=================================================================== --- 20241202_rev01 +++ 20250201_rev01 @@ -1,13 +1,13 @@ ## Reach Group - Privacy Notice We have organised this Privacy Notice based on the different ways you might interact with us and what you might want to know. Please use the contents list below to navigate to the section of the Privacy Notice which you are interested in. At the end of each section if you want to return to the contents list please click the link: 'Click here to go back to 'Contents'' -Last update: 19 July 2024 +Last update: 23 January 2025 ## CONTENTS 1. **[Who we are and how to contact us]()** 2. **[About this Privacy Notice]()** 3. **[When you browse our websites and use our apps]()** @@ -20,32 +20,32 @@ 10. **[When you visit or interact with us on social media]()** 11. **[When you apply for a job with us or work at other organisations we do business with]()** 12. **[Further ways we may receive, use and share your data]()** 13. **[How we keep your data secure, why we may keep it and countries we may transfer it to]()** 14. **[How we ensure we protect children's privacy]()** 15. **[UK and EU residents: your rights and how to exercise them]()** -16. **[US residents: relevant laws and rights]()** +16. **[US and Canadian residents: relevant laws and rights]()** ## 1\. Who we are and how to contact us We are the Reach group, which is made up of Reach plc and its subsidiaries. Reach plc is the largest national and regional news publisher in the UK with a portfolio in Ireland and the United States. We aim to create engaging, relevant content which is distributed through various channels and media including newspapers, magazines, and digital platforms - playing a central role in our audiences' daily lives. -We are the name behind some of the UK's most influential, iconic, and trusted news brands, such as the Daily Mirror, Daily Express, Daily Star, Daily Record and Sunday People as well as leading celebrity and entertainment magazine OK! and the online shopping site Yimbly.com. We also publish leading regional titles including the Manchester Evening News, Liverpool Echo, and Birmingham Mail, plus the Mirror US and Express US. You can see the list of websites and brands we publish [**here**](https://www.reachplc.com/about-us/our-brands). +We are the name behind some of the UK's most influential, iconic, and trusted news brands, such as the Daily Mirror, Daily Express, Daily Star and Daily Record, as well as leading celebrity and entertainment magazine OK! and the online shopping site Yimbly.com. We also publish leading regional titles including the Manchester Evening News, Liverpool Echo, and Birmingham Mail, plus the Mirror US and Express US. You can see the list of websites and brands we publish [**here**](https://www.reachplc.com/about-us/our-brands). -Depending on who you are and how you interact with us, the legal "controller" of your personal data will be one or more of our group companies, like MGN Limited, Local World Limited, Express Newspapers or Reach Publishing Services Limited (all at the address above). +Depending on who you are and how you interact with us, the legal "controller" of your personal data will be one or more of our group companies, like MGN Limited, Reach Regionals Media Limited, Express Newspapers, Reach Publishing Group Services Limited or Reach Shared Services Ltd (all at the address above). We have appointed a Data Protection and Privacy Officer (DPO) to oversee our data protection and privacy practices. If you have any comments, concerns or questions, including any requests to exercise your legal rights, our DPO can be reached as follows: If you are from the UK/EU: - By email: [dataprotection@reachplc.com](mailto:dataprotection@reachplc.com) - By mail: Data Protection Enquiries, Reach Plc, One Canada Square, Canary Wharf, London E14 5AP If you are from the US: -- By email: privacyofficer@reachplc.com +- By email: [privacyofficer@reachplc.com](https://www.mirror.co.uk/privacy-notice/%E2%80%9Dmailto:privacyofficer@reachplc.com%22) - By mail: Privacy Officer, Reach Plc, 19th Floor, 200 Liberty Street, New York, NY 10281 Your point of contact for anything to do with how the Reach group uses your personal data is the office of our group Data Protection Officer, who you can contact by submitting the relevant form accessible within the 'Your rights and how to exercise them' section by emailing [dataprotection@reachplc.com](mailto:dataprotection@reachplc.com) or by writing to 'The Data Protection Team' at the address above. **[\*\*\* Click here to go back to 'Contents' \*\*\*]()** @@ -182,13 +182,13 @@ From time to time we may allow our clients to compare their customer database to ours using partner platforms such as InfoSum. This is called data matching and allows our partners to see if they can reach their audiences on our platforms and to understand if an advertising campaign would be effective. Generally this will be conducted at an aggregate audience level to provide insights, rather than individual level information, although your information may be used to generate these insights. For example, this could involve matching your hashed, pseudonymised email data with the same data held by our advertising clients. This then enables the advertiser to understand if you use their products and visit our sites, then to use this data to target bespoke advertising messages. Alternatively, we may allow advertising partners to build target audiences based on predefined attributes. These 'lookalike' audiences may be similar to our partners' existing audiences. For example, a sports brand may want to reach 'football enthusiasts'. They could select audiences who have been identified as having an interest in these areas. To do this, we segment our audiences into groups depending on what we think they like or other behaviours. This helps them find the right audiences and we are able to show you more relevant advertising. -The way we match your data could also involve working with partners such as LiveRamp Inc and Tradedesk and their group companies, acting as joint controllers. These partners use this information to create a secure online identification code for the purpose of recognising you for cross-channel advertising. This code is placed in our cookie, does not contain any of your identifiable personal data, and will not be used by them to identify you. With your consent it may be shared with our advertising partners and other third-party advertisers globally for the purpose of enabling interest-based content or targeted advertising through Reach sites. These third parties may in turn use this code to link demographic or interest-based information you have provided