Aller Integrity Policy

LEGITIMATE INTEREST AS LEGAL BASIS

Aller Media are basing the processing of data on legitimate interest (opt out) as the legal basis under the GDPR law. Our purpose of using data in connection with the targeting of advertisements is a balance between our end users' right to privacy and funding free and independent journalism. In order to make use of the legitimate interest option, we focus on good control over data, good transparency and effective control options for our end users.

RESTRICTIONS OF THIRD-PARTY VENDORS

Aller Media focus on good transparency and control options for our end users. In order to give end users such control, we must have control over which third parties have access to data, and for what purposes they can use data.

Aller Media are therefore limiting the number of third-party vendors that can be used in connection with digital purchases on websites connected to Aller Media.

APPROVED THIRD-PARTIES

This list applies to both direct and programmatic buy. Any other actor who does not appear on this list will not be able to buy from Aller Media.

SSP that are on Aller Media’s inclusion list:

Google (Doubleclick), Adform, Improve Digital, Magnite (Rubicon), OMG Zero (on Adform platform), Matterkind (on Adform platform), MSupply (on Xandr platform), C-alt (on Adnuntius platform), Kobler (Essens)

DSP that are on Aller Media’s inclusion list:

Google DV360, Adform, Xandr (AppNexus), BidTheatre, Delta Project, RTB House, The Trade Desk, Criteo, Widespace (Azerion), Emerse

Changes will occur.

If you are cooperating with a media agency and you are unsure of which tools they can use, please contact your agency. The agencies are informed about our inclusion list.

If you wish to add a third-party which is not on our inclusion list. Please contact our GDPR department at [email protected]

Please notice that non-compliance of our new guidelines regarding third-parties does not provide grounds for compensation.

Aller Media Group (“Aller Media”)

Background

Purpose and scope. This Data Policy sets out conditions for processing of data in connection with advertising campaigns that run on one of Aller Media’s Publisher Services.

Other agreements. If a party has a written agreement with Aller Media in connection with advertising campaigns that run on one of Aller Medias Publisher Services, this Data Policy forms an integral part of such agreement. In the event of conflict, the written agreement prevails.

Definitions

Advertiser. A company that advertises a product, a service, or another offering.

Applicable Law. Applicable laws and regulations, e.g., the Norwegian Personal Data Act, The Norwegian Ecom Act and the GDPR.

Company. Advertiser and/or Media Agency.

Data. Any data collected from or processed on one of Aller Media’s Publisher Services when delivering or measuring advertisements (whether the data is personal data or not). For instance, user information (such as device ID, browser type, OS type, IP address and cookies), information concerning the performance of an advertisement (such as number of viewings and number of clicks), and/or information stored on a user device using cookies or similar technologies.

Ecom Act. The Norwegian Act no. 83 of 4 July 2003 relating to Electronic Communication.

GDPR. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Media Agency. A company that acts on behalf of advertisers in connection with advertising campaigns.

Personalization. The collection and processing of Data about users of a website or an app over time to customize advertising for them in other contexts, i.e. on other websites or apps. Typically, the content of the website or app is used to make inferences about the users’ interests, which inform future selections of advertisements.

Publisher. Aller Media.

Publisher Service. Any digital service that a publisher owns or sells advertising space on.

Purposes.

Permitted Purposes. Advertisement selection, delivery, reporting; the collection of Data, combination of Data with previously collected Data, selection and delivery of advertisements for users, measuring the delivery and effectiveness of such advertisements. This includes the use of previously collected Data about users’ interests in order to select advertisements, use of Data in connection with selecting advertisements based on approximately geographical location, use of Data about what advertisements were viewed, how often they were viewed, when and where they were viewed, and whether the user performed any actions in connection with the advertisement, e.g., by clicking on an advertisement or making a purchase.

For the purpose of ensuring security and prevent advertisement fraud it is permitted to use collected Data, including automatic received Data (e.g., “user agent data”), precise location data or actively scan for Data from the Publisher (e.g., screen resolution), further described under TCF 2.0 Special Purpose 1.

IAB TCF 2.0 Purpose 2, 4, 7, 9, Function 1 (in combination with Purpose 4) and Special Purpose 1 and 2 corresponds to Permitted Purposes as described above.

