
The Circana Group Global Privacy Policy and Notice
5 February 2024
The Circana Group (“Circana”, “the Group”, “we” or “us”) refers to Circana, LLC ( registered in Delaware, United States) as well as its subsidiaries and affiliates. Circana is the leading advisor on the complexity of consumer behavior. Through unparalleled technology, advanced analytics, cross-industry data and deep expertise, we provide clarity that helps almost 7,000 of the world’s leading brands and retailers take action and unlock business growth. We understand more about the complete consumer, the complete store, and the complete wallet so our clients can go beyond the data to apply insights, ignite innovation, meet consumer demand, and outpace the competition .
Privacy and data protection is central to what we do and this Privacy Policy and Notice (“Policy” or “Notice”) describes how Circana collects, uses, discloses and otherwise processes personal information described in “Scope”, as well as the rights and choices individuals have regarding such personal information. This Notice applies to the extent we process personal information on our own behalf, as a controller or business.
For information about the privacy choices you have regarding your personal information, review Section 8. Your Privacy Choices , as well as Section 14, Additional Information for Certain Jurisdictions, which includes additional information about privacy rights for residents of specific jurisdictions. If you are a resident of California, please also refer to Section 14.C. for information about the categories of personal information we collect and your rights under California privacy laws.
Your use of our Services (defined below), and any dispute over privacy, is subject to this Notice and our Terms of Use, including their applicable limitations on damages and the resolution of disputes.
-
Scope
Except as otherwise noted below, this Notice applies to the personal information that Circana processes as a controller related to:
-
our “Services,” which include:
-
(i) our mobile applications, websites, and other online services (and any feature thereof) and
-
(ii) other products and services we make available to customers (for example Unify®), including our mobile application panelists and customers;
-
-
individuals that register for or participate in our webinars and other events;
-
current, former and prospective customers, vendors and partners;
-
individuals who are subscribed to receive news, information and marketing communications from us; and
-
individuals that communicate with us or otherwise engage with us related to our Services.
Not In Scope. This Policy does not apply to the personal information that we collect and process about employees, job applicants, and contractors. Please contact us using the details found at section 13 if you require these notices.
In addition, except where expressly stated otherwise, this Policy does not apply to the extent we process personal information on behalf of our clients as a “processor” or “service provider” under applicable privacy laws (“Client Data”). Our processing of Client Data is subject to the terms of our contracts with each client, who is the “controller” or “business” under applicable privacy laws for the data that we process on their behalf. In such cases, Circana’s clients are responsible for ensuring that there is an appropriate legal basis for the processing of Client Data by Circana, and that appropriate notice has been provided, and any necessary consent has been obtained, for the processing of such data.
Additional Notices. In some cases, additional or supplemental privacy notices (each an “additional notice”) may be provided and will apply to certain personal information collected and processed by us in connection with specific Services that we provide. The additional notice will control to the extent there is a conflict with this Policy, with respect to your personal information that is subject to that notice.
2. Personal Information Collected
As further described below, we may collect personal information directly from individuals, from third parties, and automatically when such data relates to the use of our Services or other interactions with us.
Personal Information Collected Directly. The personal information we may collect from you depends upon how you use our Services or otherwise interact or engage with us, but generally includes:
-
Registration and profile information. When you register for an account in connection with our Services, or we provide you with account login credentials to access our Services, we may collect certain personal information from you, such as your name, phone number, date of birth, and email address, as well as any personal information that you otherwise submit to us through your account.
-
Survey responses. When you provide answers to the surveys we publish in connection with our Services, we may collect such survey responses, including but not limited to information regarding demographics, your food and drink consumption and preferences, your workplace, your education level and your opinion about products and services. Participation in our surveys is completely voluntary. You may choose not to answer any particular survey.
-
Payments and purchases. When you make a purchase or payment through the Services, we may collect purchase and payment information in order to process your payment, such as your credit card number and applicable billing address.
-
Communications and interactions. When you email, call, or otherwise communicate with us and with members of our team, we may collect and maintain a record of your contact details, communications and our responses. We also maintain records communications regarding information you provide to us related to any customer support requests.
-
Events and other requests. We may also collect personal information related to your participation in our events as well as other requests that you submit to us related to our Services. For example, if you register for or attend an event that we host or sponsor, we may collect information related to your registration for and participation in such event. When you contact us via email, sign up for our mailing lists, or otherwise request information from us, we collect and maintain records of your requests, including through forms you may complete on our website.
