=================================================================== --- 20230101_rev01 +++ 20230201_rev01 @@ -1,59 +1,57 @@ ShareThis takes privacy seriously. This Privacy Notice sets out what data we collect, how we collect it, why we process it, who we may share it with and, where the data we collect is personal data, your rights with respect to such personal data. ShareThis may change this Notice from time to time by updating this page. You should check this page from time to time to ensure that you are up to date with any changes. -ShareThis is committed to processing information in accordance with applicable laws (including where applicable the European Union's General Data Protection Regulation ("**GDPR**") and the California Consumer Privacy Act ("CCPA") and as described in this Privacy Notice. For specific information about how ShareThis adheres to the GDPR and your rights as an EEA data subject please click **[here.]()** For information about how ShareThis adheres to the CCPA, please click **[here]().** +ShareThis is committed to processing information in accordance with applicable laws (including where applicable the European Union's General Data Protection Regulation ("**GDPR**") and the California Consumer Privacy Act ("CCPA") and as described in this Privacy Notice. For specific information about how ShareThis adheres to European, UK and Brazil data protection law and your rights as an EEA, UK, Swiss or Brazil data subject please click **[here.]()** For information about how ShareThis adheres to applicable U.S. Privacy laws in States such as California, Colorado, Connecticut, Nevada, Virginia, and Utah, please click **[here]().** To access information for Publishers, please visit the Publisher Information page [**here**](https://www.sharethis.com/publisher/)**.** To access Publisher Terms of Use, please click [**here**](https://sharethis.com/publisher-terms-of-use/). -Last Updated on: October 10, 2022 +Last Updated on: December 30, 2022 - * * ShareThis provides website operators ("Publishers") with customizable social sharing tools, which makes sharing online content simple. Any user of a website can easily share anything on the web with their friends on social sites, such as Facebook, Twitter, Email, Digg, Reddit and more through using one of our tools on that website ("**ShareThis Icon**"). -ShareThis also collects data about internet users and how they interact with content, websites and adverts which enables ShareThis and our Publishers, advertisers, customers and data partners to facilitate the delivery of relevant, targeted advertising online to these groups. We also carry out analytics and provide insights to understand internet users' behaviour and improve the effectiveness of online content and advertising, based on such browsing, sharing, and what is considered to be the profile of that group. +ShareThis also collects pseudonymous data about internet users and how they interact with content, websites, and advertisements while online. Some of the data is collected via our tools such as the **ShareThis Icon**, and some is collected through third-party data providers. We compile this data and provide it to our Publishers and license it to advertisers, agencies, and other businesses (our "Customers") to facilitate the delivery of relevant, targeted advertising and for a number of other reasons which are listed below. -We do this by using technology such as cookies and pixels (including pixels and cookies for our customers) ("**ShareThis Publisher Applications**") to gather information regarding the browsing and sharing activities of internet users, both on websites that use our ShareThis Icon and other websites which have our technology installed on them. We also receive data from others who operate in the data analytics and advertising industries. We analyse and aggregate the data we collect to create groups of data (called audience segments) based on defined criteria. For example, we segment into groups internet users who we believe have similar characteristics, interests, needs or behavioral patterns. Where we are able to infer that two or more browsers or devices are the same user or household, we may use that information to bolster our audience segments. +We do this by using technology such as cookies and pixels (including the pixels and cookies of our customers) ("**ShareThis Publisher Applications**") to gather information regarding the browsing and sharing activities of Internet users, both on websites that have the ShareThis Icon and similar tools installed on them. We also receive data from others who operate in the data analytics and advertising industries. We analyze and aggregate the data we collect to create groups of data (called audience segments) based on defined criteria. For example, we segment into groups internet users who we believe have similar characteristics, interests, needs or behavioral patterns. Where we are able to infer that two or more browsers or devices are the same user or household, we may use that information to bolster our audience segments. We compile this data to provide analytics to our Publishers and license it to our Customers for a number of purposes as described below, including targeted advertising. -Targeted advertising has the aim of displaying advertising which is more likely to be of interest to internet users, based on aing has the aim of displaying advertising which is more likely to be of interest to internet users, based on analyses of their recent browsing and sharing activities and interactions with the website and adverts. It is also sometimes referred to as interest-based advertising or online behavioural advertising. For more information on this type of advertising, [click here](http://www.networkadvertising.org/understanding-online-advertising). +Targeted advertising has the aim of displaying advertising which is more likely to be of interest to internet users, based on analyses of their recent browsing and sharing activities and interactions with the website and adverts. It is also sometimes referred to as interest-based advertising or online behavioral advertising. For more information on this type of advertising, [click here](http://www.networkadvertising.org/understanding-online-advertising). ## Contents [I. Data Collection and Use]() [II. The GDPR and Your Rights as an EU or UK Data Subject]() [III. The LGPD and Your Rights as a Brazil Data Subject]() -[IV. The CCPA and Your Rights as California Data Subject]() +[IV. The U.S. State Privacy Laws and Your Rights as a Data Subject]() [V. Data Sharing or Disclosure, Recipients of Your Data]() [VI. Commitments to Privacy Standards]() [VII. User Choices and Opt-out Rights]() I. **Data Collection and Use** -In order to offer our products and services, we collect and use data relating to the websites you visit to display personalized advertisements, provide analytics, and data modeling based on social sharing, by us or third parties. This data is pseudonymous in that it may not be used directly by ShareThis to identify an actual person. This data does enable our systems to recognize your computer, device and/or browser over time. +In order to offer our products and services, we collect and use data relating to the websites you visit to display personalized advertisements, provide analytics, and data modeling based on social sharing, by us or third parties. This data is pseudonymous personal data in that it may not be used directly by ShareThis to identify an actual person. This data does enable our systems to recognize your computer, device and/or browser over time. In many places, this pseudonymous data is considered personal data and/or personal information under applicable law. -In many places, this data is considered personal data as it relates to an identified or identifiable natural person. +We do not intentionally collect identifiable personal information such as your name, postal address, phone number, email address, credit card information, or anything else that can allow