Privacy & Cookie Policy Update: Key Facts

A France-registered media company has issued a refreshed privacy and cookie policy, setting out the rules that govern how it collects, uses, shares, and stores personal data. The policy applies to visitors of its websites and to anyone who fills in forms, interacts with the site, or corresponds with the company by phone, email, or other means. According to the document, by visiting the website, users accept and consent to the practices described. The data controller is a company registered in France under company number 498 647 882, with its registered office at RCS Nanterre. A nominated representative has been appointed for the purposes of the relevant data protection legislation.

The update arrives as businesses across Europe continue to refine their compliance with the General Data Protection Regulation, or GDPR. The regulation, which took effect in May 2018, requires organisations to be transparent about the personal data they process, to have a lawful basis for processing, and to uphold a range of individual rights. Privacy policies and cookie policies are therefore not merely formal documents; they are public statements that explain how a company meets those obligations. The revised policy covers eight main areas: information collected, uses of information, disclosure, storage, user rights, cookies, blocking cookies, and policy changes.

Headline and Key Facts

• The policy applies to personal data collected from users through website forms, site interactions, phone calls, emails, and other correspondence.
• Data collected can include name, address, email address, phone number, preliminary business information, and business location.
• Technical information is collected automatically during visits, often through cookies, to improve browsing experience and identify where the site needs improvement.
• Information may also be received from other websites operated by the company or from third parties such as business partners, subcontractors, advertising networks, analytics providers, and search information providers.
• Uses of data include performing contracts, providing requested products and services, marketing similar goods and services with an opt-out option, notifying service changes, administering the site, troubleshooting, data analysis, testing, research, statistics, surveys, improving content presentation, enabling interactive features, maintaining security, measuring advertising effectiveness, and complying with record-keeping obligations.
• Disclosure may be made to group members, business partners, suppliers, subcontractors, advertisers, advertising networks, analytics providers, and search engine providers.
• Personal information may also be disclosed in business sale or acquisition scenarios, to comply with legal obligations, to enforce terms of use, or to protect rights, property, or safety.
• Data is stored on secure servers within the European Economic Area for a period of 10 years, with security measures that include a secure firewall, anti-virus protection software, encryption, and regular backups.
• Users have legal rights to be informed, access, rectification, deletion, restriction, portability, objection, and rights related to automated decision-making.
• Requests to exercise rights can be made in writing, and a small administrative fee of no more than £10 may apply in some cases.
• The cookie policy covers analytical and performance cookies, functionality cookies, and targeting cookies. Third parties may also use cookies.
• Users can block cookies through browser settings, but blocking may affect the ability to use the website or access all its parts and functionalities.

Scope and Data Controller

The policy explains that it should be read alongside any other documents referred to in it. It disposes the basis on which personal data collected from users, or provided by users, will be processed. The company asks users to read the policy carefully to understand its visions and practices regarding personal data and how it will manage it. The document states that by visiting the website, users are accepting and consenting to the practices described.

For GDPR purposes, the data controller is a company registered in France under company number 498 647 882, with its registered office at RCS Nanterre. A nominated representative has been appointed for the purposes of the Act. This identification matters because GDPR requires data controllers to provide clear information about their identity and contact details. The policy also indicates that the nominated representative handles questions, comments, and requests about the privacy policy.

Information Collected from Users

The policy divides the information it collects into three broad categories. The first is information users give directly. This is provided when users fill in forms on the websites, interact with the site, or correspond with the company by phone, email, or otherwise. It includes data supplied when registering to use the site and when reporting an issue with the site. The information may include name, address, email address, phone number, and preliminary information about a user's business and its location.

The second category is information collected automatically about a user's visit. This generally covers technical information and is regularly collected through small data files called cookies. The company says this data allows it to offer a good experience when browsing the site and to indicate where the site requires improvement. More detail on how cookies work, which cookies are used, and why can be found in the cookie policy.

The third category is information received from other sources. This includes information received if a user uses any of the other websites operated by the company. In that situation, the company says it will inform users when it collected that data if it intends to share it internally. It will also explain the purpose for sharing the data. The category also includes information from third parties such as business partners, subcontractors in technical services, advertising networks, analytics providers, and search information providers. The company says it will notify users when it receives information about them from those sources and the purposes for which it intends to use that information.

How Information Is Used

All information collected or received, whether personal or technical, may be used in a number of ways. The policy lists these uses in detail. The company may use data to carry out obligations arising from contracts entered into between the user and the company and to provide information, products, and services requested by the user. It may also provide information about other goods and services offered by the company or selected partners that are similar or relevant to those already purchased or enquired about. Such contact will only be made by email, phone, or SMS, and users can opt out at any time.

Other uses include notifying users about changes to services; administering the site and internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes; improving the site to ensure content is presented in the most effective manner for users and their computers; allowing users to participate in interactive features when they choose to do so; keeping the site safe and secure; measuring or understanding the effectiveness of advertising served to users and others; delivering relevant advertising; and complying with record-keeping and information storage obligations and policy.