Personal Information from Third Parties. We may collect personal information about you from third party sources, such as public databases, joint marketing partners, social media platforms or other third parties.
-
We may receive lead and prospect information from third parties about prospective customers that may be interested in our Services. We may also engage with third parties to enhance or update our customer information.
-
In order to use certain features of our Services, you may choose to share content from third party accounts. If you grant us permission to access this data by enabling this sharing, we will access and export this third-party content. Consent for this process is controlled by you. You can revoke your consent to our access any time. Where you have given us permission to access your third-party account, the specific information we collect is limited to your purchase transactions.
-
We work with third parties to gather information about how users interact with their or our services. This may include information such as demographic information, preference information, what you watch or buy, what video games you play, or your exposure to advertising. These sources include, for example: census data, the manufacturers or sellers of the products you purchase or use, organizations that collect online data, data suppliers, companies that combine purchase information, and other entities that have a legal right to provide such information to us.
Personal Information Collected Automatically. We automatically collect personal information related to your use of our Services and interactions with us and others, including information we collect automatically (e.g., using cookies and pixel tags), as well as information we derive about you and your use of the Services. Such information includes:
-
Device and browsing information. We may use cookies, log files, pixel tags and other tracking technologies to automatically collect information when users access or use our Services, such as IP address, general location information, domain name, page views, a date/time stamp, browser type, device type, device ID, Internet service provider, referring and exiting URLs, operating system, language, clickstream data, and similar device and usage information. For more information, see Section 6. Cookies, Targeting and Analytics , below.
-
Activities and usage. We may also collect activity information related to your use of the Services, such as information about the links clicked, searches, features used, content viewed, time spent within the Services.
3. Purposes of Use and Legal Bases for Processing Personal Information
Generally, we may collect, use, disclose and otherwise process the personal information we collect for the purposes set forth in this section. This section also sets forth the legal bases for which we process personal information, as required by the EU General Data Protection Regulation (the “GDPR”) and the UK General Data Protection Regulation (the “UK GDPR”).
Legal Bases for Processing. Pursuant to the GDPR and UK GDPR (and other relevant laws), we generally process your personal information pursuant to the following legal bases (the “EU/UK Legal Bases”):
-
Performance of our contract with you. Where we have a contract or agreement with you personally, certain personal information we collect is used to perform our agreements with you, including our Terms of Use and other terms and conditions applicable to the Services you use.
-
To comply with a legal obligation to which Circana is subject. The personal information we collect may be processed in order to comply with the law and our legal obligations.
-
For our legitimate business interests. We may process personal information in furtherance of our legitimate business interests such as, providing access to the Services that we have contracted to your employer, protecting, maintaining and improving the Services; developing new Services; marketing and promoting our Services (including by profiling and marketing to customers); protecting our legal rights and interests; in support of mergers, acquisitions, reorganizations and other business transactions; and to generally operate and improve our business.
-
With your consent. We may process personal information about you based on your consent, for example (where required by law) to send you marketing communications, surveys, news, updates and other communications. In addition, where required by applicable law, Circana will obtain your consent to this Policy and our collection, use and disclosure of your personal information. Users of our Services may be able to withdraw their consent at any time in accordance with applicable laws; please see Section 8. Your Privacy Choices below for information on how to withdraw your consent.
Purposes of Use and Processing. While the purposes for which we may process personal information may vary depending upon the circumstances in which we collect such personal information, in general, we may use, disclose and otherwise process personal information for the purposes set forth below.
-
Services and support. To provide and operate our Services, manage your account, communicate with you about your use of the Services, provide troubleshooting and technical support, respond to your inquiries, fulfill your requests, facilitate payment processing, communicate with you about the Services, and for similar service and support purposes. (EU/UK Legal Basis: performance of our contract with you; your consent; and/or for our legitimate business interests).
-
Analytics and improvement. To better understand how users access and use the Services and for other research and analytical purposes, such as to evaluate and improve our Services and business operations, to develop services and features, and for internal quality control and training purposes. (EU/UK Legal Basis: our legitimate business interests).
-
Customization and personalization. To tailor content we may send or display on the Services, including to offer location customization and to otherwise personalize your experiences and offerings. (EU/UK Legal Basis: our legitimate business interests; and/or your consent).
-
Marketing and advertising. For marketing and advertising purposes. For example, to send you information about our Services, such as offers, promotions, newsletters and other marketing content, as well as any other information that you sign up to receive. We also may use certain information we collect to manage and improve our advertising campaigns so that we can better reach people with relevant content. (EU/UK Legal Basis: our legitimate business interests; and/or with your consent).