in your interactions with them to the pseudonymised code. Detailed information on LiveRamp's data processing activities is available in [LiveRamp's Privacy Notice](https://liveramp.uk/privacy/service-privacy-policy/) and opt-out [here](https://optout.liveramp.com/opt_out). Information on the Trade Desk's use and how they work with partners can be found here [EUID Privacy Notice](https://www.transparentadvertising.eu/privacy). Alternatively to withdraw consent and object to targeted advertising based on the Trade Desk EUID activity click [here](https://www.transparentadvertising.eu/). +The way we match your data could also involve working with partners such as Tradedesk and their group companies, acting as joint controllers. These partners use this information to create a secure online identification code for the purpose of recognising you for cross-channel advertising. This code is placed in our cookie, does not contain any of your identifiable personal data, and will not be used by them to identify you. With your consent it may be shared with our advertising partners and other third-party advertisers globally for the purpose of enabling interest-based content or targeted advertising through Reach sites. These third parties may in turn use this code to link demographic or interest-based information you have provided in your interactions with them to the pseudonymised code. Information on the Trade Desk's use and how they work with partners can be found here [EUID Privacy Notice](https://www.transparentadvertising.eu/privacy). Alternatively to withdraw consent and object to targeted advertising based on the Trade Desk EUID activity click [here](https://www.transparentadvertising.eu/). We also work with partners such as LiveRamp Inc, acting as our processor. Detailed information on LiveRamp's data processing activities is available in [LiveRamp's Privacy Notice](https://liveramp.uk/privacy/service-privacy-policy/) and opt-out [here](https://optout.liveramp.com/opt_out). If you accept the use of cookies in our Consent Management Platform, when you submit your email address to create an account or sign-up to a newsletter or marketing we may share your email address in a hashed form with Amazon Publisher Services (APS). APS then links the hashed email to a profile which they may already hold related to that address. The hashed email will be used in a secure, pseudonymised form within a cookie to flag to APS whenever you visit an APS enabled Reach website again. APS will use this to determine, in real-time, if any of their business customers want to market to a profile similar to yours. If this is the case they may initiate an advert which will appear to you on the Reach website concerned. The APS Privacy Notice can be found at [APS PN](https://aps.amazon.com/aps/privacy-policy/). Alternatively to withdraw consent and object to targeted advertising based on APS activity click [here](https://www.amazon.com/gp/help/customer/display.html). You can also visit [www.youradchoices.org](https://www.youradchoices.org/) to have more information about how to manage your ad preferences. **Withdrawing consent** You have the right to withdraw your consent or opt-out to the processing of your personal data at any time via our Cookie Management Platform accessed via the 'cog' icon or link at the bottom of every webpage. For example, we will only match your hashed, pseudonymised email with an advertiser in the Infosum platform, if you have consented to your data being used by our adtech provider Lotame. We will also only work with partners such as LiveRamp, as described above, if you have accepted cookies in our Consent Management Platform. @@ -242,13 +242,13 @@ We process the data for determining an adblocker, on the basis of legitimate interest. As a predominantly advertising funded business, we do rely on our ability to show you advertising to help ensure we are able to provide you with the products and services you request. We process the personal data captured by our analytics providers on the basis of your consent, which we ask for through a "cookie banner" which appears when you first visit our site. That message box will reappear from time to time in case you change your mind (typically every thirty days), and on your first visit after we make a significant change. **3.3.3 How long we keep it for** -We keep the information in our server log files for up to 90 days, depending upon the log type and purpose. +We keep the information in our server log files for up to one year, depending upon the log type and purpose. Our analytics providers will keep the information they gather from our sites and apps in line with their own privacy notices, which you can access through our 'cookie banner' and Consent Management Platform (see the 'cog icon' or link at the bottom of every webpage). **3.3.4 Who we share it with and why** We use AWS and CloudFront to help us to analyse our server log files. They act at our direction, as our "processor". @@ -271,13 +271,13 @@ **3.4 Website Notifications (Pop ups)** We provide news and updates about our sites via push notification messages or 'pop-ups'. This is a free service. Our legal basis is consent, as the notifications are only sent to you if you have clicked on a button to allow it (you may have accidentally selected to receive notifications). We have no control over your subscription to notifications as it is controlled by your browser and device. We do not store any recognisable data about you or your device in connection with the push notification service. -If you wish to unsubscribe from receiving notifications please follow the instructions here: Airship- [https://support.airship.com/hc/en-us/articles/4446152158619-How-to-opt-out-from-the-web-notification](https://support.airship.com/hc/en-us/articles/4446152158619-How-to-opt-out-from-the-web-notification) +If you wish to unsubscribe from receiving notifications please follow the instructions here: [Airship](https://support.airship.com/hc/en-us/articles/4446152158619-How-to-opt-out-from-the-web-notification) and [One Signal](https://documentation.onesignal.com/v9.0/docs/unsubscribe-from-notifications). If you need additional assistance in relation to push notifications, please contact the team at [dataprotection@reachplc.com](mailto:dataprotection@reachplc.com) - with the Subject heading: Push Notifications **[\*\*\* Click here to go back to 'Contents' \*\*\*]()** ## 4\. When you create or sign into your online news or other Reach account @@ -294,13 +294,13 @@ We use your email address and the other information that you give to us as part of the account creation process to operate your account and provide those functions. When you are signed in with your Reach account, we will also have the ability to associate your account details with the information we gather through our analytics tools about how you use our sites. **4.1.1 The data we collect and what we do with it** When you create an account we may collect your name and email address. -For services that provide local information (like InYourArea) we will also collect your postcode and any associated areas of local interest that you want to be updated about. If you subscribe to a paid version of our sites such as **Premium** or **Privacy Plus** (without personalised advertising) we will collect your payment details, in order for us to fulfil your subscription. For more information on subscriptions see [9\. When you subscribe to our print or "Digital Edition" titles.]