Privacy Policy Last amended on February 5th 2022

1 · WHAT PERSONAL DATA WE MIGHT COLLECT ABOUT YOU

Personal data you give to us: If you sign up to receive marketing emails from us, we will collect your email address. If you contact us with a query, we may collect your name, contact details, and any other personal data you volunteer to us. We’ll only use this supplementary personal data to deal with your query or for the purposes explained to you at the time the personal data was collected.

Personal data we collect automatically: When you visit our website, we’ll collect technical data about your usage and browsing behaviour and about the device you’re using to access the service. For example, we receive your IP address when your device talks to our servers so we can send content to the right device. We collect this data using cookies and other similar technologies.

2 · HOW WE USE THIS PERSONAL DATA

We collect and process your personal data where we have legal bases for doing so under the applicable data protection laws. We have set out below the ways we might use your personal data, and which of the legal bases we rely on to do so.

Consent. We process your personal data based on the consent you have provided us, to:

• Send marketing to you in accordance with your marketing preferences
• Provide support and information you request from us
• Administer prize draws and competitions which you choose to enter
• Review and use any responses you provide to surveys which you choose to fill out

Legitimate interests. We process your personal data based on our legitimate interests (provided that such processing is not overridden by your data protection interests or fundamental rights and freedoms) to:

• Analyse your use of our services
• Invite you to participate in surveys, user testing and panels
• Personalise our marketing, including marketing served to you on third party services

Out “legitimate interests” are our interests when managing our business to enable us to develop, grow and improve our services.

Opting out of email marketing. You can opt-out from email marketing at any time by changing your preference in your account settings or by clicking on the unsubscribe link in each marketing email we send to you. You can also opt-out from email marketing by emailing us at the relevant email address provided below.

In accordance with industry standards, we reserve the right to retain your personal data for suppression purposes for a reasonable amount of time so we can ensure we don’t contact you in the future.

Aggregate and/or Anonymised Data: We may aggregate or anonymise certain data that we collect from you. Aggregate and de-identified data is designed so that we can’t identify you personally.

3 · WHEN WE MAY SHARE YOUR PERSONAL DATA WITH OTHERS

We won’t sell or rent your data to others. We may share your personal data outside of BritBox in the following circumstances:

Our service providers: We use a number of third parties to perform business functions on our behalf, such as sending our newsletters, hosting our online services and providing our customer services. We only disclose the personal data necessary to enable these third parties to perform their services.

Social media networks and other third parties: Generally we’ll only share your data with other third parties if you consent to this or ask us to share it.

We may also share personal data with social media or other advertising networks so we can market to you through their services and to help us to market to people with similar interests to you. For example, some services allow us to upload our customer list to match them to their users in a secure form – using a technology called hashing, which makes the data unreadable unless the other company has the same data. We require that all non-matches are securely deleted from their systems. If under the relevant local laws your consent is required to use your data in this way, we won’t do so without your consent. You may opt-out of having your data used for these purposes by contacting us as follows.

If you are in Denmark: marketing-dk@britbox.com

If you are in Finland: marketing-fi@britbox.com

If you are in Norway: marketing-no@britbox.com

If you are in Sweden: marketing-se@britbox.com

Regulatory bodies and others: We may disclose your personal data to law enforcement agencies, government/regulatory bodies, internet service providers and content protection organisations as required or allowed by law.

Sale or transfer of all or part of our business or assets: We reserve the right to transfer your personal information if we sell or transfer all or a part of our business or assets so the buyer can continue to offer you the services.

4 · WHERE WE’LL STORE AND USE YOUR PERSONAL DATA

Your personal data may be processed and/or stored in countries outside of the European Economic Area.

Where the data protection and other laws of such countries are not as comprehensive as those in the European Economic Area, we will only transfer your personal information to those countries where we have taken reasonable steps to ensure your personal data will receive an equivalent level of protection. Those reasonable steps may include using the standard data protection clauses written by the European Commission, to govern the transfer.

5 · HOW LONG WE’LL KEEP YOUR PERSONAL DATA

We’ll keep your personal data for as long as reasonably necessary to fulfil the purposes we collected it.

We may keep any aggregated and/or anonymised data we collect from you for a longer period, but it won’t be possible to link this data back to you.

6 · YOUR LEGAL RIGHTS

In certain circumstances, you have the following rights under applicable data protection laws in relation to your personal data:

Request access to your personal data. (also known as a "data subject access request"). You may request to receive a copy of the personal data we hold about you.

Request correction of your personal data. You may request to have any incomplete or inaccurate data we hold about you corrected.

Request erasure of your personal data. You may request to us to delete or remove your personal data. We may not always be able to comply with your request for specific legal reasons which will be notified to you, if applicable, when we respond to your request.

Object to processing of your personal data. You may object to our processing of your personal data for direct marketing purposes, or where we are relying on our legitimate interests (or those of a third party). In some cases, we may demonstrate that we have compelling legitimate interests to process your personal data which override your right to object.