When information is received from other sources, the company says it will combine that information with data given directly by users and data collected about them. It will use the combined information for the purposes outlined above, depending on the types of information received. This kind of data combination is common in modern digital businesses because it can create a more complete picture of user interests and needs, but it also increases the importance of transparency and lawful processing.

Disclosure of Information

The policy states that the company may share user information with any member of its group; business partners, suppliers, and subcontractors for the performance of any contract entered into with them or with the user; advertisers and advertising networks that require the data to select and serve relevant adverts to users and others; and analytics and search engine providers that assist in the improvement and optimisation of the site.

For advertisers, the policy says such information would not include anything that would make an individual identifiable to the advertisers. However, the company will provide them with aggregate information about users, for example that 500 users live within a particular area, to help them reach the kind of audience they want to target. The company may also use personal data collected from users to enable it to comply with advertisers' wishes by displaying their advertisement to their selected target audience.

The policy also lists circumstances in which personal information may be disclosed to third parties. These include the event that the company sells or buys any business or assets, in which case personal data will be disclosed to the prospective seller or buyer; if the company or substantially all of its assets are acquired by a third party, in which case personal data held about clients will be one of the transferred assets; if the company is under a duty to disclose or share personal data to comply with any legal obligation, or to enforce or apply terms of use and other agreements; and to protect the company's rights, property, or safety, or those of its clients or others.

Storage and Security

All information provided to the company is stored on its own or its selected business partners' secure servers within the European Economic Area for a period of 10 years. The company says it will take reasonable steps to protect user information in accordance with the policy. These steps include installing a secure firewall, using anti-virus protection software, encrypting data, and carrying out regular backups.

Where a user has been given or has chosen a password that enables access to certain parts of the site, the user is responsible for keeping the password confidential. The policy asks users not to share a password with anyone. It also notes that the transmission of information via the internet is not completely secure. Although the company will do its best to protect personal data, it cannot guarantee the security of any data transmitted to the site, and any such transmission is at the user's own risk. Once information has been received, the company says it will use strict procedures and security features to try to prevent unauthorised access.

Your Rights Under Law

The policy sets out a list of legal rights that individuals have in respect of their personal information. These include the right to be informed about the collection and use of personal information; the right of access to information to verify the legality of its use; the right to request that inaccurate or incomplete information is rectified; the right to request the deletion or removal of information where there is no further reason for the company to use it, such as when a user has withdrawn consent; the right to restrict the use of information; the right to obtain and reuse the information for the user's own purposes; the right to object to certain uses, such as for marketing purposes; and the right not to be subject to a decision that has a legal effect and is based on an automated decision.

Users who wish to exercise any of these rights may do so at any time by writing to the company at the address given in the policy. In some cases, the company is permitted to charge a small fee of no more than £10 in respect of administrative costs. If a user would like to request the information held about them, the policy asks them to send an email with a personal ID document and to give specific details of the information they want, such as user account information.

The policy also notes that the site may from time to time contain links to and from the websites of partner networks, advertisers, and affiliates. If a user follows a link to any of those websites, the user should note that those websites have their own privacy policies and that the company does not accept any responsibility or liability for those policies. Users are advised to check those policies before submitting any personal data to those websites.

Cookies and Tracking Technologies

The cookie policy section explains that the website uses cookies to distinguish users from other users of the website. It says this provides a better experience when browsing and helps the company improve the website. By continuing to browse the website, users are agreeing to the use of cookies as set out by the policy.

The policy describes three main types of cookies. Analytical and performance cookies collect information used either in aggregate form to help the company understand how its websites are being used or how effective its marketing campaigns are, or to help customise the websites for users. Functionality cookies are used to recognise users when they return to the website. This enables the company to personalise content, greet users by name, and remember preferences such as choice of language or region. Targeting cookies record a user's visit to the website, the pages visited, and the links followed. The company may share this information with third parties, as explained in the privacy policy.

The policy also warns that third parties, including advertising networks and providers of external services such as web traffic analysis services, may also use cookies over which the company has no control. These cookies are likely to be analytical or performance cookies or targeting cookies. This disclosure reflects a common structure in digital publishing, where first-party and third-party cookies work together to support content, advertising, and analytics.

Blocking Cookies

Users can block cookies by activating the setting on their browser that allows them to refuse the setting of all or some cookies. However, the policy warns that blocking cookies may affect the ability to use the website. In particular, users may not be able to access all or parts of the website or use the functionalities contained on it. This caveat is important because many modern websites rely on cookies for core functions such as logins, preferences, security, and content delivery.

The policy states that any changes made to the privacy policy in the future will be posted on the same page. Users are asked to check back frequently to see any updates or changes. Questions, comments, and requests regarding the privacy policy are welcomed and should be addressed to the nominated representative. The document therefore sets out both the company's current practices and the mechanism by which those practices may be updated over time.

Source:Silicon UK News