-
Planning and managing events. For event planning and management, including registration, attendance, connecting you with other event attendees, and contacting you about relevant events and Services. (EU/UK Legal Basis: our legitimate business interests).
Research and surveys. To administer surveys and questionnaires, such as for market research or customer satisfaction purposes. (EU/UK Legal Basis: our legitimate business interests).Developing insights and enhancing data. We may combine personal information collected through the Services with other information that we or third parties collect about you in other contexts. In most cases, the information that we may combine with the personal information collected through the services for market research, such as demographic information, does not directly identify consumers. (EU/UK Legal Basis: our legitimate business interests).Security and protection of rights. To protect the Services, users of our Services, and our business operations; to protect our rights or those of our stakeholders; to prevent and detect fraud, unauthorized activities and access, and other misuse; where we believe necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety or legal rights of any person or third party, or violations of our Terms of Use. (Legal basis: our legitimate business interests; to comply with a legal obligation; and/or performance of our contract with you).Compliance and legal process. To comply with the law and our legal obligations, to respond to legal process and related to legal proceedings. (Legal basis: our legitimate business interests; and/or to comply with a legal obligation).General business and operational support. To consider and implement mergers, acquisitions, reorganizations, bankruptcies, and other business transactions such as financings, and related to the administration of our general business, accounting, auditing, compliance, recordkeeping, and legal functions. (Legal basis: our legitimate business interests; and/or to comply with a legal obligation).
4. Disclosures of Personal Information
We may disclose the personal information that we collect for the purposes described above, in order to provide our Services to you, to respond to and fulfil your requests, as otherwise directed or consented to by you, and as follows:
-
Vendors and service providers. We may disclose personal information we collect to our service providers, processors and others who perform functions on our behalf. These may include, for example, IT service providers, payment processors, analytics providers, consultants, auditors and legal counsel.
-
Our affiliates and subsidiaries. We may disclose personal information we collect to our affiliates or subsidiaries, who will use and disclose this personal information in accordance with the principles of this Policy, and the more specific policies.
-
Customers. We may disclose deidentified, aggregated information regarding your use of our Services to help our business customers better understand consumer behavior. For example, we may combine and/or aggregate information or survey responses that you allow us to collect with the responses of others to produce deidentified reports. We may also create aggregated reports based upon deidentified modeled information. “Modeled information” is data based upon demographic and behavioral characteristics (e.g., gender, age, and purchasing habits) to predict what people with similar or matching characteristics would buy.
-
Customers. If you are using a product or service such as Unify® we may disclose any personal data provided, including your usage statistics to the party we have an agreement or license in place with permitting your use of such product or service.
-
Third party platforms, providers and networks. We may disclose or make available personal information to third party platforms and providers that we use to provide or make available certain features or portions of the Services, or as necessary to respond to your requests. We may also make certain information that includes personal information available to third parties in support of our marketing, analytics, advertising and campaign management (see Section 6. Cookies, Targeting and Analytics for more information).
-
Commercial Partners and Other Third Parties. (i) In connection with our business, we may disclose demographic information (e.g., gender, household size, and number of children) to commercial partners and other third parties in either single or aggregate summary form and may also provide other aggregate or deidentified information to such third parties (singular summary includes demographic information about a person without specifically identifying the person and aggregate summary includes demographic information about a group of persons without specifically identifying any person within the group); or (ii) we may also provide your personal information, with respect to some of our Services, to commercial partners and other third parties, such as retailers, brands, and partners we co-sponsor surveys with, for marketing research and analytics purposes (for example, to create models that estimate consumer preferences in the total population or to inform market segments).
-
Panel Owners. Where you have registered to become a member of a market research panel operated by another company (“Panel Owner”) and chosen to participate in a survey, we may provide information to the Panel Owner for purposes of confirming whether or not you have taken our survey.
-
Data contributors with respect to media products. In limited instances, specifically with respect to Circana’s media products, Circana combines its own market data with the data of its customers and other third parties. To ensure the combined data can be continuously updated by all parties contributing data, the data is associated with a unique ID that is made available to all data contributors. The data made available does not directly identify consumers (i.e., name, email, physical address, and other directly identifying information is not made available to data contributors).
-
In support of business transfers. If we or our affiliates are or may be acquired by, merged with, or invested in by another company, or if any of our assets are or may be transferred to another company, whether as part of a bankruptcy or insolvency proceeding or otherwise, we may transfer the information we have collected from you to the other company. We may also share certain personal information as necessary prior to the completion of such a transaction or corporate transactions such as financings or restructurings, to lenders, auditors, and third-party advisors, including attorneys and consultants, as part of due diligence or as necessary to plan for a transaction.