Prohibited Purposes. Attempt to re-identify or connect different devices, browsers or apps by using automatic received Data (e.g., “user agent data”), or by actively scan for other Data from the Publisher (e.g., screen resolution) to decide that two or several devices, browsers or apps belong to the same person or household by using probability calculation (probabilistic methods”). Collect or use precise location data, i.e., with an accuracy estimated with a radius of 500 meters or less. Collect and/or use Data derived from the Publisher to build and/or enrich advertisement profiles used to selects what advertisements a user shall see.

IAB TCF 2.0 Purpose 3 and 5, Function 2 and 3 and Special Function 1 and 2 corresponds to the Prohibited Purposes described in this section.

Vendor. A company that supplies tools to Advertisers or Media Agencies, which enable or support advertising campaigns that run on one of Aller Media’s Publisher Services.

General

Roles and responsibilities. The Publisher, the Advertiser and the Media Agency are responsible for fulfilling their respective obligations pursuant to Applicable Law. In connection with Data processed under this Data Policy, the Advertiser or Media Agency do not act as data processors for, or as joint data controllers together with, the Publisher. The Advertiser and the Media Agency shall respect this Data Policy and ensure that their processing of Data is in accordance with Applicable Law (including by ensuring that they have legal basis for the processing and by providing information to the data subjects).

Limitation of purpose. The Advertiser and the Media Agency shall only process Data for the Permitted Purposes. The Data shall not be processed for Prohibited Purposes. The Advertiser and the Media Agency must ensure a separate legal basis if they use previously collected information from sources other than the Publisher Service, and if they combine such information with the Data from the Publisher Service.

Scripts. A Publisher may, to ensure compliance with Applicable Law and this Data Policy, monitor and restrict the use of scripts or other tools that are used on a Publisher Service. Such restrictions may affect the delivery and the measurement of advertisements. The Advertiser and the Media Agency shall respect such restrictions.

Collaboration. Within the framework of the Data Policy, the Publisher and the Companies shall assist, collaborate with and provide information to each other, using reasonable endeavors, to fulfil obligations pursuant to Applicable Law, such as to meet data subjects' rights and to provide privacy information.

Personal data. In connection with advertising campaigns, the Publisher and the Companies shall not exchange or provide access to data that may contribute to identifying the users (e.g., by referring to their names or email addresses). Nor shall one share or provide access to children's personal data or special categories of personal data (sensitive data), unless specific written consent has been provided and it is permitted according to Applicable Law.

Obligations of Aller Media

Scripts. A Publisher shall use reasonable endeavors to inform Media Agencies and/or Advertisers of which restrictions that may be imposed on the use of scripts or other tools on one of Aller Media’s Publisher Services.

Cookies. On a Publisher Service, the Publisher shall comply with the Ecom Act, including the obligation to inform about the use of cookies (which will contain information on the Permitted Purposes).

Information. The Publisher shall inform their users about the Advertisers' processing of Data for the Permitted Purposes.

Tools. The Publisher shall use reasonable endeavors to map a Vendor's ability to operate according to Applicable Law and this Data Policy, and to enter into necessary agreements with the company in question. The Publisher, exercising their discretion, may refuse to use specific Vendors.

Obligations of the Advertisers

Notification. The Advertiser shall, before advertisements are delivered and measured, and before a Vendor may be used, notify the Publisher of the identity of the controlling Advertiser or Vendor. The Advertiser shall ensure that the Media Agency and the Vendor have been provided with this Data Policy.

Obligations of the Media Agencies

Notification. The Media Agency shall, before advertisements are delivered and measured on behalf of an Advertiser, and before a Vendor is used, notify the Publisher of the identity of the controlling Advertiser or Vendor. The Media Agency shall use reasonable endeavors to introduce the Publisher to each Advertiser or Vendor to facilitate the Publisher to conclude an agreement with the company in question, should the Publisher deem it desirable. As a minimum, the Media Agency shall ensure that the Advertiser and the Vendor have been provided with the Data Policy.

Duty to investigate. The Media Agency shall use reasonable endeavors to familiarize with relevant terms and conditions of any agreements between the Publisher and Advertisers of which the Media Agency acts on behalf, as well as relevant terms and conditions of any agreements between the Publisher and Vendors. The Media Agency shall refrain from, on their own or others' behalf, using Data in breach of such agreements.

Obligations of the Advertisers and the Media Agencies

Data security. A Company shall maintain appropriate technical and organizational security measures to protect the Data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access. The Company shall limit access to the Data to personnel on a need-to-know basis and ensure that such personnel are subject to appropriate confidentiality obligations.

