This Privacy Policy describes the principles and practices that apply when JCDecaux North America, Inc. and subsidiaries controlled by or under common control with JCDecaux (“JCDecaux,” “we,” or “us”) broadcasts, collects or processes data in the course of providing its services, such as when analyzing the data generated when an individual (“you” or “your”) interacts with a JCDecaux advertising display.
For the Privacy Policy that covers the practices that apply to the data generated when an individual visits JCDecaux’s website, located at www.jcdecauxna.com, please see the Privacy Notice for JCDecaux North America.
For the Privacy Policy that covers services provided outside of North America by JCDecaux entities, please see the Group Privacy Policy located at www.jcdecaux.com/jcdecauxs-privacy-and-personal-data-protection-policy.
Accessibility: For more information about how users with disabilities can access this Privacy Policy in an alternative format contact us at privacy-usa@jcdecaux.com.
In summary:
- JCDecaux does not collect information that directly identifies individuals through JCDecaux’s Assets.
- JCDecaux shares aggregated or statistical information with business partners, such as media buyers who use it to make decisions regarding their advertising campaigns and better adapt their campaign to the assumed interests of their target audience and JCDecaux acquires similar data from third parties.
- JCDecaux’s third party partners process and analyze non-personal information regarding the Assets.
Definitions
For ease of use of this document, certain terms have been associated with the specific meaning provided below.
“Aggregated Data” means the consolidation of information relating to multiple individuals or information that has been combined with other data and therefore cannot be traced back to a specific individual or that is defined as aggregated under applicable law.
“De-Identified Data” means data that has been rendered anonymous by removing any information that would allow someone to determine an individual’s identity or that is defined as de-identified under applicable law. JCDecaux commits not to re-identify any de-identified data without proper notice and/or consent.
“JCDecaux Asset” or “Asset” means an advertising display owned or operated by JCDecaux and affixed on structures such as, but not limited to, buildings, walls, bus shelters, benches, newsstands, kiosks signage displays or other type of panel.
“JCDecaux Services” or “Services” means the services, proprietary platforms, tools, methodology and equipment developed by or for JCDecaux to collect or receive data about its Assets and to enable Media Buyers to plan for, measure, manage, and optimize their digital advertising campaigns.
“Media Buyer” or “Customer” means a company that advertises its products or services, or those of its clients, on advertising signage displays, bus shelters, mobile phones or tablets or similar platforms. For example, a department store that advertises its shoes, or a university that advertises its courses could be a Media Buyer.
“Personal Information” or “PI” means information that directly or indirectly identifies a specific person, for example, name, address, telephone number, email address, or payment card number or government-issued identifier, and does not include publicly available information or De-identified or Aggregated Data. The precise definition may vary under applicable laws depending on the state where you reside.
OVERVIEW
Information about data collected by JCDecaux or licensed from third parties during the prior 12 months is described below in the What Data does JCDecaux Collect? section.
You may be able to access, delete and control certain uses of your information as set forth in the “What Rights Do I Have?” section below, or as otherwise described in the Additional U.S. State Privacy Rights section.
What Services does JCDecaux Offer?
JCDecaux provides Media Buyers with the ability to advertise their products or services on the JCDecaux Assets. JCDecaux uses technologies to identify each of its Assets. The technologies are intended to provide JCDecaux and its service providers and business partners with information about the location of its Assets, and the ability to collect non-personal information about people who are in the vicinity of a JCDecaux Asset.
JCDecaux does not have any direct or indirect means to determine a person’s actual identity (such as name), through our Assets unless the person voluntarily provides it to JCDecaux.
JCDecaux or its service providers or business partners compile this data to create just-in-time statistical information based on an environment, for example, a plaza, a train station corridor, or a bus shelter. This information is used by Media Buyers to manage and optimize their digital marketing campaigns.
For example, JCDecaux may provide a Media Buyer with information about the number of people standing in the vicinity of a particular JCDecaux Asset during particular time periods based on historical data, such as a bus shelter in New York. This is provided to help the Media Buyer understand the potential number of people or ad impressions to which their advertisement would be exposed. The Media Buyer may decide to display an advertisement for its product on that bus shelter based on that information.
What Data does JCDecaux Collect?
JCDecaux does not collect any PI that directly identifies specific individuals from or through the JCDecaux Assets without a user’s consent. In some cases, JCDecaux Assets may include an advertisement from a third party that collects PI when an individual enters their name, email address, or other PI. In these cases, PI may be collected by a third party (such as an advertiser on a JCDecaux Asset) and not by JCDecaux and will therefore be subject to that third party’s privacy policy, rather than this Privacy Policy. We have no control over, and are not responsible for, this third party’s use or your disclosure of your PI.