us or our customers to contact you directly as part of our products and services. We may collect identifiable personal information and even financial information such as payment or bank details if you are one of our Publishers or if you have a business relationship with ShareThis. -We do not intentionally collect contact information such as your name, postal address, phone number, email address, credit card information, or anything else that can allow us or our customers to contact you directly as part of our products and services. We may collect such information if you are one of our Publishers or if you have a business relationship with ShareThis. - - * * We have set out below the categories of data we process and why we process each category of data. 1. **Usage Data and Profile Information** **1.1 Usage Data** -We collect information about how _internet users_ browse the internet and interact with online content and advertisements through our ShareThis Icon, the ShareThis Publisher Applications and user interactions with advertisements on the internet. We call this "Usage Data". +We collect information about how _Internet users_ browse the Internet and interact with online content and advertisements through our ShareThis Icon, the ShareThis Publisher Applications and user interactions with advertisements on the Internet. We call this "Usage Data". Usage Data includes: - The unique IDs of the cookie(s) placed on your web browser (example: 37d387ca-f68a-11e5-b87d-0e58954c72b1) and/or a hashed version of an email address which help us recognize your browser or device over time. - Information about the user's browser and device - User agent string @@ -62,43 +60,45 @@ - Search queries from which users are directed to a webpage - Navigation from page to page - Time spent on each webpage - Interactions with the webpage, including items clicked or selected and content highlighted or copied - Ads viewed or displayed to the user and the user's interactions with those ads - Shares of content including what content is shared and where - for example, the relevant social media site (e.g., Twitter, Facebook) -- Geographic information such as country, city, state or postal code. +- Geographic information such as country, city, state, or postal code. - IP addresses - Device IDs Although the Usage Data listed above is not used by ShareThis to directly identify an actual person, it is considered to be personal data in many places. **1.2 Profile Information** -We receive information about the content of the websites that you visit and information about the audience of those websites to enable us to infer and create groups of users who have similar characteristics, interests or behavioral patterns. We combine the Usage Data with data we receive from third party advertisers, analytics vendors and data partners to create categories of data that are helpful to advertisers seeking to deliver a more personalized advertising experience. For example, if a user regularly views or shares content about shopping for a car, our systems may infer that this user may be interested in purchasing an automobile. This practice is sometimes referred to as interest based advertising, and a segment titled "interested in automobile" is sometimes referred to as an audience segment or a "profile." When we group this data into profiles, we refer to it as **"Profile Information".** +We receive information about the content of the websites that you visit and information about the audience of those websites to enable us to infer and create groups of users who have similar characteristics, interests, or behavioral patterns. We combine the Usage Data with data we receive from third party advertisers, analytics vendors and data partners to create categories of data that are helpful to advertisers seeking to deliver a more personalized advertising experience. For example, if a user regularly views or shares content about shopping for a car, our systems may infer that this user may be interested in purchasing an automobile. This practice is sometimes referred to as interest-based advertising, and a segment titled "interested in automobile" is sometimes referred to as an audience segment or a "profile." When we group this data into profiles, we refer to it as **"Profile Information".** -We can infer this Profile Information (by reference to browser identifiers, not actual names) using the information we obtain from third parties about the likely content and characteristics of the users and audiences of the websites which are visited. For example, users of a particular website may have an interest in cars and typically be within a certain age or income range. Where we are able to infer that two or more browsers or devices are the same user or household, we may use that information to bolster our Profile Information. +We can infer this Profile Information (by reference to browser identifiers, not actual names) using the information we obtain from third parties about the likely content and characteristics of the users and audiences of the websites which are visited. For example, visitors to a particular website may have an interest in cars while visitors to a different website may typically be within a certain age or income range. Where we are able to infer that two or more browsers or devices are the same user or household, we may use that information to bolster our Profile Information. -The characteristics by which we group users relate to age ranges, income ranges, education, gender, ethnicity and family composition, on the basis of the typical audience of websites they visit and content viewed. +The characteristics by which we group users relate to age ranges, income ranges, education, gender, product or activity interests and family composition (e.g., how many children in the family), on the basis of information available about the typical audience of websites they visit and content viewed. -In certain cases where Publishers that we work with utilize the "Google Analytics By ShareThis WordPress" plug-in on their websites, ShareThis uses a Google Analytics feature currently known as Google Analytics Demographics, in order to better understand the audience demographics of those Publisher websites, and to provide insights about those demographics to the Publishers that own or operate those websites. Where Google Analytics Demographics is enabled, certain Usage Data and Profile Information will be shared with Google so that we may provide demographic reporting features to those Publishers. To learn more about Google Analytics' privacy practices, please click [here](https://support.google.com/analytics/answer/6004245). To opt-out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on, please click [here](https://tools.google.com/dlpage/gaoptout), or you may also visit the [NAI consumer choice page](https://optout.networkadvertising.org/). +In certain cases where Publishers that we work with utilize the "Google Analytics By ShareThis WordPress" plug-in on their websites, ShareThis uses a Google Analytics feature currently known as Google Analytics Demographics, in order to better understand the audience demographics of those Publisher websites, and to provide insights about those demographics to the Publishers that own or operate those websites. To learn more about Google Analytics' privacy practices, please click [here](https://support.google.com/analytics/answer/6004245). To opt-out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on, please click [here](https://tools.google.com/dlpage/gaoptout), or you may also visit the [NAI consumer choice page](https://optout.networkadvertising.org/). -If you would like to see a list of the types of Profile Information used by ShareThis, including any Profile Information that is health or political in nature (U.S. only), please [click here.](https://sharethis.com/privacy-audiences/) ShareThis does not create Profile Information based upon visits to adult entertainment websites. +In the U.S., ShareThis creates modeled