() +For services that provide local information (like InYourArea) we will also collect your postcode and any associated areas of local interest that you want to be updated about. If you subscribe to a paid version of our sites such as **Premium** or **Privacy Plus** (without personalised advertising and ad tracking) we will collect your payment details, in order for us to fulfil your subscription. For more information on subscriptions see [9\. When you subscribe to our print or "Digital Edition" titles.]() Some services may let you upload your own content to our sites, such as comments or pictures. Those things will, by the nature of the service, be generally visible on the site and may be attributed to user names. Your comments may be used in print, online or on the social pages for brands owned and published by Reach plc. We may also record what types of content you have commented on, and associate this with our profile of you. Please do not provide any personal data which you do not want to be published. Comments will be subject to moderation checks before publication. We use this information to operate your account and to enable you to log in and use our services; for example, on InYourArea we use your postcode to identify the correct local information to display to you. You may also be invited during the account creation process to subscribe to one or more of our newsletters, or to opt in to receive certain special marketing offers and promotions. You can read more about that by navigating to the appropriate section of this Privacy Notice via the 'Contents' list. [Click here to go back to 'Contents'](). @@ -421,16 +421,12 @@ **Donatis**. We use a third-party provider called Donatis to manage all of the charitable donations made through our Funeral Notices website. Please note that Donatis are a "data controller", therefore, all on-site donations will be processed in accordance with their own [Privacy Notice](https://www.donatispayments.co.uk/terms/privacy/), and Terms and Conditions. When you write a message to accompany your donation, this message will be posted as a tribute on the funeral notice and, once the donation period has closed, this message will be shared with the Funeral Director that posted the notice, so that they may share all of the donation messages with the family of the deceased. If, when writing a message, you choose to make it private then, once the donation period has closed, this message will be shared with the Funeral Director and the family. A private message will not be posted on our website. When you make a donation, and select Gift Aid, we will share some personal data with the relevant charity. This will include your name, email address, and donation amount. This information enables the chosen charity to avail of the UK Government's tax relief program, meaning that they receive more of your donation than they otherwise would. Please note that Gift Aid is only available to UK tax residents; further information regarding Gift Aid can be found [here](https://www.gov.uk/claim-gift-aid). -**Marketplacelive** When you decide to place an advertisement on Marketplace Live, through our Bookanad website, the information that you have provided will be shared with Marketplace Live, so that the publication and administration of your advertisement may be effectively managed. - -**InYourArea**. When you elect to place a notice on the InYourArea website, through our Bookanad website, the information that you have provided when creating an account, and a notice, will be shared with InYourArea so that they may manage and administer your online post. For information about how InYourArea will handle your personal data, please see their own published [Privacy Notice](https://www.inyourarea.co.uk/news/privacy-notice/). - **Payment processors**. We use third party payment processors to handle payments made through our websites. These third party payment processors may act as both a "data controller", meaning that they define why and how to process the payment information you provide, and a "data processor", meaning that they act in accordance with our specific instructions when processing your transactional data. **Ancestry**. Ancestry is a sponsor of our Funeral Notices website. A link to their website can be found on the sponsorship icon visible on all funeral notices. Please note that by clicking on the ancestry sponsorship area of the funeral notice page, you will be taken to Ancestry's own website, where an automatic search will be performed on the name of the deceased. This search will be performed based on the URL that you have visited Ancestry from. We do not share any of your personal data with Ancestry; however, if you register for an Ancestry account, after following a link within a notice, Ancestry will be able to identify that you came from our website. **AddThis (Oracle)**. We have installed a tool called AddThis, provided by Oracle, on various pages of our websites. This tool provides you with the ability to share a notice on social media platforms of your choice. When you interact with the AddThis tool, and decide to share a notice on social media, AddThis will collect some personal data from your interaction. AddThis collects your personal data as a "data controller", meaning that they will use it for their own purposes. Further information on how AddThis uses personal data can be found in their [Privacy Policy](https://www.oracle.com/uk/legal/privacy/addthis-privacy-policy.html). @@ -711,23 +707,23 @@ Our online form technology providers may process your personal data outside of the UK and EEA. We have implemented safeguards to secure and limit the processing of the data, including standard agreements and frameworks approved by the relevant authorities. **[\*\*\* Click here to go back to 'Contents' \*\*\*]()** ## 9\. When you subscribe to our print, online or "e-publishing" titles, or place a Classified Ad -**9.1 When you subscribe to our print, online or "Digital Edition" titles**. +**9.1 When you subscribe to our print, online or "e-publishing" titles**. We will collect your name, address other contact details, and payment information. We will use that information to administer your subscription. We do this on the basis that it is necessary in order to provide the subscription to you with the support of our provider. We will retain this information for as long as you maintain your subscription, and for a period thereafter, in case of disputes or problems. When you subscribe to our digital edition titles your subscription is also processed via our provider and this information is retained for as long as you maintain your subscription, and for a period thereafter, in case of disputes or problems. As part of the subscription process you may be asked if you want to receive other products or services from Reach. Where this is the case you will be asked to consent to each product or service type. Such activities are managed in accordance with the relevant sections elsewhere in this Privacy Notice. **Privacy Plus Subscription** -On some of our websites we offer you a **Privacy Plus** subscription service for tracking-free access. This **Privacy Plus** subscription provides a reading option free of personalised advertising. For a monthly fee, a Privacy Plus subscription enables you to access the same content, without sharing your personal data for advertising purposes. +On some of our websites we offer you a **Privacy Plus** subscription service for access free of ad-tracking. This **Privacy Plus** subscription provides a reading option free of personalised advertising. For a monthly fee, a Privacy Plus subscription enables you to access the same content, without sharing your personal data for advertising purposes. This means: - We will not run advertising tracking technologies. - You will not receive personalised advertising. @@ -750,13 +746,13 @@ We operate accounts on different social media platforms, and you may choose to visit or to interact with us through these channels. If you choose to do so, we can usually only see information stored in your public profile on the social media platform, when you are logged in to your profile, while visiting our social media account; although we may process data that you provide to us when you contact us (for example: if you create a post, or send us a private message via Facebook). The social media platform also provides us with anonymous usage statistics, which we use to improve user experience and understand activity across our sites. We do not have access to the usage data that the operator of the social network collects to create these statistics. The operator of the social media platform also processes your data, regardless of whether you yourself have a profile on the platform. In addition, some social media platforms, such as Facebook, use cookies that are stored on your terminal device when you visit our social media account, even if you do not have your own profile in the network or are not logged in. These cookies enable the social media platform to create user profiles based on your preferences and interests and to show you advertising tailored to these. -For information on the cookies we use, and the social media operators and their privacy policies please see our [Cookie Notice](https://www.mirror.co.uk/cookie-policy/). For further information on how we may receive, use and share your data see [12.4 Social media platforms](). +For information on the social media providers and their privacy policies please see our list of [Social Media Platforms](https://www.reachplc.com/site-services/social-media-cookies). For further information on how we may receive, use and share your data see [12.4 Social media platforms](). **[\*\*\* Click here to go back to 'Contents' \*\*\*]()** ## 11\. When you apply for a job with us or work at other organisations we do business with **11.1 When you apply for a Job with us** @@ -798,12 +794,13 @@ - [12.5 WhatsApp Instant messaging platform]() - [12.6 Chatbots and other onsite data collection]() - [12.7 Discount codes, vouchers and cashback accounts]() - [12.8 Affiliate Sites, such as Mirror Bingo]() - [12.9 How we work with Group Companies]() - [12.10 Transfer as part of the sale of our business]() +- [12.11 Award or charitable donation; nomination, voting and judging]() **12.1 Further data sharing by Reach** We may pass your information to our processors - companies that we use to provide services on our behalf, for example for home delivery services, event management, prize fulfilment agencies, market research or other purposes mentioned in this Privacy Notice such as analytics, direct marketing or online advertising. These processors can only use your information in accordance with our instructions and for no other purpose In addition, further to the data sharing described elsewhere in this Privacy Notice, Reach will disclose your information and co-operate with appropriate bodies and authorities in good faith where we are required to by law, a court order, a regulatory authority, or otherwise, including with the police, trading standards, regulatory authorities, other relevant authorities, or credit reference agencies. @@ -888,23 +885,67 @@ - helping improve infrastructure and delivery systems; - understanding how our services or theirs are used; - promoting safety, security and integrity across the Reach Group e.g. securing systems and fighting spam, threats, abuse, or infringement activities; - performing analytics and analysis of how you interact with the group's products and services, to facilitate business efficiencies and develop products and services that would be relevant to you; and - sharing information to deliver more relevant advertising from across the Reach Group network. +We also share information to fulfil the service to you for example: + +- When you decide to place an advertisement on Marketplace Live, through our Bookanad website, the information that you have provided will be shared with Marketplace Live, so that the publication and administration of your advertisement may be effectively managed. +- When you elect to place a notice on the InYourArea website, through our Bookanad website, the information that you have provided when creating an account, and a notice, will be shared with InYourArea so that they may manage and administer your online post. + In addition, a key way we share data across systems and Group companies is for advertising and targeting purposes. This can be based on your online behaviour on our sites, for example: - When you go onto one of our sites we can track your behaviour on those sites, or any