Data policy/Guidelines (English version)

Aller Media Group ("Aller Media")

Background

Purpose and scope. This Data Policy sets out the terms for the processing of Data in connection with advertising campaigns delivered on one of Aller Media's Publisher Services.

Other agreements. If a company has a written agreement with Aller Media in connection with advertising campaigns delivered on one of Aller Media's Publisher Services, this Data Policy will constitute an integral part of such agreement. In case of conflict, the written agreement shall prevail.

Definitions

Advertiser. A company that advertises a product, service or other offer.

Data. All information collected from or processed on one of Aller Media's Publisist Services when delivering or measuring ads (regardless of whether this is personal data), such as user information (such as device ID, browser type, OS type, IP address and cookies), information about the delivery of an ad (e.g. number of impressions and number of clicks), and/or information stored on the user's equipment with cookies or similar technology.

The Electronic Communications Act. Act on electronic communication, LOV-2003-07-04-83.

Purpose

Prohibited purposes. Attempt to re-identify or link different devices, browsers or apps by using automatically received Data (e.g. "user agent data"), or by actively scanning for other Data from the Publisher (e.g. screen resolution) to determine that two or more devices, browsers or apps belong to the same person or household, using probabilistic methods. Collect or use precise location data, i.e. with accuracy estimated with a radius of 500m or less. Collect and/or use Data originating from the Publisher to build and/or enrich ad profiles that are used to select which ads a user will see.

IAB TCF 2.0 Purpose 3, 5 and Function 2, 3 and Special Function 1, 2 correspond to the Prohibited Purposes described in this section.

Permitted Purposes. Ad selection, delivery, reporting: collecting Data, combining Data with previously collected information, selecting and delivering ads to users, measuring delivery and effectiveness. This also includes using previously collected information about users' interests to select ads, using Data in connection with the selection of ads based on approximate geographic location, using Data about which ads were served, how often they were served, when and where they were served, and whether the user took any actions related to the ad, such as clicking on an ad or making a purchase.

To ensure security and prevent ad fraud, it is permitted to use collected Data, including automatically received Data (e.g. "user agent data"), precise location data or actively scan for Data from the Publisher (e.g. screen resolution), as further described under TCF 2.0 Special Purpose 1.

IAB TCF 2.0 Purposes 2, 4, 7, 9, Function 1 (in combination with Purpose 4) and Special Purposes 1 and 2 correspond to Approved Purposes as described above.

GDPR. REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Applicable Legislation. Relevant laws and regulations, e.g. the Personal Data Act, the Electronic Communications Act and GDPR.

Supplier. A company that provides tools to advertisers or media agencies that enable or support ad campaigns running on one of Aller Media's Publisist Services.

Media agency. A company that acts on behalf of advertisers in connection with advertising campaigns.

Personalization. The collection and processing of information about users of a website or app in order to then over time personalize advertising to them in other contexts, i.e. on other websites or apps, where the content of the website or app will typically be used to make inferences about users' interests as a basis for future ad selection.

Publisher. Aller Media.

Publisher Service. Any digital service on which Aller Media owns or sells advertising space.

Company. Advertiser and/or media agency.

General

Roles and responsibilities. The Publisher, Advertiser and Media Agency are each responsible for complying with their obligations under Applicable Laws. In relation to Data processed under this Data Policy, the Advertiser or the Media Agency is not acting as a data processor for, or as a joint controller with, the Publisher. The Advertiser and the Media Agency shall respect this Data Policy and ensure that their processing of Data complies with Applicable Laws (including by ensuring that they have an adequate legal basis for the processing and providing information to data subjects).

Purpose Limitation. The Advertiser and the Media Agency shall only process Data for the Permitted Purposes. The Data shall not be processed for Prohibited Purposes. The Advertiser and the Media Agency must ensure a separate legal basis for processing if they are to use previously obtained information from sources other than the Publisist Service, as well as if they combine such information with Data from the Publisist Service.

Scripts. To ensure compliance with Applicable Laws and this Data Policy, Publisisten may monitor and restrict the use of scripts and other tools used on the Publisist Service. Such restrictions may affect the delivery and measurement of advertisements. Advertiser and Media Agency shall respect such restrictions.

Cooperation. Within the framework of this Data Policy, Publisisten and the Companies shall assist, cooperate with and provide information to each other to the extent reasonably required to fulfill obligations under Applicable Laws, including to safeguard data subjects' rights and to provide information on data protection.