JCDecaux may affix technologies on its Assets to collect non-personal information, such as information about the advertisements being displayed or the number of people walking by the Asset.
What Information Does JCDecaux Receive from Third Parties?
JCDecaux receives information that does not directly identify you including Aggregated data. This information is derived from data that has been collected by (i) sensors and/or cameras installed by JCDecaux, and/or (ii) measurement and analytics service providers and media buyers. JCDecaux’s service providers or business partners may use this information to help the Media Buyer infer that a particular JCDecaux Asset is located in an area where at a certain time of the day or the week, a certain percentage of people walking in that area meet a certain profile. JCDecaux may also acquire non-personal information from third parties, such as the number of users who walk by a particular Asset or the demographics of people in the vicinity of an Asset.
How Does JCDecaux Use and Share this Information?
JCDecaux does not use any PI that directly identifies individuals when providing the JCDecaux Services to our clients. We use information only in aggregated form (i.e. combined with that of hundreds or thousands of other individuals) to create statistics and analytics regarding the people that walk by or near our JCDecaux Assets.
- To Defend or Enforce our Rights. We may use or share data, if any, in our custody or control: (i) to protect ourselves, (ii) to protect the JCDecaux website, (iii) to establish or exercise our legal rights, (iv) to identify a breach of contract, (v) when we believe it is appropriate to protect the property and rights of JCDecaux or a third party, the safety of our company, our Media Buyers or others, or (vi) to investigate, prevent, take action against, or stop any fraudulent, illegal, unethical, or legally actionable activity.
- Business Transfers. JCDecaux may share data with its affiliates and subsidiaries. Additionally, JCDecaux may engage in corporate restructuring, acquisitions or divestitures, and we may disclose, share or transfer some or all of the data associated with our Assets, as part of the due diligence, or after the transaction has been consummated, to allow for continuation of Services or in connection with a bankruptcy proceeding.
- Compliance with Laws and Third-Party Requests. JCDecaux cooperates with government and law enforcement officials or private parties to enforce and comply with the law, as required by applicable law. We may disclose data associated with JCDecaux Assets to government or law enforcement officials or private parties as we, in our reasonable discretion, believe necessary or appropriate to respond to legal process (including a facially valid subpoena, warrant, court order or other legal process), respond to and defend against legal claims, or otherwise as required by applicable law.
- Aggregated Data. JCDecaux may aggregate data about different Assets in order to obtain statistical information. We may create, publish, share or sell industry reports, analyses and similar materials that are used for industry analysis, demographic profiling, sales, marketing, and other business purposes. These reports provide data in aggregate form. No individual, company, or customer will be identified from these reports.
Security
JCDecaux employs administrative, physical, network and electronic measures designed to protect data associated with our Assets from unauthorized access, loss, misuse, disclosure, alteration, and destruction, in accordance with the sensitivity of such data. While we do our best to implement security measures, we do not guarantee that our safeguards will always work. JCDecaux is not liable for unauthorized disclosure of data that occurs through no fault of JCDecaux
Data Retention
JCDecaux retains data only as long as we have a business need for such data.
ADDITIONAL U.S. STATE PRIVACY RIGHTS
· If you reside in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana or another state with a similar comprehensive consumer privacy law (collectively, “Covered States”), under the California Privacy Act (“CCPA”), Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, Texas Data Privacy and Security Act, Oregon Consumer Privacy Act, Montana Consumer Data Privacy Act, and similar laws in other U.S. states (collectively, "State Privacy Laws") you have specific rights regarding your Personal Information. This section describes the rights that consumers of Covered States have and explains how to exercise those rights. To be clear, these rights are granted only to the extent that you are considered a consumer of a Covered State, and we are acting as a “controller” or “business” (as applicable) under State Privacy Laws with respect to your personal information.
Information We Collect; How We Collect It; How We Use It
General information regarding our collection, use, and disclosure of Personal Information is set forth in the Privacy Policy above.
In the past 12 months, we have collected the categories of Personal Information described above in the Privacy Policy. The Overview section also describes our business purposes for collecting such information, and the categories of third parties with whom we share information. We retain Personal Information pursuant to the section titled Data Retention.
We disclose the categories of Personal Information listed above for a business or commercial purposes to the categories of recipients described in the section, How Does JCDecaux Use and Share this Information?
Rights to Your Information
In addition to the rights set forth in our Privacy Policy, State Privacy Laws may, depending on your state of residence, provide you with the following rights:
o Right to Know About Personal Information Collected, Disclosed or Sold. You have the right to request that we disclose certain information to you about our collection, use, disclosure or sale of your Personal Information. Once we receive and confirm your verifiable consumer request (see “Exercising Access and Deletion Rights” below), and subject to certain limitations that we describe below, we will disclose such information to you. You have the right to request any or all of the following:
§ The categories of Personal Information we collected about you.