segments based off of demographic attributes where those attributes are aligned with the target audience of products marketed by pharmaceutical drug companies. +If you would like to see a list of the types of Profile Information used by ShareThis, including any Profile Information that is health or political in nature (U.S. only), please [click here.](https://sharethis.com/privacy-audiences/) ShareThis does not create Profile Information based on topics we believe to be sensitive under applicable law, or based on visits to adult entertainment websites. + **1.3 How we obtain Usage Data and Profile Information** -We collect Usage Data when your device visits our website, uses or interacts with our services (including sharing content with the ShareThis Icon), when your device visits Publishers' websites that use ShareThis Publisher Applications, and when your device views or clicks advertisements that we serve or are served on our behalf. We do so by using cookies placed on your browser, pixel tags, and HTTP headers (or other communication protocols) and the use of hashed email address. +We collect Usage Data when your device visits our website, uses or interacts with our services (including sharing content with the ShareThis Icon), when your device visits Publishers' websites that use ShareThis Publisher Applications, and when your device views or clicks advertisements that we serve or are served on our behalf. We do so by using cookies placed on your browser (to the extent that cookies are not-restricted by the browser), pixel tags, and HTTP headers (or other communication protocols) and the use of hashed email address. We may also use probabilistic IDs generated via the user agent string and IP address when cookies are restricted by the browser. _Our use of Cookies and other Tracking Technologies_ **Web Environment:** (desktop, tablet, and smartphone browsers) -ShareThis uses browser cookies to "tag" visitors on the websites that use ShareThis Publisher Applications. These users are given a technical identifier, such as C62414AY9324FB5671069928026P0067. +ShareThis places cookies containing a UID on the browsers of visitors to websites that use ShareThis Publisher Applications. The ShareThis Publisher Applications also may enable cookies to be placed by ShareThis partners and our Customers to enable the synchronization of unique identifiers between ShareThis and our third-party partners and Customers. -This browser cookie tracks the user's browsing data. Pixel tags are then used to transfer this browsing data to ShareThis and our customers and data partners. +**Cookies:** Small text files that contain a string of characters and uniquely identify a browser. Many browsers are initially set up to accept cookies. However, you may be able to change your browser settings to refuse or otherwise restrict cookies. Check your browser's "Help" files to learn more about handling cookies on your browser. -**Cookies:** Small text files that contain a string of characters and uniquely identify a browser. Cookies are installed on a browser by the publisher of a website as well by third parties who do not operate the website but whose JavaScript and/or pixel tags (described below) are found on the website. ShareThis cookies and cookies of our customers are installed in user browsers by the ShareThis Publisher Applications which are on Publishers' websites. Many browsers are initially set up to accept cookies. However, you may be able to change your browser settings to refuse or otherwise restrict cookies. Check your browser's "Help" files to learn more about handling cookies on your browser. +Below is a description of the cookies placed by ShareThis. | Cookie | Duration | Purpose | | --- | --- | --- | | \_stid | 1 year | ShareThis cookie ID. | | \_stidv | 10 years | ShareThis cookie ID version. | | wordpress\_test\_cookie | Session | ShareThis cookie, tests if we have access to cookies. | @@ -106,56 +106,74 @@ | st\_optout | 10 years | ShareThis cookie set to indicate that user has opted out from data collection. | | \_ga | 2 years | Google Analytics cookie used by ShareThis to distinguish users. | | \_gat | 1 day | Google Analytics cookie used by ShareThis to distinguish users. | | \_gid | 1 day | Google Analytics cookie used by ShareThis to distinguish users. | | visopt\_s | 3 months | VWO cookie to see the number of times the browser was closed and reopened. | | \_vis\_opt\_test\_cookie | Session | VWO session cookie to see if the cookies are enabled on the browser of the user or not. Helps in tracking the number of browser sessions of a visitor. | -| \_vwo\_uuid\_v2 | 1 year | VWO cookie calculates uniques traffic on a website. | +| \_vwo\_uuid\_v2 | 1 year | VWO cookie calculates unique traffic on a website. | | intercom-id-fe2c9dmj | 10 months | Intercom: Anonymous visitor identifier cookie for site visitors. | -| intercom-session-fe2c9dmj | 7 months | Intercom: Identifer for each unique browser session. Session cookie is refreshed on each successful logged-in ping, extending it to 1 week from that moment. User can access their conversations and have data communicated on logged out pages for 1 week, as long as the session isn't intentionally terminated with 'Intercom ('shutdown'), which usually happens on logout. | +| intercom-session-fe2c9dmj | 7 months | Intercom: Identifier for each unique browser session. Session cookie is refreshed on each successful logged-in ping, extending it to 1 week from that moment. User can access their conversations and have data communicated on logged out pages for 1 week, as long as the session isn't intentionally terminated with 'Intercom ('shutdown'), which usually happens on logout. | | pxcelBcnLcy | Sessions | ShareThis Tag Management System cookie to track latency on reporting beacon. | | pxcelAcc3PC | 1 day | ShareThis Tag Management System cookie to check whether third party cookies are accepted by the browser. This is only set if there is no incoming cookie in the request. | | pxcelPage\_c010 and/or pxcelPage\_c010\_B and/or pxcelPage\_c010\_C and/or pxcelPage\_c010\_D | 1 year | ShareThis Tag Management System cookie to track status of pixel rotation loading. ShareThis uses a different cookie for different groups of sites within the ShareThis network. | | usprivacy | n/a | ShareThis reads if the usprivacy cookie is present in the publisher domain. | | fpestid | 13 months | Fpestid is a ShareThis cookie ID set in the domain of the website operator. | -**Pixel tags:** These are small blocks of code on a webpage which read and place cookies. When you visit a webpage, ShareThis' pixel will see if your browser has a ShareThis cookie installed on it. If it doesn't, the pixel will install the cookie. If it does, the pixel will "read" the cookie and will send us information such as the time you viewed a webpage, the type of browser used and your IP address. This is how we learn about your interests and enable our customers to deliver targeted advertising to you. +**Pixel tags:** These are small blocks of code on a webpage which read and place cookies. When you visit a webpage, ShareThis' pixel will see if your browser has a ShareThis cookie installed on it. If it doesn't, the pixel will place the cookie. If the browser already has a ShareThis cookie, the pixel will "read" the cookie and will send us information such as the time you viewed a webpage, the type of browser used and your IP address. This is how we learn about your interests and enable our customers to deliver targeted advertising to you. **HTTP headers:** These are transmitted whenever a webpage is viewed, and contain technical information required to connect your browser to the webpage. This information may include information about the browser and the requested webpage. ShareThis collects this information. -**Hashed emails:** Hashing an email is a cryptographic function. Hashing is a way of encrypting a piece of data, like an email address, into a hexadecimal string. By doing this, each email address becomes an