-
Compliance and legal obligations. We may also disclose personal information to third parties to comply with our legal and compliance obligations and to respond to legal process. For example, we may disclose information in response to subpoenas, court orders, and other lawful requests by regulators and law enforcement, including responding to national security or law enforcement disclosure requirements. This may include regulators, government entities, and law enforcement as required by law or legal process. In addition, it may include certain disclosures that we are required to make under applicable laws, such as the names of sweepstakes and contest winners.
-
Security and protection of rights. We may disclose personal information where we believe doing so is necessary to protect the Services, our rights and property, or the rights, property and safety of others. For example, we may disclose personal information in order to (i) prevent, detect, investigate and respond to fraud, unauthorized activities and access, illegal activities, and misuse of the Services, (ii) situations involving potential threats to the health, safety or legal rights of any person or third party, or (iii) enforce, and detect, investigate and take action in response to violations of, our Terms of Use. We may also disclose information, including personal information, related to litigation and other legal claims or proceedings in which we are involved, as well as for our internal accounting, auditing, compliance, recordkeeping, and legal functions.
5. Aggregate Data and Non-identifiable Data
We may also receive, use and disclose aggregate and other non-identifiable data related to our business and the Services for quality control, analytics, research, development and other purposes. Some of this information may be considered “deidentified” under U.S. privacy laws (i.e., data that it is no longer linked or reasonably linkable to an identified or identifiable consumer). Where we rely on data that has been “de-identified” as defined by U.S. privacy laws, we will maintain and use such information in deidentified form and will not attempt to reidentify such information, except in order to determine whether our deidentification processes are reasonable and adequate or as otherwise set forth by these laws.
6. Cookies, Targeting and Analytics
We and our third-party service providers may use cookies, pixels, local storage objects, log files, APIs, and other mechanisms to automatically collect information browsing, activity, device and similar information within our Services and to target advertising and content. We may use this information to, for example, analyze and understand how users’ access and use our Services, as well to identify and resolve bugs and errors in our Services and to assess secure, protect, optimize and improve the performance of our Services. You have certain choices about our use of cookies and tracking within the Services, as described in this section. For more information on the types of personal information we collect via cookies and similar mechanisms, please see Section 2. Personal Information Collected .
Cookies. Cookies are alphanumeric identifiers that we transfer to your device’s hard drive through your web browser for record-keeping purposes. Some cookies allow us to make it easier for you to navigate our Services, while others are used to enable a faster log-in process, support the security and performance of the Services, or allow us to track activity and usage data within Service.
Pixel tags. Pixel tags (sometime called web beacons or clear GIFs) are tiny graphics with a unique identifier, similar in function to cookies. While cookies are stored locally on your device, pixel tags are embedded invisibly within web pages and online content. We may use these, in connection with our Services to, among other things, track the activities of users, help us manage content and compile usage statistics. We may also use these in HTML e-mails we send, to help us track e-mail response rates, identify when our e-mails are viewed, and track whether our e-mails are forwarded.
Third-Party Analytics and Tools. We may use third party tools, such as Google Analytics, which are operated by third party companies. These third-party analytics companies may collect usage data (using cookies, pixels and similar tools) about our Services in order to provide us with reports and metrics that help us to evaluate usage of our Services and improve performance and user experiences.
Cross-device Tracking. We and our third-party providers may use the information that we collect about you within our Services and on other third-party sites and services to help us and these third parties to identify other devices that you use (e.g., a mobile phone, tablet, other computer, etc.). This information may be used as set forth in this section and Section 6. Cookies, Targeting and Analytics.
Targeted Advertising. We work with third parties, such as ad networks, channel partners, mobile ad networks, analytics and measurement services and others (“third-party ad companies”) to personalize content and display advertising within our Services, as well as to manage our advertising on third-party sites, mobile apps and online services. We may share certain information with these third-party ad companies, and we and they may use cookies, pixels tags, and other tools to collect usage and browsing information within our Services, as well as on third-party sites, apps and services, such as IP address, location information, device ID, cookie and advertising IDs, and other identifiers, as well as browsing information. We and these third-party ad companies use this information to provide you more relevant ads and content within our Services and on third-party sites and apps, and to evaluate the success of such ads and content.