of our other sites across our Group companies, and use this to target advertising or email content to you. For example, if you use our ecommerce site yimbly.com, we can see if you later visited one of our other sites and you may see advertising for the products you looked at based on this. If you would prefer to opt out, you can do so via the consent management pop-up. - This also applies if you open an email from us and this takes you online as we can use the information from your online behaviour to later target marketing to you. So for example if you subscribe to marketing emails on one of our regional news sites and we see you looked at sporting content on our other sites we may provide you with sport related content in your marketing emails from the regional news site. You can unsubscribe from emails at any time. - We may also upload emails (in hashed, pseudonymous form) straight to the advertising data system and this enables us to identify the same non-identifiable user across devices. So we know, for example, that the person who looks at Reach lifestyle content on their phone and then Reach fashion content on their desktop, is in fact the same non-identified person. You can unsubscribe from emails at any time. - We may also use the other data you have provided to us, combined with your online behaviour, to personalise your email campaigns. For example, if you signed up an account when browsing 'football' content on our news sites, we may classify you as a 'football intender'. Later when you go online we may see you are also interested in content on films and classify you as a 'football and films intender'. As a result you may see advertising content related to football and films, when you visit our sites. **12.10 Transfer as part of the sale of our business** If we sell part or all of our business, personal information may be one of the transferred business assets. If this happens, your information may be disclosed to any successors of our business for them to use for the purpose set out in this Privacy Notice. +**12.11 Award or charitable donation; nomination, voting and judging** + +**Nomination and voting** + +When you make a nomination or are nominated (either by a nominator, or directly by us) for an award or charitable donation, we may ask for the following personal information: + +- First name and surname of the nominator +- Telephone number of the nominator +- Email address of the nominator +- Name of the nominee +- Postal address nominee +- Email address nominee +- Telephone number of the nominee + +Personal information may also be included in the narrative of why the nominee deserves the award or charitable donation. This could include anything about the nominee's life, including sensitive data such as health information or criminal offence data about themselves or others. We may also conduct our own research to find identified nominees. We will collect the same information to the extent it is available from publicly available sources or other third parties we interview. + +When you vote for a nomination, for example via an online form, we may also collect personal information including your name, IP and email address. + +Generally, we will only process your personal information on one or more of the following legal grounds: + +**Our legitimate interests**: Where it is necessary to use your personal information for the purposes of our legitimate interests (or those of a third party). For example: + +- We have a legitimate interest in collecting the nominator's personal details (such as name, contact numbers and/or email address) from the nominator, from publicly available sources or when we find out about the nominee's story from another source, so we can contact the nominee or identified nominee to see if they are interested in taking part in the award or charitable donation process. +- We have a legitimate interest in using the nominee's/ identified nominee's personal information so we can assess their suitability to receive an award or charitable donation, including performing background checks. + +**Consent**: We may ask you for your consent to use your personal information for a specific purpose. We will explain the specific purpose for processing at the time we ask you for such consent. + +**Judging** + +When you submit a nomination for an award or charitable donation, or you are nominated for an award or charitable donation, we will review all of the information provided in line with the selection criteria. We will use the personal information provided by nominators, or compiled from its own research, to produce a shortlist for each award or charitable donation. If the nomination does not comply with the terms and conditions, then the relevant personal information will be promptly deleted. + +Personal information of shortlisted potential award or charitable donation winners (which may include both nominees and identified nominees) may be shared with the relevant award or charitable donation judging panel. The panels are made up of members selected by us and will review the shortlist to choose winners of the award or charitable donation and inform us of their decision. Alternatively we may advertise for public vote, for example in our national and regional newspapers. + +We may also contact nominators and/or nominees/ identified nominees to research their story prior to the winners being contacted. + +If you are selected as a winner of an award or charitable donation, we will use the personal data provided by the nominators to contact the winners. Winners will be contacted and asked to confirm that they are happy to be winners of the relevant award or charitable donation and for their personal information to be used for this purpose. + +The personal data may also be used to communicate & run an event, for publication in Reach print and on-line titles, and for use on social media platforms. + **[\*\*\* Click here to go back to 'Contents' \*\*\*]()** ## 13\. How we keep your data secure, why we may keep it, and countries we may transfer it to **13.1 How we keep your data secure.** @@ -1071,13 +1112,13 @@ **16.1.1 Personal Information that we collect, use and share** The table below provides a summary of the categories of your personal information Reach may have collected, the sources of that data, the reasons for collection and who we may have disclosed the data to over the last twelve months. The information gathered in this table may apply to you in different ways depending on how you have interacted with us. **Please see the keys below the table to inform the second and third column:** -

Category	Business Purpose for Disclosure	Categories of Recipients of Disclosures	Do we share this data?