Request restriction of processing of your personal data. You may request us to suspend the processing of your personal data in certain circumstances. We may not always be able to comply with your request for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Request the transfer of your personal data to you or to a third party. You may request that we provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. This right only applies to automated personal data which you initially provided consent for us to use. Where this right applies, we will provide such transfer as far as it is technically feasible.

Exercising these rights: : if you wish to exercise any of the rights set out above, please contact us using the relevant email address provided below.

You will not have to pay a fee to exercise any of these rights. However, we may charge a reasonable fee, or refuse to comply with your request, if your request is clearly unfounded, repetitive or excessive.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

7 · Cookie Notice

Like most companies, we and our service providers use cookies and similar technologies on our website and our apps. We use these technologies for a variety of purposes, including to operate our service and for the analytics and marketing purposes described below.

Cookies and similar technologies: Cookies are small text files that are commonly stored on your device when you browse and use websites and online services, to enable that website or online service to recognise your device. We use other similar technologies like cookies such as browser storage, web beacons, plugins and pixels, which may also store small amounts of data on your device. These cookies and similar technologies are not usually used to store personal information.

We have a cookie consent management platform on our website. You can find out more about cookies set through our website and exercise your cookie consent choices when you are accessing our website, by clicking here: link One.

Opt-out tools provided by our service providers:

Analytics: We use third party analytics services on our website and apps so we can optimise and improve our services. These analytics services use cookies and similar technologies to collect information about your use of our services, plus technical data such as your IP address, browser type and version, time of visit, whether you are a return visitor, or any referring website. Examples of the analytics services we use and a link to the opt-out tool for the relevant service, are listed below.

Google Analytics, opt-out: tools.google.com/dlpage/gaoptout
AT Internet, opt-out: http://www.xiti.com/en/optout.aspx

Personalisation and online advertising: We use cookies and similar technologies to personalise content based on your browsing behaviour. We may also use advertising companies to serve our online marketing to you elsewhere on the web. They may also collect information about your online activities over time and across different websites and online services so they can better understand your interests, and serve you with relevant adverts. Some of these services may hold personally identifiable information and they may match this to your browsing behaviour for their own profiling and advertising purposes. Examples of the services we use for personalisation and marketing and a link to the opt-out tool for the relevant service, are listed below.

Google Advertising, opt-out: www.google.com/settings/ads

Facebook Advertising, opt-out:

if you have a Facebook account: www.facebook.com/settings/?tab=ads
if you don’t have a Facebook account: www.youronlinechoices.com/

Advertising industry opt-out tools: Advertising companies that serve interest-based advertising may participate in self-regulatory programs that provide tools that enable you to opt out from your browsing data being used by these companies to customise adverts to your interests:

European Interactive Digital Advertising Alliance (EDAA): www.youronlinechoices.com/

Browser settings: You can also your browser to decline all or some browser cookies, or delete them when you close your browser. You can find instructions for this on your browser’s help menu. If you disable or refuse all cookies, please note that some parts of this website may become inaccessible or not function properly. If you have opted-out of cookies, a cookie will be set which tells the website not to track you. If you delete or clear your cookies, you will delete the opt-out.

Mobile device settings: You can opt-out of mobile app tracking by certain advertising networks through the privacy and/or advertising settings on your device. To find out how to change these settings for Apple, or Android devices, see:

Apple: www.support.apple.com/en-gb/HT202074

Android: www.google.co.uk/policies/technologies/ads/

Email settings: We measure the effectiveness of our email marketing campaigns through the use of a pixel, or image file. You can opt out by turning off images in your email client – your provider may set them to ‘off’ by default.

Do Not Track: Your browser or device may include ‘Do Not Track’ functionality. As there’s no common industry standard, we don’t currently respond to ‘Do Not Track’ signals. We continue to monitor industry and technological developments in this area and may adopt a standard if one is agreed.

8 · CONTACT US

Our Privacy Officer is responsible for overseeing questions or complaints in relation to this Privacy Policy. If you have any questions about this Privacy Policy, including any requests to exercise your legal rights, or a complaint or concern about how we have processed your personal data, please contact us using the details set out below.

Email:

If you are in Denmark: privacy-dk@britbox.com

If you are in Finland: privacy-fi@britbox.com

If you are in Norway: privacy-no@britbox.com

If you are in Sweden: privacy-se@britbox.com

Post:

Privacy Officer
BritBox International Limited
1 Television Centre, 101 Wood Lane, London, United Kingdom, W12 7FA

You can also contact us via our EU Representative, using the details set out below.

GDPR department
NJORD Law Firm
Aaboulevarden 17, DK-8000 Aarhus C, Denmark
gdpr@njordlaw.com

You have the right to make a complaint at any time to the local regulator for data protection in your country. We would, however, appreciate the chance to deal with your concerns before you make a complaint to the regulator, so please contact us in the first instance.