Privacy in Aller Media

ALL MEDIA HAVE SWITCHED TO CONSENT AS THE BASIS FOR PROCESSING PERSONALIZED ADS

Aller Media has now switched to consent as the basis for processing to deliver personalized ads, the reason for the change is to adapt to European industry standards in this area. The change means that in the future we will only deliver personalized ads to those of our users who have actively consented to this through our consent solution/CMP (Consent Management Platform).

Please note that some advertising purposes are still based on legitimate interest as a basis for processing. You can read more about this in our privacy policy.

DATA SHARING AND RESTRICTION OF THIRD PARTIES

In connection with the delivery of ads, Aller Media only allows ad providers that follow our guidelines. We do not allow data sharing in violation of our guidelines. We do not allow our ad providers to track our users across different websites to create or build profiles. We limit the number of ad providers we share data with in accordance with this policy and compliance with the policy is monitored. This is also in line with the Media Companies Association's guidelines.

An overview of the currently approved ad providers can be viewed by opening our Consent Management Solution (CMP). This is available at the bottom of each webpage that contains ads, under the link "Your ad choices". Here you will also find more information about the specific purposes.

Please note that inability to use certain advertising suppliers and failure to comply with our advertising supplier policy does not give rise to compensation.

Aller Media Group ("Aller Media")

Background

Purpose and scope. This Data Policy sets out conditions for processing of data in connection with advertising campaigns that run on one of Aller Media's Publisher Services.

Other agreements. If a party has a written agreement with Aller Media in connection with advertising campaigns that run on one of Aller Media's Publisher Services, this Data Policy forms an integral part of such agreement. In the event of conflict, the written agreement prevails.

Definitions

Advertiser. A company that advertises a product, a service, or another offering.

Applicable Law. Applicable laws and regulations, e.g., the Norwegian Personal Data Act, The Norwegian Ecom Act and the GDPR.

Company. Advertiser and/or Media Agency.

Data. Any data collected from or processed on one of Aller Media's Publisher Services when delivering or measuring advertisements (whether the data is personal data or not). For instance, user information (such as device ID, browser type, OS type, IP address and cookies), information concerning the performance of an advertisement (such as number of viewings and number of clicks), and/or information stored on a user device using cookies or similar technologies.

Ecom Act. The Norwegian Act no. 83 of 4 July 2003 relating to Electronic Communication.

GDPR. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Media Agency. A company that acts on behalf of advertisers in connection with advertising campaigns.

Personalization. The collection and processing of Data about users of a website or an app over time to customize advertising for them in other contexts, i.e. on other websites or apps. Typically, the content of the website or app is used to make inferences about the users' interests, which inform future selections of advertisements.

Publisher. Aller Media.

Publisher Service. Any digital service that a publisher owns or sells advertising space on.

Purposes.

Permitted Purposes. Advertisement selection, delivery, reporting; the collection of Data, combination of Data with previously collected Data, selection and delivery of advertisements for users, measuring the delivery and effectiveness of such advertisements. This includes the use of previously collected Data about users' interests in order to select advertisements, use of Data in connection with selecting advertisements based on approximately geographical location, use of Data about what advertisements were viewed, how often they were viewed, when and where they were viewed, and whether the user performed any actions in connection with the advertisement, e.g., by clicking on an advertisement or making a purchase.

For the purpose of ensuring security and prevent advertisement fraud it is permitted to use collected Data, including automatic received Data (e.g., "user agent data"), precise location data or actively scan for Data from the Publisher (e.g., screen resolution), further described under TCF 2.0 Special Purpose 1.

IAB TCF 2.0 Purpose 2, 4, 7, 9, Function 1 (in combination with Purpose 4) and Special Purpose 1 and 2 corresponds to Permitted Purposes as described above.

Prohibited Purposes. Attempt to re-identify or connect different devices, browsers or apps by using automatic received Data (e.g., "user agent data"), or by actively scan for other Data from the Publisher (e.g., screen resolution) to decide that two or several devices, browsers or apps belong to the same person or household by using probability calculation (probabilistic methods"). Collect or use precise location data, i.e., with an accuracy estimated with a radius of 500 meters or less. Collect and/or use Data derived from the Publisher to build and/or enrich advertisement profiles used to selects what advertisements a user shall see.