Personal Information
Identifiers such as name, email address, billing information, username, any provided phone numbers, such as home, or mobile, online screen name, security questions and password.	P1, P2, P3, P4, P5, P6, P7	D1, D2, D3, D4, D5, D6, D7, D8	No
Commercial Data such as records of your purchases and transaction data.	P1, P2, P3, P4, P6, P7	D1, D2, D3, D6, D7, D8	No
Customer Records such as financial or payment information to process payments and information about your transactions and purchases with us.	P1, P7	D2, D6, D7, D8	No
Internet & electronic network activity information including, but not limited to browsing history, search history, and information regarding interactions with an internet website, application, or advertisement, including other usage data related to your use of any of our Services or other online services. Please see our Cookie Notice for further information.	P1, P2, P3, P4, P5, P6, P7	D1, D2, D3, D4, D5, D6, D7, D8	Yes
Device information and identifiers such as IP address; browser type and language; operating system; platform type; device type; software and hardware attributes; and unique device, advertising, and app identifiers.	P1, P2, P3, P4, P6, P7	D1, D2, D3, D4, D5, D6, D7, D8	Yes
Geolocation Data such as general location, and, if you provide permission, precise GPS location.	P1, P2, P3, P4, P6, P7	D1, D2, D3, D4, D5, D6, D7, D8	Yes
Sensory Data such as audio recordings if you call our customer service or volunteer this information as part of using our services and photographs in connection with your social media account	P1, P2, P5, P7	D1, D2, D6, D7, D8	No
Financial Data such as credit or debit card number, verification number, and expiration date, to process payments and information about your transactions and purchases with us.	P1, P7	D2, D6, D7, D8	No
Social media information (which may include personal identifiers, photos, location, user generated content, demographic information). If you link your account or access the Services through a third-party connection or log-in, we may have access to any information you provide to that social network depending on your privacy settings, such as your name, email address, photo, location, and current city; and information you provide to us directly through our pages on social networking and blogging platforms (e.g., Facebook, Instagram, YouTube, and Twitter).	P1, P2, P3, P4, P5, P6, P7	D1, D2, D3, D4, D5, D6, D7, D8	No
Research, survey, or sweepstakes information (including personal identifiers and user generated content) collected if you participate in a survey or sweepstakes; includes information needed for you to participate (such as contact information), and to fulfil your prize.	P1, P2, P3, P4, P5, P6, P7	D1, D2, D3, D5, D6, D7, D8	No
Inference Data including inferences drawn from any of the information identified above to create a profile reflecting a consumer's preferences, characteristics, behaviour or attitudes.	P1, P2, P3, P4, P6, P7	D1, D2, D3, D5, D6, D7, D8	No
Sensitive Personal Information
Account log-in in combination with any required security questions or password collected if you create an account with us.	P1, P2, P7	D2, D6, D7, D8	No

Category	Business Purpose for Disclosure	Categories of Recipients of Disclosures	Do we share this data?
Personal Information
Identifiers such as name, email address, billing information, username, any provided phone numbers, such as home, or mobile, online screen name, security questions and password.	P1, P2, P3, P4, P5, P6, P7	D1, D2, D3, D4, D5, D6, D7, D8	No
Commercial Data such as records of your purchases and transaction data.	P1, P2, P3, P4, P6, P7	D1, D2, D3, D6, D7, D8	No
Customer Records such as financial or payment information to process payments and information about your transactions and purchases with us.	P1, P7	D2, D6, D7, D8	No
Internet & electronic network activity information including, but not limited to browsing history, search history, and information regarding interactions with an internet website, video, application, or advertisement, including other usage data related to your use of any of our Services or other online services. Please see our Cookie Notice for further information.	P1, P2, P3, P4, P5, P6, P7	D1, D2, D3, D4, D5, D6, D7, D8	Yes
Device information and identifiers such as IP address; browser type and language; operating system; platform type; device type; software and hardware attributes; and unique device, advertising, and app identifiers.	P1, P2, P3, P4, P6, P7	D1, D2, D3, D4, D5, D6, D7, D8	Yes
Geolocation Data such as general location, and, if you provide permission, precise GPS location.	P1, P2, P3, P4, P6, P7	D1, D2, D3, D4, D5, D6, D7, D8	Yes
Sensory Data such as audio recordings if you call our customer service or volunteer this information as part of using our services and photographs in connection with your social media account	P1, P2, P5, P7	D1, D2, D6, D7, D8	No
Financial Data such as credit or debit card number, verification number, and expiration date, to process payments and information about your transactions and purchases with us.	P1, P7	D2, D6, D7, D8	No
Social media information (which may include personal identifiers, photos, location, user generated content, demographic information). If you link your account or access the Services through a third-party connection or log-in, we may have access to any information you provide to that social network depending on your privacy settings, such as your name, email address, photo, location, and current city; and information you provide to us directly through our pages on social networking and blogging platforms (e.g., Facebook, Instagram, YouTube, and Twitter).	P1, P2, P3, P4, P5, P6, P7	D1, D2, D3, D4, D5, D6, D7, D8	No
Research, survey, or sweepstakes information (including personal identifiers and user generated content) collected if you participate in a survey or sweepstakes; includes information needed for you to participate (such as contact information), and to fulfil your prize.	P1, P2, P3, P4, P5, P6, P7	D1, D2, D3, D5, D6, D7, D8	No
Inference Data including inferences drawn from any of the information identified above to create a profile reflecting a consumer's preferences, characteristics, behaviour or attitudes.	P1, P2, P3, P4, P6, P7	D1, D2, D3, D5, D6, D7, D8	No
Sensitive Personal Information
Account log-in in combination with any required security questions or password collected if you create an account with us.	P1, P2, P7	D2, D6, D7, D8	No