Personal data. In connection with advertising campaigns, Publisisten and the Companies shall not share or provide access to information that may help to identify users (e.g. by reference to their name or e-mail address). This includes not sharing or providing access to personal data about children or special categories of personal data (sensitive data), unless express written consent has been given and it is permitted under Applicable Laws.

Duties for Aller Media

Scripts. Aller Media will do what can reasonably be expected to inform the Media Agency and Advertiser of any restrictions imposed on the use of scripts or other tools on any of Aller Media's Publisher Services.

Cookies. On a Publisher Service, the Publisher will comply with the Ecom Act, including the obligation to inform about the use of cookies (which will include information about the permitted purposes).

Information. The Publisher shall inform its Users about the Advertisers' processing of Data for the Permitted Purposes.

Tools. Publisher shall make reasonable efforts to determine Supplier's ability to operate within Applicable Laws and this Data Policy and enter into necessary agreements with the company in question. Publisher may at its sole discretion refuse the use of specific Suppliers.

Obligations for Advertisers

Notification. The Advertiser shall, before ads are delivered and measured, and before a Supplier is used, inform the Publisher of the identity of the Advertiser or Supplier responsible for processing. The Advertiser shall ensure that the Media Agency and the Supplier have been made aware of this Data Policy.

Duties for Media Agencies

Notification. The Media Agency shall, prior to delivering and measuring advertisements on behalf of an Advertiser, and prior to using a Supplier, inform the Publisher of the identity of the Advertiser or Supplier responsible for processing. The Media Agency shall do what can reasonably be expected to introduce the Publisher to the individual Advertiser or Supplier in order to facilitate that the Publisher can enter into an agreement with the company in question if the Publisher so wishes. As a minimum, the Media Agency shall ensure that the Advertiser and Supplier have been made aware of this Data Policy.

Duty to investigate. The Media Agency shall do what can reasonably be expected to familiarize itself with relevant terms in any agreements the Publisher has entered into with Advertisers that the Media Agency acts on behalf of, as well as agreements between the Publisher and Suppliers. The Media Agency shall refrain from, on its own behalf or on behalf of others, using Data in breach of such agreements.

Obligations for Advertisers and Media Agency

Data security. A Company shall have appropriate technical and organizational security measures in place to protect the Data against accidental or unlawful destruction or unreasonable loss, alteration, unauthorized disclosure or access. The Company shall limit access to the Data to employees with a "need-to-know" and shall ensure that they are subject to appropriate confidentiality obligations.

Data Security Breach. In the event of a security breach relating to the Data, the Company shall notify the Publisher without undue delay so that the parties involved can respond and manage any risks to the data subjects in a satisfactory manner. The parties shall cooperate with respect to any requirement to notify a data protection authority. The Company may not, without Publisisten's prior written consent, mention or refer to Publisisten's name or trademark in a personal data breach notification to a data protection authority or to the affected data subjects, unless it is strictly necessary to comply with Applicable Laws and Publisisten has been duly notified.

Data transfer. A Company may only transfer Personal Data (as defined in the GDPR) to a third country or an international organization if the conditions set out in Chapter V of the GDPR are met and the Publisher has been informed in writing in advance of the transfer. The Company will be responsible for the legality of such transfer,

Disclosure. A Company may only disclose or provide access to Data to a third party (e.g. data processors or measurement companies) to the extent necessary to fulfill the Permitted Purposes and provided that the Company ensures that the third party only processes Data within the scope of this Data Policy.

Sanctions

Exclusion. If Publisisten has reasonable grounds to believe that a Company is acting in violation of this Data Policy, Publisisten has the right to temporarily suspend a campaign and/or exclude the Company from running ad campaigns on Aller Media's Publisist Services. This shall not be considered a breach of contract by the Publisher of any agreement regarding such ad campaigns, and it shall not relieve the Company from fulfilling any other agreements with the Publisher.

Amendments. Publisher may amend this Data Policy from time to time. Amendments will be binding as soon as they are posted on Publisisten's website or otherwise communicated to Company or, if the changes are material, 30 days after notice of the change is communicated, unless the change must take effect immediately in order to comply with Applicable Laws.

Notifications. When this Data Policy states that a message must be communicated in writing, it may also be sent by email.