Etyka HMD

1. Introduction

HMD Global Oy and its affiliates (“HMD,” “we,” or “us”) is committed to the security of our products, software, and services. We value the contribution of independent security researchers and the wider security community in helping us continually improve the cybersecurity of our products, software, and services by identifying and addressing vulnerabilities before they can be exploited. This Coordinated Vulnerability Disclosure (CVD) Policy explains what systems and products are covered, how to report a suspected vulnerability to us, what you can expect from us once you do, and how we ask you to manage disclosure of your findings. By submitting a vulnerability report to HMD through the Security Vulnerability Reporting Form or through other channels, you accept and agree to the terms of this policy.

2. Scope

This policy applies to all HMD products, software, and digital services offered by HMD, unless a system or service is explicitly excluded below.

This policy also applies to third-party software, platforms and services that are integrated into, or supplied with, HMD products and services where HMD is the customer-facing provider. Where a report concerns a component supplied by a partner, HMD will coordinate assessment, remediation and disclosure with that partner in accordance with Section 8.

This policy applies to every vulnerability report regardless of the channel through which it reaches HMD, including the Security Vulnerability Reporting Form, customer support, email, social media or a third-party platform.

This policy supplements the terms of service or terms of use applicable to the relevant HMD product, software or service, available at HMD Terms. Security research conducted in accordance with this policy is authorised notwithstanding any restriction in those terms on reverse engineering, testing or similar activities. Any activity that does not comply with this policy is not authorised and remains subject to those terms, including their liability and indemnification provisions.

3. Obligations for Security Researchers

When conducting security research or reporting a vulnerability under this policy, you shall:

• Notify us as soon as possible after discovering a real or potential security issue using HMD's Security Vulnerability Reporting Form.
• Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
• Only use exploits to the extent necessary to confirm a vulnerability's existence. Not attempt to access, exfiltrate, modify or retain data beyond what is needed to demonstrate the issue and validate the vulnerability. Avoid actions that could impact systems, users, or third parties.
• Not disclose the vulnerability, or any details of it, publicly or to any third party other than a competent authority, except as permitted in Section 8 (Confidentiality and Timeline).
• Refrain from publishing working exploit code, proof-of-concept tooling, or step-by-step reproduction detail that would enable exploitation while affected users remain unpatched, even after the coordinated disclosure period has ended.
• Avoid submitting reports generated solely by automated tools without validation or meaningful analysis.
• Comply with all applicable laws.
• Only test using devices, accounts and data that you own or are expressly authorised to use, and not access, or attempt to access, the accounts, devices or data of other users.
• Not exploit any vulnerability or information of it, or enable others to exploit it, for any purpose other than demonstrating it to HMD under this policy.

If, in the course of your research, you unintentionally encounter personal data, financial information, or confidential or proprietary information belonging to HMD or any third party, stop testing the affected area, notify us promptly, and do not access, retain, or disclose such information.

4. Test Methods Not Authorised

The following are not authorised under this policy:

• Network denial-of-service (DoS/DDoS) testing or other activities intended to degrade availability or cause disruption to systems, services, or data.
• Physical security testing or social engineering activities targeting HMD employees, contractors, facilities, or third parties, unless explicitly agreed with HMD in advance.
• High-volume or sustained automated scanning or testing against HMD production systems or services without prior agreement with HMD, or any automated testing that degrades availability or performance for other users.
• Any testing against production systems or services that is likely to affect availability, integrity, performance, or other users' experience, unless explicitly agreed with HMD in advance

5. Authorisation

If you act in good faith and make a reasonable effort to avoid harm and to comply with this policy during your security research, we will consider your research to be authorised. This authorisation extends to HMD products, software and services to the extent HMD is entitled to grant it. Where HMD becomes aware that it cannot authorise research, we will tell you promptly. We will collaborate with you to understand and resolve the reported issue quickly, and HMD will not recommend or pursue legal action related to research conducted in accordance with this policy. Should legal action be initiated by a third party against you for activities conducted in accordance with this policy, we will make this authorisation known.

