A European media company has published an updated privacy and cookie policy that sets out how it collects, uses, stores and shares personal data. The policy applies to visitors and users of its website and is designed to align with the General Data Protection Regulation. It covers information that users provide directly, data collected automatically through cookies, and information received from third parties. The update also includes a detailed cookie policy and a summary of user rights.

Key Facts

• The policy applies to personal and technical data collected through website forms, site interactions, phone calls and email.
• Data collected may include name, address, email address, phone number, business information and location details.
• Automatic data collection uses cookies to gather technical information and improve the browsing experience.
• Information may be combined with data from other websites operated by the company and from third-party business partners, subcontractors, advertising networks and analytics providers.
• Personal data may be used for contractual obligations, marketing, service notifications, site administration, research, security and advertising effectiveness.
• Data may be shared with group members, suppliers, advertisers, analytics providers and in the event of a business sale or legal obligation.
• Information is stored on secure servers within the European Economic Area for a period of 10 years.
• Security measures include firewalls, anti-virus software, encryption and regular backups.
• Users have rights to be informed, access, rectification, erasure, restriction, portability, objection and protection against automated decision-making.
• The cookie policy describes analytical, functionality and targeting cookies and explains how users can block them through browser settings.

Policy Scope and Data Collection

The company states that it is committed to protecting and respecting privacy. The policy explains the basis on which personal data collected from users, or provided by them, will be processed. By visiting the website, users are deemed to accept and consent to the practices described in the policy. For the purposes of the GDPR, the data controller is identified as a company registered in France. The company has also nominated a representative for data protection purposes.

The policy divides the information it collects into three broad categories: information users give directly, information collected automatically, and information received from other sources. Each category is subject to different collection methods and uses.

Information Provided by Users

Users provide information when they fill in forms on the website, interact with the site, or correspond with the company by phone, email or other means. This includes data supplied during registration and when reporting an issue with the site. The information may include a user's name, address, email address and phone number, as well as preliminary information about their business and its location. The policy does not specify every form or interaction, but it indicates that such data is essential for account management, customer support and service delivery.

Automatically Collected Data

The company automatically collects technical information about visits to the site. This data is typically gathered through small data files known as cookies. The policy states that this information helps the company offer a good browsing experience and identify areas where the site requires improvement. More detail on cookies, including the specific types used and their purposes, is provided in the accompanying cookie policy.

Data from Other Sources

The company may receive information about users if they use other websites operated by the company. In such cases, the company says it will inform users when data is collected if it intends to share that data internally, and will explain the purpose of the sharing. The company may also receive information from third parties, including business partners, technical subcontractors, advertising networks, analytics providers and search information providers. The policy states that users will be notified when such information is received and the purposes for which it will be used.

How the Company Uses Personal Data

All information collected or received, whether personal or technical, may be used in several ways. The policy lists the following purposes:

• To carry out obligations arising from contracts between the user and the company and to provide requested information, products and services.
• To provide information about other goods and services offered by the company or selected partners that are similar or relevant to those already purchased or enquired about. Such contact is limited to email, phone or SMS, and users can opt out at any time.
• To notify users about changes to services.
• To administer the site and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes.
• To improve the site and ensure content is presented in the most effective manner for users and their computers.
• To allow users to participate in interactive features of the service when they choose to do so.
• As part of efforts to keep the site safe and secure.
• To measure or understand the effectiveness of advertising served to users and others, and to deliver relevant advertising.
• To comply with record-keeping and information-storage obligations and policy.

When information is received from other sources, the company says it will combine it with data provided directly by users and data collected automatically. The combined information will be used for the purposes outlined above, depending on the types of information received. Under the GDPR, such processing must have a lawful basis, which may include consent, performance of a contract, compliance with a legal obligation, or legitimate interests. The policy does not explicitly identify the lawful basis for each purpose, but its descriptions suggest a mix of contractual necessity, consent and legitimate business interests.

Disclosure and Sharing Practices

The company may share user information with several parties. These include any member of its corporate group, business partners, suppliers and subcontractors involved in performing contracts. Advertisers and advertising networks may receive data to select and serve relevant adverts. The policy states that such information would not include anything that makes an individual identifiable to advertisers. However, the company may provide aggregate information about users, such as the number of users living in a particular area, to help advertisers reach their target audience. The company may also use personal data to display advertisements to selected target audiences.

Analytics and search engine providers that assist with site improvement and optimisation may also receive data. The policy further states that personal information may be disclosed to third parties in specific circumstances:

• If the company sells or buys any business or assets, in which case personal data may be disclosed to the prospective seller or buyer.
• If the company or substantially all of its assets are acquired by a third party, in which case personal data held about clients would be one of the transferred assets.
• If the company is under a duty to disclose or share personal data to comply with a legal obligation, or to enforce or apply its terms of use and other agreements.
• To protect the company's rights, property or safety, or those of its clients or others.

These provisions are common in privacy policies and reflect the need to address business transfers and legal compliance. The policy does not provide a specific timeframe for notifying users of such disclosures, but it indicates that sharing is limited to the purposes described.