Custom Lists and Matching. We may share or make available certain customer list information (such as your name, email address and other contact information) with third parties (i) so that we can better target ads and content to you across third party sites, platforms and services, and (ii) in some cases, these third parties may help us to enhance our customer lists with additional demographic or other information, so we can better target our advertising and marketing campaigns.
Managing Your Preferences. We make available several ways for you to manage your preferences regarding targeted advertising and cookies within our Services. Many of these are browser and device specific, which means that you need to set the preference for each browser and device you use to access our Services; in addition, if you delete or block cookies, you may need to reapply these preferences. Further, opting out of cookies and advertising as discussed below does not mean that you will no longer receive advertising content from us. You may continue to receive generic or “contextual” ads from us. Cookie preference. You can review or change your preferences for targeting cookies and tags on our websites by adjusting your cookie settings. These settings are browser and device specific. Browser signals. If our website detects that your browser is transmitting a “global privacy control”—or GPC— signal, we will apply that to opt that browser on your device out of targeting cookies on our website. If you come to our website from a different device or from a different browser on the same device, you will need to apply GPC for that browser and/or device as well. See Section 14.C, Additional Privacy Information for California Residents, below, for more information about GPC. Our websites do not recognize or respond to browser “do not track” signals. Mobile settings. In addition to the above, some of our apps may include third-party advertising and analytics. You can change your targeting and advertising preferences for these apps by adjusting your device privacy settings (you can find iOS instructions here , and Android instructions here ).Industry ad choice programs. You can also control how participating third-party ad companies use the information that they collect about your visits to our websites and use of our mobile applications, and those of third parties, in order to display more relevant targeted advertising to you; for more information and to opt out of receiving targeted ads from participating third-party ad networks go to:U.S. Users : aboutads.info/choices (Digital Advertising Alliance) (You can also download the DAA AppChoices tool in order to help control interest-based advertising on apps on your mobile device)Canada Users : youradchoices.ca/choices/ (Digital Advertising Alliance of Canada)EU Users : youronlinechoices.eu (European Interactive Digital Advertising Alliance)
Please note that opting out of participating ad networks does not opt you out of being served advertising. You may continue to receive generic or ‘contextual’ ads on our Services. You may also continue to receive targeted ads on other websites, from companies that do not participate in the above programs.
-
Browser settings. If you wish to prevent cookies from tracking your activity on our website or visits across multiple websites, you can set your browser to block certain cookies or notify you when a cookie is set; you can also delete cookies. The Help portion of the toolbar on most browsers will tell you how to prevent your device from accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to delete cookies. Visitors to our Services who disable cookies will be able to browse the website, but some features may not function.
7. International Transfers of Data
Circana is headquartered in the United States, and has operations, entities, and service providers in the United States and throughout the world. As such, Circana may collect your personal information from the United States, and we may transfer your personal information to and process your personal information from the United States and other jurisdictions where we and our affiliates and service providers have operations. Some of these jurisdictions (including the United States) may not provide equivalent levels of data protection as compared to your home jurisdiction.
Where applicable, transfers to service providers or other third parties will be made pursuant to the recipient’s compliance with the European Commission’s Standard Contractual Clauses and/or the UK’s International Data Transfer Addendum/ Agreement; pursuant to the consent of the individual to whom the personal information pertains; as necessary to perform a contract with that individual or in the individual’s interest, or to carry out pre-contractual steps; or as otherwise permitted by applicable law. A copy of the Standard Contractual Clauses can be found here and further details are available on request by contacting us using the details found at Section 13.
8. Your Privacy Choices
We make available a number of ways that you can manage your privacy choices and submit privacy requests related to your personal data. These include:
-
Account information. You can review and update some of the personal information that we maintain about you by logging into your account, where applicable, and updating your account information.
-
Push notifications. In connection with some of our Services, we may send push notifications from time-to-time in order to communicate with you regarding your account and promotions. If you no longer wish to receive these types of communications, you may turn them off at the device level.
-
Targeted advertising/cookie preferences. As described in Section 6. Cookies, Targeting and Analytics there are several ways that you can manage your preferences for targeting cookies and advertising by us and on our website. You can review or change your preferences for many cookies and tags on our website, other than those that are necessary to operation and functionality, by adjusting your cookie settings in your browser. These preferences are browser and device specific. So, you will need to set your preferences for each browser and device you use, and if you subsequently delete or block cookies you may need to reapply these settings.
-
Marketing communications. You can opt out of receiving marketing emails from us by using the unsubscribe link in the footer of each marketing email we send to you.