IAB TCF 2.0 Purpose 3 and 5, Function 2 and 3 and Special Function 1 and 2 corresponds to the Prohibited Purposes described in this section.

Vendor. A company that supplies tools to Advertisers or Media Agencies, which enable or support advertising campaigns that run on one of Aller Media's Publisher Services.

General

Roles and responsibilities. The Publisher, the Advertiser and the Media Agency are responsible for fulfilling their respective obligations pursuant to Applicable Law. In connection with Data processed under this Data Policy, the Advertiser or Media Agency do not act as data processors for, or as joint data controllers together with, the Publisher. The Advertiser and the Media Agency shall respect this Data Policy and ensure that their processing of Data is in accordance with Applicable Law (including by ensuring that they have legal basis for the processing and by providing information to the data subjects).

Limitation of purpose. The Advertiser and the Media Agency shall only process Data for the Permitted Purposes. The Data shall not be processed for Prohibited Purposes. The Advertiser and the Media Agency must ensure a separate legal basis if they use previously collected information from sources other than the Publisher Service, and if they combine such information with the Data from the Publisher Service.

Scripts. A Publisher may, to ensure compliance with Applicable Law and this Data Policy, monitor and restrict the use of scripts or other tools that are used on a Publisher Service. Such restrictions may affect the delivery and the measurement of advertisements. The Advertiser and the Media Agency shall respect such restrictions.

Collaboration. Within the framework of the Data Policy, the Publisher and the Companies shall assist, collaborate with and provide information to each other, using reasonable endeavors, to fulfil obligations pursuant to Applicable Law, such as to meet data subjects' rights and to provide privacy information.

Personal data. In connection with advertising campaigns, the Publisher and the Companies shall not exchange or provide access to data that may contribute to identifying the users (e.g., by referring to their names or email addresses). Nor shall one share or provide access to children's personal data or special categories of personal data (sensitive data), unless specific written consent has been provided and it is permitted according to Applicable Law.

Obligations of Aller Media

Scripts. A Publisher shall use reasonable endeavors to inform Media Agencies and/or Advertisers of which restrictions that may be imposed on the use of scripts or other tools on one of Aller Media's Publisher Services.

Cookies. On a Publisher Service, the Publisher shall comply with the Ecom Act, including the obligation to inform about the use of cookies (which will contain information on the Permitted Purposes).

Information. The Publisher shall inform their users about the Advertisers' processing of Data for the Permitted Purposes.

Tools. The Publisher shall use reasonable endeavors to map a Vendor's ability to operate according to Applicable Law and this Data Policy, and to enter into necessary agreements with the company in question. The Publisher, exercising their discretion, may refuse to use specific Vendors.

Obligations of the Advertisers

Notification. The Advertiser shall, before advertisements are delivered and measured, and before a Vendor may be used, notify the Publisher of the identity of the controlling Advertiser or Vendor. The Advertiser shall ensure that the Media Agency and the Vendor have been provided with this Data Policy.

Obligations of the Media Agencies

Notification. The Media Agency shall, before advertisements are delivered and measured on behalf of an Advertiser, and before a Vendor is used, notify the Publisher of the identity of the controlling Advertiser or Vendor. The Media Agency shall use reasonable endeavors to introduce the Publisher to each Advertiser or Vendor to facilitate the Publisher to conclude an agreement with the company in question, should the Publisher deem it desirable. As a minimum, the Media Agency shall ensure that the Advertiser and the Vendor have been provided with the Data Policy.

Duty to investigate. The Media Agency shall use reasonable endeavors to familiarize with relevant terms and conditions of any agreements between the Publisher and Advertisers of which the Media Agency acts on behalf, as well as relevant terms and conditions of any agreements between the Publisher and Vendors. The Media Agency shall refrain from, on their own or others' behalf, using Data in breach of such agreements.

Obligations of the Advertisers and the Media Agencies

Data security. A Company shall maintain appropriate technical and organizational security measures to protect the Data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access. The Company shall limit access to the Data to personnel on a need-to-know basis and ensure that such personnel are subject to appropriate confidentiality obligations.

Data security breach. In the event of a security breach involving the Data, the Company shall notify the Publisher without undue delay, in order for the involved parties to properly respond to and address any data subject risks. The involved parties shall collaborate with regards to potential notification requirements to the data protection authorities. Without the Publisher's prior written approval, the Company is not entitled to mention or refer to the name or trademark of the Publisher in any breach notification to a supervisory authority or to the affected data subjects, unless it is strictly necessary in order to comply with Applicable Law and provided the Publisher has been duly notified.

