Data Policy (english)

Aller Media Group (“Aller Media”)

Background

Purpose and scope. This Data Policy sets out conditions for processing of data in connection with advertising campaigns that run on one of Aller Media’s Publisher Services.

Other agreements. If a party has a written agreement with Aller Media in connection with advertising campaigns that run on one of Aller Medias Publisher Services, this Data Policy forms an integral part of such agreement. In the event of conflict, the written agreement prevails.

Definitions

Advertiser. A company that advertises a product, a service, or another offering.

Applicable Law. Applicable laws and regulations, e.g., the Norwegian Personal Data Act, The Norwegian Ecom Act and the GDPR.

Company. Advertiser and/or Media Agency.

Data. Any data collected from or processed on one of Aller Media’s Publisher Services when delivering or measuring advertisements (whether the data is personal data or not). For instance, user information (such as device ID, browser type, OS type, IP address and cookies), information concerning the performance of an advertisement (such as number of viewings and number of clicks), and/or information stored on a user device using cookies or similar technologies.

Ecom Act. The Norwegian Act no. 83 of 4 July 2003 relating to Electronic Communication.

GDPR. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Media Agency. A company that acts on behalf of advertisers in connection with advertising campaigns.

Personalization. The collection and processing of Data about users of a website or an app over time to customize advertising for them in other contexts, i.e. on other websites or apps. Typically, the content of the website or app is used to make inferences about the users’ interests, which inform future selections of advertisements.

Publisher. Aller Media.

Publisher Service. Any digital service that a publisher owns or sells advertising space on.

Purposes.

Permitted Purposes. Advertisement selection, delivery, reporting; the collection of Data, combination of Data with previously collected Data, selection and delivery of advertisements for users, measuring the delivery and effectiveness of such advertisements. This includes the use of previously collected Data about users’ interests in order to select advertisements, use of Data in connection with selecting advertisements based on approximately geographical location, use of Data about what advertisements were viewed, how often they were viewed, when and where they were viewed, and whether the user performed any actions in connection with the advertisement, e.g., by clicking on an advertisement or making a purchase.

For the purpose of ensuring security and prevent advertisement fraud it is permitted to use collected Data, including automatic received Data (e.g., “user agent data”), precise location data or actively scan for Data from the Publisher (e.g., screen resolution), further described under TCF 2.0 Special Purpose 1.

IAB TCF 2.0 Purpose 2, 4, 7, 9, Function 1 (in combination with Purpose 4) and Special Purpose 1 and 2 corresponds to Permitted Purposes as described above.

Prohibited Purposes. Attempt to re-identify or connect different devices, browsers or apps by using automatic received Data (e.g., “user agent data”), or by actively scan for other Data from the Publisher (e.g., screen resolution) to decide that two or several devices, browsers or apps belong to the same person or household by using probability calculation (probabilistic methods”). Collect or use precise location data, i.e., with an accuracy estimated with a radius of 500 meters or less. Collect and/or use Data derived from the Publisher to build and/or enrich advertisement profiles used to selects what advertisements a user shall see.

IAB TCF 2.0 Purpose 3 and 5, Function 2 and 3 and Special Function 1 and 2 corresponds to the Prohibited Purposes described in this section.

Vendor. A company that supplies tools to Advertisers or Media Agencies, which enable or support advertising campaigns that run on one of Aller Media’s Publisher Services.

General

Roles and responsibilities. The Publisher, the Advertiser and the Media Agency are responsible for fulfilling their respective obligations pursuant to Applicable Law. In connection with Data processed under this Data Policy, the Advertiser or Media Agency do not act as data processors for, or as joint data controllers together with, the Publisher. The Advertiser and the Media Agency shall respect this Data Policy and ensure that their processing of Data is in accordance with Applicable Law (including by ensuring that they have legal basis for the processing and by providing information to the data subjects).

Limitation of purpose. The Advertiser and the Media Agency shall only process Data for the Permitted Purposes. The Data shall not be processed for Prohibited Purposes. The Advertiser and the Media Agency must ensure a separate legal basis if they use previously collected information from sources other than the Publisher Service, and if they combine such information with the Data from the Publisher Service.

Scripts. A Publisher may, to ensure compliance with Applicable Law and this Data Policy, monitor and restrict the use of scripts or other tools that are used on a Publisher Service. Such restrictions may affect the delivery and the measurement of advertisements. The Advertiser and the Media Agency shall respect such restrictions.

