The privacy policy of a leading UK-based media company has been updated, and it brings important changes to how your personal information is handled. This breakdown explains everything you need to know, from the types of data collected to the legal rights you can exercise as a user.

Introduction to the Privacy Policy

The company respects your privacy and is committed to protecting your personal data. This privacy notice explains how your data is looked after when you visit the website, regardless of where you visit from. It also outlines your privacy rights and how the law protects you. The notice is structured in layers, so you can navigate directly to specific areas such as important information, data collection, legal rights, and a glossary of terms.

Who Controls Your Data?

The company is the data controller and is responsible for your personal data. A data protection officer (DPO) has been appointed to oversee questions related to this privacy notice. If you have any concerns, you can contact the DPO via email or postal mail. The company also reminds you of your right to make a complaint to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues. However, they ask that you contact them first so they can try to resolve your concerns before you approach the ICO.

What Personal Data Is Collected?

Personal data means any information about an individual from which that person can be identified. The company groups this data into several categories:

• Identity Data: first name, last name, username, marital status, title, date of birth, and gender.
• Contact Data: billing address, delivery address, email address, and telephone numbers.
• Financial Data: bank account details and payment card details.
• Transaction Data: details of payments to and from you, and other details of products and services you have purchased.
• Technical Data: IP address, login data, browser type and version, time zone, location, browser plug-in types, operating system, and other technology on your devices.
• Profile Data: username and password, purchases or orders, your interests, preferences, feedback, and survey responses.
• Usage Data: information about how you use the website, products, and services.
• Marketing and Communications Data: your preferences for receiving marketing and your communication preferences.

The company also collects Aggregated Data, such as statistical or demographic data, which is not considered personal data in law because it does not directly or indirectly reveal your identity. If combined with personal data, however, it is treated as personal data. Importantly, the policy states that no special categories of personal data (race, ethnicity, religion, health, biometric data, etc.) or criminal conviction information are collected.

How Is Your Data Collected?

There are three main ways the company collects personal data about you.

First, through direct interactions. When you apply for products or services, create an account, subscribe to publications, request marketing, enter a competition, or give feedback, you provide personal data directly. This may include identity, contact, and financial information.

Second, through automated technologies. As you use the website, technical data about your equipment, browsing actions, and patterns is automatically collected using cookies, server logs, and similar technologies. If you visit other websites that employ the company's cookies, technical data may also be received.

Third, from third parties or publicly available sources. The company may receive technical data from analytics providers and advertising networks. For example, Google Analytics and Google DoubleClick for Publishers are mentioned as potential sources, both of which may be based inside or outside the EU.

How Your Personal Data Is Used

The company only uses your personal data when the law permits it. The most common legal bases are performance of a contract, legitimate interests, and compliance with legal or regulatory obligations. Generally, consent is not relied on as a legal basis except for third-party direct marketing via email or text message.

In a structured table, the policy lists a range of purposes and the corresponding lawful basis:

• Registering a new customer: performance of a contract.
• Processing and delivering orders: performance of a contract and legitimate interests for debt recovery.
• Managing the relationship: performance of a contract, compliance with legal obligations, and legitimate interests to keep records updated.
• Running prize draws and surveys: performance of a contract and legitimate interests to study customer behaviour.
• Administering and protecting the business: legitimate interests for business operations, IT security, fraud prevention, and legal compliance.
• Delivering relevant content and ads: legitimate interests to study customer use and inform marketing strategy.
• Using data analytics: legitimate interests to improve the website, products, and customer relationships.
• Making recommendations: legitimate interests to develop products and grow the business.

Marketing Choices

The company strives to give you choices about certain personal data uses, especially marketing and advertising. You can adjust your preferences by logging into the member area of the website. Promotional offers are based on your identity, contact, technical, usage, and profile data to determine what might be relevant to you. You will receive marketing communications if you have requested information, purchased goods or services, or entered a promotion and have not opted out.

For third-party marketing, the company will obtain your express opt-in consent before sharing your data with any company outside its group. You can opt out of marketing messages at any time by changing your preferences or using the opt-out link. Importantly, opting out of marketing does not affect other data provided for product purchases or transactions.

You can also set your browser to refuse cookies, but some website features may become inaccessible or malfunction if you do so.

Disclosures of Your Personal Data

Your personal data may be shared with several parties for the purposes described in the policy. These include internal third parties within the company group, external third parties such as service providers and professional advisers, and third parties involved in a business sale or merger. All third parties are required to respect the security of your data and treat it according to the law. They cannot use it for their own purposes.

International Transfers

The policy states that the company does not transfer personal data outside the European Economic Area (EEA) under normal circumstances. If transfers occur, they will only be to countries with adequate protection levels, using approved contracts, or to Privacy Shield-certified US providers. You can contact the company for more details on the specific mechanism used.

Data Security Measures

The company has implemented security measures to prevent accidental loss, unauthorised access, alteration, or disclosure. Access is limited to employees and third parties with a business need to know. They are subject to confidentiality duties. Procedures are in place to handle suspected data breaches, and you will be notified where legally required.

How Long Your Data Is Retained

By law, basic customer information (contact, identity, financial, and transaction data) is retained for six years after you cease being a customer for tax purposes. You can request data deletion in certain circumstances. If data is anonymised for research or statistical purposes, it may be used indefinitely without further notice to you.

Your Legal Rights

The policy outlines seven key rights under data protection law:

• Request access: you can receive a copy of your personal data and check if processing is lawful.
• Request correction: you can have incomplete or inaccurate data corrected.
• Request erasure: you can ask for deletion where there is no good reason for continued processing.
• Object to processing: you can object based on legitimate interests or direct marketing.
• Request restriction: you can ask to suspend processing in certain scenarios, such as accuracy disputes.
• Request transfer: you can request your data in a structured, machine-readable format for transfer to another service.
• Withdraw consent: you can withdraw consent at any time, though this does not affect prior lawful processing.

There is no fee for exercising these rights, unless requests are clearly unfounded or excessive. The company may request identity verification to ensure security and aims to respond within one month, which may be extended for complex cases.

Glossary and Key Terms

The policy defines important terms to help you understand its provisions. Legitimate interest refers to the business's interest in running and managing operations while ensuring the best and most secure experience for you. Performance of a contract covers processing necessary to fulfil a contract or to take steps before entering one. Compliance with a legal obligation means processing required by law.

Internal third parties are other companies within the group based in the UK or EU that provide administrative and IT services. External third parties include service providers, professional advisers, and authorities such as HMRC. Each has defined roles as processors or joint controllers.

This privacy policy recaps how your personal data is managed and protected. By understanding these key facts, you can make informed choices about your data and exercise your rights effectively.

Source: UKTN News