Data transfer. A Company shall not transfer personal data (in the meaning of the GDPR) to a third country or an international organization unless the conditions laid down in Chapter V of the GDPR have been met and the Publisher has received prior written notice of the transfer. The Company is responsible for the lawfulness of such transfer.

Disclosure. A Company may only disclose or give a third party access to Data (for example data processors or measurement companies) to the extent such disclosure is required to fulfil the Permitted Purposes and provided the company ensures that the third party only processes Data as permitted in this Data Policy.

Sanctions

Exclusion. If the Publisher has reasonable grounds to believe that a Company acts contrary to this Data Policy, the Publisher is entitled to temporarily stop a campaign and/or exclude the Company from running advertising campaigns on Aller Media's Publisher Services. Such exclusion shall not be deemed a breach of any advertising campaign agreements, and it shall not exempt the Company from fulfilling any other agreements it may have with the Publisher.

Changes. The Publisher may change this Data Policy from time to time. The changes will be binding once they have been published on the Publisher's website or otherwise communicated to the Company, or - if the changes are substantial - 30 days following the notice of change, unless the change must enter into force immediately to comply with Applicable Law.

Notices. When this Data Policy stipulates that a notice be sent in writing, it may also be sent by email.

Aller Media Group ("Aller Media")

Background

Purpose and scope. This Data Policy sets out the terms for the processing of Data in connection with advertising campaigns delivered on one of Aller Media's Publisher Services.

Other agreements. If a company has a written agreement with Aller Media in connection with advertising campaigns delivered on one of Aller Media's Publisher Services, this Data Policy will constitute an integral part of such agreement. In case of conflict, the written agreement shall prevail.

Definitions

Advertiser. A company that advertises a product, service or other offer.

Data. All information collected from or processed on one of Aller Media's Publisist Services when delivering or measuring ads (regardless of whether this is personal data), such as user information (such as device ID, browser type, OS type, IP address and cookies), information about the delivery of an ad (e.g. number of impressions and number of clicks), and/or information stored on the user's equipment with cookies or similar technology.

The Electronic Communications Act. Act on electronic communication, LOV-2003-07-04-83.

Purpose

Prohibited purposes. Attempt to re-identify or link different devices, browsers or apps by using automatically received Data (e.g. "user agent data"), or by actively scanning for other Data from the Publisher (e.g. screen resolution) to determine that two or more devices, browsers or apps belong to the same person or household, using probabilistic methods. Collect or use precise location data, i.e. with accuracy estimated with a radius of 500m or less. Collect and/or use Data originating from the Publisher to build and/or enrich ad profiles that are used to select which ads a user will see.

IAB TCF 2.0 Purpose 3, 5 and Function 2, 3 and Special Function 1, 2 correspond to the Prohibited Purposes described in this section.

Permitted Purposes. Ad selection, delivery, reporting: collecting Data, combining Data with previously collected information, selecting and delivering ads to users, measuring delivery and effectiveness. This also includes using previously collected information about users' interests to select ads, using Data in connection with the selection of ads based on approximate geographic location, using Data about which ads were served, how often they were served, when and where they were served, and whether the user took any actions related to the ad, such as clicking on an ad or making a purchase.

To ensure security and prevent ad fraud, it is permitted to use collected Data, including automatically received Data (e.g. "user agent data"), precise location data or actively scan for Data from the Publisher (e.g. screen resolution), as further described under TCF 2.0 Special Purpose 1.

IAB TCF 2.0 Purposes 2, 4, 7, 9, Function 1 (in combination with Purpose 4) and Special Purposes 1 and 2 correspond to Approved Purposes as described above.

GDPR. REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Applicable Legislation. Relevant laws and regulations, e.g. the Personal Data Act, the Electronic Communications Act and GDPR.

Supplier. A company that provides tools to advertisers or media agencies that enable or support ad campaigns running on one of Aller Media's Publisist Services.

Media agency. A company that acts on behalf of advertisers in connection with advertising campaigns.

Personalization. The collection and processing of information about users of a website or app in order to then over time personalize advertising to them in other contexts, i.e. on other websites or apps, where the content of the website or app will typically be used to make inferences about users' interests as a basis for future ad selection.