unrecognizable jumble of numbers and letters. This technique doesn't allow us to send you an email message or to identify who you are. However, it does allow us to recognize your browser or device in the same way that cookies help us to recognize your browser or device. ShareThis may obtain hashed emails from our advertising partners to help provide our products and services. We may also receive and hash emails you provide to our Publishers. For more information, and to better understand the choices available to you, please visit [https://thenai.org/opt-out/ama-opt-out/](https://thenai.org/opt-out/ama-opt-out/). +**Hashed emails:** Hashing an email is a cryptographic function. Hashing is a way of encrypting a piece of data, like an email address, into a hexadecimal string. By doing this, each email address becomes an unrecognizable jumble of numbers and letters. This technique doesn't allow us to send you an email message or to identify who you are. However, it does allow us to recognize your browser or device in the same way that cookies help us to recognize your browser or device. ShareThis may obtain hashed emails from our advertising partners to help provide our products and services. We may also receive and hash emails you provide to our Publishers. For more information, and to better understand the choices available to you, please visit https://thenai.org/opt-out/ama-opt-out/. **Mobile Environments:** (Mobile applications) To serve ads in mobile applications identifiers may be used, such as Google Advertising ID or Apple IDFA, depending on the operating system of your mobile device. The advertiser identifier does not identify you directly, but it enables advertisers and their technology partners to recognize your mobile device over time. Many of the mobile operating systems which provide these advertising IDs also provide the functionality to reset them and/or to record your opt-out choice. See your device manufacturer for more information or visit NAI Mobile opt-out page at [https://www.networkadvertising.org/mobile-choice/](https://www.networkadvertising.org/mobile-choice). **Connected TV Environments:** (Mobile applications) -To serve ads onto TV streaming devices and smart TVs, pseudonymous advertising identifiers may be used. The advertiser identifier does not identify you directly, but it enables advertisers and their technology partners to recognize your smart TV and/or streaming device over time. Many streaming devices and smart TVs that provide these advertising IDs also provide the functionality to reset them and/or to record your opt-out choice. See your device manufacturer for more information or visit the NAI SmartTV opt-out page at [https://thenai.org/opt-out/connected-tv-choices/](https://thenai.org/opt-out/connected-tv-choices/). +To serve ads onto TV streaming devices and smart TVs, pseudonymous advertising identifiers may be used. The advertiser identifier does not identify you directly, but it enables advertisers and their technology partners to recognize your smart TV and/or streaming device over time. Many streaming devices and smart TVs that provide these advertising IDs also provide the functionality to reset them and/or to record your opt-out choice. See your device manufacturer for more information or visit the NAI SmartTV opt-out page at https://thenai.org/opt-out/connected-tv-choices/. **Linking Environments:** (browsers and mobile apps used) To serve you personalized advertisements and provide a seamless online experience, third party data partners that we work with may link your identifiers on the different environments you use. We may enable the linking of our Usage Data through cookie syncing. We do not use plain text information that may be used by ShareThis to identify you such as your name or address to operate the linking. Our data partners may use exact linking methods by leveraging the pseudonymous data collected through our technology such as advertising partner identifiers. -You can manage cookies, change consents or opt out of personalized ads using the mechanisms described in '[User Choices'](https://sharethis.com/privacy/). +**Probabilistic IDs**: Some browsers may block or otherwise restrict our ability to place cookies in the ShareThis domain. When this occurs, ShareThis may use a combination of user agent and IP address to help us recognize a browser or device over time. +You can manage cookies, change consents, or opt out of personalized ads using the mechanisms described in '[User Choices'](https://sharethis.com/privacy/). + **1.4 How we use Usage Data and Profile Information** -In addition, we may license portions of this data to our partners for their use for targeted advertising, analytics and modeling. Where allowed by law, our customers may use this data for other uses such as addressing fraud, enhancing their security efforts or understanding macro investment trends. +We use Usage Data and Profile Information internally for the following business purposes: -Our customers who we share your data with may use this information to generate their own Profile Information. They may independently gain other demographical information about you through their own cookies or web beacons and combine it with the data we provide to them. While we require our customers to avoid merging data received from ShareThis with identifiable personal data such as a clear email address (i.e., in violation of the [NAI Code of Conduct](https://thenai.org/accountability/code-enforcement/)), the use of cookies and pixel tags by these third-party advertisers, publishers, and ad networks are subject to their own privacy policies. Please refer to the 'Recipients of Your Data' section of this Privacy Notice for more information about who we disclose your data to. +- To enable our tools to function; +- Pursuant to our relationship with Google Analytics Demographics, to enable demographic reporting features we provide to our Publishers; +- To link browsers and devices that we infer might belong to the same household; +- To enable us to sync unique identifiers; +- To enable ST to manage the security of our Website, tools, networks, and systems. +- To comply with applicable laws. +We may also use Usage Data and Profile Information and/or audience segments and license such information to our Customers for the following business purposes including (where not prohibited under applicable law): + +- To enable the delivery of targeted advertising +- To conduct market research and analytics in order to find meaningful patterns in the data that enables ShareThis to draw insights into how web Users generally behave. This may have specific application to companies seeking to better understand the characteristics of their target customer. It also may help hedge funds attempting understanding macro investment trends. +- For data modeling in order to draw inferences. For example, to create lookalike audiences models. +- To create modeled segments based off of demographic attributes. +- To enhance security features or reduce fraud, including ad fraud, +- To enhance addressability features that enable a company to recognize the same browser, device and/or user over time. + +Our Customers who we share your data with may use this information to generate their own Profile Information. They may independently gain other demographical information about you through their own cookies or web beacons and combine it with the data we provide to them. While we require our customers to avoid merging data received from ShareThis with identifiable personal data such as a clear email address (i.e., in violation of the [NAI Code of Conduct](https://thenai.org/accountability/code-enforcement/)), the use of cookies and pixel tags by these third-party advertisers, publishers, and ad networks are subject to their own privacy policies. Please refer to the 'Recipients of Your Data' section of this Privacy Notice for more information about who we disclose your data to. + 2. **Children** -ShareThis does not intentionally collect data from children and does not tailor any Profile Information to enable targeting of children under 16 years of age. If you are a parent or guardian and believe we may be processing data of children you are responsible for, please see the section on User Choices and Rights, or contact us directly. +ShareThis does not intentionally collect data from children and does not tailor any Profile Information or otherwise license data to enable targeting of children under 16 years of age. If you are a parent or guardian and believe we may be processing data of children you are responsible for, please see the section on User Choices and Rights, or contact us directly. 