NPM PRIVACY NOTICE FOR EU RESIDENTS

National Public Media LLC (“NPM,” “we” or “us”) owns, operates, or provides access to nationalpublicmedia.com and its features and services, including NPM Creative and the Self-Serve Sponsorship Portal/Book A Campaign service (“Self-Serve Sponsorship Portal”), or other sites, digital platforms and interactive services (collectively, the “Services”).  This Notice for EU Residents (“Notice”) applies only to the Services and does not govern the separate sites and services of NPM’s members (National Public Radio, Inc. (“NPR”), Public Broadcasting Service (“PBS”), and WGBH, Inc. (“WGBH”)), NPM’s customers, or the sites and services of any third parties that may link to or be linked to from the Services.  This Notice governs our privacy practices in handling the information we collect about individuals in the EU who use our Services (“you” or “your”).   Terms that are not defined in this Notice have the same definitions as in NPM’s Terms of Use.  NPM processes personal data under this Notice as a data controller.  The Contact Details of NPM are listed at the end of this Notice.  This Notice may be changed if there is a change in the way NPM processes personal data or if there is a change in applicable law.  We will notify users of changes that are deemed material under applicable law by updating the date of this Notice and providing other information as required.  Last modified: May 25, 2018.

“Personal data” means any information relating to an identified or identifiable natural person (“data subject”).  An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Categories of Data Obtained Directly from You

NPM and our service providers obtain personal data from you including your name, email address, company, city, state, billing address, telephone number, payment card information and PayPal information.  We and our service providers may collect this information when you:

  • Book a campaign through the Self-Serve Sponsorship Portal.
  • Contact us for information, to ask a question, or for other purposes.
  • Submit, upload, or otherwise send creative materials, company logos, content, or other materials (“User Materials”) or submit or send other information through our Services.
  • Register for an event we sponsor.
  • Register for an update about relevant news and research.
  • Otherwise volunteer information to us or respond to a request for information through any of our Services.

If you book a campaign through the Self-Serve Sponsorship Portal, our service provider, buysellads.com, may collect your payment card or PayPal information, subject to the separate terms and conditions and privacy policy of buysellads.com.  NPM does not collect or have access to such payment card information or PayPal information.  NPM is not responsible for the services or privacy practices of buysellads.com and we recommend that you review and familiarize yourself with the buysellads.com terms and conditions and privacy policy before you book a campaign through the NPM Services.

Information Obtained Automatically Through Technology

You can find NPM’s Statement Regarding Cookies and Other Tracking Technologies here. Depending on which Services you use and how you access them, the information collected automatically through technology, such as access logs, cookies, pixels and other tracking technologies, may include:

  • Internet Protocol Address (IP address)
  • The domain name of your Internet Service Provider
  • The site, application, platform or service you visited before and after visiting our Services.
  • Information about your computer or mobile device, and its browser, operating system, settings and software.
  • Unique device identifiers on your mobile device.
  • Your approximate geographic location (derived from request header information, such as your IP address) and/or more precise location information if you have enabled location services on your mobile device.
  • The dates, times, duration and frequency of your interactions with our Services, search terms, the media files you download and interact with, and your navigation path through our Services.
  • Listening data, including information about your interactions with media files you listen to or view through our Services, such as time and date stamps for when a file is downloaded and when playback of a particular segment or sponsorship credit starts, stops, is skipped or is paused.
  • Information about your interactions with our email messages.
  • Any errors you encountered during your use of the Services.

Information Not Obtained Directly From You

The Services use third-party analytics, cookie data collection and linking services (collectively “Analytics Services”), including Google Universal Analytics, Google Analytics Demographics and Interest Reporting, Google Analytics Advanced Segments, and DoubleClick for Publishers.  These Analytics Services may use cookies, pixel tags, and other tracking and storage technologies to collect or receive information (not including your name or the email address you register with NPM) from the Services and elsewhere on the Internet and use that information to analyze and measure NPM’s audience. For example, NPM and Analytics Services may use first-party cookies (such as the Google Analytics cookies) and third-party cookies (such as Google Analytics Demographics and Interest Reporting and Advanced Segments cookies) together to inform and optimize our Services. In addition, we may use analytics data, including but not limited to, geographic, demographic, and interest reporting information, to recognize and understand user preferences, make improvements, and for other operational purposes. Each Analytics Service’s ability to use and share analytics information is governed by such Analytics’ Service’s terms of use and privacy policy.

Purposes for Processing of Personal Data

NPM processes your data in order to:

  • Book, launch and publish your public media online campaign through the Services.
  • Publish and otherwise use the User Materials according to our Terms of Use.
  • Provide you with information about public media sponsorship opportunities.
  • Manage, administer, promote, analyze and improve the Services and our communications, including measuring and analyzing user traffic and usage patterns.
  • Respond to your questions or messages.
  • Offer you access to NPM events.
  • Recognize you as a returning user as you access our Services using different computers, devices and browsers and to save and “remember” your contact information for later visits.
  • Send you email and marketing, sponsorship, and other communications from NPM, NPM’s members, and NPM’s customers.
  • Understand whether and when you read our email messages and click on links in those messages.
  • Generate aggregate or other information that does not directly identify you as an individual or the devices you use to access our Services, and use and share that information for NPM’s purposes.
  • Prevent potentially prohibited or illegal activities, comply with applicable laws, and enforce our Terms of Use or other legal rights.

We also may use the information collected from you in other ways, and for other purposes, that are described to you at the point of collection or for which we otherwise have obtained your consent.