Publisher. Aller Media.

Publisher Service. Any digital service on which Aller Media owns or sells advertising space.

Company. Advertiser and/or media agency.

General

Roles and responsibilities. The Publisher, Advertiser and Media Agency are each responsible for complying with their obligations under Applicable Laws. In relation to Data processed under this Data Policy, the Advertiser or the Media Agency is not acting as a data processor for, or as a joint controller with, the Publisher. The Advertiser and the Media Agency shall respect this Data Policy and ensure that their processing of Data complies with Applicable Laws (including by ensuring that they have an adequate legal basis for the processing and providing information to data subjects).

Purpose Limitation. The Advertiser and the Media Agency shall only process Data for the Permitted Purposes. The Data shall not be processed for Prohibited Purposes. The Advertiser and the Media Agency must ensure a separate legal basis for processing if they are to use previously obtained information from sources other than the Publisist Service, as well as if they combine such information with Data from the Publisist Service.

Scripts. To ensure compliance with Applicable Laws and this Data Policy, Publisisten may monitor and restrict the use of scripts and other tools used on the Publisist Service. Such restrictions may affect the delivery and measurement of advertisements. Advertiser and Media Agency shall respect such restrictions.

Cooperation. Within the framework of this Data Policy, Publisisten and the Companies shall assist, cooperate with and provide information to each other to the extent reasonably required to fulfill obligations under Applicable Laws, including to safeguard data subjects' rights and to provide information on data protection.

Personal data. In connection with advertising campaigns, Publisisten and the Companies shall not share or provide access to information that may help to identify users (e.g. by reference to their name or e-mail address). This includes not sharing or providing access to personal data about children or special categories of personal data (sensitive data), unless express written consent has been given and it is permitted under Applicable Laws.

Duties for Aller Media

Scripts. Aller Media will do what can reasonably be expected to inform the Media Agency and Advertiser of any restrictions imposed on the use of scripts or other tools on any of Aller Media's Publisher Services.

Cookies. On a Publisher Service, the Publisher will comply with the Ecom Act, including the obligation to inform about the use of cookies (which will include information about the permitted purposes).

Information. The Publisher shall inform its Users about the Advertisers' processing of Data for the Permitted Purposes.

Tools. Publisher shall make reasonable efforts to determine Supplier's ability to operate within Applicable Laws and this Data Policy and enter into necessary agreements with the company in question. Publisher may at its sole discretion refuse the use of specific Suppliers.

Obligations for Advertisers

Notification. The Advertiser shall, before ads are delivered and measured, and before a Supplier is used, inform the Publisher of the identity of the Advertiser or Supplier responsible for processing. The Advertiser shall ensure that the Media Agency and the Supplier have been made aware of this Data Policy.

Duties for Media Agencies

Notification. The Media Agency shall, prior to delivering and measuring advertisements on behalf of an Advertiser, and prior to using a Supplier, inform the Publisher of the identity of the Advertiser or Supplier responsible for processing. The Media Agency shall do what can reasonably be expected to introduce the Publisher to the individual Advertiser or Supplier in order to facilitate that the Publisher can enter into an agreement with the company in question if the Publisher so wishes. As a minimum, the Media Agency shall ensure that the Advertiser and Supplier have been made aware of this Data Policy.

Duty to investigate. The Media Agency shall do what can reasonably be expected to familiarize itself with relevant terms in any agreements the Publisher has entered into with Advertisers that the Media Agency acts on behalf of, as well as agreements between the Publisher and Suppliers. The Media Agency shall refrain from, on its own behalf or on behalf of others, using Data in breach of such agreements.

Obligations for Advertisers and Media Agency

Data security. A Company shall have appropriate technical and organizational security measures in place to protect the Data against accidental or unlawful destruction or unreasonable loss, alteration, unauthorized disclosure or access. The Company shall limit access to the Data to employees with a "need-to-know" and shall ensure that they are subject to appropriate confidentiality obligations.

Data Security Breach. In the event of a security breach relating to the Data, the Company shall notify the Publisher without undue delay so that the parties involved can respond and manage any risks to the data subjects in a satisfactory manner. The parties shall cooperate with respect to any requirement to notify a data protection authority. The Company may not, without Publisisten's prior written consent, mention or refer to Publisisten's name or trademark in a personal data breach notification to a data protection authority or to the affected data subjects, unless it is strictly necessary to comply with Applicable Laws and Publisisten has been duly notified.