3. **Emails from Users with ShareThis Icon** When you share to email with the ShareThis Icon, you choose how to connect to email from your device. We will only know what content you shared, and that you did so by means of email. We do not receive any information about the email itself, for example, your email address, the email address of the recipient or the content of your email. We are not responsible for the information shared by users via the ShareThis Publisher Applications. 4. **Account Information** @@ -165,27 +183,27 @@ Many of our services can be used without registering with us. However if you are a Publisher, or represent a Publisher, and want to use some of our enhanced features, you will need to register with us. If you choose to register with us, you must be and you affirm that you are 16 years of age or older. **We do not sell or share registration information with third parties for direct marketing purposes.** 5. **Business contacts data** -We may process your personal data if you are or your employer has a business relationship with us. You could be a customer, supplier, or a prospect (e.g. a Publisher, a data provider, a social media platform, an agency, an advertiser etc.). The personal data we hold about you refers to your professional life (name, email address, billing address, office address, phone numbers, title, company you work for). We would have collected that information from exchanging emails or business cards, meeting at industry meetings or client sessions etc. We may process that data for a number of legitimate business purposes, including: a) to communicate with you within the context of our business relationship; b) to provide our products or services; c) for billing and invoicing purposes; and d) for sales, marketing and product promotional purposes ((e.g., uploading emails into LinkedIn and similar platforms to advertise new services to current and prospective customers). +We may process your personal data if you are or your employer has a business relationship with us. For example, if you're a Customer, a prospective Customer, a vendor/supplier of ours, or a business partner, we may process your data. The personal data we hold about you refers to your professional life (name, email address, billing address, office address, phone numbers, title, company you work for). We would have collected that information from exchanging emails or business cards, meeting at industry meetings or client sessions etc. We may process that data for a number of legitimate business purposes, including: a) to communicate with you within the context of our business relationship; b) to provide our products or services; c) for billing and invoicing purposes; and d) for sales, marketing and product promotional purposes ((e.g., uploading emails into LinkedIn and similar platforms to advertise new services to current and prospective Customers). This data may also be processed for the purposes set out in the section '[General purposes which apply to all data.'](https://sharethis.com/privacy/) 6. **Employee and Job Applicants' data** If you are an employee of ShareThis, or you apply for a role with ShareThis, in the US or in Europe, please refer to our HR Policy for information about how we process your data. These can be obtained from our HR department at [HR@ShareThis.com](mailto:HR@ShareThis.com). 7. **Data Collected on ShareThis.com** -This section sets out how we process data of _visitors of our corporate website_ (ShareThis.com), apart from any ['Usage Data and Profile Information'](https://sharethis.com/privacy/) and the ['Account Information'](https://sharethis.com/privacy/) which relates only to Publishers who register with us. +This section sets out how we process data of _visitors of our corporate website_ (our "Website", ShareThis.com), apart from any ['Usage Data and Profile Information'](https://sharethis.com/privacy/) and the ['Account Information'](https://sharethis.com/privacy/) which relates only to Publishers who register with us. -When you visit our website, you may choose to provide information to us voluntarily if you interact with ShareThis.com in certain ways, such as by applying for employment with ShareThis, or using one of our contact forms. This information is used only for the reasons for which it was collected, such as responding to your communication, and it is not shared with third parties other than trusted service providers who are contractually required to only use such data to fulfill the purpose for which it was collected. +When you visit our Website, you may choose to provide information to us voluntarily if you interact with ShareThis.com in certain ways, such as by applying for employment with ShareThis, or using one of our contact forms. This information is used only for the reasons for which it was collected, such as responding to your communication, and it is not shared with third parties other than trusted service providers who are contractually required to only use such data to fulfill the purpose for which it was collected. -This Privacy Notice does not apply to the privacy practices of other websites or of third parties who collect information on ShareThis.com. We encourage you to visit the applicable policies of those third parties, or visit www.aboutads.info to learn more about interest-based advertising and to see your opt-out choices from other participating companies that may be collecting and using data on ShareThis.com. +Where we enable third parties to collect pseudonymous information on ShareThis.com (e.g., using cookies and pixels), that information may be viewed as a sale of data by ShareThis under applicable in certain jurisdictions such as California. To address this, we provide you with a privacy notice when you visit the Website and the opportunity to opt-out of these third-party data collection practices on our Website. We encourage you to visit the applicable policies of those third parties or visit www.aboutads.info to learn more about interest-based advertising and to see your opt-out choices from other participating companies that may be collecting and using data on ShareThis.com. 8. **General purposes which apply to all data** There are a number of "general" reasons that ShareThis may process data on our systems. Many of them are required by applicable law and/or to help us ensure that the Internet remains a safe space. Some of them enable us to promote and grow our business. If you'd like additional information, please email privacy@sharethis.com. We may also process data for the following purposes: a) as required by applicable law; b) to cooperate with competent legal authorities such as data protection regulators, the police and the FBI; c) to enforce our terms and conditions, including by obtaining advice and conducting legal proceedings; d) to protect our operations, property and interests, and those of third parties; e) to sell and promote the sale of our business and/or assets. @@ -197,57 +215,40 @@ If you are located in Brazil, then the Brazilian General Law for the Protection of Personal Data (LGPD) applies to our processing of personal data. The LGPD grants those located Brazil a set of clear privacy rights and imposes responsibilities on ShareThis as we process the personal data of data subjects located in Brazil. The ShareThis privacy policy outlines how and why ShareThis