Privacy Policy for JCDecaux Digital Advertising Services

 

This Privacy Policy is effective as of May 12, 2017 (view archived version, view changes).

 

This Privacy Policy describes the principles and practices that apply when JCDecaux North America, Inc. and affiliated entities controlled by or under common control with JCDecaux (“JCDecaux,” “we,” or “us”) broadcasts, collects or processes data in the course of providing its services, such as when analyzing the data generated when an individual (“you” or “your”) interacts with a JCDecaux advertising display.

 

For the Privacy Policy that covers the practices that apply to the data generated when an individual visits the JCDecaux website, located at www.jcdecauxna.com, please see the Privacy Policy for the JCDecaux Website.

 

In summary:

  • JCDecaux processes and analyzes data generated when technologies attached to JCDecaux assets collect data or interact with mobile devices to create information that is used to plan and manage advertising campaigns;
  • JCDecaux does not know Personal Identifiable Information (PII) of individuals whose mobile devices interact with JCDecaux assets or who otherwise interact with JCDecaux assets;
  • JCDecaux shares aggregated or statistical information with media buyers who use it to make decisions regarding their advertising campaigns and better adapt their campaign to the assumed interests of their target audience.

Definitions

For ease of use of this document, certain terms have been associated with the specific meaning provided below.

 

“Ad Impression” means a single instance of the display of an advertisement to an individual.

 

“Anonymous Data” means data that is collected without any associated identifying information and that is not linked or reasonably linkable to an individual or to a particular computer or device.

 

“Aggregated Data” means the consolidation of information relating to multiple individuals or information that has been combined with other data and therefore cannot be traced back to a specific individual.

 

“Data” means anonymous, aggregated data about a person’s whereabouts, activities, or location relative to a JCDecaux Asset, or that is generated by, or results from, the interaction of a person with an Asset, such as for example, interaction with a QR Code affixed on a bus shelter owned or operated by JCDecaux. It can also be provided by Third Party Providers who have access to their own data sources and are able to correlate their information to JCD Assets.

 

“De-Identified Data” means data that has been rendered anonymous by removing any information that would allow someone to determine an individual’s identity.  

“Device” means a smart phone or tablet that is able to receive Blue Tooth communications and/or Wi-Fi, and to connect to the Internet, and that contains certain applications that are able to interact with JCDecaux Technologies.

 

“Device Advertising ID” means an identifier that is associated with a particular Device, but cannot be used to determine the identity of the owner or user of that device. A Device Advertising ID can be reset at any time by the owner or user of the device. The most common types of Device Advertising ID are IDFA (for iOS devices) and GAID/AAID (for Android devices)

 

“JCDecaux Asset” or “Asset” means an advertising display owned or operated by JCDecaux, and affixed on structures such as, but not limited to, buildings, walls, bus shelters, benches, newsstands, kiosks signage displays or other type of panel.

 

“JCDecaux Services” or “Services” means the services, proprietary platforms, tools, methodology and equipment developed by or for JCDecaux to collect or receive data about its Assets and to enable Media Buyers to plan for, measure, manage, and optimize their digital advertising campaigns.

 

“JCDecaux Technology” or “Technology” means any of the identifying technologies that are affixed on JCDecaux Assets and that are used or intended to be used to transmit or convey certain information. JCDecaux Technologies include, for example, beacons, NFC tags, cameras, sensors and QR Code tags (defined below in this document).

 

“MAC Address” (or Media Access Control Address) means the unique identifier assigned to network interfaces of a computer or device for communications with a network (ISP, cellular, etc.)

 

“Media Buyer” or “Customer” means a company that advertises its products or services, or those of its clients, on advertising signage displays, bus shelters, mobile phones or tablets or similar platforms. For example, a department store that advertises its shoes, or a university that advertises its courses could be a Media Buyer.

 

“Non-Personally Identifiable Information” (or “Non-PII”) means data that is linked to a particular computer or device, and may include without limitation, IP address, MAC address, Advertising ID (IDFA and/or GAID/AAID) and other unique identifiers associated with Devices where such identifiers or IP addresses are not linked to Personally Identifiable Information.

 

“Personally Identifiable Information” (or PII) means information that is used or intended to be used to identify a specific individual, including, for example, name, address, telephone number, email address, manufacturer device identification numbers, or payment card number or government-issued identifier.

 

“Person”, “People” “you” or “your” means an individual who walks or stands near or by a JCDecaux Asset.

 

What Services does JCDecaux Offer?

JCDecaux provides Media Buyers with the ability to advertise their products or services on the JCDecaux Assets. JCDecaux uses Technologies to identify each of its Assets. The Technologies are intended to provide JCDecaux and its service providers and business partners with information about the location of its Assets, and the ability to collect anonymous data about People who walk or stand by or near a JCDecaux Asset, or who interact with an Asset. Such data cannot be associated with a particular individual without having access to confidential information held by telecommunications or internet service providers. JCDecaux does not have any direct or indirect means to determine a person’s identity, unless the person provides it to JCDecaux.