Data transfer. A Company may only transfer Personal Data (as defined in the GDPR) to a third country or an international organization if the conditions set out in Chapter V of the GDPR are met and the Publisher has been informed in writing in advance of the transfer. The Company will be responsible for the legality of such transfer,

Disclosure. A Company may only disclose or provide access to Data to a third party (e.g. data processors or measurement companies) to the extent necessary to fulfill the Permitted Purposes and provided that the Company ensures that the third party only processes Data within the scope of this Data Policy.

Sanctions

Exclusion. If Publisisten has reasonable grounds to believe that a Company is acting in violation of this Data Policy, Publisisten has the right to temporarily suspend a campaign and/or exclude the Company from running ad campaigns on Aller Media's Publisist Services. This shall not be considered a breach of contract by the Publisher of any agreement regarding such ad campaigns, and it shall not relieve the Company from fulfilling any other agreements with the Publisher.

Amendments. Publisher may amend this Data Policy from time to time. Amendments will be binding as soon as they are posted on Publisisten's website or otherwise communicated to Company or, if the changes are material, 30 days after notice of the change is communicated, unless the change must take effect immediately in order to comply with Applicable Laws.

Notifications. When this Data Policy states that a message must be communicated in writing, it may also be sent by email.

CUSTOMER CONTACT DATABASE (CRM)

We at Aller Media may have registered you in our customer contact database (CRM system) because you are an important partner for us and we want to keep in touch with you.

We have stored your information because you are an employee of a company that buys or that we consider will potentially buy ads in one of our brands or in one of our partners' brands. Aller Media's brands can be found here: https://annonse.aller.no/merkevarer

The information we have stored about you is your name, email, title and any phone number.

We also store information about which B2B Events we want to invite you to. Aller Media is the data controller for the data we have stored about you.

The legal basis for this processing is that it is necessary for our legitimate interest in being able to contact you as a customer and execute the agreements on advertising sales.

NEWSLETTER

Aller Media sends out email newsletters with the latest news about our brands, products, services and events. In order for us to send you email newsletters, you must register an email address. The email address will only be used to send out newsletters. When you sign up for the newsletter, you consent to our processing of information about you. The email address is stored in a separate database operated by our data processor Make AS, is not shared with others and is deleted when you unsubscribe from the newsletter. You can unsubscribe by clicking the unsubscribe link in the newsletter or by contacting us.

The legal basis for this processing is necessary for our legitimate interest in being able to keep you updated on our brands, services and events.

Aller Media processes your personal data until you unsubscribe from the newsletter.

YOUR RIGHTS

Within the framework of applicable legislation, you have the following privacy rights:

• Right to information. You have the right to receive further information about our use of your personal data.

• Right of access. You have the right to a copy of your personal data.

• Right to rectification. You have the right to have incorrect information about you corrected.

• Right to be forgotten. You have the right to request that your data is anonymized if we no longer need it.

• Right to restrict the processing of personal data. You have the right to request that we stop using your personal data.

• Right to object to the processing of personal data. You have the right to object to our use of your personal data.

• Right to prevent automated decisions. You have the right not to be subject to automated decision-making processes with legal or similar effect (e.g. automated credit scoring). We do not currently use automated decision-making.

There are exceptions to the rights described above. These exceptions follow from legislation and may, for example, mean that access to certain data is not granted or that data cannot be deleted. You can get more information about these exceptions by contacting us or the Norwegian Data Protection Authority.

You can exercise your rights, and get more information about which exceptions and limitations apply, through your contact at Aller Media or by contacting us at [email protected].

CONTACT US

If you believe that we have processed your personal data in a way that does not comply with the data protection legislation, we hope that you will contact us so that we can provide you with answers and clarify any misunderstandings. You also have the right to lodge a complaint with the Norwegian Data Protection Authority.

The legal basis for this use of data is our legitimate interest in sending offers and information relevant to you and the company you work for.

Information about you will be stored in our database as long as you work for a company that Aller Media has an interest in contacting.

For further information about Privacy at Aller Media, please contact us:

E- mail: [email protected].

Postal address:

Aller Media AS
V/Personal data protection
Postboks 1169, centrum
0107 Oslo