Data Storage, Retention and Security

All information provided to the company is stored on secure servers operated by the company or its selected business partners within the European Economic Area. The retention period is stated as 10 years. The company says it will take reasonable steps to protect information in accordance with the policy, including installing a secure firewall, using anti-virus protection software, encrypting data and carrying out regular backups.

Where users have been given, or have chosen, a password to access certain parts of the site, they are responsible for keeping it confidential. The company asks users not to share passwords with anyone. The policy also acknowledges that transmission of information over the internet is not completely secure. Although the company will do its best to protect personal data, it cannot guarantee the security of data transmitted to the site, and any transmission is at the user's own risk. Once information is received, the company says it will use strict procedures and security features to prevent unauthorised access.

The 10-year retention period is notable because the GDPR requires that personal data be kept only as long as necessary for the purposes for which it is processed. A fixed 10-year period may be appropriate for certain contractual or legal record-keeping requirements, but it could raise questions about whether all data is genuinely needed for that duration. The policy does not explain how the company determines that 10 years is necessary for each category of data.

User Rights Under GDPR

The policy outlines a series of rights that users have under law in respect of their personal information. These include:

• The right to be informed about the collection and use of personal information.
• The right of access to information to verify the legality of its use.
• The right to request that inaccurate or incomplete information is rectified.
• The right to request deletion or removal of information where there is no further reason for the company to use it, such as when consent is withdrawn or a service is no longer provided.
• The right to restrict the use of information.
• The right to obtain and reuse information for personal purposes, often referred to as data portability.
• The right to object to certain uses, such as marketing.
• The right not to be subject to a decision that has a legal effect and is based on automated decision-making.

Users can exercise these rights at any time by writing to the company at the address given in the policy. The policy states that in some cases a small fee of no more than £10 may be charged for administrative costs. It also asks users to send an email with a personal ID document and specific details of the information requested. Under the GDPR, access requests should generally be fulfilled free of charge unless they are manifestly unfounded or excessive. The reference to a £10 fee may therefore be narrower in practice than the policy suggests. The requirement for an ID document is consistent with the need to verify identity before disclosing personal data.

The policy also notes that the site may contain links to and from the websites of partner networks, advertisers and affiliates. Users who follow such links are advised that those websites have their own privacy policies, and the company does not accept responsibility or liability for those policies. Users are encouraged to check the policies before submitting personal data to external websites.

Cookie Policy and User Controls

The accompanying cookie policy explains that the website uses cookies to distinguish users from one another. The company says this provides a better browsing experience and helps improve the website. By continuing to browse the website, users are deemed to have agreed to the use of cookies as set out in the policy. This approach is common, although EU rules generally require consent for non-essential cookies rather than relying solely on continued browsing.

Types of Cookies

The policy describes three main categories of cookies:

• Analytical/performance cookies. These collect information used in aggregate form to help the company understand how the website is used, how effective marketing campaigns are, and how to customise the website for users.
• Functionality cookies. These are used to recognise users when they return to the website. They enable the company to personalise content, greet users by name and remember preferences such as language or region.
• Targeting cookies. These record visits to the website, the pages visited and the links followed. The company may share this information with third parties, as explained in the privacy policy.

The policy also warns that third parties, including advertising networks and providers of external services such as web traffic analysis, may use cookies over which the company has no control. These cookies are likely to be analytical/performance cookies or targeting cookies.

Blocking Cookies

Users can block cookies by activating the setting on their browser that allows them to refuse the setting of all or some cookies. The company warns that blocking cookies may affect the ability to use the website. In particular, users may not be able to access all or parts of the website or use its functionalities. The policy does not provide a detailed list of individual cookies or their durations, but it gives users a general mechanism for control through browser settings.

Analysis: Transparency and Practical Implications

The updated policy reflects many of the transparency requirements introduced by the GDPR. It explains what data is collected, why it is collected, who it may be shared with, how long it is retained and what rights users have. It also provides a separate cookie policy that describes the categories of cookies and how to block them. These elements are important for accountability and for helping users make informed decisions.

At the same time, the policy illustrates some of the challenges that organisations face when translating legal requirements into clear public documents. For example, the reliance on continued browsing as a signal of consent for cookies may not satisfy the stricter consent standards under EU law, which generally require an affirmative action for non-essential cookies. The 10-year retention period is another area that may warrant further explanation, since data minimisation and storage limitation are core GDPR principles. The reference to a £10 fee for access requests is also narrower than the general GDPR rule that access should be free of charge unless requests are excessive.

For users, the policy provides a useful overview of their rights and the company's practices. It encourages users to check back frequently for updates and to review external websites' privacy policies before submitting personal data. The company says that any future changes to the privacy policy will be posted on the same page. Questions, comments and requests regarding the policy should be addressed to the company's nominated representative.

Users who choose to block cookies may still be able to access some parts of the website, but the company warns that functionality could be limited. The policy does not indicate whether a cookie consent banner or preference centre is available, but it does describe browser settings as the primary method for refusing cookies.

Source:Silicon UK News