-
Text messages. If you authorize us to contact you through SMS text messaging, we may use the phone number associated with a specific Service to contact you with information related to your use of that Service. Such text messages are for transactional purposes only, and never for marketing of any kind. You may opt out of text messaging at any time by texting STOP to the number provided in the text or by contacting us through the information in section 13. Residents of certain jurisdictions, including California and other U.S. states, the European Union, and the United Kingdom, have additional rights as set forth below in Section 14. Additional Information for Certain Jurisdictions .
For more information about our privacy practices and your privacy choices, you may contact us as set forth in the ‘Contact Us’ section below
9. Retention
We retain your personal information for as long as necessary to fulfill the purposes for which it was collected or as otherwise necessary to comply with our legal obligations, resolve disputes, maintain appropriate business records, and enforce our agreements.
10. Children
Protecting the privacy of young children is especially important. Our Services are not directed to children under the age of 16, and we do not knowingly collect personal information from children under the age of 16 without obtaining parental consent. If we learn that personal information has been collected on the Services from persons under 16 years of age and without verifiable parental consent, then we will take the appropriate steps to delete this information. If you are a parent or guardian and discover that your child under 16 years of age has obtained an account on the Services, then you may alert us using the information provided in Section 13. Contact Us, and request that we delete that child’s personal information from our systems.
11. Security
We have implemented safeguards that are intended to protect the personal information we collect from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. Please be aware that despite our efforts, no data security measures can guarantee security.
12. Changes to this Policy
This Policy is current as of the Effective Date set forth above. We may change this Policy from time to time, so please be sure to check back periodically. We will post any updates to the Policy at www.circana.com/privacy. If we make material changes to how we collect, use and disclose the personal data we have previously collected about you, we will endeavor to provide you prior notice, such as by emailing you or posting prominent notice through on our website or within the Services.
13. Contact Us
If you have questions about this Notice or our privacy practices, you may contact us through by email at privacy@circana.com.
14. Additional Information for Residents in Certain Jurisdictions
This section includes additional information as required under privacy laws of certain jurisdictions.
15. EEA and UK
Residents of the EEA and UK have the following rights regarding your personal information that we hold, subject to any conditions or limitations set out in applicable law:
-
Access. You have the right to obtain information about our processing of your personal information and obtain access to and a copy of your personal information.
-
Rectification. You may have the right to update, complete, or correct inaccuracies in your personal information.
-
Erasure. You may have the right to have your personal information deleted.
-
Portability. You may have the right to obtain a machine-readable copy of your personal information or to have us transfer it to another controller of your choice.
-
Restriction. You have the right to restrict the processing of your personal information, meaning that we will not further process your personal information except to store it.
-
Withdrawal of consent. You have the right to withdraw your consent to our processing of your personal information, without affecting the lawfulness of processing up until withdrawal.
-
You also have the right to object to the processing of your personal information for direct marketing (including profiling) purposes.
Please note that some of these rights may be limited, such as where we have an overriding interest or legal obligation to continue to process the data. Please contact us using the information set out above, in Section 13. “Contact Us,” if you wish to exercise any of your rights or if you have any inquiries or complaints regarding the processing of your personal information by us.
If you are not happy with how your rights are handled, you can submit a complaint with the relevant data protection authority of your habitual residence, your place of work or the place of the alleged infringement/violation of your rights. This link will redirect you to the European Data Protection Board Website with an up-to-date list of all European Union Data Protection Authorities: https://edpb.europa.eu/about-edpb/board/members_en . The UK authority, the ICO, can be reached here: https://ico.org.uk/ .
Controller of your Information. The controller of your information is the Circana entity you or your employer has entered into a contract with, or you have subscribed to or contacted. Our EU representative is the Circana Group’s Irish subsidiary and can be contacted through the details found in Section 13.
16. United States
If you are a resident of California, please review our California Privacy Supplement for a description of your rights pursuant to California privacy laws.
Residents of other certain other US states, including Colorado, Connecticut, Utah, and Virginia, have additional rights under applicable privacy laws, subject to certain limitations, which may include:
-
Correction. The right to correct inaccuracies in their personal information, taking into account the nature and purposes of the processing of the personal information.
-
Deletion. To delete their personal information provided to or obtained by us.
-
Access: to confirm whether we are processing their personal information and to obtain a copy of their personal information in a portable and, to the extent technically feasible, readily usable format.
-
Opt-Out: to opt out of certain types of processing, including:
-
to opt out of the “sale” of their personal information.
-
to opt out of targeted advertising by us.