**Data collection key** Purposes - P1 - Performing services; including but not limited to customer service and related requests, processing orders or other transactions, managing and maintaining your account, marketing or advertorial services, analytics. @@ -1130,15 +1171,16 @@ - **Correction.** You can request that we correct inaccurate Personal Information. - **Portability.** You have the right to receive your information in an easily understandable, machine readable and transmittable form. - **Opt-out of sale or sharing.** You have the right to opt out of the sale or sharing of your Personal Information. - **Limit the use of your Sensitive Personal Information.** You have the right to limit the use or disclosure of your sensitive personal information ("SPI") to the information necessary to perform services or provide goods reasonably expected. - **Non-discrimination.** The right not to be subject to discriminatory treatment for exercising their rights under the CPRA/CPRA. -In the past 12 months, we have shared your Personal Information with third parties in the following circumstances: +In the past 12 months, we have shared your Personal Information with third parties in the following circumstances, which California law classifies as a "sale" of your Personal Information: -- supplying your data to third parties with your express consent (e.g. where you opt-in to receive notifications or create an account); +- supplying your data to third parties with your express consent (e.g. where you opt-in to receive notifications or create an account) or with promotional partners, such as when you enter a promotion; +- supplying attendee data to third parties who provide services in connection with our events, and sending your data to suppliers of certain products and services (where you have consented to hear from such third parties); - using services that help deliver interest-based ads, content and services to you and may transfer personal information to business partners for their use. California law classifies our use of these services as "sharing" your Personal Information to the companies that provide the services. This is because we allow them to collect information from our website users (e.g., online identifiers and browsing activity) so they can help serve ads, content and services more likely to interest you. **16.1.5 Do Not "Sell" or "Share" My Personal Information** California residents may opt out of the "sale" or "sharing" of their personal information. @@ -1183,13 +1225,13 @@ California residents may request and obtain a list of any third parties that we have disclosed personal information to over the previous calendar year for the purposes of sending you direct marketing about the third party's own products and services. If you would like to request this information please contact us using the [rights request form](https://docs.google.com/forms/d/e/1FAIpQLSe_S4UU9agFYuaYgp0IJr_OmXICpKF8oS8N2AaP-ybt29L-rw/viewform) or by emailing privacyofficer@reachplc.com quoting 'California Privacy Rights-(insert name of Reach Group brand)' in the subject header and state which right(s) you wish to exercise. **[\*\*\* Click here to go back to 'Contents' \*\*\*]()** **16.2 Residents of US states with applicable privacy legislation** -This section applies solely to individual residents of States with applicable privacy legislation including, but not limited to Virginia, Colorado, Connecticut, Utah, Oregon and Texas. It describes how we collect, use and share Personal Information of residents when operating our business, and their rights with respect to that Personal Information. This section should be read in conjunction with the rest of this Privacy Notice which provides further details on the nature of our data processing. +This section applies solely to individual residents of States with applicable privacy legislation including, but not limited to Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana, Delaware, Iowa, Nebraska, New Jersey and New Hampshire. It describes how we collect, use and share Personal Information of residents when operating our business, and their rights with respect to that Personal Information. This section should be read in conjunction with the rest of this Privacy Notice which provides further details on the nature of our data processing. **16.2.1 Personal Information We Collect** We may collect the following types of Personal Information about you as described below: **A. Personal Information You Provide to Us** @@ -1271,22 +1313,25 @@ - Our legal advisors and parties involved in a legal process. - To an entity involved in the sale of our business - Third parties to whom you or your agents authorise us to disclose your Personal Information in connection with products or Services we provide to you. In order to provide advertisements and content that are more relevant to you, we and our advertising and content providers may collect certain types of Personal Information when you use our Products (such as, by way of example, your email, the IP address of your device, the identifier on your mobile device, or cookies stored on your device). We may combine this information with other information we have, or that we collect through other sources, and may share the information we collect with third parties to provide interest based or targeted advertising and content, including textual and/or audio-visual ads or content. In addition, our advertising partners and Social Media Platforms may use information received from us to combine it with other information they may have obtained about you through other sources or through your relationship with them. If you would like to opt out from this use, or for more information, please see our Cookie Policy for more information. **We do not sell your sensitive personal data.** +For information on the third party advertising and analytic partners we work with please [click here](https://www.reachplc.com/site-services/third-party-cookies). For information on the social media operators and their privacy policies please see our list of [Social Media Platforms](https://www.reachplc.com/site-services/social-media-cookies). + **16.2.3 Residents Rights** Privacy laws in some US states give residents certain rights with respect to their personal data. These rights include: - **Access.** You can request a copy of the Personal Information we collected about you. - **Right to correct.** You have the right to correct inaccuracies in the personal information we collect from you, taking into account the nature of the personal information and the purposes for which we process it. - **Right to delete.** You have the right to delete personal information that you have provided or that we have obtained about you. Please note that we may deny such a request if the requested deletion falls under an exception to this right set as provided by the relevant law. Additionally, if you request the deletion of your personal information and we have obtained such information from a third-party source, we may retain such data by keeping a record of the deletion request and the minimum data necessary to ensure that your personal information remains deleted from our records and that such retained data is not used for any other purpose, or we may opt you out of the processing of such personal information for any purpose except for those allowed under the relevant legislation. - **Right to data portability.