Collaboration. Within the framework of the Data Policy, the Publisher and the Companies shall assist, collaborate with and provide information to each other, using reasonable endeavors, to fulfil obligations pursuant to Applicable Law, such as to meet data subjects' rights and to provide privacy information.

Personal data. In connection with advertising campaigns, the Publisher and the Companies shall not exchange or provide access to data that may contribute to identifying the users (e.g., by referring to their names or email addresses). Nor shall one share or provide access to children's personal data or special categories of personal data (sensitive data), unless specific written consent has been provided and it is permitted according to Applicable Law.

Obligations of Aller Media

Scripts. A Publisher shall use reasonable endeavors to inform Media Agencies and/or Advertisers of which restrictions that may be imposed on the use of scripts or other tools on one of Aller Media’s Publisher Services.

Cookies. On a Publisher Service, the Publisher shall comply with the Ecom Act, including the obligation to inform about the use of cookies (which will contain information on the Permitted Purposes).

Information. The Publisher shall inform their users about the Advertisers' processing of Data for the Permitted Purposes.

Tools. The Publisher shall use reasonable endeavors to map a Vendor's ability to operate according to Applicable Law and this Data Policy, and to enter into necessary agreements with the company in question. The Publisher, exercising their discretion, may refuse to use specific Vendors.

Obligations of the Advertisers

Notification. The Advertiser shall, before advertisements are delivered and measured, and before a Vendor may be used, notify the Publisher of the identity of the controlling Advertiser or Vendor. The Advertiser shall ensure that the Media Agency and the Vendor have been provided with this Data Policy.

Obligations of the Media Agencies

Notification. The Media Agency shall, before advertisements are delivered and measured on behalf of an Advertiser, and before a Vendor is used, notify the Publisher of the identity of the controlling Advertiser or Vendor. The Media Agency shall use reasonable endeavors to introduce the Publisher to each Advertiser or Vendor to facilitate the Publisher to conclude an agreement with the company in question, should the Publisher deem it desirable. As a minimum, the Media Agency shall ensure that the Advertiser and the Vendor have been provided with the Data Policy.

Duty to investigate. The Media Agency shall use reasonable endeavors to familiarize with relevant terms and conditions of any agreements between the Publisher and Advertisers of which the Media Agency acts on behalf, as well as relevant terms and conditions of any agreements between the Publisher and Vendors. The Media Agency shall refrain from, on their own or others' behalf, using Data in breach of such agreements.

Obligations of the Advertisers and the Media Agencies

Data security. A Company shall maintain appropriate technical and organizational security measures to protect the Data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access. The Company shall limit access to the Data to personnel on a need-to-know basis and ensure that such personnel are subject to appropriate confidentiality obligations.

Data security breach. In the event of a security breach involving the Data, the Company shall notify the Publisher without undue delay, in order for the involved parties to properly respond to and address any data subject risks. The involved parties shall collaborate with regards to potential notification requirements to the data protection authorities. Without the Publisher's prior written approval, the Company is not entitled to mention or refer to the name or trademark of the Publisher in any breach notification to a supervisory authority or to the affected data subjects, unless it is strictly necessary in order to comply with Applicable Law and provided the Publisher has been duly notified.

Data transfer. A Company shall not transfer personal data (in the meaning of the GDPR) to a third country or an international organization unless the conditions laid down in Chapter V of the GDPR have been met and the Publisher has received prior written notice of the transfer. The Company is responsible for the lawfulness of such transfer.

Disclosure. A Company may only disclose or give a third party access to Data (for example data processors or measurement companies) to the extent such disclosure is required to fulfil the Permitted Purposes and provided the company ensures that the third party only processes Data as permitted in this Data Policy.

Sanctions

Exclusion. If the Publisher has reasonable grounds to believe that a Company acts contrary to this Data Policy, the Publisher is entitled to temporarily stop a campaign and/or exclude the Company from running advertising campaigns on Aller Media’s Publisher Services. Such exclusion shall not be deemed a breach of any advertising campaign agreements, and it shall not exempt the Company from fulfilling any other agreements it may have with the Publisher.

Changes. The Publisher may change this Data Policy from time to time. The changes will be binding once they have been published on the Publisher's website or otherwise communicated to the Company, or – if the changes are substantial – 30 days following the notice of change, unless the change must enter into force immediately to comply with Applicable Law.

Notices. When this Data Policy stipulates that a notice be sent in writing, it may also be sent by email.