-
to opt out of any processing of personal information for purposes of making decisions that produce legal or similarly significant effects.
You may submit a request to exercise most of your privacy rights under U.S. state privacy laws by contacting privacy@circana.com. To opt out of targeted advertising by us, you can adjust your cookies settings on your device. (See Section 8. Your Privacy Choices for additional information about the privacy choices we provide and how to exercise them.) We will respond to your request as required under the applicable privacy law(s). If we deny your request, you may appeal our decision by following the directions provided to you during the request process.
17. California Privacy Supplement
This California Privacy Supplement provides California residents with additional information regarding our collection, use and disclosure of their personal information, as well as their privacy rights, under California privacy laws, including the California Consumer Privacy Act (“CCPA”).
Categories of Personal Information Collected
Categories of Third Party Disclosures
Identifiers
Service providers Advisors and agentsRegulators, government entities and law enforcementAffiliates and subsidiariesAdvertising networks Data analytics providersSocial networks Internet service providers, operating systems and platforms Data brokersBusiness customer/clientOthers as required by law
Customer Records
Includes personal information, such as name, account name, user ID, contact information, employment information, and financial or payment information, that individuals provide us in order to purchase or obtain our Services. For example, this may include information collected when an individual register for an account, purchases our Services, or enters into an agreement with us related to our Services.
Includes direct identifiers, such as name, alias, user ID, username, account number or unique personal identifier; email address, phone number, address and other contact information; IP address and other online identifiers
Service providers Advisors and agentsRegulators, government entities and law enforcementAffiliates and subsidiariesOthers as required by law
Includes records of personal property, products or services purchased, obtained, or considered, or other purchasing or use histories or tendencies.
Commercial information
Service providers Advisors and agentsRegulators, government entities and law enforcementAffiliates and subsidiariesOthers as required by law
Service providers Advisors and agentsRegulators, government entities and law enforcement Affiliates and subsidiaries Advertising networks Data analytics providers Social networks Internet service providers, operating systems and platforms Data brokers Business customer/client Others as required by law
Including, but not limited to, browsing history, clickstream data, search history, and information regarding interactions with an internet website, application, or advertisement, including other usage data related to your use of any of our Services.
Internet and electronic network activity information
Professional information
Includes professional and employment-related information, such as current employer(s), position(s), and business contact information.
Service providers Advisors and agentsRegulators, government entities and law enforcementAffiliates and subsidiariesBusiness customer/clientOthers as required by law
Education Information
Information about an individual’s educational history, including level of education.
Service providers Advisors and agentsRegulators, government entities and law enforcementAffiliates and subsidiariesBusiness customer/clientOthers as required by law
Profiles and inferences
Including inferences drawn from any of the information identified above to create a profile reflecting a consumer’s preferences, characteristics, behavior or attitudes.
Service providers Advisors and agentsRegulators, government entities and law enforcementAffiliates and subsidiariesAdvertising networksData analytics providersSocial networksInternet service providers, operating systems and platformsBusiness customer/clientOthers as required by law
Protected classifications
We collect some information that is considered a protected classification under California/federal law, such as your race, gender, age, and date of birth.
Service providers Advisors and agentsRegulators, government entities and law enforcementAffiliates and subsidiariesAdvertising networksData analytics providersData brokersBusiness customer/clientOthers as required by law
Sensitive personal information
We may collect racial or ethnic origin (e.g., from surveys in which you participate); health and fitness data; and the contents of your emails (i.e., where you have granted us access so that we can identify purchases that may be eligible for loyalty and rewards).
Service providers Advisors and agentsAffiliates and subsidiariesAdvertising networksData analytics providersBusiness customer/clientOthers as required by law
Sales and Sharing of Personal Information. California privacy laws define a “sale” as disclosing or making available to a third-party personal information in exchange for monetary or other valuable consideration, and “sharing” broadly includes disclosing or making available personal information to a third party for purposes of cross-context behavioral advertising. Pursuant to the CCPA, we may sell/share personal information as described below:
-
With third-party analytics companies and marketing and advertising partners: identifiers, commercial information, internet and electronic network activity information and profiles and inferences. We do this in order to provide and improve our Services, improve and evaluate our marketing and advertising campaigns, and better reach individuals with relevant ads and content.
-
With our commercial partners, business customers, and data partners that utilize our media products: identifiers, customer records, commercial information, professional information, education information and profiles and inferences, including certain information considered sensitive personal information under the CCPA. We do this so that these partners may better understand consumer behavior, analyze, and improve marketing and advertising campaigns, and reach consumers with more relevant ads and content.