processes personal data. This section is designed to provide more information on how ShareThis adheres to the LGPD and your rights as a data subject located in Brazil. - * * **Definition of Personal Data** -Like the GDPR, the LGPD defines personal data broadly. As such, where Usage Data and/or Profile Information relates to an individual in the Brazil, we treat it as personal data. Similarly, nearly all of the data collected from EEA and UK data subjects in the context of our normal business operations is likely to be considered personal data. This includes: a) data collected via visits to ShareThis.com; b) data collected from Customers, Publishers and business partners; and c) data collected from employees and prospective employees, as applicable. +The LGPD defines personal data broadly. As such, where Usage Data and/or Profile Information relates to an individual in the Brazil, we treat it as personal data. Similarly, nearly all of the data collected from EEA and UK data subjects in the context of our normal business operations is likely to be considered personal data. This includes: a) data collected via visits to ShareThis.com; b) data collected from Customers, Publishers and business partners; and c) data collected from employees and prospective employees, as applicable. **Special Categories of Personal Data** ShareThis does not collect nor process any special categories of personal data with respect to data subjects in Brazil. **Legal Basis for Processing** The LGPD entities seeking to process personal data to have a valid legal basis for doing so. The legal basis utilized by ShareThis include: a) consent; b) legitimate interest (i.e., where we believe that our need to process the data and/or the value we deliver by processing such data is not outweighed by the rights of the data subject); c) where necessary for the performance of a contract; and d) where processing is necessary to comply with our legal obligations. **Brazil and Data Subject Rights** Where the LGPD applies, such data subjects have certain rights, including: a) The right to be informed about the types of data being processed and the legal basis for processing; b) the right to access and see the data being processed; c) the right of rectification, to make corrections to data subject to processing; d) the right to erase data; e) the right to restrict processing of data; f) the right of data portability; g) the right to object to the processing of data and f) the right not to be subject to automated decision-making. Some of these rights apply only in certain circumstances and depend on the legal basis relied upon to process the data. If you are located in Brazil and have questions about how ShareThis implements these rights, please email us at privacy@sharethis.com. -IV. **The CCPA and Your Rights as California Data Subject** +IV. **The U.S. State Privacy Laws (e.g., CCPA) and Your Rights as a Data Subject** - * * -Starting January 1, 2020, the California Consumer Privacy Act (CCPA) provides additional privacy protections for California data subjects and users, including: +A number of U.S. states (e.g., California, Colorado, Connecticut, Nevada, Virginia, and Utah) have enacted laws that may provide additional privacy protections for data subjects and users located into those states, including: - the right to see what data we have about you, your computer or device (i.e., the right to know), +- the right to correct the data we have about you, your computer or device, - the right to delete the data we have about you, your computer or device (i.e., the right to delete), and -- the right to opt-out of the sale of data about you, your computer or device to certain third parties (i.e., the right to opt-out from sales of your information). +- the right to opt-out of the sale or sharing of data about you, your computer or device to certain third parties (i.e., the right to opt-out from sales or sharing of your information) and the right to opt-out of profiling and/or targeted ads. -The CCPA defines personal information broadly. And as such, almost all of the information we collect is considered personal information under the CCPA. California data subjects may send an email to [privacy@sharethis.com](mailto:privacy@sharethis.com) to exercise those rights of visit our data subject access page at [CCPA GDPR Data Subject Access Request](https://sharethis.com/ccpa-gdpr-data-subject-access-request-page/). California data subjects may also call us on our toll free CCPA privacy hotline at 1-800-272-1765. +These U.S. state laws define personal information broadly. And as such, almost all of the information we collect is considered personal information under these laws. U.S. data subjects may send an email to [privacy@sharethis.com](mailto:privacy@sharethis.com) to exercise those rights of visit data subject access page. California data subjects may also call us on our toll free CCPA privacy hotline at 1-800-272-1765. -We do not treat users that exercise any of the above rights differently. However, we may not be able to honor a right if doing so would violate applicable law. ShareThis does not sell data collected via our website or the data we use to operate our business. However, we transfer personal information collected via the ShareThis Publisher Applications to third parties and as such are considered to have sold data over the past twelve months under California law, including any of the Usage Data, Profile Information and/or audience segments. +We do not treat users that exercise any of the above rights differently. However, we may not be able to honor a right if doing so would violate applicable law. ShareThis does not sell data collected via our Website or the data we use to operate our business. However, we transfer personal information collected via the ShareThis Publisher Applications to third parties and as such are considered to have sold data over the past twelve months under California law, including any of the Usage Data, Profile Information and/or audience segments. -**Your California Data Subject Access and Deletion Rights** +We generally ask only for the minimum information necessary to help us process a subject access or deletion request and will keep information pertaining to your request for up to two years. If you are a customer of ShareThis with a login and password to the ShareThis platform, we ask that you first direct your request to the person or persons at your organization that administers the relationship with ShareThis. California data subjects may also call us on our toll free CCPA privacy hotline at 1-800-272-1765. -The California Consumer Privacy Act (CCPA) provides certain rights to California consumers - including the right to know the personal information that we may have about you, and the right to delete that information. ShareThis is committed to transparency, and we want California consumers to have access to personal information that we may have about them and/or the devices that they may use to access the Internet. We generally ask only for the minimum information necessary to help us process a subject access or deletion request and will keep information pertaining to your request for up to two years. If you are a customer of ShareThis with a login and password to the ShareThis platform, we ask that you first direct your request to the person or persons at your organization that administers the relationship with ShareThis. - -If you'd like to make a CCPA access or deletion request, please send an email to [privacy@sharethis.com](mailto:privacy@ShareThis.com). California data subjects may also call us on our toll free CCPA privacy hotline at 1-800-272-1765. - -If you make a subject access request as set out in this policy, you are entitled to see and delete the personal information that we have about you including any digital identifiers such as cookie IDs and mobile advertising IDs that ShareThis may store. We will confirm your request within 10 days and make a good faith attempt to fulfill your request