 

JCDecaux or its service providers or business partners compile this data to create just-in-time statistical information based on anonymous, aggregate analysis, about an environment, for example, a plaza, a train station corridor, or a bus shelter. This information is used by Media Buyers to manage and optimize their digital marketing campaigns.

 

For example, JCDecaux may provide a Media Buyer with information about the number of people standing in the vicinity of a particular JCDecaux Asset during particular time periods based on historical data, such as a bus shelter in New York. This is provided to help the Media Buyer understand the potential number of people or Ad Impressions to which their advertisement would be exposed. The Media Buyer may decide to display an advertisement for its product on that bus shelter based on that information.

What Data does JCDecaux Collect?

JCDecaux or its Third Party Providers may collect, use and share data it collects through your proximity to our Assets or through your interaction with Technologies associated with our Assets.

  • PII Collected

    JCDecaux does not collect any PII from or through the JCDecaux Assets. In some cases, JCDecaux Assets may include an advertisement that collects PII when an individual enters their name, email address, or other PII. In these cases, PII may be collected by a third party (such as an advertiser on a JCDecaux Asset) and not by JCDecaux, and will be subject to that third party’s privacy policy, rather than this Privacy Policy. We have no control over, and are not responsible for, this third party’s use or your disclosure of your PII.

  • Non PII Collected

    JCDecaux may collect non-PII from or through the JCDecaux Assets. When people use an NFC or QR Code tag from a JCDecaux Asset, this use may generate non-PII that JCDecaux may receive from its service providers or business partners.

  • De-Identified Data Collected

    JCDecaux may, from time to time, collect De-identified data from or through the JCDecaux Assets.  However, it is the policy of JCDecaux not to re-identify any data at any time.

What Technologies does JCDecaux Uses?

JCDecaux may affix Technologies on its Assets as allowed by its advertising agreements with various city authorities or agencies. JCDecaux has entered into contracts with service providers and business partners who are able to read data provided by the Technologies.

  • Beacons

    Beacons do not capture information. Instead, they emit their identification number and information about their location over Bluetooth connections.

    Only Devices that are equipped with Bluetooth technology and have this feature turned on by you may be able to recognize a signal emitted by a beacon installed on a JCDecaux Asset.

    Only those Devices that are equipped with app(s) that are able to recognize these beacons may capture the signal emitted by such beacons.

    For Android users, an app is able to detect a beacon signal only if it is in use and only if you have allowed the app to share your location.

    For iOS users, an app is able to detect a beacon signal only if the person has allowed the app to share his/her location. For additional information, please reference: https://support.apple.com/en-us/HT202880
     

    When an app meets the conditions above, it is able to detect a signal from a JCDecaux beacon. It is also able to identify the beacon, record the approximate distance to the beacon based on the signal strength, and decide what action to take according the programming of the app. For example, it may notify the app publisher that user x is next to beacon y.

  • Cameras

    Camera technology may be used when a device is attached to a JCDecaux Asset to capture images in order to count people or measure engagement with a JCDecaux Asset. Neither JCDecaux nor its Third party providers will use facial recognition technology and no images or videos will be stored.

  • NFC and QR Code Interactive Touchpoints

    NFC (or Near Field Communication) is initiated by tapping a Device on an intelligent NFC interactive touchpoint. The tapping triggers the Device’s capabilities to interpret the embedded URL being transmitted by the NFC tag, and opens the corresponding website or application provided by a Third Party within the Device environment.

    A QR Code is similar to a barcode. When a person scans a QR code using an app located on his/her Device, the app interprets the QR Code and accesses the related website or application of the Third Party whose URL address is written into the QR Code.

    Unlike a beacon, which emits its ID in a continuous mode but is captured only if certain conditions are met, an NFC or QR Code touchpoint is ineffective unless a person taps the NFC reader or scans the QR code touch point with his/her Device to activate the interaction with a website or an app.

  • Sensors

    A Sensor is a device, embedded in a JCDecaux asset, that is used to count nearby devices that are broadcasting a Wi-Fi signal.  All Wi-Fi devices with Wi-Fi set to “on” or “active” send out “probes”, which alert the device to available Wi-Fi networks that that device can connect to. One of the data points broadcasted by a users’ device “probe” is the device MAC address, which information is immediately encrypted upon receipt by the Sensor. These “probes” (which include MAC addresses) are what the Sensors use to count the number of nearby devices.  Additionally, other data broadcast in that “probe” may include manufacturer name, and signal strength (i.e. the strength of the connection between the user device and the Sensor). All data is encrypted using the Advanced Encryption Standard (AES). Only devices within a particular proximity (approximately 80 meters/260 feet) to a Sensor can be detected by said sensor.