We do not sell or share personal information (including sensitive personal information) about individuals who we know are under sixteen (16) years old.
Sources of Personal Information. In general, we may collect personal information from the following categories of sources:
-
Directly from the individual
-
Advertising networks
-
Data analytics providers
-
Social networks
-
Internet service providers
-
Operating systems and platforms
-
Data brokers
-
Public databases
-
Joint marketing partners
-
Business customers
-
Affiliates and subsidiaries
Purposes of Collection, Use, and Disclosure.As described in more detail in Section 3. Purposes of Use and Legal Bases for Processing Personal Information and Section 4. Disclosures of Personal Information or our Privacy Policy, we may collect, use, disclose and otherwise process the above personal information for the following business or commercial purposes and as otherwise directed or consented to by you:
-
Services and support
-
Analytics and improvement
-
Customization and personalization
-
Marketing and advertising
-
Planning and managing events
-
Research and surveys
-
Combining personal information
-
Security and protection of rights
-
Compliance and legal process
-
General business and operational support
Retention. We retain the personal information we collect only as reasonably necessary for the purposes described above or otherwise disclosed to you at the time of collection and as otherwise necessary to comply with our legal obligations, resolve disputes, maintain appropriate business records, and enforce our agreements. In some cases we may aggregate or de-identify information, such that it is no longer linked or reasonably linkable to you, and we may maintain such non-identifiable information indefinitely.
CCPA Rights. Under the CCPA, California residents have the following rights (subject to certain limitations):
-
Opt out of sales and sharing. The rightto opt-out of our sale and sharing of their personal information.
-
Limit uses and disclosure of sensitive personal information. The right to limit our use or disclosure of sensitive personal information to those authorized by the CCPA.
-
Deletion. The right to the deletion of their personal information that we have collected, subject to certain exceptions.
-
To know/access. The right to know what personal information we have collected about them, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about them.
-
Correction. The right to correct inaccurate personal information that we maintain about them.
-
Non-discrimination. The rightnot to be subject to discriminatory treatment for exercising their rights under the CCPA.
Submitting CCPA Requests.California residents may exercise their CCPA privacy rights as set forth in this section.
-
Request to know/access, correct, delete and limit.California residentsmay submit verifiable requests to access/know, correct and delete their personal information maintained by us, as well as requests to limit the use and disclosure of their sensitive personal information online by submitting a request to privacy@circana.com. You may also submit a request by calling us..
If you submit a request to access/know, correct or delete your personal information, we will take steps to verify your request by matching the information provided by you with the information we have in our records. Please complete all required fields on our webform (or otherwise provide us with this information via the above toll-free number). We will process your request based upon the personal information in our records that is linked or reasonably linkable to the information provided in your request. In some cases, we may request additional information in order to verify your request or where necessary to process your request.
-
Requests to opt out. California residents may exercise their right to opt out online by submitting an opt out request to privacy@circana.com or by calling us. We will apply your opt out based upon the personal information in our records that is linked or reasonably linkable to the information provided in your request. In addition, our website responds to global privacy control—or “GPC”—signals, which means that if we detect that your browser is communicating a GPC signal, we will process that as a request to opt that particular browser and device out of sharing (i.e., via cookies and tracking tools) on our website. Note that if you come back to our website from a different device or use a different browser on the same device, you will need to opt out (or set GPC for) that browser and device as well. More information about GPC is available at: https://globalprivacycontrol.org/ .
-
Authorized agents. Authorized agents may initiate a request on behalf of another individual by contacting us atprivacy@circana.com; authorized agents will be required to provide proof of their authorization and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.
-
Financial incentives and non-discrimination.With respect to some of our Services, we may make available certain programs or offerings that are considered “financial incentives” under the CCPA. We do not offer financial incentives that are discriminatory. You can find a description of these programs and our applicable notice(s) as required by the CCPA in the privacy policies associated with these Services. We will obtain your consent before including you in a financial incentive and you may opt out of such participation at any time.
Rights Under California Shine the Light Law. Under California’s “Shine the Light” law (Cal. Civ. Code § 1798.83), California residents who provide us certain personal information are entitled to request and obtain from us, free of charge, information about the personal information (if any) we have shared with third parties for their own direct marketing use. Such requests may be made once per calendar year for information about any relevant third-party sharing in the prior calendar year. To submit a “Shine the Light” request, email us at privacy@circana.com, and include in your request a current California address and your attestation that you are a California resident.