauthorized use of the Oculus Products, breaches of our terms and policies, or other harmful or illegal activity; to protect ourselves (including our rights, property or Oculus Products), our users or others, including as part of investigations or regulatory enquiries; or to prevent death or imminent bodily harm.

  • For people under the age of majority (under 18, in most EU countries) who have a limited ability to enter into an enforceable contract, we may be unable to process personal data on the grounds of contractual necessity. Nevertheless, when such a person uses our Oculus Products, it is in our legitimate interests to:

    • Provide, personalize, and improve the Oculus Products; for people under their Member State’s age of consent: as modified to ensure special protections and restricted features regarding the marketing communications relating to the Oculus Products. This includes processing information people under the age of consent allow us to receive through device-based settings they enable, to provide the features and services covered by those settings.

    • Promote safety and security, including through tools focused specifically on threats to people under the age of majority.

    • Provide non-marketing communications for the Oculus Products or customer service-related issues.

  • The legitimate interests we rely on for this processing are:

    • To create, provide, support and maintain innovative products and features that enable people under the age of majority to express themselves, play, communicate, discover and engage with information and communities relevant to their interests, build community, and utilize tools and features that promote their well-being.

    • To secure our platform and network, maintain information security, and keep the Oculus Products free of harmful or inappropriate content; and to protect the safety of people under the age of majority, including to prevent exploitation or other harms to which such individuals may be particularly vulnerable.

You have the right to object to, and seek restriction of, such processing. To exercise your rights, visit the Oculus Privacy Center.

We will consider several factors when assessing an objection including: our users’ reasonable expectations; the benefits and risks to you, us, other users, or third parties; and other available means to achieve the same purpose that may be less invasive and do not require disproportional effort. Your objection will be upheld and we will cease processing your information, unless the processing is based on compelling legitimate grounds or is needed for legal reasons. If you are under the age of majority in your country and have a limited ability to enter an enforceable contract, we will take particular account of the fact that you are below the age of majority and adjust our assessment of our legitimate interests and the balancing of your interests and rights accordingly.

• Compliance with a legal obligation:

  • For processing data when the law requires it, including, for example, if there is a valid legal request for certain data. See the Oculus Privacy Policy, under “How do we respond to legal requests and prevent harm?” for more information.

• Protection of your vital interests or those of another person:

  • The vital interests we rely on for this processing include protection of your life or physical integrity or that of others, and we rely on it to combat harmful conduct and promote safety and security, for example, when we are investigating reports of harmful conduct or when someone needs help.

• Tasks carried out in the public interest:

  • For undertaking research for social good and to promote safety, integrity and security, as described in the Oculus Privacy Policy under “How do we use information?”, where this is necessary in the public interest as laid down by Union law or Member State law to which we are subject.

When we process your data as necessary for a task carried out in the public interest, you have the right to object to, and seek restriction of, our processing. To exercise your rights, visit the Oculus Privacy Center.

In evaluating an objection, we'll evaluate several factors, including: reasonable user expectations; the benefits and risks to you and third parties; and other available means to achieve the same purpose that may be less invasive and do not require disproportional effort. Your objection will be upheld and we will cease processing your information, unless the processing is based on compelling legitimate grounds or is needed for legal reasons.