  • How Does the Data Collection Technology Work?

    When a person passes or stands by a JCDecaux Asset, the person’s Device may interact with a beacon and/or sensor located on or near the JCDecaux Asset. If all conditions identified above are met for either beacons and/or sensors, whichever the case may be, the receipt of the information by a Device triggers the transmittal of the information to a Third Party that can measure and analyze the data to develop statistics concerning the environment in which the particular Asset is located.

    When a person taps on an NFC reader or scans a QR Code touchpoint, affixed on a JCDecaux Asset, the action triggers the transmittal of the information contained in the NFC or QR touchpoint to a Third Party, an entity that can measure and analyze the data to develop statistics concerning the environment in which the particular Asset is located.

    If a JCDecaux Asset leverages Camera technology for pedestrian/vehicle counting, then the camera technology will register a count if you are within the range of this specific technology Importantly, no images or videos are stored or recorded.

    This data may be combined with other data collected by the measurement and analysis entity or a third party through other tools. JCDecaux does not have any control over the nature, type, or detail of the data that the person’s Device transmits to third parties. These settings are solely in the control of the publisher of the application that performs such transmittal or that of the person as explained in the section “What Rights do I have?” (located below).

What Information Does JCDecaux Receive from Third Parties?

JCDecaux does not receive any PII from service providers, business partners or Media Buyers in connection with its Services. JCDecaux receives only anonymous data, non-PII, aggregated data, or Device Advertising ID.

This information is derived from data that has been collected by (i) sensors and/or cameras installed by JCDecaux and/or (ii) measurement and analytics service providers and media buyers (with whom it has previously contracted) whose apps are able to recognize the signals sent by JCDecaux beacons or to interpret the signals generated by interaction with an NFC reader or QR codes affixed on the JCDecaux Assets when they interact with peoples’ Devices.

The combination of the information that is collected through the use of the JCDecaux Technologies by JCDecaux or its service providers or business partners may help the Media Buyer infer that a particular JCDecaux Asset is located in an area where at a certain time of the day or the week, a certain percentage of people walking in that area meet a certain profile, such as certain demographics, interest, lifestyle, median age, interest or socio professional background. For example, the aggregate information might indicate the number of adults, who are walking in a particular area, who appear to be interested in classical music but does not provide any information about a particular individual.

Additionally, JCDecaux may be authorized by a city or agency to access its apps to embed technology within the app to capture data via a Software Development Kit (a piece of code that facilitates communication between said app and a service provider, “SDK”). In such case the individual using the app will be subject to the privacy policies of that city or agency. JCDecaux will treat any data it may capture in accordance with this policy.

 

What is Required from Business Partners, Service Providers, Third Party Data Suppliers, and Media Buyers

JCDecaux requires its business partners, service providers, third party data suppliers, and Media Buyers that deal with digital data to comply with the requirements of the major advertising and marketing trade associations, such as NAI, DAA and IAB. For information about these associations you should visit the following sites:

When JCDecaux has agreed, pursuant to a contract with a business partner, to limit certain uses of the data collected by service providers and other business partners as described above, JCDecaux will ensure that its contracts with these service providers and business partners are consistent with such restrictions and limitations.

How Does JCDecaux Use this Information?

JCDecaux does not use any personally identifiable information of individuals when providing the JCDecaux Services.

We use information only in aggregated form (i.e. combined with that of hundreds or thousands of other individuals) to create statistics and analytics regarding the people that walk by or near our JCDecaux Assets.

With Whom Does JCDecaux Share Data?

  • Service Providers and Business Partners

    We allow our service providers and business partners to use in raw form the data that they receive and that is emitted when a sensor and/or beacon communicates with an individual’s Device, or when a person activates an NFC or QR Code communication from one of our Assets.


    These service providers and business partners may include, for example, Advertisers, Advertising Networks, Ad Exchanges, Ad Servers, Agency Trading Desks and Demand Side Platforms (DSP’s), who may use this information for analytics purposes (e.g. to create statistics about the pedestrian traffic near a JCDecaux Asset) or for retargeting purposes (e.g. to deliver an ad to a person who is assumed to have seen an advertisement on a JCDecaux Asset).

    The information collected as indicated above, after it has been combined with third parties’ information, may be used to make decisions regarding where and when to display advertisements. For example, an advertiser or advertising agency may elect to purchase advertising space on that particular JCDecaux Asset after the advertiser or advertising agency has identified that a particular JCDecaux Asset meets their needs and requirements for advertising purposes.

  • Third Party Mobile Advertising Suppliers

    JCDecaux may also partner with third party suppliers who provide mobile advertising programs. These third parties are able to deliver an advertisement to a person’s mobile device when they are in the vicinity of any JCDecaux Asset, or have interacted with an Asset in the past, through the use of anonymous mobile identifiers (IDFA, AAID, WindowsID).