within 45 days. - -Under the CCPA, your request to see the personal information that we have about you may include: (1) specific pieces of personal information that we may have about you; (2) categories of personal information we have collected about you; (3) categories of sources from which the personal information is collected; (4) categories of personal information that we sold or disclosed for a business purpose about you; (5) categories of third parties to whom the personal information was sold or disclosed for a business purpose under the CCPA; and (6) the business or commercial purpose for collecting or selling personal information. Most of this information is described at least generally in our privacy policy. - -**Verifying Data Subject Access and Deletion Requests** - -We may take steps to verify your request and may require you to demonstrate or attest via affidavit that you own or control the computer or device from which you are making such requests - particularly where you are seeking access to or deletion of pseudonymous personal information such as digital identifiers. - -We will fulfill requests we are able to verify so long as we are not prohibited from doing so by applicable law and/or the information is not essential to us for billing, fraud prevention or security purposes. We will share our reason(s) for denying your request in the event that we are unable to fulfill your request. If we are unable to fulfil your deletion request, we may invite you to make a request to opt-out at our privacy policy. - -**Access and Deletion Requests made via Authorized Agents** - -You may make an access or deletion request via an authorized agent by having such agent follow the process below. Please note that we will request any authorized agent demonstrate that they have been authorized by you to make a request on your behalf. And we will verify your request and/or require you to complete an affidavit as described above. We request that any authorized agent provide us with contact details such as an email address and phone number so that we may ensure a timely response to the consumer. - **CCPA Metrics for 2021** Pursuant to CCPA Regulation 999.317(g), ShareThis informs you of the following metrics:

	Total	Whole	Part	Denied
a. The number of CCPA requests to know that ShareThis received, complied with whole or part and denied in 2021	16	16	0	0
b. The number of CCPA requests to delete that ShareThis received, complied with whole or part and denied in 2021	38	38	0	0
c. The number of CCPA requests to opt-out that ShareThis received via our email form, complied with whole or part and denied in 2021	7	7	0	0

d. The median number of days within which ShareThis substantively responded to requests to know, requests to delete and requests to opt-out	Total
Requests to know	9
Requests to delete	8
Requests to opt-out	8

@@ -255,26 +256,25 @@

	Total
e. The number of opt-out requests we received via the ShareThis opt-out page or industry opt-out pages worldwide in 2021 all of which resulted in the real-time placement of an opt-out cookie by ShareThis as described in this privacy policy.	41,769,347

V. **Data Sharing or Disclosure, Recipients of Your Data** - * * -We share Usage Data, Profile Information and/or audience segments for marketing and advertising purposes with: +We sell and/or share Usage Data, Profile Information and/or audience segments with the following types of businesses, and accept for Publishers, we view each of the below as our Customers: -- Advertisers; -- Publishers; -- Advertising agencies and agency trading desks which operate technology platforms designed to deliver ads on websites and other forms of digital media; -- Agency trading desks; -- Data management platform which help advertisers and publishers organize data about Internet users; -- Investment firms and financial institutions seeking to better understand how consumers use the Internet; -- Device graph service providers who link different online identifiers to a single user; -- Advertising technology providers which hep automate the. delivery of advertisements on websites and. other forms of digital media; -- Research companies seeking to better understand consumer perceptions; -- Data brokers and other data partners. +- Publishers - We provide analytics tools for Publishers based on the data collected via the ShareThis tools. +- Advertisers and Retailers - companies seeking to better understand their customers so as to more effectively serve those customer's needs +- Advertising Agencies - companies that purchase advertising on behalf of other companies. +- Advertising Technology Companies - companies that enable the delivery of advertising, mostly via digital channels, including demand side platforms, supply side platforms, advertising exchanges and ad servers. +- Marketing Technology Companies - companies that enable the delivery of marketing messages via channels such as email and SMS. +- Data Companies - companies that process data into profiles that enable other companies to market and advertise more effectively. +- Professional Services Companies - Companies that provide high level strategy and analytic services. +- Security or Fraud Prevention Vendors - Companies that help ensure the security and reliability of their customer's data or infrastructure. +- Investment Firms - Financial services companies and investment firms seeking to better understand how consumers use the Internet. -(all, our "**Customers**") for the purposes listed in the section ['Data Collection and Use](https://sharethis.com/privacy/).' +We share this information for the purposes listed in the section ['Data Collection and Use](https://sharethis.com/privacy/).' Where the GDPR applies to Usage Data and Profile Information and we share this data with our Customers, our Customers are independent controllers in relation to their processing of such data and they process it in accordance with their own privacy policies. Customers may share the data which they process with other third parties who are not mentioned in this Privacy Notice, in accordance with their own privacy policies. As an example, they may use third party service providers to display advertising or other content on their behalf. Please review some of our Customer's privacy policies for more information: @@ -287,13 +287,13 @@ Nielsen: [https://www.nielsen.com/ssa/en/legal/privacy-policy/](https://www.nielsen.com/ssa/en/legal/privacy-policy/) Retargetly: [https://retargetly.com/privacy-policy](https://retargetly.com/privacy-policy) 1plusX: [https://www.1plusx.com/privacy-policy/](https://www.1plusx.com/privacy-policy/%20) AptivIO: [https://aptiv.io/privacy-policy](https://aptiv.io/privacy-policy) Dunn & Bradstreet: [https://www.dnb.com/ca-en/utility-pages/privacy-policy.html](https://www.dnb.com/ca-en/utility-pages/privacy-policy.html) -**2\. Other third party agents and service providers** +**2\. Other third-party agents and service providers** We share the data described in this Privacy Notice trusted agents with data storage and processing facilities such as Amazon Web Services who are required under contract to only process data according to our written instructions and we require them to use data only for the purposes of providing services to us and to implement security controls and to maintain the confidentiality of that information. Here are the categories of service providers utilized by ShareThis: - Cloud data storage providers such as Amazon Web Services; - Customer billing systems providers; - Email service providers offering tools to send emails on our behalf; @@ -309,13 +309,13 @@ We have defined retention policies for different types of personal data. We only retain data for as long as necessary for the purpose for which we process it and only as long as it remains relevant, unless we need to retain it because we are required to do so by law, to defend and exercise claims, or for regulatory reasons. **3.1 Usage Data, Profile Information and Data Collected via ShareThis.com** We