Authorisation under this Section is conditional on continued compliance with this policy, including the obligations in Section 8. If you do not comply, authorisation is withdrawn prospectively from the date of non-compliance. Withdrawal is not retrospective: it does not affect research already carried out in good faith, avoiding harm and in compliance with this policy before that date.

6. Reporting a Vulnerability

Submit your report using HMD's Security Vulnerability Reporting Form. This form is HMD's primary reporting channel for all security vulnerabilities.

When submitting a report, please include:

• The name of the affected HMD product or service, if known.
• A detailed description of the suspected vulnerability and its potential impact.
• Steps to reproduce the issue, where possible, including any proof-of-concept details or material where available.

You do not need a complete understanding of the issue before reporting — the most crucial step is letting us know as soon as possible.

7. What You Can Expect from Us

We aim to keep you informed throughout the process, subject to any confidentiality, legal, or security constraints that apply:

8. Confidentiality and Timeline

You agree to keep the details of any reported vulnerability confidential, and not to disclose them publicly or to any third party other than a competent authority unless HMD agrees in writing to the disclosure.

We aim to investigate and remediate the reported vulnerability within 90 days. If a fix requires more time — for example due to the complexity of a hardware or supply-chain-related issue — we will communicate with you about the delay and the reasons for it.

9. Intellectual Property

HMD and its licensors retain all right, title and interest, including all intellectual property rights, in HMD products, software, services, content and documentation. Nothing in this policy grants you any licence or other right in them, other than the limited authorisation in Section 5.

By submitting a report, you grant HMD and its affiliates a worldwide, non-exclusive, royalty-free, perpetual, irrevocable, transferable and sublicensable licence to use, copy, modify, disclose and otherwise exploit the report and any related material, including any proof-of-concept, for any purpose, including investigating and remediating the vulnerability, coordinating with suppliers and competent authorities, and publishing security information. You are not entitled to any compensation for such use.

You represent that your report is your own work, that you have the right to submit it, and that it does not contain information that you are obliged to keep confidential or that infringes the rights of any third party.

10. Liability and Indemnification

If you breach this policy, HMD reserves the right to take any action available to it under applicable law and under the terms of service applicable to the relevant product, software or service.

You are liable, in accordance with applicable law, for any damage or loss that your breach of this policy causes to HMD, its affiliates, its users or any third party.

You agree to defend and indemnify HMD and its affiliates against all third-party claims, and all liabilities, losses, costs and damages, resulting from or arising out of (i) your breach of this policy, or (ii) your infringement or violation of any intellectual property rights, privacy or other rights of a third party in connection with your research or report. This paragraph does not apply to research conducted in accordance with this policy.

HMD provides the vulnerability reporting process on an “as is” basis. To the extent permitted by applicable law, HMD is not liable for any indirect, incidental or consequential damages arising out of or in connection with your research or report.

This policy is governed by the laws of Finland, excluding its conflict of law rules. Any dispute arising out of or in connection with this policy shall be settled by the District Court of Helsinki, Finland. This is without prejudice to any mandatory rights you have under the law of your country of residence.

11. Data Protection

We process personal data provided through the vulnerability disclosure process to receive, assess, investigate, mitigate, and remediate reported security vulnerabilities. Information submitted under this policy is used to investigate, mitigate, and remediate vulnerabilities, communicate with reporters, maintain records of the disclosure process, prevent misuse of the reporting channel, and improve the security of our products, systems and services.

The categories of personal data processed may include:

• Name and contact details of the reporter.
• Technical information contained in vulnerability reports.
• Communications related to the report.

The processing of personal data is based on our legitimate interest in maintaining the security, confidentiality, integrity, and availability of our products, systems and services, preventing security incidents, and coordinating responsible vulnerability disclosure. Personal data is retained only for as long as necessary.

Personal data is disclosed only to personnel, service providers, and advisors who need access to the information for vulnerability management purposes or where required by law.

Where a report concerns a partner-supplied component, we may share your report and related communications with that partner for the purpose of assessment and remediation. We will share your identity with the partner only where this is necessary for that purpose.

For further information regarding the processing of personal data, please refer to HMD Global Privacy Policy for products and services.

12. Questions

Questions regarding this policy can be submitted via HMD's Support chat. We welcome suggestions for improving this policy.