  • To Defend or Enforce our Rights.

    We may use or share data, if any, in our custody or control:  (i)  to protect ourselves, (ii) to  protect the JCDecaux website, (iii) to establish or exercise our legal rights, (iv) to identify a breach of contract, (v)  when we believe it is appropriate to protect the property and rights of JCDecaux or a third party, the safety of our company, our Media Buyers or others, or (vi)  to investigate, prevent, take action against, or stop any fraudulent, illegal, unethical, or legally actionable activity.

  • Business Transfers

    JCDecaux may share data with its affiliates and subsidiaries. Additionally, JCDecaux may engage in corporate restructuring, acquisitions or divestitures and we may disclose, share or transfer some or all of the data associated with our Assets, as part of the due diligence, or after the transaction has been consummated, to allow for continuation of Services.

  • Compliance with Laws and Third Party Requests

    JCDecaux cooperates with government and law enforcement officials or private parties to enforce and comply with the law, as required by applicable law. We may disclose data associated with JCDecaux Assets to government or law enforcement officials or private parties as we, in our reasonable discretion, believe necessary or appropriate to respond to legal process (including a facially valid subpoena, warrant, court order or other legal process), respond to and defend against legal claims, or otherwise as required by applicable law.

  • After Aggregating Data

    JCDecaux may aggregate data about different Assets in order to obtain statistical information. We may create, publish, share or sell industry reports, analyses and similar materials that are used for industry analysis, demographic profiling, sales, marketing, and other business purposes. These reports provide data in aggregate form. No individual, company, or customer may be identified from these reports.

Security

JCDecaux employs administrative, physical, network and electronic measures designed to protect data associated with our Assets from unauthorized access, loss, misuse, disclosure, alteration, and destruction, in accordance with the sensitivity of such data. While we do our best to implement security measures, we do not guarantee that our safeguards will always work. JCDecaux is not liable for unauthorized disclosure of data that occurs through no fault of JCDecaux.

What Rights do I Have?

We respect the privacy of individuals. To this end, we identify below the privacy choices that people may have.

  • You can prevent the collection of data

    Information, if any, about a person’s presence near a JCDecaux Asset is collected by or through third party apps that the person has installed on his/her Device. JCDecaux does not interact directly with people, and therefore, cannot offer people the ability or any technology that would provide the ability to block the collection of data associated with JCDecaux Assets.

    To prevent the collection of information by third parties, in response to a signal from a beacon, people can do any of the following:

    • Power off their phone
    • Disable Bluetooth (which will prevent interaction with a beacon)
    • Disable Wi-Fi (which will prevent interaction with a sensor)
    • Prohibit the use of geolocation
    • Remove or not use those applications that are able to interact with the JCDecaux Technologies

    To prevent the collection of information by third parties, in response to an NFC or QR Code signal, people should not use or interact with NFC or QR code touch points.

  • You can limit the Collection of Data for Interest Based Advertising

    The advertising industry offers means for individuals who want to limit the collection of data about them for Interest Based Advertising (IBA). If you wish to prevent certain forms of tracking, you may wish to consider the use of the AppChoices App, offered by the Digital Advertising Alliance, which provides the ability to limit the collection of data for interest based advertising from all or a number of the companies that participate in the DAA program on a mobile device. For more information, please visit: http://www.aboutads.info/appchoices

  • You can adjust the settings of your mobile Device

    You may also wish to adjust the setting on your mobile Device. On these settings, you will be able to reset your Device’s Advertising ID and/or limit ad tracking. Please note that by limiting ad tracking through the settings on your Device, you will disable all ad tracking, not just those of a specific entity.

    iOS Users

    For iOS 6 users:  Go to Settings / General / About / Advertising.

    For iOS 7 and up users:  Go to Settings/ Privacy / Advertising

    Android Users

    Go to Google Setting / Ads / Opt-out of Interest-Based ads.

Our Policy Towards Children

We have no way to know whether we are provided with data collected from devices associated with users under age 13. If we become aware that we are inadvertently in possession of Data about a child under age 13, we will remove such data from our files.

Changes

This Privacy Policy may be updated from time to time for any reason. We will notify you of any material changes to this Privacy Policy by posting the new Privacy Policy for Digital Advertising Services on the JCDecaux Site, and as required by applicable law.

Except as stated above, all changes will apply to the data that are already collected, and to data that are collected after the effective date of the revised Policy. You are advised to consult this Privacy Policy regularly for any changes.

How to Contact Us

If you have any questions about this Privacy Policy, please contact us via our website; or by mail addressed to JCDecaux North America, Inc. 3 Park Avenue, 33rd Floor, New York, NY 10016, attn: General Counsel.