§ The categories of sources from which the Personal Information is collected.
§ Our business or commercial purpose for collecting or selling that Personal Information.
§ The categories of third parties with whom we share that Personal Information.
§ The specific pieces of Personal Information we collected about you.
o Right to Data Portability. You have the right to request a copy of Personal Information that we have collected and maintained about you. Some State Privacy Laws allow you to request your information from us up to twice during a twelve (12) month period. We will provide our responses in a readily usable format, which is usually electronic.
o Right to Correct. You have the right to correct inaccuracies in the Personal Information we collect from you, taking into account the nature of the Personal Information and the purposes for which we process it.
o Right to Request Deletion. You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions under State Privacy Laws. Once we receive and confirm your verifiable consumer request (see “Exercising Access and Deletion Rights” below), we will delete (and direct our service providers to delete) your Personal Information from our records. However, we may retain Personal Information that has been de-identified or aggregated. Furthermore, we may deny your deletion request if retaining the information is necessary for us or our service provider(s) in order to perform certain actions set forth under State Privacy Laws, such as detecting security incidents and protecting against fraudulent or illegal activity.
o Right to Opt Out. We do not “sell” your Personal Information collected via the Assets, as that term “sell” is defined under applicable data privacy laws or use it for targeted advertising with third parties.
o Right to Non-Discrimination. We will not discriminate against you for exercising any of your rights under State Privacy Laws, including, but not limited to, by:
§ Denying you goods or services.
§ Charging you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
§ Providing you a different level or quality of goods or services.
§ Suggesting that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
Exercising Access and Deletion Rights. To exercise the rights described above, please submit a request to us by either:
§ Contact us at privacy-usa@jcdecaux.com or by mail addressed to JCDecaux North America, Inc., 350 Fifth Avenue, 73rd floor, New York, New York 10118, attn: General Counsel.
Only you, or a person or business entity you authorize to act on your behalf (an “authorized agent”), may make the requests set forth above. If you use an authorized agent to make a request, you must provide the authorized agent written permission to do so, and we may require that you verify your identity directly with us. You may also make a request on behalf of your minor child, but we may ask you to submit reliable proof of your identity.
The request should include your contact information and describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. In addition, you should provide sufficient information (including name and email address) that allows us to reasonably verify that you are the person about whom we collected the personal information or an authorized representative. In addition, we ask that you provide us with the following information to allow us to reasonably verify that you are the person about whom we collected the personal information or an authorized agent: whether receive marketing communications from us; whether you or your business has purchased advertising from JCDecaux ; and, if you are an authorized agent, confirmation that you have been authorized to act in such capacity. When providing us with this information, you represent and affirm that all information provided is true and accurate.
We will respond to consumer requests within forty-five (45) days from when you contacted us. If you have a complex request, State Privacy Laws allow us up to ninety (90) days to respond. We will still contact you within forty-five (45) days from when you contacted us to let you know we need more time to respond.
In order to protect the security of your Personal Information, we will not honor a request if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. The method used to verify your identity will vary depending on the nature of the request. Generally speaking, verification will be performed by matching the identifying information provided by you to the Personal Information that we already have.
We are not obligated to provide the information set forth above under “Right to Know About Personal Information Collected, Disclosed or Sold” more than twice in a 12-month period.
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
If we decline to take action on a request that you have submitted, we will inform you of our reasons for doing so and provide instructions for how to appeal the decision. Depending on your state of residence you may have the right to appeal within a reasonable period of time after you have received our decision. If you have this appeal right, within 60 days (45 days for residents of Colorado) of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If we deny your appeal, we will provide you with a method for contacting your state attorney general’s office to submit a complaint.
Our Policy Towards Children
We do not knowingly collect PI from devices associated with users under age 16. If we become aware that we are inadvertently in possession of PI about a child under age 13, we will remove such data from our files. If you are under the age of 13, do not send any Personal Information about yourself to JCDecaux.
Changes
This Privacy Policy may be updated from time to time for any reason. We will notify you of any material changes to this Privacy Policy by posting the new Privacy Policy for Digital Advertising Services on the JCDecaux Site, and as required by applicable law. Except as stated above, all changes will apply to the data that are already collected, and to data that are collected after the effective date of the revised Policy. You are advised to consult this Privacy Policy regularly for any changes.
How to Contact Us
If you have any questions about this Privacy Policy, please contact us via our website or by mail addressed to JCDecaux North America, Inc., 350 Fifth Avenue, 73rd Floor, New York, NY 10118, attn: General Counsel.