Sharing Your Personal Data

NPM may share your personal data with the following categories of recipients:

  • NPM’s members (NPR, PBS, and WGBH) and NPM’s customers for their internal purposes, for purposes of fulfilling your online campaign requests, providing information about sponsorship opportunities, and sending you marketing, sponsorship, and other communications, and for other purposes disclosed at the point of collection or for which we otherwise have obtained your consent.
  • NPM’s authorized service providers to provide services on our behalf.
  • NPM’s analytics partners such as Google Universal Analytics, Google Analytics Demographics and Interest Reporting, Google Analytics Advanced Segments, Google Analytics DoubleClick for Publishers, and others.
  • If we sell a Service or in the unlikely event of bankruptcy.
  • With public authorities when required by law, to respond to subpoenas, court orders, legal process, and other law enforcement measures, and to comply with legal or regulatory obligations.
  • With other parties when necessary to enforce our Terms of Use, to protect the vital interests of our users or other natural persons, or when required by law.
  • With other parties if the information is anonymous and aggregate.
  • With other parties if we have disclosed such sharing to you at the time of collection of the information or if we otherwise have your consent.

Lawful Basis for the Processing of Personal Data

NPM is required to demonstrate a lawful basis for the processing of personal data.  NPM relies on the following:

  1. Legitimate interest: We process personal data for certain legitimate business purposes, which include some or all of the following:
    • Data analytics
    • Booking, launching and publishing your public media online campaign through the Services
    • Providing information about public media sponsorship opportunities
    • Operating, modifying and improving the Services
    • Identifying usage trends
    • Web hosting
    • Direct marketing
    • Fraud prevention
    • Network and information systems security
    • Serving sponsorship messages, ads or other messages on third-party services based on user behavior and/or preferences
    • Responding to user questions and requests for information
    • Complying with laws and regulations and enforcing NPM’s Terms of Use and other legal rights
  2. Consent: We may process personal data based on your consent to send personalized sponsorship messages or ads from NPM and its sponsors on third-party sites and to share this information with sponsorship, advertising, analytics, and other third party service providers.  If you do not consent to the processing, you will not be able to access all of our Services.  If you do grant consent, you can withdraw your consent at any time by visiting choice.npr.org and as described in “Your Rights” below.  You may also unsubscribe from emails. Please note that all processing of your personal data will cease once you have withdrawn consent but this will not affect any personal data that has already been processed.

 

Retention

Your personal data is retained no longer than is reasonably necessary to perform the processing described in this Notice and in case of any legal claims or complaints, or as required by law.

Your Rights

Subject to exemptions under applicable law (which may include, depending on the circumstances, U.S. law protecting the rights to free speech and free press or EU law protecting the rights to freedom of expression or information, including processing for journalistic purposes), you have the following rights with respect to your personal data:

  • To request a copy of your personal data which NPM hold
  • To request that NPM provide you access to and/or rectify personal data that is inaccurate or out of dat
  • To request erasure of your personal data where it is no longer necessary for NPM to retain
  • If you have consented to processing, the right to withdraw consent at any time.
  • To request that the data controller provide you with your personal data and where possible, to transmit that data directly to another data controller, where applicable. This right of portability only applies where the processing is based on consent or is necessary for the performance of a contract and if NPM processes the data by automated means;
  • To request a restriction on further processing where applicable.
  • The right to object to processing if the processing is based on legitimate interest, is for direct marketing, or is for scientific/historical research and statistics.
  • To lodge a complaint with a supervisory authority.

You may exercise these rights by contacting NPM at privacy@npr.org and stating your specific request in writing.  NPM reserves the right to verify your identity and confirm your right to the information.  The following options are also available:

  • For information on opt-out tools for sponsorship messages, ads, or interest based messages, click here: http://www.youronlinechoices.eu/.
  • To withdraw consent for collection of precise device location, you may access the privacy settings of your mobile device.
  • To withdraw consent to marketing emails, click the “unsubscribe” link on the email. You may also change your email preferences by contacting us.  However, even if you opt out of receiving such communications, we retain the right to send you non-marketing communications (such as information about changes to our Terms of Use or this Notice).
  • To correct, update or delete your information, contact us.
  • To prevent your data from being used by Google Analytics, click here for the Google Universal Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout .  To learn more about how Google uses data, visit www.google.com/policies/privacy/partners/.

Transfer of Data Abroad

Because NPM operates the Services from the US, your personal data may be transferred to the US and/or to countries or territories outside the EEA or Switzerland not recognized by the European Commission as ensuring an adequate level of protection pursuant to the GDPR.  Where required, data transfers will be made subject to the terms of the applicable EU Standard Contractual Clauses or with your consent.  NPM will take all steps reasonably necessary to ensure that personal data is treated securely and in accordance with this Notice in respect of such transfer.

Security

NPM employs physical, technical and organizational safeguards to ensure an appropriate level of security for personal data, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and security for the rights and freedoms of natural persons.

Automated Decision Making and Analysis

NPM and its data analytics and sponsorship vendors may analyze user interactions with the Services to serve personalized sponsorship messages, ads and interest-based messages on third-party sites. The consequences of such processing for the data subject are that the data subject receives personalized sponsorship messages, ads or other interest-based messages from NPM and sponsors of NPM on third-party sites.

Age Limits

You must be at least 18 years of age to submit any User Materials or personal data on or through the Services.  If your child is under age 16 and has provided personal data through the Services, please contact us at privacy@npr.org for deletion of the data.

Further Processing

If NPM plans to use personal data for a new purpose, it will update this Notice and communicate the changes to individuals before starting any new processing.

Contact Details

Data Protection Officer
Micah Ratner
NPM
1111 North Capital Street, NE
Washington, DC  20002
privacy@npr.org

Data Controller
National Public Media LLC
1111 North Capital Street, NE
Washington, DC  20002, USA
privacy@npr.org