Data security breach. In the event of a security breach involving the Data, the Company shall notify the Publisher without undue delay, in order for the involved parties to properly respond to and address any data subject risks. The involved parties shall collaborate with regards to potential notification requirements to the data protection authorities. Without the Publisher's prior written approval, the Company is not entitled to mention or refer to the name or trademark of the Publisher in any breach notification to a supervisory authority or to the affected data subjects, unless it is strictly necessary in order to comply with Applicable Law and provided the Publisher has been duly notified.

Data transfer. A Company shall not transfer personal data (in the meaning of the GDPR) to a third country or an international organization unless the conditions laid down in Chapter V of the GDPR have been met and the Publisher has received prior written notice of the transfer. The Company is responsible for the lawfulness of such transfer.

Disclosure. A Company may only disclose or give a third party access to Data (for example data processors or measurement companies) to the extent such disclosure is required to fulfil the Permitted Purposes and provided the company ensures that the third party only processes Data as permitted in this Data Policy.

Sanctions

Exclusion. If the Publisher has reasonable grounds to believe that a Company acts contrary to this Data Policy, the Publisher is entitled to temporarily stop a campaign and/or exclude the Company from running advertising campaigns on Aller Media’s Publisher Services. Such exclusion shall not be deemed a breach of any advertising campaign agreements, and it shall not exempt the Company from fulfilling any other agreements it may have with the Publisher.

Changes. The Publisher may change this Data Policy from time to time. The changes will be binding once they have been published on the Publisher's website or otherwise communicated to the Company, or – if the changes are substantial – 30 days following the notice of change, unless the change must enter into force immediately to comply with Applicable Law.

Notices. When this Data Policy stipulates that a notice be sent in writing, it may also be sent by email.

In Aller Media we will register all our partners in our B2B CRM system because you are important to us and we want to keep in contact with you.

The reason why we save your information is either because you are employed in a company that buys products and services from Aller Media or because we see you as a potential buyer. Our brands are Dagbladet, Dagbladet Magasin, dagbladet.no, dinside.no, KK, kk.no, Se og Hør, Se og Hør Extra, Børsen, seoghør.no, lommelegen.no, sol.no, vi.no, elbil24.no, kode24.no, Allers, Jeger, Vakre Hjem & Interiør, PåTV and Adlink.

The information we store is your name, email, title and possibly your phone number.

We also register information regarding which B2B events we would like to invite you to. Aller Media is responsible for processing the data we have stored about you.

Within the framework of the applicable legislation, you have the following privacy rights:

• Right to information. You have the right to receive more information about our use of your personal data.
• Right to insight. You have the right to receive a copy about your personal data.
• Right to correction. You have the right to correct wrongful information about you. You can update your information through your user account. If there is other information you wish to correct or if you do not have a user account, please contact us directly.
• Right to be erased. You have the right to ask for all your personal data to be erased if we no longer need them.
• Right to restrict the processing of your personal data. You have the right to request that we stop using your personal data.
• Right to have information transferred. In certain circumstances, you have the right to be provided with personal data that you have given us in a format that enables you to transfer the personal data to another organization. You may also have the right to have your personal data transferred directly from us to the organization. This right only applies to information that is processed using automated methods and that is based on consent from you or that is processed as part of fulfilling an agreement with you. This right only covers information that you have given us, either directly through, for example, registering a user account or that has been generated through your use of our services.
• The right to object to the processing of personal data. You have the right to object to our use of your personal data, for example by objecting to marketing.
• Right to prevent automated decisions. You have the right not to be subject to automated decision-making processes with legal or similar effect (for example, automated credit assessment). At present, we do not use automated decisions.

There are exceptions to the rights that are described above. These exceptions follow from legislation and may mean that access to certain information is not granted or that information cannot be deleted. You can get more information about these exceptions by contacting us or the Norwegian Data Protection Authority.

You can use your rights, and get more information about which exceptions and limitations apply, through your contact in Aller Media or by contacting us at [email protected]

If you believe that we have processed your personal data in a way that is not according to privacy legislation, please contact us, so that we can provide answers and clear up any misunderstandings. You also have the right to lodge a complaint with the Norwegian Data Protection Authority.

The legal basis for this use of information is our legitimate interest in sending offers and information that are relevant to you and the company you work for.

Your information will be stored in our database as long as you are working for a company that Aller Media has an interest in.

For further information about privacy policy in Aller Media you can contact us:

Email: [email protected]

Address:

Aller Media AS

V/Personvern

Postboks 1169, Sentrum

0107 Oslo