retain Usage Data and Profile Information for up to 13 months from the date of collection for targeted advertising, and for up to 36 months for insights and analytics. We also retain data collected via ShareThis.com for up to 36 months for analytics and to ensure that our website functions properly. -We may aggregate and anonymise data so that it can no longer be linked to a device or individual, therefore it ceases to be personal data, and we may retain this data for longer periods. +We may aggregate and anonymize data so that it can no longer be linked to a device or individual, therefore it ceases to be personal data, and we may retain this data for longer periods. **3.2 Account Information** We retain Account Information for as long as you have an active account with us. If you have not logged into any of our services with your username and password for a period of 14 consecutive months, we may deem your account as being inactive and delete your Account Information. This could result in the loss of data you may have saved and we do not accept liability for such deletion. You always have the option to cancel your account with us at any time. Simply sign into the site and click on the My Account at the top of the page. Click on Edit Profile and then select Deactivate Account and follow the instructions. You may also request to have your Account Information removed by submitting a request to [privacy@sharethis.com](mailto:privacy@sharethis.com). @@ -343,13 +343,13 @@ ShareThis, Inc. is committed to protecting data and enabling individual privacy rights in every location we do business. Therefore, we comply with the GDPR and the EU-US and Swiss-US Privacy Shield Frameworks. In accordance with the GDPR, which is designed to empower and protect the data privacy rights of EU individuals, ShareThis makes available user consent tools (ShareThis is a registered CMP with the IAB Transparency and Consent Framework), as well as facilitating user data rights outlined throughout this notice. VII. **User Choices and Opt-out Rights** -If you do not want to receive advertisements based on Usage Data and Profile Information collected by ShareThis on your current browser, you can change and manage your preferences in relation to the collection and processing of Usage Data and Profile Information by clicking the ShareThis opt-out button available on this privacy policy. When data subjects opt-out, ShareThis will stop transferring data about their browser or device to third parties but does not otherwise treat those users differently. +If you do not want to receive advertisements based on Usage Data and Profile Information collected by ShareThis on your current browser, you can change and manage your preferences in relation to the collection and processing of Usage Data and Profile Information by clicking the ShareThis opt-out button available on this privacy policy. When data subjects opt-out, ShareThis will stop profiling, engaging in targeted advertising and/or selling or otherwise transferring data about their browser or device to third parties in accordance with applicable law. If you do not want to receive ads based on Usage Data collected by ShareThis whatever device or browser used, you must opt-out from our services for each device and each internet web browser. **Click below to "Limit Ad-Tracking" function on mobile devices:** Instructions by Google for most Androids: [Google Play Help](https://support.google.com/googleplay/answer/3405269) @@ -377,15 +377,15 @@ [European Interactive Digital Advertising Alliance ("EDAA") Opt-Out Platform](http://www.youronlinechoices.com/) The [Ghostery browser extension](https://www.ghostery.com/products/) is also a good tool to see a list of all third-party cookies on each website you visit and allows you to selectively opt out. **Note:** -The opt-out tools above are currently cookie-based ie they set a cookie on your browser which tells us that you have opted out. This means that the opt-out will only function if your browser is set to accept third party cookies. If your browser is set to automatically reject cookies or if you remove all cookies from your browser, the opt-out mechanism will not work since we would not see an opt-out cookie on your browser. +The opt-out tools above are currently cookie-based i.e., they set a cookie on your browser which tells us that you have opted out. This means that the opt-out will only function if your browser is set to accept third party cookies. If your browser is set to automatically reject cookies or if you remove all cookies from your browser, the opt-out mechanism will not work since we would not see an opt-out cookie on your browser. -Also keep in mind that cookies are browser based, therefore if you change browsers, operating systems or computers you would need to opt out again. +Also keep in mind that cookies are browser based, therefore if you change browsers, operating systems, or computers you would need to opt out again. **Mobile environment:** While the opt-out methods described above often work for mobile web browsing, they are cookie-based and are therefore less reliable in mobile "app" environments that may not accept interest-based advertising cookies. Instead, you can typically opt out at the mobile platform level by the "limit ad tracking" function within the settings, as described below. Though we do not collect data from mobile apps for interest-based advertising, we or third parties we work with may use such data collected by others in delivering interest-based ads. @@ -401,13 +401,13 @@ To use the "Limit Ad-Tracking" option, follow the instructions provided by Apple here: [Apple Support Center](https://support.apple.com/en-us/HT202074). Please note that this is a device setting and will disable interest-based ads from all providers, and not just for ShareThis. **Do Not Track:** -You may also stop the collection of your Usage Data by using the do-not-track function of your browser. ShareThis recognizes these do-not-track signals from your browser. As required by law, or where we are able to ascertain that such signals are enacted by you and not set by default by your browser, we will consider them to be an indication that you have opted out. +You may also stop the collection of your Usage Data by using the do-not-track function or similar privacy controls of your browser. ShareThis recognizes these do-not-track signals from your browser. As required by law, or where we are able to ascertain that such signals are enacted by you and not set by default by your browser, we will consider them to be an indication that you have opted out. **Onward Transfer/Privacy Shield:** ShareThis complies with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Frameworks as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union and the United Kingdom and/or Switzerland to the United States in reliance on Privacy Shield. The Privacy Shield is administered by the US Department of Commerce regarding the collection, use, and retention of personal information from European Union member countries as well as Switzerland and the United Kingdom. ShareThis has certified that it adheres to the Privacy Shield Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement and Liability. If there is any conflict between the policies in this privacy notice and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification page, please visit [https://www.privacyshield.gov](https://www.privacyshield.gov/). In the context of an onward transfer, ShareThis is responsible for the processing of personal data it receives under the Privacy Shield and subsequently transfers to a third party acting as an agent on its behalf. ShareThis shall remain liable under the Privacy Shield principles if its agent processes such personal data in a manner inconsistent with the Privacy Shield principles, unless the ShareThis proves that it is not responsible for the event giving rise to the damage.

ShareThis Privacy Notice

Full text changes — 20230101_rev01 to 20230201_rev01