** You have the right to access and obtain a copy of your personal information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another business without hindrance, where the processing is carried out by automated means. +- **Right to Know.** You have the right to obtain a list of the third parties that have received your personal data from us. - **Right to opt out of targeted ads, sales to third parties, or profiling**. You have the right to opt-out of the processing of your personal information for purposes of: (i) targeted advertising; (ii) the sale of personal information; or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. As described in this privacy notice: - We DO process personal information for the purposes of targeted advertising; - We DO NOT sell your personal information in exchange for monetary consideration; - We DO NOT engage in profiling decisions based on your personal information that produce legal or similarly significant effects concerning you. @@ -1295,25 +1340,27 @@ **How to exercise your right to information, access, and deletion** You may exercise your privacy rights by submitting the [rights request form](https://docs.google.com/forms/d/e/1FAIpQLSe_S4UU9agFYuaYgp0IJr_OmXICpKF8oS8N2AaP-ybt29L-rw/viewform) or by emailing privacyofficer@reachplc.com quoting 'US Privacy Rights (insert name of Reach Group brand)' in the subject header and detail which right(s) you wish to exercise, and the US state you live in. **How to exercise your right to opt-out of the "sale or sharing" of your Personal Information** -- **For internet and mobile users.** If you do not wish for us or our online third-party partners (such as advertising networks) to sell or share your personal information with others, please click on the "Do Not Sell or Share My Personal Information" link in the footer of the relevant website. If you access this site and/or app from other devices or browsers, or clear your cookies on your devices or browsers, you will need to indicate your preferences again from those devices or browsers. +- **For internet and mobile users.** If you do not wish for us or our online third-party partners (such as advertising networks) to sell or share your personal information with others, please click on the "Do Not Sell or Share My Personal Information" link in the footer of the relevant website. If you access this site and/or app from other devices or browsers, or clear your cookies on your devices or browsers, you will need to indicate your preferences again from those devices or browsers. Alternatively to opt out of "sales" or "sharing" of personal information you can toggle your cookies off in the cookie preference centre or, in applicable states, enable Global Privacy Control ("GPC") on your browser. To learn more about GPC, please visit [https://globalprivacycontrol.org/](https://globalprivacycontrol.org/). - **For other offline users eg account holders:** You may also submit a request directly by submitting the [rights request form](https://docs.google.com/forms/d/e/1FAIpQLSe_S4UU9agFYuaYgp0IJr_OmXICpKF8oS8N2AaP-ybt29L-rw/viewform) or by emailing privacyofficer@reachplc.com quoting 'US Privacy Rights-(insert name of Reach Group brand)' in the subject header and state 'opt-out of third-party sale or share'. We reserve the right to ask for evidence of your residency before processing your request. **16.2.5 Our Response Time to Your Request** -We will make every effort to respond to your request within forty-five (45) days from when you contacted us. If you have a complex request, the legislation allows us up to ninety (90) days to respond. We will still contact you within forty-five (45) days from when you contacted us to let you know we need more time to respond and the reason for the extension. +We will make every effort to respond to your request within forty-five (45) days from when you contacted us. If you have a complex request, the legislation allows us up to ninety (90) days to respond. We will still contact you within forty-five (45) days from when you contacted us to let you know we need more time to respond and the reason for the extension. For particular states where the time frame for response may be shorter, we will adhere to the required legal timeframe. -Residents of certain states, including Virginia, Colorado, Connecticut, Oregon and Texas may appeal a refusal to take action on a request by contacting us by emailing privacyofficer@reachplc.com. +**16.2.6 Right to Appeal** +Residents of certain states, including Virginia, Colorado, Connecticut, Oregon, Texas, Delaware, Iowa, Nebraska, New Hampshire and New Jersey may appeal a refusal to take action on a request by contacting us by emailing [privacyofficer@reachplc.com](mailto:privacyofficer@reachplc.com). + **[\*\*\* Click here to go back to 'Contents' \*\*\*]()** -**16.3 Other residents with applicable legislation** +**16.3 Residents of other states and territories with applicable legislation** Residents may be covered by other local state data protection or privacy legislation. To exercise these rights please use the [rights request form](https://docs.google.com/forms/d/e/1FAIpQLSe_S4UU9agFYuaYgp0IJr_OmXICpKF8oS8N2AaP-ybt29L-rw/viewform), to submit a request in relation to your data rights. **16.3.1 Nevada Privacy Rights** Reach does not currently sell your personal data, as defined by Nevada Law, for monetary compensation to third parties for their own purposes. Nevada residents, however, may request that we include their name on a do-not-sell list in the event Reach were to do so in the future. Please email us at privacyofficer@reachplc.com if you want to place your name on the do not sell list. @@ -1334,8 +1381,6 @@ We may need to verify your identity before processing your request, which may require us to request additional personal information from you. In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity or locate your information in our systems, or as permitted by law. We will attempt to respond to your request within thirty (30) days. We will advise you in writing if we cannot meet your request within this time limit. To exercise these rights please use the our [rights request form](https://docs.google.com/forms/d/e/1FAIpQLSe_S4UU9agFYuaYgp0IJr_OmXICpKF8oS8N2AaP-ybt29L-rw/viewform) or contact us by emailing [privacyofficer@reachplc.com](mailto:privacyofficer@reachplc.com). - -**[\*\*\* Click here to go back to 'Contents' \*\*\*]()**

Reach Group - Privacy Notice

Full text changes — 20241202_rev01 to 20250201_rev01